# Manual steps and what is not migrated

Generated by StackToIT from `execution-plan.json`. Nothing in this folder has been run: StackToIT reads and writes files and creates, changes and deletes nothing in any cloud. Every step is carried out by a person, by OpenTofu or by a script of this folder that a person runs. Paths are relative to the output folder.

## Manual steps

The 254 manual steps of the plan in 41 work packages, in the order of the Work packages table of `execution/README.md`. Each package says who carries it out, what it touches, what it waits for, how far it is and when it is done; its steps follow it in full, folded. Steps that say the same thing on different resources are one entry that gives the text once, with {resource} for the resource, and lists each step by its name beside its resource; what every step of an entry comes after is said once, and so is the text a line of each step begins and ends with, with its field in braces for what each step says there.

### `WP-01` — Answer the decisions the plan asks as steps (prepare)

- Owner: Network Architect
- Steps: 1 (1 requires a design decision)
- Affected resources: `module.vpc.module.vpc.aws_route_table.private`
- Rests on: `DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST`
- Waits for: `DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST`
- State: waits for decisions
- Done when: the decision DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST is answered (accepted or rejected, with its evidence) in the inputs of the run and is no longer open when the run is repeated

<details>
<summary>The 1 step of WP-01</summary>

#### The decision step of module.vpc.module.vpc.aws_route_table.private (`DEC/routing/DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST`)

- Phase: Prepare
- What: Answer decision DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST: Decide the egress address of module.vpc.module.vpc.aws_route_table.private: keep the changing address of the STACKIT network, or give each server that an allow-list names a STACKIT public IP
- Why: a NAT gateway's fixed egress address is lost on STACKIT: the address a routed network leaves by is the network's own, shared by every routed network of the project, not fixed and not settable
- Who: Network Architect
- When: before pilot
- Needs: the answer to the decision DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST
- Done when: the decision DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST is answered (accepted or rejected, with its evidence) in the inputs of the run and is no longer open when the run is repeated
- Source: `module.vpc.module.vpc.aws_route_table.private`
- State: not executable — requires a design decision — blocked by `DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST`
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

</details>

### `WP-02` — Set up the identities and access (prepare)

- Owner: Identity Architect
- Steps: 10 (10 a person can start now)
- Affected resources: `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`, `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`, `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`, `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`, `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (10 different conditions).

<details>
<summary>The 10 steps of WP-02</summary>

#### The step "Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.execution_role_arn-586451`)

- Phase: Prepare
- What: Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach
- Why: the role is the platform agent's identity, not the application's (execution_role_arn of module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role). a platform agent's identity is not an application identity and has no STACKIT counterpart; the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person
- Who: Identity Architect
- When: before pilot
- Needs: No input is named for this step
- Done when: the identity fact of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed
- Source: `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`
- State: executable: a person can start it now
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The step "Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this gets…" (`MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.task_role_arn-686488`)

- Phase: Prepare
- What: Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it
- Why: the workload is a container service, not a server an account is attached to (task_role_arn of module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.carts_service.aws_iam_role.task_role). the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person
- Who: Identity Architect
- When: before pilot
- Needs: No input is named for this step
- Done when: the identity fact of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.carts_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed
- Source: `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`
- State: executable: a person can start it now
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The step "Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.execution_role_arn-dedc98`)

- Phase: Prepare
- What: Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach
- Why: the role is the platform agent's identity, not the application's (execution_role_arn of module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role). a platform agent's identity is not an application identity and has no STACKIT counterpart; the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person
- Who: Identity Architect
- When: before pilot
- Needs: No input is named for this step
- Done when: the identity fact of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed
- Source: `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`
- State: executable: a person can start it now
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The step "Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.task_role_arn-15a967`)

- Phase: Prepare
- What: Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it
- Why: the workload is a container service, not a server an account is attached to (task_role_arn of module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role). the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person
- Who: Identity Architect
- When: before pilot
- Needs: No input is named for this step
- Done when: the identity fact of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed
- Source: `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`
- State: executable: a person can start it now
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The step "Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.execution_role_arn-b70bc2`)

- Phase: Prepare
- What: Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach
- Why: the role is the platform agent's identity, not the application's (execution_role_arn of module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role). a platform agent's identity is not an application identity and has no STACKIT counterpart; the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person
- Who: Identity Architect
- When: before pilot
- Needs: No input is named for this step
- Done when: the identity fact of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed
- Source: `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`
- State: executable: a person can start it now
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The step "Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.task_role_arn-9651e2`)

- Phase: Prepare
- What: Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it
- Why: the workload is a container service, not a server an account is attached to (task_role_arn of module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role). the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person
- Who: Identity Architect
- When: before pilot
- Needs: No input is named for this step
- Done when: the identity fact of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed
- Source: `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`
- State: executable: a person can start it now
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The step "Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.execution_role_arn-eacc48`)

- Phase: Prepare
- What: Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach
- Why: the role is the platform agent's identity, not the application's (execution_role_arn of module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role). a platform agent's identity is not an application identity and has no STACKIT counterpart; the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person
- Who: Identity Architect
- When: before pilot
- Needs: No input is named for this step
- Done when: the identity fact of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed
- Source: `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`
- State: executable: a person can start it now
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The step "Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.task_role_arn-d0b927`)

- Phase: Prepare
- What: Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it
- Why: the workload is a container service, not a server an account is attached to (task_role_arn of module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.orders_service.aws_iam_role.task_role). the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person
- Who: Identity Architect
- When: before pilot
- Needs: No input is named for this step
- Done when: the identity fact of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.orders_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed
- Source: `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`
- State: executable: a person can start it now
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The step "Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this pulls…" (`MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.execution_role_arn-2d22d2`)

- Phase: Prepare
- What: Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach
- Why: the role is the platform agent's identity, not the application's (execution_role_arn of module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role). a platform agent's identity is not an application identity and has no STACKIT counterpart; the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person
- Who: Identity Architect
- When: before pilot
- Needs: No input is named for this step
- Done when: the identity fact of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed
- Source: `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
- State: executable: a person can start it now
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The step "Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this gets…" (`MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.task_role_arn-0c66b7`)

- Phase: Prepare
- What: Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it
- Why: the workload is a container service, not a server an account is attached to (task_role_arn of module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.ui_service.aws_iam_role.task_role). the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person
- Who: Identity Architect
- When: before pilot
- Needs: No input is named for this step
- Done when: the identity fact of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.ui_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed
- Source: `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
- State: executable: a person can start it now
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

</details>

### `WP-03` — Carry the routing the draft does not write (prepare)

- Owner: Network Architect
- Steps: 2 (2 a person can start now)
- Affected resources: `module.vpc.module.vpc.aws_route_table.private`, `module.vpc.module.vpc.aws_route_table.public`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (2 different conditions).

<details>
<summary>The 2 steps of WP-03</summary>

#### Alike steps on 2 resources (aws_route_table) — the routing precondition of {resource} (`MAN/routing/precondition-outside-area:{resource}`)

- Phase: Prepare
- What: Create the target project outside a Network Area: {resource} is replaced by STACKIT's default routing, which was observed to give a routed network the same reachability only in a project outside a Network Area
- Who: Network Architect
- When: before pilot
- Needs: the STACKIT project the draft is created in (var.project_id) and whether it lies inside a Network Area
- Done when: the target project exists outside a Network Area, or the architect has decided how {resource} is replaced inside the area
- State: executable: a person can start it now
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The routing precondition of module.vpc.module.vpc.aws_route_table.private (`MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.private`) — {resource} = `module.vpc.module.vpc.aws_route_table.private`
  - Why: STACKIT's default routing was observed to give a routed network the same reachability only in a project outside a Network Area (tested on a STACKIT project in eu01 on 2026-10-10); the default routing table of an area was never read (the organisation read answered 403), so a project created inside an existing area (var.project_id naming one) is not covered by this replacement and the table needs the architect's decision there
- The routing precondition of module.vpc.module.vpc.aws_route_table.public (`MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.public`) — {resource} = `module.vpc.module.vpc.aws_route_table.public`
  - Why: STACKIT's default routing was observed to give a routed network the same reachability only in a project outside a Network Area (tested on a STACKIT project in eu01 on 2026-10-10); the default routing table of an area was never read (the organisation read answered 403), so a project created inside an existing area (var.project_id naming one) is not covered by this replacement and the table needs the architect's decision there. Also not equivalent for a server WITHOUT a public IP: the source's internet gateway serves only an instance with a public IPv4 or Elastic IP address, so such a server had no internet path, while on STACKIT it leaves through the network's shared SNAT address (the test of 2026-10-10): that egress is new, the table does not carry it, and it is decided on the subnet (subnet-egress-ipv4-unproven)

</details>

### `WP-04` — Write the security group rules the draft does not write (prepare)

- Owner: Security Architect
- Steps: 2 (2 a person can start now)
- Affected resources: `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`
- Target: `stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (2 different conditions).

<details>
<summary>The 2 steps of WP-04</summary>

#### The step "Place the source rule…" (`MAN/security/aws/unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules.0-217968`)

- Phase: Prepare
- What: Place the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] on the security group it belongs to and write it
- Why: the rule is attached to module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix but cannot be attributed to one of its groups (group-choice); a rule on the wrong group allows what the source did not allow there, so none was produced
- Who: Security Architect
- When: before pilot
- Needs: No input is named for this step
- Done when: the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] is written on the security group it belongs to
- Source: `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`
- Target: `stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix`
- State: executable: a person can start it now
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The step "Place the source rule…" (`MAN/security/aws/unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules.0-f26028`)

- Phase: Prepare
- What: Place the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] on the security group it belongs to and write it
- Why: the rule is attached to module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix but cannot be attributed to one of its groups (group-choice); a rule on the wrong group allows what the source did not allow there, so none was produced
- Who: Security Architect
- When: before pilot
- Needs: No input is named for this step
- Done when: the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] is written on the security group it belongs to
- Source: `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`
- Target: `stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix`
- State: executable: a person can start it now
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

</details>

### `WP-05` — Routing architecture review (foundation)

- Owner: Network Architect
- Steps: 2 (2 a person can start now)
- Affected resources: `module.vpc.module.vpc.aws_route_table.private`, `module.vpc.module.vpc.aws_route_table.public`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (2 different conditions).

<details>
<summary>The 2 steps of WP-05</summary>

#### Alike steps on 2 resources (aws_route_table) — the review of the open settings of {resource} (`MAN/semantic/{resource}/open-settings`)

- Phase: Foundation
- Who: Network Architect
- State: executable: a person can start it now
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The review of the open settings of module.vpc.module.vpc.aws_route_table.private (`MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings`) — {resource} = `module.vpc.module.vpc.aws_route_table.private`
  - What: Review the 8 open critical settings of `module.vpc.module.vpc.aws_route_table.private` (aws_route_table) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`routes`, `route-destinations`, `route-targets`, `nat-fixed-egress-address`, `egress-restriction`, `subnet-association-target`, `tcr-route-table-vpc-id`, `network-topology-boundary`)
  - Why: The assessment leaves 8 critical settings of `module.vpc.module.vpc.aws_route_table.private` open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item.
  - When: applies only if its count (local.create_private_subnets && local.max_subnet_length > 0 ? local.nat_gateway_count : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
  - Needs: the answer to each decision register record (decisions.json): what the STACKIT target does for the setting, or the accepted difference - `routes` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE, Network Architect); `route-destinations` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE, Network Architect); `route-targets` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE, Network Architect); `nat-fixed-egress-address` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE, Network Architect); `egress-restriction` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE, Network Architect); `subnet-association-target` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE, Network Architect); `tcr-route-table-vpc-id` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE, Network Architect); `network-topology-boundary` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE, Network Architect)
  - Done when: every one of the 8 settings is closed: each is set up on its STACKIT target and checked, or the decision that production does not need it is recorded (the condition of each is stated with its item, and `assurance/critical-semantics.json` says what closes it)
  - Settings (8, the step is done when every one is closed):
    - `routes` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Custom routes map to stackit_routing_table_route, an experimental resource (experiment routing-tables); next hops that name AWS gateways are chosen anew.
      - When: applies only if its count (local.create_private_subnets && local.max_subnet_length > 0 ? local.nat_gateway_count : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person creates the routes on the STACKIT routing table (stackit_routing_table_route, experimental) and chooses the next hops anew, because they name AWS gateways.
    - `route-destinations` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Destinations are read by value: every route of a default-only table sends 0.0.0.0/0 to an internet or NAT gateway — STACKIT's default network routing, observed equivalent for a draft outside a Network Area (the test of 2026-10-10) and REVIEW all the same.
      - When: applies only if its count (local.create_private_subnets && local.max_subnet_length > 0 ? local.nat_gateway_count : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person confirms every route destination that is not the default route to an internet or NAT gateway (a CIDR, a prefix list, any IPv6 route): the draft carries none, and a specific destination needs a stackit_routing_table_route, which takes IPv4 CIDR destinations only.
    - `route-targets` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The next hop of each route of the table: a route whose target is anything but an internet or NAT gateway, or that names none, makes the table a custom routing table.
      - When: applies only if its count (local.create_private_subnets && local.max_subnet_length > 0 ? local.nat_gateway_count : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person decides the next hop of each route on STACKIT: an internet gateway becomes the next hop internet, an appliance (a network interface or an instance) a next hop of type ipv4. A NAT gateway, a transit gateway or a VPC peering has no STACKIT counterpart, so the connectivity design is the person's.
    - `nat-fixed-egress-address` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. NOT CARRIED, an observed loss (the test of 2026-10-10): the NAT gateway's fixed egress address.
      - When: applies only if its count (local.create_private_subnets && local.max_subnet_length > 0 ? local.nat_gateway_count : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person accepts the project's shared egress address, which can change and cannot be set, or gives each server a STACKIT public IP when a third party allow-lists the old address.
    - `egress-restriction` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The restriction of egress to the NAT gateway (the only way out of a private subnet) is carried on STACKIT by the egress rules of the security groups, not by a route (the test of 2026-10-10: with egress rules for one /32 only that destination was reachable, with none nothing left). Whether the source restricts egress that way, and whether the draft carries those rules for the servers of this table's subnets, is not something this contract can read, so it is REVIEW and never PRESERVED: a person confirms that the servers of the private subnets keep a restricting egress rule set.
      - When: applies only if its count (local.create_private_subnets && local.max_subnet_length > 0 ? local.nat_gateway_count : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person confirms that the servers of the private subnets keep a restricting egress rule set in their security groups, because on STACKIT the restriction of egress is carried by egress rules, not by a route.
    - `subnet-association-target` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE)
      - Why: A check of the knowledge base (rt private subnet association) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states which subnet uses this route table, for the associations the draft does not attach.
      - When: applies only if its count (local.create_private_subnets && local.max_subnet_length > 0 ? local.nat_gateway_count : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person decides which networks of the Network Area take the routing table and sets routing_table_id on them: STACKIT attaches a routing table to a whole network (stackit_network.routing_table_id), there is no per-subnet association, and routing tables apply only to routed Layer 3 networks in a Network Area.
    - `tcr-route-table-vpc-id` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). aws_route_table.vpc_id: The VPC whose subnets this route table's rules apply to; a route table's entries only make sense, and only affect reachability, within this one VPC, so losing or mismapping it silently changes which network the routing rules govern. A custom table is REVIEW whatever the estate: the draft's stackit_routing_table is organisation and Network Area scoped (organization_id, network_area_id, pinned provider), not a resource of the project that is the VPC's boundary (the experimental stackit_vpc_routing_table, pinned provider: project_id, vpc_id, is a VPC-scoped table that the draft does not write and that nothing establishes as the counterpart of an AWS route table), so which networks the table governs is decided by the Network Area the person puts the project in and the routing_table_id each network is given. A table the draft does not make (count or for_each) and one left to the architect are REVIEW. Several VPCs, a VPC count that is not visible, or a vpc_id (this table's or another unit's) that is a literal, a variable, a data source or an expression the scan cannot reduce to the estate's VPC: which routing domain the table belongs to is the architect's decision — REVIEW. Held CRITICAL: it decides which networks, clients or endpoints reach the resource or what it reaches.
      - When: applies only if its count (local.create_private_subnets && local.max_subnet_length > 0 ? local.nat_gateway_count : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person decides which STACKIT networks the routing table governs: the draft's custom table is organisation and Network Area scoped, so the Network Area the project joins and the routing table each network is given decide it.
    - `network-topology-boundary` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this route table included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.
      - When: applies only if its count (local.create_private_subnets && local.max_subnet_length > 0 ? local.nat_gateway_count : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
  - Risk: the assessment leaves 8 critical settings of `module.vpc.module.vpc.aws_route_table.private` open (the draft does not carry them): the migration of `module.vpc.module.vpc.aws_route_table.private` is not complete until every one is closed; this step is the one step of them (`assurance/critical-semantics.json` says why each is open)
- The review of the open settings of module.vpc.module.vpc.aws_route_table.public (`MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings`) — {resource} = `module.vpc.module.vpc.aws_route_table.public`
  - What: Review the 5 open critical settings of `module.vpc.module.vpc.aws_route_table.public` (aws_route_table) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`routes`, `route-destinations`, `route-targets`, `tcr-route-table-vpc-id`, `network-topology-boundary`)
  - Why: The assessment leaves 5 critical settings of `module.vpc.module.vpc.aws_route_table.public` open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item.
  - When: applies only if its count (local.create_public_subnets ? local.num_public_route_tables : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
  - Needs: the answer to each decision register record (decisions.json): what the STACKIT target does for the setting, or the accepted difference - `routes` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC, Network Architect); `route-destinations` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC, Network Architect); `route-targets` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC, Network Architect); `tcr-route-table-vpc-id` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC, Network Architect); `network-topology-boundary` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC, Network Architect)
  - Done when: every one of the 5 settings is closed: each is set up on its STACKIT target and checked, or the decision that production does not need it is recorded (the condition of each is stated with its item, and `assurance/critical-semantics.json` says what closes it)
  - Settings (5, the step is done when every one is closed):
    - `routes` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Custom routes map to stackit_routing_table_route, an experimental resource (experiment routing-tables); next hops that name AWS gateways are chosen anew.
      - When: applies only if its count (local.create_public_subnets ? local.num_public_route_tables : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person creates the routes on the STACKIT routing table (stackit_routing_table_route, experimental) and chooses the next hops anew, because they name AWS gateways.
    - `route-destinations` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Destinations are read by value: every route of a default-only table sends 0.0.0.0/0 to an internet or NAT gateway — STACKIT's default network routing, observed equivalent for a draft outside a Network Area (the test of 2026-10-10) and REVIEW all the same.
      - When: applies only if its count (local.create_public_subnets ? local.num_public_route_tables : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person confirms every route destination that is not the default route to an internet or NAT gateway (a CIDR, a prefix list, any IPv6 route): the draft carries none, and a specific destination needs a stackit_routing_table_route, which takes IPv4 CIDR destinations only.
    - `route-targets` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The next hop of each route of the table: a route whose target is anything but an internet or NAT gateway, or that names none, makes the table a custom routing table.
      - When: applies only if its count (local.create_public_subnets ? local.num_public_route_tables : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person decides the next hop of each route on STACKIT: an internet gateway becomes the next hop internet, an appliance (a network interface or an instance) a next hop of type ipv4. A NAT gateway, a transit gateway or a VPC peering has no STACKIT counterpart, so the connectivity design is the person's.
    - `tcr-route-table-vpc-id` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). aws_route_table.vpc_id: The VPC whose subnets this route table's rules apply to; a route table's entries only make sense, and only affect reachability, within this one VPC, so losing or mismapping it silently changes which network the routing rules govern. A custom table is REVIEW whatever the estate: the draft's stackit_routing_table is organisation and Network Area scoped (organization_id, network_area_id, pinned provider), not a resource of the project that is the VPC's boundary (the experimental stackit_vpc_routing_table, pinned provider: project_id, vpc_id, is a VPC-scoped table that the draft does not write and that nothing establishes as the counterpart of an AWS route table), so which networks the table governs is decided by the Network Area the person puts the project in and the routing_table_id each network is given. A table the draft does not make (count or for_each) and one left to the architect are REVIEW. Several VPCs, a VPC count that is not visible, or a vpc_id (this table's or another unit's) that is a literal, a variable, a data source or an expression the scan cannot reduce to the estate's VPC: which routing domain the table belongs to is the architect's decision — REVIEW. Held CRITICAL: it decides which networks, clients or endpoints reach the resource or what it reaches.
      - When: applies only if its count (local.create_public_subnets ? local.num_public_route_tables : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person decides which STACKIT networks the routing table governs: the draft's custom table is organisation and Network Area scoped, so the Network Area the project joins and the routing table each network is given decide it.
    - `network-topology-boundary` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this route table included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.
      - When: applies only if its count (local.create_public_subnets ? local.num_public_route_tables : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
  - Risk: the assessment leaves 5 critical settings of `module.vpc.module.vpc.aws_route_table.public` open (the draft does not carry them): the migration of `module.vpc.module.vpc.aws_route_table.public` is not complete until every one is closed; this step is the one step of them (`assurance/critical-semantics.json` says why each is open)

</details>

### `WP-06` — Decide and set the critical settings (foundation)

- Owner: Network Architect
- Steps: 6 (6 a person can start now)
- Affected resources: `module.vpc.module.vpc.aws_eip.nat`, `module.vpc.module.vpc.aws_internet_gateway.this`, `module.vpc.module.vpc.aws_nat_gateway.this`, `module.vpc.module.vpc.aws_subnet.private`, `module.vpc.module.vpc.aws_subnet.public`, `module.vpc.module.vpc.aws_vpc.this`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (5 different conditions).

<details>
<summary>The 6 steps of WP-06</summary>

#### The setting `public-address` of module.vpc.module.vpc.aws_eip.nat (`MAN/semantic/module.vpc.module.vpc.aws_eip.nat/public-address`)

- Phase: Foundation
- What: Decide what the STACKIT target of `module.vpc.module.vpc.aws_eip.nat` (aws_eip) does for its critical setting `public-address`, which the draft does not carry, and set it up by hand, or record that production does not need it
- Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The address changes. An Elastic IP of a NAT gateway is its fixed egress address, an open question on STACKIT (fixed egress ip of the NAT gateway rule).
- Who: Network Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to the decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-EIP-NAT (decisions.json): what the STACKIT target does for the critical setting `public-address`, or the accepted difference
- Done when: A person decides how peers that allow-list the Elastic IP are served: STACKIT egress uses the project's shared address, which differs from the Elastic IP, cannot be set and can change; a STACKIT public IP per server keeps its address.
- Source: `module.vpc.module.vpc.aws_eip.nat`
- State: executable: a person can start it now
- Risk: the assessment leaves the critical setting `public-address` of `module.vpc.module.vpc.aws_eip.nat` open (REVIEW: a person decides what the target does for it): the migration of `module.vpc.module.vpc.aws_eip.nat` is not complete until this step is done
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The setting `network-topology-boundary` of module.vpc.module.vpc.aws_internet_gateway.this (`MAN/semantic/module.vpc.module.vpc.aws_internet_gateway.this/network-topology-boundary`)

- Phase: Foundation
- What: Decide what the STACKIT target of `module.vpc.module.vpc.aws_internet_gateway.this` (aws_internet_gateway) does for its critical setting `network-topology-boundary`, which the draft does not carry, and set it up by hand, or record that production does not need it
- Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this gateway included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.
- Who: Network Architect
- When: applies only if its count (local.create_public_subnets && var.create_igw ? 1 : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
- Needs: the answer to the decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-INTERNET-GATEWAY-THIS (decisions.json): what the STACKIT target does for the critical setting `network-topology-boundary`, or the accepted difference
- Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
- Source: `module.vpc.module.vpc.aws_internet_gateway.this`
- State: executable: a person can start it now
- Risk: the assessment leaves the critical setting `network-topology-boundary` of `module.vpc.module.vpc.aws_internet_gateway.this` open (REVIEW: a person decides what the target does for it): the migration of `module.vpc.module.vpc.aws_internet_gateway.this` is not complete until this step is done
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The review of the open settings of module.vpc.module.vpc.aws_nat_gateway.this (`MAN/semantic/module.vpc.module.vpc.aws_nat_gateway.this/open-settings`)

- Phase: Foundation
- What: Review the 3 open critical settings of `module.vpc.module.vpc.aws_nat_gateway.this` (aws_nat_gateway) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`network-topology-boundary`, `fixed-egress-ip`, `nat-placement`)
- Why: The assessment leaves 3 critical settings of `module.vpc.module.vpc.aws_nat_gateway.this` open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item.
- Who: Network Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to each decision register record (decisions.json): what the STACKIT target does for the setting, or the accepted difference - `network-topology-boundary` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-NAT-GATEWAY-THIS, Network Architect); `fixed-egress-ip` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-NAT-GATEWAY-THIS, Network Architect); `nat-placement` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-NAT-GATEWAY-THIS, Network Architect)
- Done when: every one of the 3 settings is closed: each is set up on its STACKIT target and checked, or the decision that production does not need it is recorded (the condition of each is stated with its item, and `assurance/critical-semantics.json` says what closes it)
- Settings (3, the step is done when every one is closed):
  - `network-topology-boundary` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-NAT-GATEWAY-THIS)
    - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this NAT gateway included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.
    - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
  - `fixed-egress-ip` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-NAT-GATEWAY-THIS)
    - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A stable egress IP on STACKIT is an open question (no source in this repository answers it; the per-network SNAT address is computed and cannot be chosen or kept).
    - Done when: A person decides how peers that allow-list the Elastic IP are served: a routed STACKIT network leaves by the project's shared egress address, which cannot be set and can change, so the allow-list follows it or each server gets a STACKIT public IP.
  - `nat-placement` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-NAT-GATEWAY-THIS)
    - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A zonal NAT gateway (subnet_id) is placed in one AZ; a regional one lists its per-AZ egress in availability_zone_address(es).availability_zone. STACKIT has no NAT gateway resource, and its documentation does not state whether the implicit outbound path is zone-scoped: REVIEW.
    - Done when: A person decides whether the egress path must stay in one zone or per zone, because the STACKIT documentation does not state whether the implicit outbound path is scoped to a zone.
- Source: `module.vpc.module.vpc.aws_nat_gateway.this`
- State: executable: a person can start it now
- Risk: the assessment leaves 3 critical settings of `module.vpc.module.vpc.aws_nat_gateway.this` open (the draft does not carry them): the migration of `module.vpc.module.vpc.aws_nat_gateway.this` is not complete until every one is closed; this step is the one step of them (`assurance/critical-semantics.json` says why each is open)
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### Alike steps on 3 resources (aws_subnet, aws_vpc) — the review of the open settings of {resource} (`MAN/semantic/{resource}/open-settings-network-architect`)

- Phase: Foundation
- Why: The assessment leaves {why} open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item.
- Who: Network Architect
- Needs: the answer to each decision register record (decisions.json): what the STACKIT target does for the setting, or the accepted difference - {needs}
- Done when: every one of the {done when} settings is closed: each is set up on its STACKIT target and checked, or the decision that production does not need it is recorded (the condition of each is stated with its item, and `assurance/critical-semantics.json` says what closes it)
- State: executable: a person can start it now
- Risk: the assessment leaves {risk} is not complete until every one is closed; this step is the one step of them (`assurance/critical-semantics.json` says why each is open)
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The review of the open settings of module.vpc.module.vpc.aws_subnet.private (`MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect`) — {resource} = `module.vpc.module.vpc.aws_subnet.private`
  - What: Review the 4 open critical settings of `module.vpc.module.vpc.aws_subnet.private` (aws_subnet) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`subnet-vpc-membership`, `network-topology-boundary`, `private-egress-ipv4`, `prefix`)
  - Why ({why}): 4 critical settings of `module.vpc.module.vpc.aws_subnet.private`
  - When: applies only if its count (local.create_private_subnets ? local.len_private_subnets : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
  - Needs ({needs}): `subnet-vpc-membership` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE, Network Architect); `network-topology-boundary` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE, Network Architect); `private-egress-ipv4` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE, Network Architect); `prefix` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE, Network Architect)
  - Done when ({done when}): 4
  - Settings (4, the step is done when every one is closed):
    - `subnet-vpc-membership` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The VPC the subnet belongs to: the draft creates every network in one project, so the source VPC's boundary is kept only when the estate has one VPC and every resource that names a VPC provably names it; the draft states the estate's topology and what the architect decides about it once, at the top of its network file.
      - When: applies only if its count (local.create_private_subnets ? local.len_private_subnets : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `network-topology-boundary` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this subnet included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.
      - When: applies only if its count (local.create_private_subnets ? local.len_private_subnets : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `private-egress-ipv4` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE)
      - Why: A check of the knowledge base (subnet egress ipv4 unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The source and the target are not equivalent for outbound access, and the draft closes nothing: REVIEW.
      - When: applies only if its count (local.create_private_subnets ? local.len_private_subnets : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `prefix` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE)
      - Why: The value is not visible statically (a case of the mapping rule for this kind of unit), so nothing is credited for it. stackit_network.ipv4_prefix. TRANSFORMED for a CIDR the scan has seen. The draft carries the prefix as stackit_network.ipv4_prefix taken from a variable without a default (pinned provider: "The IPv4 prefix of the network (CIDR)") and says in the variable's description that the source CIDR is not visible; decide the CIDR each STACKIT network gets (the source CIDRs are reused unless the address plan changes) and enter it before plan.
      - When: applies only if its count (local.create_private_subnets ? local.len_private_subnets : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A literal value or a resolved reference in the source closes it, or a person confirms the value.
  - Risk ({risk}): 4 critical settings of `module.vpc.module.vpc.aws_subnet.private` open (the draft does not carry them): the migration of `module.vpc.module.vpc.aws_subnet.private`
- The review of the open settings of module.vpc.module.vpc.aws_subnet.public (`MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect`) — {resource} = `module.vpc.module.vpc.aws_subnet.public`
  - What: Review the 5 open critical settings of `module.vpc.module.vpc.aws_subnet.public` (aws_subnet) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`subnet-vpc-membership`, `network-topology-boundary`, `effective-route-table`, `private-egress-ipv4`, `prefix`)
  - Why ({why}): 5 critical settings of `module.vpc.module.vpc.aws_subnet.public`
  - When: applies only if its count (local.create_public_subnets && (!var.one_nat_gateway_per_az || local.len_public_subnets >= length(var.azs)) ? local.len_public_subnets : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
  - Needs ({needs}): `subnet-vpc-membership` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC, Network Architect); `network-topology-boundary` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC, Network Architect); `effective-route-table` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC, Network Architect); `private-egress-ipv4` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC, Network Architect); `prefix` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC, Network Architect)
  - Done when ({done when}): 5
  - Settings (5, the step is done when every one is closed):
    - `subnet-vpc-membership` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The VPC the subnet belongs to: the draft creates every network in one project, so the source VPC's boundary is kept only when the estate has one VPC and every resource that names a VPC provably names it; the draft states the estate's topology and what the architect decides about it once, at the top of its network file.
      - When: applies only if its count (local.create_public_subnets && (!var.one_nat_gateway_per_az || local.len_public_subnets >= length(var.azs)) ? local.len_public_subnets : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `network-topology-boundary` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this subnet included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.
      - When: applies only if its count (local.create_public_subnets && (!var.one_nat_gateway_per_az || local.len_public_subnets >= length(var.azs)) ? local.len_public_subnets : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `effective-route-table` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC)
      - Why: A check of the knowledge base (subnet route table undecided) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The subnet follows the VPC's main route table when no association names a route table.
      - When: applies only if its count (local.create_public_subnets && (!var.one_nat_gateway_per_az || local.len_public_subnets >= length(var.azs)) ? local.len_public_subnets : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person decides which routes the subnet's network gets: the draft attaches no routing table to the network, and a STACKIT network gets a default gateway unless it is told not to, so what the subnet reaches can differ from AWS.
    - `private-egress-ipv4` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC)
      - Why: A check of the knowledge base (subnet egress ipv4 unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The source and the target are not equivalent for outbound access, and the draft closes nothing: REVIEW.
      - When: applies only if its count (local.create_public_subnets && (!var.one_nat_gateway_per_az || local.len_public_subnets >= length(var.azs)) ? local.len_public_subnets : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `prefix` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC)
      - Why: The value is not visible statically (a case of the mapping rule for this kind of unit), so nothing is credited for it. stackit_network.ipv4_prefix. TRANSFORMED for a CIDR the scan has seen. The draft carries the prefix as stackit_network.ipv4_prefix taken from a variable without a default (pinned provider: "The IPv4 prefix of the network (CIDR)") and says in the variable's description that the source CIDR is not visible; decide the CIDR each STACKIT network gets (the source CIDRs are reused unless the address plan changes) and enter it before plan.
      - When: applies only if its count (local.create_public_subnets && (!var.one_nat_gateway_per_az || local.len_public_subnets >= length(var.azs)) ? local.len_public_subnets : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
      - Done when: A literal value or a resolved reference in the source closes it, or a person confirms the value.
  - Risk ({risk}): 5 critical settings of `module.vpc.module.vpc.aws_subnet.public` open (the draft does not carry them): the migration of `module.vpc.module.vpc.aws_subnet.public`
- The review of the open settings of module.vpc.module.vpc.aws_vpc.this (`MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect`) — {resource} = `module.vpc.module.vpc.aws_vpc.this`
  - What: Review the 5 open critical settings of `module.vpc.module.vpc.aws_vpc.this` (aws_vpc) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`network-topology-boundary`, `default-nacl-rules`, `default-route-table`, `default-security-group-omitted-direction`, `main-table-set`)
  - Why ({why}): 5 critical settings of `module.vpc.module.vpc.aws_vpc.this`
  - When: Timing to be scheduled by the owner
  - Needs ({needs}): `network-topology-boundary` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS, Network Architect); `default-nacl-rules` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS, Network Architect); `default-route-table` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS, Network Architect); `default-security-group-omitted-direction` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS, Network Architect); `main-table-set` (record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS, Network Architect)
  - Done when ({done when}): 5
  - Settings (5, the step is done when every one is closed):
    - `network-topology-boundary` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). STACKIT has no VPC container in its stable model: the project is the boundary of its networks and its virtual router routes between all networks of one project (docs.stackit.cloud core-networking architecture, updated Aug 20, 2026: "Routing between multiple Virtual Networks in the same project"; SNA "extends the networking architecture to enable cross-project connectivity"). Several VPCs, or a count the scan cannot see: the draft puts every network in the one var.project_id and cannot keep them apart — REVIEW, the choice is the architect's. A unit that names a VPC, or is placed in a subnet (subnet_id, subnets, vpc_config.subnet_ids, ...), without one whole reference to the VPC or to a subnet of the estate may stand in a VPC the estate does not create: the architect decides it the same way (REVIEW).
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `default-nacl-rules` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The account's default network ACL is adopted by the VPC (aws_default_network_acl); a deny rule, a rule that is not all-protocol, a CIDR other than 0.0.0.0/0 or ::/0, or an explicitly empty rule list narrows or leaves undecided what the AWS default allow-all states.
      - Done when: A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.
    - `default-route-table` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS)
      - Why: A check of the knowledge base (vpc main table undecided) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The account's default route table is adopted (a facet of the VPC, aws_default_route_table, AWS provider 6.66.0). Routes other than a plain 0.0.0.0/0 to an internet or NAT gateway are REVIEW.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `default-security-group-omitted-direction` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS)
      - Why: A check of the knowledge base (vpc default sg no ingress rules) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The adopted default security group of the VPC (a facet, aws_default_security_group) does not state an ingress or an egress direction. Nothing is drafted for this facet, so the empty direction is not reproduced: a person decides whether servers that used the default group must stay without outbound traffic (delete the allow-all egress rules of the STACKIT group after apply) or are meant to have it, and puts them in a STACKIT group that states no ingress rule, not in the project's default group.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `main-table-set` (Network Architect; decision register record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS)
      - Why: A check of the knowledge base (vpc main table undecided) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting names the route table that is the main route table of the VPC, when the configuration sets it or the scan cannot tell. STACKIT has no main route table.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
  - Risk ({risk}): 5 critical settings of `module.vpc.module.vpc.aws_vpc.this` open (the draft does not carry them): the migration of `module.vpc.module.vpc.aws_vpc.this`

</details>

### `WP-07` — Decide and set the critical settings (foundation)

- Owner: Platform Architect
- Steps: 3 (3 a person can start now)
- Affected resources: `module.vpc.module.vpc.aws_subnet.private`, `module.vpc.module.vpc.aws_subnet.public`, `module.vpc.module.vpc.aws_vpc.this`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (2 different conditions).

<details>
<summary>The 3 steps of WP-07</summary>

#### Alike steps on 2 resources (aws_subnet) — the setting `availability-zone` of {resource} (`MAN/semantic/{resource}/availability-zone`)

- Phase: Foundation
- What: Decide what the STACKIT target of `{resource}` (aws_subnet) does for its critical setting `availability-zone`, which the draft does not carry, and set it up by hand, or record that production does not need it
- Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The availability zone of the subnet. STACKIT networks are regional (stackit_network has no zone field, pinned provider); the zone is chosen per server and volume, and AWS zone names do not map to STACKIT zones.
- Who: Platform Architect
- Done when: A person decides, per source zone, which STACKIT zone (eu01-1, eu01-2 or eu01-3) takes the servers and volumes that sat in it, so that the source's spread and its failure domains are kept.
- State: executable: a person can start it now
- Risk: the assessment leaves the critical setting `availability-zone` of `{resource}` open (REVIEW: a person decides what the target does for it): the migration of `{resource}` is not complete until this step is done
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The setting `availability-zone` of module.vpc.module.vpc.aws_subnet.private (`MAN/semantic/module.vpc.module.vpc.aws_subnet.private/availability-zone`) — {resource} = `module.vpc.module.vpc.aws_subnet.private`
  - When: applies only if its count (local.create_private_subnets ? local.len_private_subnets : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
  - Needs: the answer to the decision register record DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE (decisions.json): what the STACKIT target does for the critical setting `availability-zone`, or the accepted difference
- The setting `availability-zone` of module.vpc.module.vpc.aws_subnet.public (`MAN/semantic/module.vpc.module.vpc.aws_subnet.public/availability-zone`) — {resource} = `module.vpc.module.vpc.aws_subnet.public`
  - When: applies only if its count (local.create_public_subnets && (!var.one_nat_gateway_per_az || local.len_public_subnets >= length(var.azs)) ? local.len_public_subnets : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source
  - Needs: the answer to the decision register record DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC (decisions.json): what the STACKIT target does for the critical setting `availability-zone`, or the accepted difference

#### The setting `dns-settings` of module.vpc.module.vpc.aws_vpc.this (`MAN/semantic/module.vpc.module.vpc.aws_vpc.this/dns-settings`)

- Phase: Foundation
- What: Decide what the STACKIT target of `module.vpc.module.vpc.aws_vpc.this` (aws_vpc) does for its critical setting `dns-settings`, which the draft does not carry, and set it up by hand, or record that production does not need it
- Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. enable_dns_support and enable_dns_hostnames of the VPC decide how names resolve for what runs in it; STACKIT has no VPC object (each subnet becomes a stackit_network).
- Who: Platform Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to the decision register record DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS (decisions.json): what the STACKIT target does for the critical setting `dns-settings`, or the accepted difference
- Done when: A person confirms how names resolve for the servers of the migrated networks.
- Source: `module.vpc.module.vpc.aws_vpc.this`
- State: executable: a person can start it now
- Risk: the assessment leaves the critical setting `dns-settings` of `module.vpc.module.vpc.aws_vpc.this` open (REVIEW: a person decides what the target does for it): the migration of `module.vpc.module.vpc.aws_vpc.this` is not complete until this step is done
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

</details>

### `WP-08` — Write the security group rules the draft does not write (security)

- Owner: Security Architect
- Steps: 13 (3 a person can start now, 10 require a design decision)
- Affected resources: `module.retail_app_ecs.module.alb.aws_lb.this`, `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`, `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`, `module.retail_app_ecs.module.carts_service.aws_security_group.this`, `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`, `module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`, `module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`, `module.retail_app_ecs.module.orders_service.aws_security_group.this`, `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`, `module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Target: `stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix`
- Rests on: `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Waits for: `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- State: waits for decisions (10 of 13 steps)
- Done when: each step meets the condition stated with it below (9 different conditions).

<details>
<summary>The 13 steps of WP-08</summary>

#### The security acceptance of module.retail_app_ecs.module.alb.aws_lb.this (`MAN/security/accept/module.retail_app_ecs.module.alb.aws_lb.this:plaintext-public-listener`)

- Phase: Security
- What: Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.alb.aws_lb.this (PLAINTEXT_PUBLIC_LISTENER): The source load balancer module.retail_app_ecs.module.alb.aws_lb.this is internet-facing and every listener it states is HTTP (port 80 forwards to its targets, no listener is HTTPS or TLS): clients reach the application without transport encryption.
- Why: HIGH: waits for security acceptance, because the draft carries the weakness. The cutover decision (GO or ROLLBACK) waits for the step that records who accepted it, when and by what reference, or for the hardening. The source line is .terraform/modules/retail_app_ecs.alb/main.tf:5. Hardening, if wanted: serve the application over HTTPS (an HTTPS listener with a certificate, certificate_config in the pinned provider schema) and redirect or close port 80. StackToIT changes none of it: the acceptance is the Security Architect's decision and a record of it.
- Who: Security Architect
- When: before the GO or ROLLBACK decision of the migration
- Needs: the decision of the Security Architect (accept the weakness knowingly, or harden it in the draft or in the clients) and, for an acceptance, who accepted it, when and by what reference:
  - (1) accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.alb.aws_lb.this that the draft carries: The source load balancer module.retail_app_ecs.module.alb.aws_lb.this is internet-facing and every listener it states is HTTP (port 80 forwards to its targets, no listener is HTTPS or TLS): clients reach the application without transport encryption. In the draft: the drafted listener of stackit_application_load_balancer.retail_app_ecs_alb_this is plain HTTP on port 80, as the source states it; the public address is kept and no HTTPS listener or certificate is added. Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)
- Done when: the acceptance (who, when, reference) or the hardening is recorded for module.retail_app_ecs.module.alb.aws_lb.this (PLAINTEXT_PUBLIC_LISTENER)
- Source: `module.retail_app_ecs.module.alb.aws_lb.this`
- State: executable: a person can start it now
- Rollback (available): an acceptance changes nothing in the draft or in AWS

#### The step "Design the security attachment of…" (`MAN/security/attachment-design:module.retail_app_ecs.module.carts_service.aws_security_group.this`)

- Phase: Security
- What: Design the security attachment of module.retail_app_ecs.module.carts_service.aws_security_group.this: how the segmentation that group gave the tasks of module.retail_app_ecs.module.carts_service.aws_ecs_service.this is carried on STACKIT, as the decision DEC-GEN-CONVERT-POD-SEGMENTATION chooses (a Kubernetes NetworkPolicy from the rules of the group, a group on the nodes, or the difference accepted with who accepted it), before the tasks are started
- Why: the drafted group stackit_security_group.retail_app_ecs_carts_service_this is attached to no block of the draft, so its rules restrict nothing on STACKIT (UNENFORCED); the manifests of module.retail_app_ecs.module.carts_service.aws_ecs_service.this start the tasks without the restriction the source had until a person designs the attachment
- Who: Security Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to the decision DEC-GEN-CONVERT-POD-SEGMENTATION
- Done when: the step that the decision DEC-GEN-CONVERT-POD-SEGMENTATION settles is carried out as it was answered and checked against the target
- Source: `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`, `module.retail_app_ecs.module.carts_service.aws_security_group.this`
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The security acceptance of module.retail_app_ecs.module.carts_service.aws_security_group.this (`MAN/security/accept/module.retail_app_ecs.module.carts_service.aws_security_group.this:open-ingress-application-port`)

- Phase: Security
- What: Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.carts_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.carts_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to.
- Why: HIGH: waits for security acceptance, because the drafted rule is written as the source states it and is unenforced until the group is attached, so the weakness is not removed. The cutover decision (GO or ROLLBACK) waits for the step that records who accepted it, when and by what reference, or for the hardening. The source line is ../../lib/ecs/service/sg.tf:1. Hardening, if wanted: limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule. StackToIT changes none of it: the acceptance is the Security Architect's decision and a record of it.
- Who: Security Architect
- When: before the GO or ROLLBACK decision of the migration
- Needs: the decision of the Security Architect (accept the weakness knowingly, or harden it in the draft or in the clients) and, for an acceptance, who accepted it, when and by what reference:
  - (1) accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.carts_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.carts_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)
- Done when: the acceptance (who, when, reference) or the hardening is recorded for module.retail_app_ecs.module.carts_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT)
- Source: `module.retail_app_ecs.module.carts_service.aws_security_group.this`
- After: the step "Design the security attachment of…"
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`; it also comes after the step "Design the security attachment of…", a manual prerequisite
- Rollback (available): an acceptance changes nothing in the draft or in AWS

#### The step "Design the security attachment of…" (`MAN/security/attachment-design:module.retail_app_ecs.module.catalog_service.aws_security_group.this`)

- Phase: Security
- What: Design the security attachment of module.retail_app_ecs.module.catalog_service.aws_security_group.this: how the segmentation that group gave the tasks of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this is carried on STACKIT, as the decision DEC-GEN-CONVERT-POD-SEGMENTATION chooses (a Kubernetes NetworkPolicy from the rules of the group, a group on the nodes, or the difference accepted with who accepted it), before the tasks are started
- Why: the drafted group stackit_security_group.retail_app_ecs_catalog_service_this is attached to no block of the draft, so its rules restrict nothing on STACKIT (UNENFORCED); the manifests of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this start the tasks without the restriction the source had until a person designs the attachment
- Who: Security Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to the decision DEC-GEN-CONVERT-POD-SEGMENTATION
- Done when: the step that the decision DEC-GEN-CONVERT-POD-SEGMENTATION settles is carried out as it was answered and checked against the target
- Source: `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`, `module.retail_app_ecs.module.catalog_service.aws_security_group.this`
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The security acceptance of module.retail_app_ecs.module.catalog_service.aws_security_group.this (`MAN/security/accept/module.retail_app_ecs.module.catalog_service.aws_security_group.this:open-ingress-application-port`)

- Phase: Security
- What: Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.catalog_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.catalog_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to.
- Why: HIGH: waits for security acceptance, because the drafted rule is written as the source states it and is unenforced until the group is attached, so the weakness is not removed. The cutover decision (GO or ROLLBACK) waits for the step that records who accepted it, when and by what reference, or for the hardening. The source line is ../../lib/ecs/service/sg.tf:1. Hardening, if wanted: limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule. StackToIT changes none of it: the acceptance is the Security Architect's decision and a record of it.
- Who: Security Architect
- When: before the GO or ROLLBACK decision of the migration
- Needs: the decision of the Security Architect (accept the weakness knowingly, or harden it in the draft or in the clients) and, for an acceptance, who accepted it, when and by what reference:
  - (1) accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.catalog_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.catalog_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)
- Done when: the acceptance (who, when, reference) or the hardening is recorded for module.retail_app_ecs.module.catalog_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT)
- Source: `module.retail_app_ecs.module.catalog_service.aws_security_group.this`
- After: the step "Design the security attachment of…"
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`; it also comes after the step "Design the security attachment of…", a manual prerequisite
- Rollback (available): an acceptance changes nothing in the draft or in AWS

#### The step "Design the security attachment of…" (`MAN/security/attachment-design:module.retail_app_ecs.module.checkout_service.aws_security_group.this`)

- Phase: Security
- What: Design the security attachment of module.retail_app_ecs.module.checkout_service.aws_security_group.this: how the segmentation that group gave the tasks of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this is carried on STACKIT, as the decision DEC-GEN-CONVERT-POD-SEGMENTATION chooses (a Kubernetes NetworkPolicy from the rules of the group, a group on the nodes, or the difference accepted with who accepted it), before the tasks are started
- Why: the drafted group stackit_security_group.retail_app_ecs_checkout_service_this is attached to no block of the draft, so its rules restrict nothing on STACKIT (UNENFORCED); the manifests of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this start the tasks without the restriction the source had until a person designs the attachment
- Who: Security Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to the decision DEC-GEN-CONVERT-POD-SEGMENTATION
- Done when: the step that the decision DEC-GEN-CONVERT-POD-SEGMENTATION settles is carried out as it was answered and checked against the target
- Source: `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`, `module.retail_app_ecs.module.checkout_service.aws_security_group.this`
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The security acceptance of module.retail_app_ecs.module.checkout_service.aws_security_group.this (`MAN/security/accept/module.retail_app_ecs.module.checkout_service.aws_security_group.this:open-ingress-application-port`)

- Phase: Security
- What: Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.checkout_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.checkout_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to.
- Why: HIGH: waits for security acceptance, because the drafted rule is written as the source states it and is unenforced until the group is attached, so the weakness is not removed. The cutover decision (GO or ROLLBACK) waits for the step that records who accepted it, when and by what reference, or for the hardening. The source line is ../../lib/ecs/service/sg.tf:1. Hardening, if wanted: limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule. StackToIT changes none of it: the acceptance is the Security Architect's decision and a record of it.
- Who: Security Architect
- When: before the GO or ROLLBACK decision of the migration
- Needs: the decision of the Security Architect (accept the weakness knowingly, or harden it in the draft or in the clients) and, for an acceptance, who accepted it, when and by what reference:
  - (1) accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.checkout_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.checkout_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)
- Done when: the acceptance (who, when, reference) or the hardening is recorded for module.retail_app_ecs.module.checkout_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT)
- Source: `module.retail_app_ecs.module.checkout_service.aws_security_group.this`
- After: the step "Design the security attachment of…"
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`; it also comes after the step "Design the security attachment of…", a manual prerequisite
- Rollback (available): an acceptance changes nothing in the draft or in AWS

#### The step "Design the security attachment of…" (`MAN/security/attachment-design:module.retail_app_ecs.module.orders_service.aws_security_group.this`)

- Phase: Security
- What: Design the security attachment of module.retail_app_ecs.module.orders_service.aws_security_group.this: how the segmentation that group gave the tasks of module.retail_app_ecs.module.orders_service.aws_ecs_service.this is carried on STACKIT, as the decision DEC-GEN-CONVERT-POD-SEGMENTATION chooses (a Kubernetes NetworkPolicy from the rules of the group, a group on the nodes, or the difference accepted with who accepted it), before the tasks are started
- Why: the drafted group stackit_security_group.retail_app_ecs_orders_service_this is attached to no block of the draft, so its rules restrict nothing on STACKIT (UNENFORCED); the manifests of module.retail_app_ecs.module.orders_service.aws_ecs_service.this start the tasks without the restriction the source had until a person designs the attachment
- Who: Security Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to the decision DEC-GEN-CONVERT-POD-SEGMENTATION
- Done when: the step that the decision DEC-GEN-CONVERT-POD-SEGMENTATION settles is carried out as it was answered and checked against the target
- Source: `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`, `module.retail_app_ecs.module.orders_service.aws_security_group.this`
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The security acceptance of module.retail_app_ecs.module.orders_service.aws_security_group.this (`MAN/security/accept/module.retail_app_ecs.module.orders_service.aws_security_group.this:open-ingress-application-port`)

- Phase: Security
- What: Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.orders_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.orders_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to.
- Why: HIGH: waits for security acceptance, because the drafted rule is written as the source states it and is unenforced until the group is attached, so the weakness is not removed. The cutover decision (GO or ROLLBACK) waits for the step that records who accepted it, when and by what reference, or for the hardening. The source line is ../../lib/ecs/service/sg.tf:1. Hardening, if wanted: limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule. StackToIT changes none of it: the acceptance is the Security Architect's decision and a record of it.
- Who: Security Architect
- When: before the GO or ROLLBACK decision of the migration
- Needs: the decision of the Security Architect (accept the weakness knowingly, or harden it in the draft or in the clients) and, for an acceptance, who accepted it, when and by what reference:
  - (1) accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.orders_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.orders_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)
- Done when: the acceptance (who, when, reference) or the hardening is recorded for module.retail_app_ecs.module.orders_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT)
- Source: `module.retail_app_ecs.module.orders_service.aws_security_group.this`
- After: the step "Design the security attachment of…"
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`; it also comes after the step "Design the security attachment of…", a manual prerequisite
- Rollback (available): an acceptance changes nothing in the draft or in AWS

#### The step "Design the security attachment of…" (`MAN/security/attachment-design:module.retail_app_ecs.module.ui_service.aws_security_group.this`)

- Phase: Security
- What: Design the security attachment of module.retail_app_ecs.module.ui_service.aws_security_group.this: how the segmentation that group gave the tasks of module.retail_app_ecs.module.ui_service.aws_ecs_service.this is carried on STACKIT, as the decision DEC-GEN-CONVERT-POD-SEGMENTATION chooses (a Kubernetes NetworkPolicy from the rules of the group, a group on the nodes, or the difference accepted with who accepted it), before the tasks are started
- Why: the drafted group stackit_security_group.retail_app_ecs_ui_service_this is attached to no block of the draft, so its rules restrict nothing on STACKIT (UNENFORCED); the manifests of module.retail_app_ecs.module.ui_service.aws_ecs_service.this start the tasks without the restriction the source had until a person designs the attachment
- Who: Security Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to the decision DEC-GEN-CONVERT-POD-SEGMENTATION
- Done when: the step that the decision DEC-GEN-CONVERT-POD-SEGMENTATION settles is carried out as it was answered and checked against the target
- Source: `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`, `module.retail_app_ecs.module.ui_service.aws_security_group.this`
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The security acceptance of module.retail_app_ecs.module.ui_service.aws_security_group.this (`MAN/security/accept/module.retail_app_ecs.module.ui_service.aws_security_group.this:open-ingress-application-port`)

- Phase: Security
- What: Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.ui_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.ui_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to.
- Why: HIGH: waits for security acceptance, because the drafted rule is written as the source states it and is unenforced until the group is attached, so the weakness is not removed. The cutover decision (GO or ROLLBACK) waits for the step that records who accepted it, when and by what reference, or for the hardening. The source line is ../../lib/ecs/service/sg.tf:1. Hardening, if wanted: limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule. StackToIT changes none of it: the acceptance is the Security Architect's decision and a record of it.
- Who: Security Architect
- When: before the GO or ROLLBACK decision of the migration
- Needs: the decision of the Security Architect (accept the weakness knowingly, or harden it in the draft or in the clients) and, for an acceptance, who accepted it, when and by what reference:
  - (1) accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.ui_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.ui_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)
- Done when: the acceptance (who, when, reference) or the hardening is recorded for module.retail_app_ecs.module.ui_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT)
- Source: `module.retail_app_ecs.module.ui_service.aws_security_group.this`
- After: the step "Design the security attachment of…"
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`; it also comes after the step "Design the security attachment of…", a manual prerequisite
- Rollback (available): an acceptance changes nothing in the draft or in AWS

#### The step "Re-create the rules beyond the known set of group…" (`MAN/security/aws/incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group-module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.0.:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules-b506f3`)

- Phase: Security
- What: Re-create the rules beyond the known set of group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0] (rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules)
- Why: an unknown number of entries of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules are not visible statically (group-choice): only the known ones were produced
- Who: Security Architect
- When: before pilot
- Needs: No input is named for this step
- Done when: every entry of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules is known and has a rule, or it is confirmed that the known entries are all
- Source: `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`
- Target: `stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix`
- After: the OpenTofu step for stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix
- State: executable: a person can start it now
- Risk: placed in the security phase after the OpenTofu step for stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix, which it depends on; its own phase is prepare
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The step "Re-create the rules beyond the known set of group…" (`MAN/security/aws/incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group-module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.0.:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules-a538f6`)

- Phase: Security
- What: Re-create the rules beyond the known set of group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0] (rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules)
- Why: an unknown number of entries of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules are not visible statically (group-choice): only the known ones were produced
- Who: Security Architect
- When: before pilot
- Needs: No input is named for this step
- Done when: every entry of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules is known and has a rule, or it is confirmed that the known entries are all
- Source: `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`
- Target: `stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix`
- After: the OpenTofu step for stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix
- State: executable: a person can start it now
- Risk: placed in the security phase after the OpenTofu step for stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix, which it depends on; its own phase is prepare
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

</details>

### `WP-09` — Decide and set the critical settings (security)

- Owner: Identity Architect
- Steps: 11 (11 a person can start now)
- Affected resources: `module.retail_app_ecs.aws_kms_key.cmk`, `module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role`, `module.retail_app_ecs.module.carts_service.aws_iam_role.task_role`, `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role`, `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role`, `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role`, `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role`, `module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role`, `module.retail_app_ecs.module.orders_service.aws_iam_role.task_role`, `module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role`, `module.retail_app_ecs.module.ui_service.aws_iam_role.task_role`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (2 different conditions).

<details>
<summary>The 11 steps of WP-09</summary>

#### The setting `deletion-window` of module.retail_app_ecs.aws_kms_key.cmk (`MAN/semantic/module.retail_app_ecs.aws_kms_key.cmk/deletion-window`)

- Phase: Security
- What: Decide what the STACKIT target of `module.retail_app_ecs.aws_kms_key.cmk` (aws_kms_key) does for its critical setting `deletion-window`, which the draft does not carry, and set it up by hand, or record that production does not need it
- Why: A check of the knowledge base (kms deletion window) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). STACKIT KMS deletes a key scheduled for deletion after 30 days (docs create-and-manage-keys, 'Delete a key'), with no setting: 30 is PRESERVED, another window REVIEW.
- Who: Identity Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to the decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-AWS-KMS-KEY-CMK (decisions.json): what the STACKIT target does for the critical setting `deletion-window`, or the accepted difference
- Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
- Source: `module.retail_app_ecs.aws_kms_key.cmk`
- State: executable: a person can start it now
- Risk: the assessment leaves the critical setting `deletion-window` of `module.retail_app_ecs.aws_kms_key.cmk` open (REVIEW: a person decides what the target does for it): the migration of `module.retail_app_ecs.aws_kms_key.cmk` is not complete until this step is done
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### Alike steps on 10 resources (aws_iam_role) — the review of the open settings of {resource} (`MAN/semantic/{resource}/open-settings`)

- Phase: Security
- Why: The assessment leaves 4 critical settings of `{resource}` open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item.
- Who: Identity Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to each decision register record (decisions.json): what the STACKIT target does for the setting, or the accepted difference - `trust` {needs}
- Done when: every one of the 4 settings is closed: each is set up on its STACKIT target and checked, or the decision that production does not need it is recorded (the condition of each is stated with its item, and `assurance/critical-semantics.json` says what closes it)
- State: executable: a person can start it now
- Risk: the assessment leaves 4 critical settings of `{resource}` open (the draft does not carry them): the migration of `{resource}` is not complete until every one is closed; this step is the one step of them (`assurance/critical-semantics.json` says why each is open)
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The review of the open settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role (`MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings`) — {resource} = `module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role` (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-ecs`)
  - Needs ({needs}): (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885, Identity Architect); `permissions` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885, Identity Architect); `iam-trust-service-workload` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885, Identity Architect); `iam-managed-ecs` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885, Identity Architect)
  - Settings (4, the step is done when every one is closed):
    - `trust` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried.
      - Done when: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.
    - `permissions` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person.
      - Done when: A person translates each permission of the attached policies into STACKIT roles on the target resources.
    - `iam-trust-service-workload` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885)
      - Why: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `iam-managed-ecs` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885)
      - Why: A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
- The review of the open settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role (`MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings`) — {resource} = `module.retail_app_ecs.module.carts_service.aws_iam_role.task_role`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.carts_service.aws_iam_role.task_role` (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-customer-policy`)
  - Needs ({needs}): (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA, Identity Architect); `permissions` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA, Identity Architect); `iam-trust-service-workload` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA, Identity Architect); `iam-managed-customer-policy` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA, Identity Architect)
  - Settings (4, the step is done when every one is closed):
    - `trust` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried.
      - Done when: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.
    - `permissions` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. The unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) through this setting (the target does not carry it: it is in the class redesign), so what the reference becomes is part of this setting.
      - Done when: A person translates each permission of the attached policies into STACKIT roles on the target resources.
    - `iam-trust-service-workload` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA)
      - Why: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `iam-managed-customer-policy` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA)
      - Why: A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
- The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role (`MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings`) — {resource} = `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role` (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-ecs`)
  - Needs ({needs}): (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913, Identity Architect); `permissions` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913, Identity Architect); `iam-trust-service-workload` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913, Identity Architect); `iam-managed-ecs` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913, Identity Architect)
  - Settings (4, the step is done when every one is closed):
    - `trust` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried.
      - Done when: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.
    - `permissions` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. The unit names 2 resources through this setting whose references the draft does not resolve: module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (aws_secretsmanager_secret), module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (aws_secretsmanager_secret). What each reference becomes is part of this setting.
      - Done when: A person translates each permission of the attached policies into STACKIT roles on the target resources.
    - `iam-trust-service-workload` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913)
      - Why: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `iam-managed-ecs` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913)
      - Why: A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
- The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role (`MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings`) — {resource} = `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role` (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-customer-policy`)
  - Needs ({needs}): (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1, Identity Architect); `permissions` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1, Identity Architect); `iam-trust-service-workload` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1, Identity Architect); `iam-managed-customer-policy` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1, Identity Architect)
  - Settings (4, the step is done when every one is closed):
    - `trust` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried.
      - Done when: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.
    - `permissions` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person.
      - Done when: A person translates each permission of the attached policies into STACKIT roles on the target resources.
    - `iam-trust-service-workload` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1)
      - Why: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `iam-managed-customer-policy` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1)
      - Why: A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
- The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role (`MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings`) — {resource} = `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role` (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-ecs`)
  - Needs ({needs}): (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673, Identity Architect); `permissions` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673, Identity Architect); `iam-trust-service-workload` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673, Identity Architect); `iam-managed-ecs` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673, Identity Architect)
  - Settings (4, the step is done when every one is closed):
    - `trust` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried.
      - Done when: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.
    - `permissions` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person.
      - Done when: A person translates each permission of the attached policies into STACKIT roles on the target resources.
    - `iam-trust-service-workload` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673)
      - Why: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `iam-managed-ecs` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673)
      - Why: A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
- The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role (`MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings`) — {resource} = `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role` (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-customer-policy`)
  - Needs ({needs}): (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6, Identity Architect); `permissions` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6, Identity Architect); `iam-trust-service-workload` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6, Identity Architect); `iam-managed-customer-policy` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6, Identity Architect)
  - Settings (4, the step is done when every one is closed):
    - `trust` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried.
      - Done when: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.
    - `permissions` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. The unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) through this setting (the target does not carry it: it is in the class redesign), so what the reference becomes is part of this setting.
      - Done when: A person translates each permission of the attached policies into STACKIT roles on the target resources.
    - `iam-trust-service-workload` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6)
      - Why: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `iam-managed-customer-policy` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6)
      - Why: A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
- The review of the open settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role (`MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings`) — {resource} = `module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role` (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-ecs`)
  - Needs ({needs}): (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202, Identity Architect); `permissions` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202, Identity Architect); `iam-trust-service-workload` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202, Identity Architect); `iam-managed-ecs` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202, Identity Architect)
  - Settings (4, the step is done when every one is closed):
    - `trust` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried.
      - Done when: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.
    - `permissions` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. The unit names 2 resources through this setting whose references the draft does not resolve: module.retail_app_ecs.aws_secretsmanager_secret.mq (aws_secretsmanager_secret), module.retail_app_ecs.aws_secretsmanager_secret.orders_db (aws_secretsmanager_secret). What each reference becomes is part of this setting.
      - Done when: A person translates each permission of the attached policies into STACKIT roles on the target resources.
    - `iam-trust-service-workload` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202)
      - Why: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `iam-managed-ecs` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202)
      - Why: A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
- The review of the open settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role (`MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings`) — {resource} = `module.retail_app_ecs.module.orders_service.aws_iam_role.task_role`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.orders_service.aws_iam_role.task_role` (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-customer-policy`)
  - Needs ({needs}): (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65, Identity Architect); `permissions` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65, Identity Architect); `iam-trust-service-workload` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65, Identity Architect); `iam-managed-customer-policy` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65, Identity Architect)
  - Settings (4, the step is done when every one is closed):
    - `trust` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried.
      - Done when: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.
    - `permissions` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person.
      - Done when: A person translates each permission of the attached policies into STACKIT roles on the target resources.
    - `iam-trust-service-workload` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65)
      - Why: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `iam-managed-customer-policy` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65)
      - Why: A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
- The review of the open settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role (`MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings`) — {resource} = `module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role` (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-ecs`)
  - Needs ({needs}): (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0, Identity Architect); `permissions` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0, Identity Architect); `iam-trust-service-workload` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0, Identity Architect); `iam-managed-ecs` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0, Identity Architect)
  - Settings (4, the step is done when every one is closed):
    - `trust` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried.
      - Done when: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.
    - `permissions` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person.
      - Done when: A person translates each permission of the attached policies into STACKIT roles on the target resources.
    - `iam-trust-service-workload` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0)
      - Why: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `iam-managed-ecs` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0)
      - Why: A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
- The review of the open settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role (`MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings`) — {resource} = `module.retail_app_ecs.module.ui_service.aws_iam_role.task_role`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.ui_service.aws_iam_role.task_role` (aws_iam_role) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-customer-policy`)
  - Needs ({needs}): (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE, Identity Architect); `permissions` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE, Identity Architect); `iam-trust-service-workload` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE, Identity Architect); `iam-managed-customer-policy` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE, Identity Architect)
  - Settings (4, the step is done when every one is closed):
    - `trust` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried.
      - Done when: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.
    - `permissions` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person.
      - Done when: A person translates each permission of the attached policies into STACKIT roles on the target resources.
    - `iam-trust-service-workload` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE)
      - Why: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `iam-managed-customer-policy` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE)
      - Why: A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.

</details>

### `WP-10` — Decide and set the critical settings (security)

- Owner: Network Architect
- Steps: 12 (12 a person can start now)
- Affected resources: `module.dependencies.aws_security_group.catalog_opensearch_sg`, `module.dependencies.aws_security_group.mq`, `module.dependencies.module.catalog_rds.aws_security_group.this`, `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd`, `module.dependencies.module.orders_rds.aws_security_group.this`, `module.retail_app_ecs.module.alb.aws_security_group.this`, `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`, `module.retail_app_ecs.module.carts_service.aws_security_group.this`, `module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `module.retail_app_ecs.module.orders_service.aws_security_group.this`, `module.retail_app_ecs.module.ui_service.aws_security_group.this`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (4 different conditions).

<details>
<summary>The 12 steps of WP-10</summary>

#### Alike steps on 12 resources (aws_security_group) — the review of the open settings of {resource} (`MAN/semantic/{resource}/open-settings`)

- Phase: Security
- Why: The assessment leaves {why} open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item.
- Who: Network Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to each decision register record (decisions.json): what the STACKIT target does for the setting, or the accepted difference - `network-topology-boundary` {needs}
- Done when: every one of the {done when} settings is closed: each is set up on its STACKIT target and checked, or the decision that production does not need it is recorded (the condition of each is stated with its item, and `assurance/critical-semantics.json` says what closes it)
- State: executable: a person can start it now
- Risk: the assessment leaves {risk} is not complete until every one is closed; this step is the one step of them (`assurance/critical-semantics.json` says why each is open)
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The review of the open settings of module.dependencies.aws_security_group.catalog_opensearch_sg (`MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings`) — {resource} = `module.dependencies.aws_security_group.catalog_opensearch_sg`
  - What: Review the 5 open critical settings of `module.dependencies.aws_security_group.catalog_opensearch_sg` (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`network-topology-boundary`, `stateful`, `egress-restriction`, `standalone-rule-not-generated`, `standalone-rule-remote-not-resolved`)
  - Why ({why}): 5 critical settings of `module.dependencies.aws_security_group.catalog_opensearch_sg`
  - Needs ({needs}): (record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG, Network Architect); `stateful` (record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG, Network Architect); `egress-restriction` (record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG, Network Architect); `standalone-rule-not-generated` (record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG, Network Architect); `standalone-rule-remote-not-resolved` (record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG, Network Architect)
  - Done when ({done when}): 5
  - Settings (5, the step is done when every one is closed):
    - `network-topology-boundary` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `stateful` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG)
      - Why: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true).
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
    - `egress-restriction` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG)
      - Why: A check of the knowledge base (sg egress restricted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `standalone-rule-not-generated` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG)
      - Why: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An aws_security_group_rule the draft does not generate (the draft names its settings NOT CARRIED, or the KB cannot decide that it generates it): a prefix list, an ICMP type with every code, ICMPv6 limited by type or code, a protocol with no STACKIT counterpart, a source or protocol or port not visible statically, a source group that is not one whole reference to a security group of the draft, or a repeated or conditionally created group. A person re-creates the rule with the STACKIT range or group it needs (a rule is never widened: a stackit_security_group_rule without source allows every address, pinned provider) - REVIEW, per rule.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `standalone-rule-remote-not-resolved` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The source of a standalone security group rule: the other security group (source_security_group_id) whose members the rule lets in.
      - Done when: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A person re-creates the rule with the STACKIT security group or address range it needs; the draft does not widen it (a stackit_security_group_rule without a source allows everything, pinned provider).
  - Risk ({risk}): 5 critical settings of `module.dependencies.aws_security_group.catalog_opensearch_sg` open (the draft does not carry them): the migration of `module.dependencies.aws_security_group.catalog_opensearch_sg`
- The review of the open settings of module.dependencies.aws_security_group.mq (`MAN/semantic/module.dependencies.aws_security_group.mq/open-settings`) — {resource} = `module.dependencies.aws_security_group.mq`
  - What: Review the 4 open critical settings of `module.dependencies.aws_security_group.mq` (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`network-topology-boundary`, `stateful`, `egress-restriction`, `standalone-rule-not-generated`)
  - Why ({why}): 4 critical settings of `module.dependencies.aws_security_group.mq`
  - Needs ({needs}): (record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ, Network Architect); `stateful` (record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ, Network Architect); `egress-restriction` (record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ, Network Architect); `standalone-rule-not-generated` (record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ, Network Architect)
  - Done when ({done when}): 4
  - Settings (4, the step is done when every one is closed):
    - `network-topology-boundary` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `stateful` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ)
      - Why: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true).
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
    - `egress-restriction` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ)
      - Why: A check of the knowledge base (sg egress restricted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `standalone-rule-not-generated` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ)
      - Why: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An aws_security_group_rule the draft does not generate (the draft names its settings NOT CARRIED, or the KB cannot decide that it generates it): a prefix list, an ICMP type with every code, ICMPv6 limited by type or code, a protocol with no STACKIT counterpart, a source or protocol or port not visible statically, a source group that is not one whole reference to a security group of the draft, or a repeated or conditionally created group. A person re-creates the rule with the STACKIT range or group it needs (a rule is never widened: a stackit_security_group_rule without source allows every address, pinned provider) - REVIEW, per rule.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 4 critical settings of `module.dependencies.aws_security_group.mq` open (the draft does not carry them): the migration of `module.dependencies.aws_security_group.mq`
- The review of the open settings of module.dependencies.module.catalog_rds.aws_security_group.this (`MAN/semantic/module.dependencies.module.catalog_rds.aws_security_group.this/open-settings`) — {resource} = `module.dependencies.module.catalog_rds.aws_security_group.this`
  - What: Review the 5 open critical settings of `module.dependencies.module.catalog_rds.aws_security_group.this` (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`network-topology-boundary`, `stateful`, `egress-restriction`, `rule-ports`, `standalone-rule-values`)
  - Why ({why}): 5 critical settings of `module.dependencies.module.catalog_rds.aws_security_group.this`
  - Needs ({needs}): (record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS, Network Architect); `stateful` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS, Network Architect); `egress-restriction` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS, Network Architect); `rule-ports` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS, Network Architect); `standalone-rule-values` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS, Network Architect)
  - Done when ({done when}): 5
  - Settings (5, the step is done when every one is closed):
    - `network-topology-boundary` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `stateful` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS)
      - Why: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true).
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
    - `egress-restriction` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS)
      - Why: A check of the knowledge base (sg egress restricted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `rule-ports` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS)
      - Why: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `standalone-rule-values` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS)
      - Why: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). An aws_security_group_rule becomes a stackit_security_group_rule: type → direction, protocol → protocol, cidr_blocks → ip_range (one rule per range), source_security_group_id → remote_security_group_id. A rule that is not generated is named NOT CARRIED and the group is REVIEW.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
  - Risk ({risk}): 5 critical settings of `module.dependencies.module.catalog_rds.aws_security_group.this` open (the draft does not carry them): the migration of `module.dependencies.module.catalog_rds.aws_security_group.this`
- The review of the open settings of module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd (`MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings`) — {resource} = `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd`
  - What: Review the 6 open critical settings of `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd` (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`network-topology-boundary`, `stateful`, `rule-ports`, `standalone-rule-values`, `standalone-rule-other-sources`, `standalone-rule-empty-sources`)
  - Why ({why}): 6 critical settings of `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd`
  - Needs ({needs}): (record DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0, Network Architect); `stateful` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0, Network Architect); `rule-ports` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0, Network Architect); `standalone-rule-values` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0, Network Architect); `standalone-rule-other-sources` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0, Network Architect); `standalone-rule-empty-sources` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0, Network Architect)
  - Done when ({done when}): 6
  - Settings (6, the step is done when every one is closed):
    - `network-topology-boundary` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `stateful` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0)
      - Why: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true).
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
    - `rule-ports` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0)
      - Why: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `standalone-rule-values` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0)
      - Why: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). An aws_security_group_rule becomes a stackit_security_group_rule: type → direction, protocol → protocol, cidr_blocks → ip_range (one rule per range), source_security_group_id → remote_security_group_id. A rule that is not generated is named NOT CARRIED and the group is REVIEW.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `standalone-rule-other-sources` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0)
      - Why: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). A standalone rule's own group (self) and IPv6 ranges are written where the draft places the rule (self as remote_security_group_id of the group, an IPv6 range as ip_range with ether_type IPv6), and the draft names the rule NOT CARRIED when the plan withholds it; prefix lists are not generated (as rule other sources for inline rules; prefix lists: the prefix list check), and a person adds the rule if the traffic must pass — REVIEW in every order position.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `standalone-rule-empty-sources` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0)
      - Why: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). self = false and empty IPv6/prefix-list lists (module defaults) add no source, as the drafted rule adds none — PRESERVED, per rule that states no source, next to rules that do (those are standalone rule other sources, REVIEW); REVIEW when a rule of the group is not generated (its settings are named NOT CARRIED, the rule not generated check) or a value is not visible statically: the draft names such a value NOT CARRIED and nothing here claims it carried.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
  - Risk ({risk}): 6 critical settings of `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd` open (the draft does not carry them): the migration of `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd`
- The review of the open settings of module.dependencies.module.orders_rds.aws_security_group.this (`MAN/semantic/module.dependencies.module.orders_rds.aws_security_group.this/open-settings`) — {resource} = `module.dependencies.module.orders_rds.aws_security_group.this`
  - What: Review the 5 open critical settings of `module.dependencies.module.orders_rds.aws_security_group.this` (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`network-topology-boundary`, `stateful`, `egress-restriction`, `rule-ports`, `standalone-rule-values`)
  - Why ({why}): 5 critical settings of `module.dependencies.module.orders_rds.aws_security_group.this`
  - Needs ({needs}): (record DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS, Network Architect); `stateful` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS, Network Architect); `egress-restriction` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS, Network Architect); `rule-ports` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS, Network Architect); `standalone-rule-values` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS, Network Architect)
  - Done when ({done when}): 5
  - Settings (5, the step is done when every one is closed):
    - `network-topology-boundary` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `stateful` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS)
      - Why: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true).
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
    - `egress-restriction` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS)
      - Why: A check of the knowledge base (sg egress restricted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `rule-ports` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS)
      - Why: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `standalone-rule-values` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS)
      - Why: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). An aws_security_group_rule becomes a stackit_security_group_rule: type → direction, protocol → protocol, cidr_blocks → ip_range (one rule per range), source_security_group_id → remote_security_group_id. A rule that is not generated is named NOT CARRIED and the group is REVIEW.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
  - Risk ({risk}): 5 critical settings of `module.dependencies.module.orders_rds.aws_security_group.this` open (the draft does not carry them): the migration of `module.dependencies.module.orders_rds.aws_security_group.this`
- The review of the open settings of module.retail_app_ecs.module.alb.aws_security_group.this (`MAN/semantic/module.retail_app_ecs.module.alb.aws_security_group.this/open-settings`) — {resource} = `module.retail_app_ecs.module.alb.aws_security_group.this`
  - What: Review the 3 open critical settings of `module.retail_app_ecs.module.alb.aws_security_group.this` (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`network-topology-boundary`, `stateful`, `egress-restriction`)
  - Why ({why}): 3 critical settings of `module.retail_app_ecs.module.alb.aws_security_group.this`
  - Needs ({needs}): (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS, Network Architect); `stateful` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS, Network Architect); `egress-restriction` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS, Network Architect)
  - Done when ({done when}): 3
  - Settings (3, the step is done when every one is closed):
    - `network-topology-boundary` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `stateful` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true).
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
    - `egress-restriction` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS)
      - Why: A check of the knowledge base (sg egress restricted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
  - Risk ({risk}): 3 critical settings of `module.retail_app_ecs.module.alb.aws_security_group.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.alb.aws_security_group.this`
- The review of the open settings of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix (`MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings`) — {resource} = `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`
  - What: Review the 6 open critical settings of `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix` (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`network-topology-boundary`, `stateful`, `rule-ports`, `standalone-rule-values`, `standalone-rule-other-sources`, `standalone-rule-empty-sources`)
  - Why ({why}): 6 critical settings of `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`
  - Needs ({needs}): (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862, Network Architect); `stateful` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862, Network Architect); `rule-ports` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862, Network Architect); `standalone-rule-values` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862, Network Architect); `standalone-rule-other-sources` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862, Network Architect); `standalone-rule-empty-sources` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862, Network Architect)
  - Done when ({done when}): 6
  - Settings (6, the step is done when every one is closed):
    - `network-topology-boundary` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `stateful` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true).
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
    - `rule-ports` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862)
      - Why: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `standalone-rule-values` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862)
      - Why: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). An aws_security_group_rule becomes a stackit_security_group_rule: type → direction, protocol → protocol, cidr_blocks → ip_range (one rule per range), source_security_group_id → remote_security_group_id. A rule that is not generated is named NOT CARRIED and the group is REVIEW.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `standalone-rule-other-sources` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862)
      - Why: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). A standalone rule's own group (self) and IPv6 ranges are written where the draft places the rule (self as remote_security_group_id of the group, an IPv6 range as ip_range with ether_type IPv6), and the draft names the rule NOT CARRIED when the plan withholds it; prefix lists are not generated (as rule other sources for inline rules; prefix lists: the prefix list check), and a person adds the rule if the traffic must pass — REVIEW in every order position.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `standalone-rule-empty-sources` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862)
      - Why: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). self = false and empty IPv6/prefix-list lists (module defaults) add no source, as the drafted rule adds none — PRESERVED, per rule that states no source, next to rules that do (those are standalone rule other sources, REVIEW); REVIEW when a rule of the group is not generated (its settings are named NOT CARRIED, the rule not generated check) or a value is not visible statically: the draft names such a value NOT CARRIED and nothing here claims it carried.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
  - Risk ({risk}): 6 critical settings of `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`
- The review of the open settings of module.retail_app_ecs.module.carts_service.aws_security_group.this (`MAN/semantic/module.retail_app_ecs.module.carts_service.aws_security_group.this/open-settings`) — {resource} = `module.retail_app_ecs.module.carts_service.aws_security_group.this`
  - What: Review the 6 open critical settings of `module.retail_app_ecs.module.carts_service.aws_security_group.this` (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`network-topology-boundary`, `stateful`, `rule-ports`, `egress-rule-protocol`, `ingress-sources`, `egress-sources`)
  - Why ({why}): 6 critical settings of `module.retail_app_ecs.module.carts_service.aws_security_group.this`
  - Needs ({needs}): (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF, Network Architect); `stateful` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF, Network Architect); `rule-ports` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF, Network Architect); `egress-rule-protocol` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF, Network Architect); `ingress-sources` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF, Network Architect); `egress-sources` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF, Network Architect)
  - Done when ({done when}): 6
  - Settings (6, the step is done when every one is closed):
    - `network-topology-boundary` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `stateful` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true).
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
    - `rule-ports` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).
      - Done when: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.
    - `egress-rule-protocol` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. protocol → stackit_security_group_rule.protocol (pinned provider). the egress restriction setting reads the same attribute and is REVIEW exactly when the egress restriction check fires; this semantic is then REVIEW as well, so the two critical readers of egress.protocol never disagree (TRANSFORMED only when neither check fires).
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
    - `ingress-sources` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).
      - Done when: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.
    - `egress-sources` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. As ingress sources; the egress restriction setting reads egress.cidr_blocks too and is REVIEW exactly when the egress restriction check fires — the same order here, so the two never disagree.
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
  - Risk ({risk}): 6 critical settings of `module.retail_app_ecs.module.carts_service.aws_security_group.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.carts_service.aws_security_group.this`
- The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_security_group.this (`MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_security_group.this/open-settings`) — {resource} = `module.retail_app_ecs.module.catalog_service.aws_security_group.this`
  - What: Review the 6 open critical settings of `module.retail_app_ecs.module.catalog_service.aws_security_group.this` (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`network-topology-boundary`, `stateful`, `rule-ports`, `egress-rule-protocol`, `ingress-sources`, `egress-sources`)
  - Why ({why}): 6 critical settings of `module.retail_app_ecs.module.catalog_service.aws_security_group.this`
  - Needs ({needs}): (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F, Network Architect); `stateful` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F, Network Architect); `rule-ports` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F, Network Architect); `egress-rule-protocol` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F, Network Architect); `ingress-sources` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F, Network Architect); `egress-sources` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F, Network Architect)
  - Done when ({done when}): 6
  - Settings (6, the step is done when every one is closed):
    - `network-topology-boundary` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `stateful` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true).
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
    - `rule-ports` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).
      - Done when: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.
    - `egress-rule-protocol` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. protocol → stackit_security_group_rule.protocol (pinned provider). the egress restriction setting reads the same attribute and is REVIEW exactly when the egress restriction check fires; this semantic is then REVIEW as well, so the two critical readers of egress.protocol never disagree (TRANSFORMED only when neither check fires).
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
    - `ingress-sources` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).
      - Done when: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.
    - `egress-sources` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. As ingress sources; the egress restriction setting reads egress.cidr_blocks too and is REVIEW exactly when the egress restriction check fires — the same order here, so the two never disagree.
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
  - Risk ({risk}): 6 critical settings of `module.retail_app_ecs.module.catalog_service.aws_security_group.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.catalog_service.aws_security_group.this`
- The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_security_group.this (`MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_security_group.this/open-settings`) — {resource} = `module.retail_app_ecs.module.checkout_service.aws_security_group.this`
  - What: Review the 6 open critical settings of `module.retail_app_ecs.module.checkout_service.aws_security_group.this` (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`network-topology-boundary`, `stateful`, `rule-ports`, `egress-rule-protocol`, `ingress-sources`, `egress-sources`)
  - Why ({why}): 6 critical settings of `module.retail_app_ecs.module.checkout_service.aws_security_group.this`
  - Needs ({needs}): (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F, Network Architect); `stateful` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F, Network Architect); `rule-ports` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F, Network Architect); `egress-rule-protocol` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F, Network Architect); `ingress-sources` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F, Network Architect); `egress-sources` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F, Network Architect)
  - Done when ({done when}): 6
  - Settings (6, the step is done when every one is closed):
    - `network-topology-boundary` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `stateful` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true).
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
    - `rule-ports` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).
      - Done when: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.
    - `egress-rule-protocol` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. protocol → stackit_security_group_rule.protocol (pinned provider). the egress restriction setting reads the same attribute and is REVIEW exactly when the egress restriction check fires; this semantic is then REVIEW as well, so the two critical readers of egress.protocol never disagree (TRANSFORMED only when neither check fires).
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
    - `ingress-sources` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).
      - Done when: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.
    - `egress-sources` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. As ingress sources; the egress restriction setting reads egress.cidr_blocks too and is REVIEW exactly when the egress restriction check fires — the same order here, so the two never disagree.
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
  - Risk ({risk}): 6 critical settings of `module.retail_app_ecs.module.checkout_service.aws_security_group.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.checkout_service.aws_security_group.this`
- The review of the open settings of module.retail_app_ecs.module.orders_service.aws_security_group.this (`MAN/semantic/module.retail_app_ecs.module.orders_service.aws_security_group.this/open-settings`) — {resource} = `module.retail_app_ecs.module.orders_service.aws_security_group.this`
  - What: Review the 6 open critical settings of `module.retail_app_ecs.module.orders_service.aws_security_group.this` (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`network-topology-boundary`, `stateful`, `rule-ports`, `egress-rule-protocol`, `ingress-sources`, `egress-sources`)
  - Why ({why}): 6 critical settings of `module.retail_app_ecs.module.orders_service.aws_security_group.this`
  - Needs ({needs}): (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3, Network Architect); `stateful` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3, Network Architect); `rule-ports` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3, Network Architect); `egress-rule-protocol` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3, Network Architect); `ingress-sources` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3, Network Architect); `egress-sources` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3, Network Architect)
  - Done when ({done when}): 6
  - Settings (6, the step is done when every one is closed):
    - `network-topology-boundary` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `stateful` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true).
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
    - `rule-ports` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).
      - Done when: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.
    - `egress-rule-protocol` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. protocol → stackit_security_group_rule.protocol (pinned provider). the egress restriction setting reads the same attribute and is REVIEW exactly when the egress restriction check fires; this semantic is then REVIEW as well, so the two critical readers of egress.protocol never disagree (TRANSFORMED only when neither check fires).
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
    - `ingress-sources` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).
      - Done when: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.
    - `egress-sources` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. As ingress sources; the egress restriction setting reads egress.cidr_blocks too and is REVIEW exactly when the egress restriction check fires — the same order here, so the two never disagree.
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
  - Risk ({risk}): 6 critical settings of `module.retail_app_ecs.module.orders_service.aws_security_group.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.orders_service.aws_security_group.this`
- The review of the open settings of module.retail_app_ecs.module.ui_service.aws_security_group.this (`MAN/semantic/module.retail_app_ecs.module.ui_service.aws_security_group.this/open-settings`) — {resource} = `module.retail_app_ecs.module.ui_service.aws_security_group.this`
  - What: Review the 6 open critical settings of `module.retail_app_ecs.module.ui_service.aws_security_group.this` (aws_security_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`network-topology-boundary`, `stateful`, `rule-ports`, `egress-rule-protocol`, `ingress-sources`, `egress-sources`)
  - Why ({why}): 6 critical settings of `module.retail_app_ecs.module.ui_service.aws_security_group.this`
  - Needs ({needs}): (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS, Network Architect); `stateful` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS, Network Architect); `rule-ports` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS, Network Architect); `egress-rule-protocol` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS, Network Architect); `ingress-sources` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS, Network Architect); `egress-sources` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS, Network Architect)
  - Done when ({done when}): 6
  - Settings (6, the step is done when every one is closed):
    - `network-topology-boundary` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS)
      - Why: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
    - `stateful` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true).
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
    - `rule-ports` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).
      - Done when: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.
    - `egress-rule-protocol` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. protocol → stackit_security_group_rule.protocol (pinned provider). the egress restriction setting reads the same attribute and is REVIEW exactly when the egress restriction check fires; this semantic is then REVIEW as well, so the two critical readers of egress.protocol never disagree (TRANSFORMED only when neither check fires).
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
    - `ingress-sources` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).
      - Done when: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.
    - `egress-sources` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS)
      - Why: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. As ingress sources; the egress restriction setting reads egress.cidr_blocks too and is REVIEW exactly when the egress restriction check fires — the same order here, so the two never disagree.
      - Done when: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.
  - Risk ({risk}): 6 critical settings of `module.retail_app_ecs.module.ui_service.aws_security_group.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.ui_service.aws_security_group.this`

</details>

### `WP-11` — Decide and set the critical settings (security)

- Owner: Platform Architect
- Steps: 4 (4 a person can start now)
- Affected resources: `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db`, `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch`, `module.retail_app_ecs.aws_secretsmanager_secret.mq`, `module.retail_app_ecs.aws_secretsmanager_secret.orders_db`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (4 different conditions).

<details>
<summary>The 4 steps of WP-11</summary>

#### Alike steps on 4 resources (aws_secretsmanager_secret) — the setting "name" of {resource} (`MAN/semantic/{resource}/tc-secretsmanager-secret-name`)

- Phase: Security
- What: Choose the Vault path the secret {what}, and point the applications that look the secret up by name at that path
- Why: The plan holds the write of the secret as the STACKIT API step WriteSecret of {why} and does not carry the name of the source: the source builds the name of the secret from a value the scan cannot know, so it does not state the name as a literal the plan can rely on. The plan states no path for it, so the name stays open for a person to decide.
- Who: Platform Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to the decision register record {needs} (decisions.json): what the STACKIT target does for the critical setting `tc-secretsmanager-secret-name`, or the accepted difference
- Done when: A person names the Vault path in {done when} has run, and the applications look the secret up at that path.
- State: executable: a person can start it now
- Risk: the assessment leaves the critical setting `tc-secretsmanager-secret-name` of `{resource}` open (REVIEW: a person decides what the target does for it): the migration of `{resource}` is not complete until this step is done
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (`MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db/tc-secretsmanager-secret-name`) — {resource} = `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db`
  - What ({what}): `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db` is written under in the Secrets Manager instance of the draft, set it in `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB` (the input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db)
  - Why ({why}): module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, which takes its path from `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB`
  - Needs ({needs}): DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB
  - Done when ({done when}): `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB`, the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db
- The setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (`MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch/tc-secretsmanager-secret-name`) — {resource} = `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch`
  - What ({what}): `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch` is written under in the Secrets Manager instance of the draft, set it in `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH` (the input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch)
  - Why ({why}): module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, which takes its path from `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH`
  - Needs ({needs}): DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E
  - Done when ({done when}): `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH`, the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch
- The setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.mq (`MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.mq/tc-secretsmanager-secret-name`) — {resource} = `module.retail_app_ecs.aws_secretsmanager_secret.mq`
  - What ({what}): `module.retail_app_ecs.aws_secretsmanager_secret.mq` is written under in the Secrets Manager instance of the draft, set it in `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ` (the input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq)
  - Why ({why}): module.retail_app_ecs.aws_secretsmanager_secret.mq, which takes its path from `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ`
  - Needs ({needs}): DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ
  - Done when ({done when}): `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ`, the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq
- The setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.orders_db (`MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.orders_db/tc-secretsmanager-secret-name`) — {resource} = `module.retail_app_ecs.aws_secretsmanager_secret.orders_db`
  - What ({what}): `module.retail_app_ecs.aws_secretsmanager_secret.orders_db` is written under in the Secrets Manager instance of the draft, set it in `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB` (the input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db)
  - Why ({why}): module.retail_app_ecs.aws_secretsmanager_secret.orders_db, which takes its path from `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB`
  - Needs ({needs}): DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB
  - Done when ({done when}): `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB`, the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db

</details>

### `WP-12` — Decide and set the critical settings (security)

- Owner: Security Architect
- Steps: 4 (4 a person can start now)
- Affected resources: `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db`, `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch`, `module.retail_app_ecs.aws_secretsmanager_secret.mq`, `module.retail_app_ecs.aws_secretsmanager_secret.orders_db`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (3 different conditions).

<details>
<summary>The 4 steps of WP-12</summary>

#### Alike steps on 2 resources (aws_secretsmanager_secret) — the review of the open settings of {resource} (`MAN/semantic/{resource}/open-settings-security-architect`)

- Phase: Security
- What: Review the 2 open critical settings of `{resource}` (aws_secretsmanager_secret) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`secret-value`, `customer-managed-key`)
- Why: The assessment leaves 2 critical settings of `{resource}` open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item.
- Who: Security Architect
- When: Timing to be scheduled by the owner
- Done when: every one of the 2 settings is closed: each is set up on its STACKIT target and checked, or the decision that production does not need it is recorded (the condition of each is stated with its item, and `assurance/critical-semantics.json` says what closes it)
- State: executable: a person can start it now
- Risk: the assessment leaves 2 critical settings of `{resource}` open (the draft does not carry them): the migration of `{resource}` is not complete until every one is closed; this step is the one step of them (`assurance/critical-semantics.json` says why each is open)
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The review of the open settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (`MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db/open-settings-security-architect`) — {resource} = `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db`
  - Needs: the answer to each decision register record (decisions.json): what the STACKIT target does for the setting, or the accepted difference - `secret-value` (record DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB, Security Architect); `customer-managed-key` (record DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB, Security Architect)
  - Settings (2, the step is done when every one is closed):
    - `secret-value` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB)
      - Why: The value of the secret is the document you supply, not something the plan carries: StackToIT never reads it from the source (state, variables, code) and writes it nowhere itself, so this critical setting stays open for a person to decide where the values come from. The plan holds the write as the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, which sends the document named in `STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_CATALOG_DB` to the secret at the path STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB names of the drafted Secrets Manager instance, after the migration user the draft creates, and which waits for the opt-in to the Vault-compatible API.
      - Done when: A person decides where the values of the document come from (the same value from a secure source, or a new one: moving is the moment to rotate), supplies it through `STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_CATALOG_DB`, and the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db has run. The person also names the Vault path the applications read, in `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB`.
    - `customer-managed-key` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB)
      - Why: A check of the knowledge base (secret cmk) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Critical and reading the key since 2026-09-27: the draft names it NOT CARRIED, except where it sets the instance's kms_key (below). The AWS key does not move, AWS's key per secret has no per-secret counterpart, and the draft sets the kms_key block (referencing the drafted STACKIT key) only when every source of the shared instance is an AWS secret that references that one key — otherwise it names the key NOT CARRIED with the reason; either way a person decides (REVIEW, see the customer-managed key check).
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.
- The review of the open settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (`MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch/open-settings-security-architect`) — {resource} = `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch`
  - Needs: the answer to each decision register record (decisions.json): what the STACKIT target does for the setting, or the accepted difference - `secret-value` (record DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E, Security Architect); `customer-managed-key` (record DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E, Security Architect)
  - Settings (2, the step is done when every one is closed):
    - `secret-value` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E)
      - Why: The value of the secret is the document you supply, not something the plan carries: StackToIT never reads it from the source (state, variables, code) and writes it nowhere itself, so this critical setting stays open for a person to decide where the values come from. The plan holds the write as the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, which sends the document named in `STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_CATALOG_OPENSEARCH` to the secret at the path STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH names of the drafted Secrets Manager instance, after the migration user the draft creates, and which waits for the opt-in to the Vault-compatible API.
      - Done when: A person decides where the values of the document come from (the same value from a secure source, or a new one: moving is the moment to rotate), supplies it through `STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_CATALOG_OPENSEARCH`, and the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch has run. The person also names the Vault path the applications read, in `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH`.
    - `customer-managed-key` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E)
      - Why: A check of the knowledge base (secret cmk) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Critical and reading the key since 2026-09-27: the draft names it NOT CARRIED, except where it sets the instance's kms_key (below). The AWS key does not move, AWS's key per secret has no per-secret counterpart, and the draft sets the kms_key block (referencing the drafted STACKIT key) only when every source of the shared instance is an AWS secret that references that one key — otherwise it names the key NOT CARRIED with the reason; either way a person decides (REVIEW, see the customer-managed key check).
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.

#### Alike steps on 2 resources (aws_secretsmanager_secret) — the setting `secret-value` of {resource} (`MAN/semantic/{resource}/secret-value`)

- Phase: Security
- Who: Security Architect
- When: Timing to be scheduled by the owner
- State: executable: a person can start it now
- Risk: the assessment leaves the critical setting `secret-value` of `{resource}` open (REVIEW: a person decides what the target does for it): the migration of `{resource}` is not complete until this step is done
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The setting `secret-value` of module.retail_app_ecs.aws_secretsmanager_secret.mq (`MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.mq/secret-value`) — {resource} = `module.retail_app_ecs.aws_secretsmanager_secret.mq`
  - What: Supply the value of the secret `module.retail_app_ecs.aws_secretsmanager_secret.mq` (aws_secretsmanager_secret) through the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq: put the JSON object of its key/value pairs in a file outside the package and keep it out of version control, name the file in `STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_MQ`, the sensitive input of that step, and run the step; the value is not set up by hand and the script of the step is what sends it
  - Why: The value of the secret is the document you supply, not something the plan carries: StackToIT never reads it from the source (state, variables, code) and writes it nowhere itself, so this critical setting stays open for a person to decide where the values come from. The plan holds the write as the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq, which sends the document named in `STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_MQ` to the secret at the path STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ names of the drafted Secrets Manager instance, after the migration user the draft creates, and which waits for the opt-in to the Vault-compatible API.
  - Needs: the answer to the decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ (decisions.json): what the STACKIT target does for the critical setting `secret-value`, or the accepted difference
  - Done when: A person decides where the values of the document come from (the same value from a secure source, or a new one: moving is the moment to rotate), supplies it through `STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_MQ`, and the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq has run. The person also names the Vault path the applications read, in `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ`.
- The setting `secret-value` of module.retail_app_ecs.aws_secretsmanager_secret.orders_db (`MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.orders_db/secret-value`) — {resource} = `module.retail_app_ecs.aws_secretsmanager_secret.orders_db`
  - What: Supply the value of the secret `module.retail_app_ecs.aws_secretsmanager_secret.orders_db` (aws_secretsmanager_secret) through the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db: put the JSON object of its key/value pairs in a file outside the package and keep it out of version control, name the file in `STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_ORDERS_DB`, the sensitive input of that step, and run the step; the value is not set up by hand and the script of the step is what sends it
  - Why: The value of the secret is the document you supply, not something the plan carries: StackToIT never reads it from the source (state, variables, code) and writes it nowhere itself, so this critical setting stays open for a person to decide where the values come from. The plan holds the write as the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db, which sends the document named in `STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_ORDERS_DB` to the secret at the path STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB names of the drafted Secrets Manager instance, after the migration user the draft creates, and which waits for the opt-in to the Vault-compatible API.
  - Needs: the answer to the decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB (decisions.json): what the STACKIT target does for the critical setting `secret-value`, or the accepted difference
  - Done when: A person decides where the values of the document come from (the same value from a secure source, or a new one: moving is the moment to rotate), supplies it through `STACKIT_INPUT_SECRET_DOCUMENT_RETAIL_APP_ECS_ORDERS_DB`, and the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db has run. The person also names the Vault path the applications read, in `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB`.

</details>

### `WP-13` — Decide and set the critical settings (data services)

- Owner: Data Architect
- Steps: 4 (4 a person can start now)
- Affected resources: `module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (3 different conditions).

<details>
<summary>The 4 steps of WP-13</summary>

#### Alike steps on 3 resources (aws_dynamodb_table, aws_elasticache_replication_group, aws_rds_cluster) — the review of the open settings of {resource} (`MAN/semantic/{resource}/open-settings-data-architect`)

- Phase: Data services
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to each decision register record (decisions.json): what the STACKIT target does for the setting, or the accepted difference - {needs}
- Done when: every one of the {done when} settings is closed: each is set up on its STACKIT target and checked, or the decision that production does not need it is recorded (the condition of each is stated with its item, and `assurance/critical-semantics.json` says what closes it)
- State: executable: a person can start it now
- Risk: the assessment leaves {risk} is not complete until every one is closed; this step is the one step of them (`assurance/critical-semantics.json` says why each is open)
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The review of the open settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this (`MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-data-architect`) — {resource} = `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
  - What: Review the 2 open critical settings of `module.dependencies.module.catalog_rds.aws_rds_cluster.this` (aws_rds_cluster) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`backup-retention`, `final-snapshot`)
  - Why: The assessment leaves 2 critical settings of `module.dependencies.module.catalog_rds.aws_rds_cluster.this` open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item.
  - Needs ({needs}): `backup-retention` (record DEC-DATA-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS, Data Architect); `final-snapshot` (record DEC-DATA-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS, Data Architect)
  - Done when ({done when}): 2
  - Settings (2, the step is done when every one is closed):
    - `backup-retention` (Data Architect; decision register record DEC-DATA-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: Whether the draft carries this setting is decided by its semantic ledger entry "backup retention", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). A retention not visible statically (a variable) is read by no fact and the draft carries nothing for it: a person compares it with the target's backup retention (REVIEW).
      - Done when: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.
    - `final-snapshot` (Data Architect; decision register record DEC-DATA-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no final snapshot or delete-time backup setting (pinned provider): it is deleted when Terraform destroys it — a person decides how data survives a destroy (export first) — REVIEW.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 2 critical settings of `module.dependencies.module.catalog_rds.aws_rds_cluster.this` open (the draft does not carry them): the migration of `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
- The review of the open settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (`MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-data-architect`) — {resource} = `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
  - What: Review the 2 open critical settings of `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` (aws_elasticache_replication_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`snapshots-off`, `seed-snapshot`)
  - Why: The assessment leaves 2 critical settings of `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item. The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value.
  - Needs ({needs}): `snapshots-off` (record DEC-DATA-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374, Data Architect); `seed-snapshot` (record DEC-DATA-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374, Data Architect)
  - Done when ({done when}): 2
  - Settings (2, the step is done when every one is closed):
    - `snapshots-off` (Data Architect; decision register record DEC-DATA-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. No snapshots in the source; whether a STACKIT Valkey instance takes snapshots by default (parameters.snapshot, not generated) is not documented — REVIEW.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `seed-snapshot` (Data Architect; decision register record DEC-DATA-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The instance is created empty: the data is migrated by a person (RDB export and import, or replication); stackit_valkey_instance and stackit_redis_instance have no snapshot or restore attribute (pinned provider). snapshot_arns is observed for every set value, an empty list included: the draft names snapshot_arns NOT CARRIED even when it is empty; a conditional with a null branch stays undecided, hence REVIEW.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 2 critical settings of `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` open (the draft does not carry them): the migration of `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
- The review of the open settings of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (`MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-data-architect`) — {resource} = `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`
  - What: Review the 3 open critical settings of `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this` (aws_dynamodb_table) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`key-schema`, `point-in-time-recovery`, `ttl`)
  - Why: The assessment leaves 3 critical settings of `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this` open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item. The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value.
  - Needs ({needs}): `key-schema` (record DEC-DATA-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE, Data Architect); `point-in-time-recovery` (record DEC-DATA-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE, Data Architect); `ttl` (record DEC-DATA-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE, Data Architect)
  - Done when ({done when}): 3
  - Settings (3, the step is done when every one is closed):
    - `key-schema` (Data Architect; decision register record DEC-DATA-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The draft names the partition/sort key as the collection's unique index; the data model is rewritten by people.
      - Done when: A person designs the keys and indexes of the replacement collection (partition and sort key, attribute names and types, secondary index keys), because the draft names only the key as the collection's unique index.
    - `point-in-time-recovery` (Data Architect; decision register record DEC-DATA-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. MongoDB Flex has a point-in-time window in hours (options.point_in_time_window_hours); its maximum is not documented in the provider schema. The draft carries no value for it.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `ttl` (Data Architect; decision register record DEC-DATA-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. DynamoDB TTL reads epoch seconds; a MongoDB TTL index expires only BSON dates, so the attribute changes type. The time-to-live check still fires only for enabled = true; the case handler REVIEW covers the other states.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 3 critical settings of `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this` open (the draft does not carry them): the migration of `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`

#### The setting `final-snapshot` of module.dependencies.module.orders_rds.aws_rds_cluster.this (`MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-snapshot`)

- Phase: Data services
- What: Decide what the STACKIT target of `module.dependencies.module.orders_rds.aws_rds_cluster.this` (aws_rds_cluster) does for its critical setting `final-snapshot`, which the draft does not carry, and set it up by hand, or record that production does not need it
- Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no final snapshot or delete-time backup setting (pinned provider): it is deleted when Terraform destroys it — a person decides how data survives a destroy (export first) — REVIEW.
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to the decision register record DEC-DATA-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS (decisions.json): what the STACKIT target does for the critical setting `final-snapshot`, or the accepted difference
- Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
- Source: `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- State: executable: a person can start it now
- Risk: the assessment leaves the critical setting `final-snapshot` of `module.dependencies.module.orders_rds.aws_rds_cluster.this` open (REVIEW: a person decides what the target does for it): the migration of `module.dependencies.module.orders_rds.aws_rds_cluster.this` is not complete until this step is done
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

</details>

### `WP-14` — Decide and set the critical settings (data services)

- Owner: Identity Architect
- Steps: 3 (3 a person can start now)
- Affected resources: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (2 different conditions).

<details>
<summary>The 3 steps of WP-14</summary>

#### The review of the open settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (`MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect`)

- Phase: Data services
- What: Review the 5 open critical settings of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` (aws_opensearch_domain) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`fine-grained-access`, `domain-settings`, `access-and-encryption-settings`, `nbr-aws-opensearch-domain-policy`, `opensearch-domain-policy-resource`)
- Why: The assessment leaves 5 critical settings of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item. The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value.
- Who: Identity Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to each decision register record (decisions.json): what the STACKIT target does for the setting, or the accepted difference - `fine-grained-access` (record DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E, Identity Architect); `domain-settings` (record DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E, Identity Architect); `access-and-encryption-settings` (record DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E, Identity Architect); `nbr-aws-opensearch-domain-policy` (record DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E, Identity Architect); `opensearch-domain-policy-resource` (record DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E, Identity Architect)
- Done when: every one of the 5 settings is closed: each is set up on its STACKIT target and checked, or the decision that production does not need it is recorded (the condition of each is stated with its item, and `assurance/critical-semantics.json` says what closes it)
- Settings (5, the step is done when every one is closed):
  - `fine-grained-access` (Identity Architect; decision register record DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E)
    - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether fine-grained access control, with users, roles and permissions inside the domain, is switched on.
    - Done when: A person re-creates the access rules another way, because fine-grained IAM access has no equivalent on STACKIT OpenSearch, which offers an access list and credentials per instance.
  - `domain-settings` (Identity Architect; decision register record DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E)
    - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_opensearch_instance takes a plan (plan_name: nodes and storage), a version and parameters (sgw_acl, syslog, tls_protocols, tls_ciphers, etc.; pinned provider): the domain's node layout, zone awareness, storage, access policy, endpoint TLS and HTTPS settings, internal user database and log publishing are not generated — a person maps them to the plan and parameters — REVIEW.
    - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - `access-and-encryption-settings` (Identity Architect; decision register record DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E)
    - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The access policy, free-form engine options, fine-grained access switches, encryption at rest and between nodes, the HTTPS and TLS policy of the endpoint and the engine version of the domain, read wherever they are set.
    - Done when: A person maps each setting to the STACKIT OpenSearch instance, which has an access list, TLS protocols and ciphers and a version, but no policy document, no free-form option map and no encryption switch (pinned provider).
  - `nbr-aws-opensearch-domain-policy` (Identity Architect; decision register record DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E)
    - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_opensearch_domain_policy (search access policy) attaches an access policy to this domain, so who may reach and use it is decided by that policy and not by the domain's own settings.
    - Done when: A person reads the policy the neighbour attaches and confirms that the replacing OpenSearch domain lets the same principals act on it, and no more, or that the access is dropped on purpose.
  - `opensearch-domain-policy-resource` (Identity Architect; decision register record DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E)
    - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The domain's resource-based access policy, written as aws_opensearch_domain_policy (a part of the domain), has no counterpart on STACKIT OpenSearch.
    - Done when: A person lists the principals and conditions the policy names, decides how their separation is kept (one instance per trust level, or in the application) and puts the source ranges into sgw_acl.
- Source: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
- State: executable: a person can start it now
- Risk: the assessment leaves 5 critical settings of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` open (the draft does not carry them): the migration of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` is not complete until every one is closed; this step is the one step of them (`assurance/critical-semantics.json` says why each is open)
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### Alike steps on 2 resources (aws_rds_cluster) — the setting `admin-username-not-carried` of {resource} (`MAN/semantic/{resource}/admin-username-not-carried`)

- Phase: Data services
- What: Decide what the STACKIT target of `{resource}` (aws_rds_cluster) does for its critical setting `admin-username-not-carried`, which the draft does not carry, and set it up by hand, or record that production does not need it
- Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The master username is not a literal of a single cluster that PostgreSQL Flex accepts: a name a variable supplies or that is not visible statically (the draft writes the user with a variable that has no default), a name STACKIT reserves (admin and postgres: the draft writes a variable that rejects them), or a repeated cluster (a user per cluster only when every instance is evaluated). A person chooses the administrator's name on the target — REVIEW.
- Who: Identity Architect
- When: Timing to be scheduled by the owner
- Done when: A person creates the administrator on the target with a name the target accepts and confirms the application connects with it.
- State: executable: a person can start it now
- Risk: the assessment leaves the critical setting `admin-username-not-carried` of `{resource}` open (REVIEW: a person decides what the target does for it): the migration of `{resource}` is not complete until this step is done
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The setting `admin-username-not-carried` of module.dependencies.module.catalog_rds.aws_rds_cluster.this (`MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/admin-username-not-carried`) — {resource} = `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
  - Needs: the answer to the decision register record DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS (decisions.json): what the STACKIT target does for the critical setting `admin-username-not-carried`, or the accepted difference
- The setting `admin-username-not-carried` of module.dependencies.module.orders_rds.aws_rds_cluster.this (`MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/admin-username-not-carried`) — {resource} = `module.dependencies.module.orders_rds.aws_rds_cluster.this`
  - Needs: the answer to the decision register record DEC-IAM-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS (decisions.json): what the STACKIT target does for the critical setting `admin-username-not-carried`, or the accepted difference

</details>

### `WP-15` — Decide and set the critical settings (data services)

- Owner: Network Architect
- Steps: 4 (4 a person can start now)
- Affected resources: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (3 different conditions).

<details>
<summary>The 4 steps of WP-15</summary>

#### Alike steps on 3 resources (aws_opensearch_domain, aws_rds_cluster) — the review of the open settings of {resource} (`MAN/semantic/{resource}/open-settings-network-architect`)

- Phase: Data services
- Why: The assessment leaves {why} open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item. The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value.
- Who: Network Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to each decision register record (decisions.json): what the STACKIT target does for the setting, or the accepted difference - {needs}
- Done when: every one of the {done when} settings is closed: each is set up on its STACKIT target and checked, or the decision that production does not need it is recorded (the condition of each is stated with its item, and `assurance/critical-semantics.json` says what closes it)
- State: executable: a person can start it now
- Risk: the assessment leaves {risk} is not complete until every one is closed; this step is the one step of them (`assurance/critical-semantics.json` says why each is open)
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The review of the open settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (`MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-network-architect`) — {resource} = `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
  - What: Review the 2 open critical settings of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` (aws_opensearch_domain) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`private-endpoint`, `network-settings`)
  - Why ({why}): 2 critical settings of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
  - Needs ({needs}): `private-endpoint` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E, Network Architect); `network-settings` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E, Network Architect)
  - Done when ({done when}): 2
  - Settings (2, the step is done when every one is closed):
    - `private-endpoint` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether the domain lives inside a VPC, with subnets and security groups, instead of behind a public endpoint.
      - Done when: A person translates the networks that may reach the domain into the access list (a list of CIDR ranges) of the STACKIT OpenSearch instance, which has no network or subnet input (pinned provider).
    - `network-settings` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The VPC placement of the domain (subnet and security group ids, IP address type), read where it is set whatever its value. stackit_opensearch_instance has no network or subnet input; its access control is parameters.sgw_acl, a CIDR list (pinned provider) - REVIEW: a person translates the reachable networks into sgw_acl.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 2 critical settings of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` open (the draft does not carry them): the migration of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
- The review of the open settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this (`MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-network-architect`) — {resource} = `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
  - What: Review the 3 open critical settings of `module.dependencies.module.catalog_rds.aws_rds_cluster.this` (aws_rds_cluster) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`db-network-placement`, `security-groups`, `member-settings`)
  - Why ({why}): 3 critical settings of `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
  - Needs ({needs}): `db-network-placement` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS, Network Architect); `security-groups` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS, Network Architect); `member-settings` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS, Network Architect)
  - Done when ({done when}): 3
  - Settings (3, the step is done when every one is closed):
    - `db-network-placement` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no subnet, availability-zone or IP-family attribute (pinned provider): clients reach it at the endpoint STACKIT assigns, restricted by its ACL — a person decides how clients reach it — REVIEW.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `security-groups` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT database instances have no security groups: access is a CIDR ACL (network.acl, pinned provider); the draft's ACL variable defaults to the CIDRs of the groups' ingress rules where visible, and group-to-group rules cannot be expressed — a person checks the ACL — REVIEW.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `member-settings` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Cluster members are not separate STACKIT resources (the flavor defines the nodes, pinned provider): a member's failover priority, parameter group, subnet group, zone, CA certificate and Performance Insights key have no attribute — a person decides what the nodes need — REVIEW.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 3 critical settings of `module.dependencies.module.catalog_rds.aws_rds_cluster.this` open (the draft does not carry them): the migration of `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
- The review of the open settings of module.dependencies.module.orders_rds.aws_rds_cluster.this (`MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-network-architect`) — {resource} = `module.dependencies.module.orders_rds.aws_rds_cluster.this`
  - What: Review the 3 open critical settings of `module.dependencies.module.orders_rds.aws_rds_cluster.this` (aws_rds_cluster) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`db-network-placement`, `security-groups`, `member-settings`)
  - Why ({why}): 3 critical settings of `module.dependencies.module.orders_rds.aws_rds_cluster.this`
  - Needs ({needs}): `db-network-placement` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS, Network Architect); `security-groups` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS, Network Architect); `member-settings` (record DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS, Network Architect)
  - Done when ({done when}): 3
  - Settings (3, the step is done when every one is closed):
    - `db-network-placement` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no subnet, availability-zone or IP-family attribute (pinned provider): clients reach it at the endpoint STACKIT assigns, restricted by its ACL — a person decides how clients reach it — REVIEW.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `security-groups` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT database instances have no security groups: access is a CIDR ACL (network.acl, pinned provider); the draft's ACL variable defaults to the CIDRs of the groups' ingress rules where visible, and group-to-group rules cannot be expressed — a person checks the ACL — REVIEW.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `member-settings` (Network Architect; decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Cluster members are not separate STACKIT resources (the flavor defines the nodes, pinned provider): a member's failover priority, parameter group, subnet group, zone, CA certificate and Performance Insights key have no attribute — a person decides what the nodes need — REVIEW.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 3 critical settings of `module.dependencies.module.orders_rds.aws_rds_cluster.this` open (the draft does not carry them): the migration of `module.dependencies.module.orders_rds.aws_rds_cluster.this`

#### The setting `network-placement` of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (`MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/network-placement`)

- Phase: Data services
- What: Decide what the STACKIT target of `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` (aws_elasticache_replication_group) does for its critical setting `network-placement`, which the draft does not carry, and set it up by hand, or record that production does not need it
- Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_valkey_instance has no subnet, security-group, zone or IP-family attribute; client access can be limited by CIDR with parameters.sgw_acl, which the draft does not generate — a person decides it.
- Who: Network Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to the decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374 (decisions.json): what the STACKIT target does for the critical setting `network-placement`, or the accepted difference
- Done when: A person decides how clients reach the Valkey instance, which has no subnet or security-group setting, for example by limiting client CIDR ranges with its access parameter.
- Source: `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
- State: executable: a person can start it now
- Risk: the assessment leaves the critical setting `network-placement` of `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` open (REVIEW: a person decides what the target does for it): the migration of `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` is not complete until this step is done
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

</details>

### `WP-16` — Decide and set the critical settings (data services)

- Owner: Platform Architect
- Steps: 5 (5 a person can start now)
- Affected resources: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (4 different conditions).

<details>
<summary>The 5 steps of WP-16</summary>

#### Alike steps on 4 resources (aws_dynamodb_table, aws_elasticache_replication_group, aws_opensearch_domain and 1 more kind) — the review of the open settings of {resource} (`MAN/semantic/{resource}/open-settings-platform-architect`)

- Phase: Data services
- Who: Platform Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to each decision register record (decisions.json): what the STACKIT target does for the setting, or the accepted difference - {needs}
- Done when: every one of the {done when} settings is closed: each is set up on its STACKIT target and checked, or the decision that production does not need it is recorded (the condition of each is stated with its item, and `assurance/critical-semantics.json` says what closes it)
- State: executable: a person can start it now
- Risk: the assessment leaves {risk} is not complete until every one is closed; this step is the one step of them (`assurance/critical-semantics.json` says why each is open)
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The review of the open settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (`MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect`) — {resource} = `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
  - What: Review the 4 open critical settings of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` (aws_opensearch_domain) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`engine-version`, `cluster-layout-settings`, `storage-settings`, `tc-opensearch-domain-domain-name`)
  - Why: The assessment leaves 4 critical settings of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item. The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value.
  - Needs ({needs}): `engine-version` (record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E, Platform Architect); `cluster-layout-settings` (record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E, Platform Architect); `storage-settings` (record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E, Platform Architect); `tc-opensearch-domain-domain-name` (record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E, Platform Architect)
  - Done when ({done when}): 4
  - Settings (4, the step is done when every one is closed):
    - `engine-version` (Platform Architect; decision register record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states which engine and version the OpenSearch domain runs: OpenSearch or legacy Elasticsearch, with its version number.
      - Done when: A person chooses the version of the STACKIT OpenSearch instance, which has a version setting (pinned provider), and checks that the domain's clients work with it.
    - `cluster-layout-settings` (Platform Architect; decision register record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Every node-layout setting of the domain, read where it is set whatever its value (on, off, empty, a variable, a reference, a block written as an attribute object): instance count, dedicated masters, warm and cold storage, zone awareness and its zone count, multi-AZ with standby and the deployment strategy. A stackit_opensearch_instance takes a plan (plan_name) that fixes nodes, topology and storage, no zone-awareness or tier setting (pinned provider, the provider documentation of opensearch_instance) - REVIEW: a person picks the plan that matches the layout.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `storage-settings` (Platform Architect; decision register record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether the data nodes use EBS volumes, read where it is set whatever its value. Storage of a stackit_opensearch_instance is defined by its plan (pinned provider, the provider documentation of opensearch_instance): no EBS switch - REVIEW: a person picks a plan whose disk fits the index size.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `tc-opensearch-domain-domain-name` (Platform Architect; decision register record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_opensearch_domain.domain_name: Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). No semantic of this family has verified it as carried.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 4 critical settings of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` open (the draft does not carry them): the migration of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
- The review of the open settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this (`MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect`) — {resource} = `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
  - What: Review the 5 open critical settings of `module.dependencies.module.catalog_rds.aws_rds_cluster.this` (aws_rds_cluster) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`engine`, `engine-version`, `member-engine`, `tc-database-name`, `tcf-rds-cluster-instance--identifier`)
  - Why: The assessment leaves 5 critical settings of `module.dependencies.module.catalog_rds.aws_rds_cluster.this` open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item. The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value.
  - Needs ({needs}): `engine` (record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS, Platform Architect); `engine-version` (record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS, Platform Architect); `member-engine` (record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS, Platform Architect); `tc-database-name` (record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS, Platform Architect); `tcf-rds-cluster-instance--identifier` (record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS, Platform Architect)
  - Done when ({done when}): 5
  - Settings (5, the step is done when every one is closed):
    - `engine` (Platform Architect; decision register record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The database engine of the cluster (Aurora PostgreSQL, Aurora MySQL, or a Multi-AZ cluster on PostgreSQL or MySQL), which decides the STACKIT database service it lands on.
      - Done when: For a MySQL-compatible cluster a person tests the schemas and queries on STACKIT MariaDB, the closest managed engine, because STACKIT has no MySQL product; for a PostgreSQL cluster, which lands on PostgreSQL Flex, a person confirms that no Aurora-only feature (storage auto-scaling, fast clones, global databases, serverless v2 scaling) is relied on.
    - `engine-version` (Platform Architect; decision register record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The version of the database engine that the cluster runs.
      - Done when: For a PostgreSQL cluster a person picks a major version that PostgreSQL Flex offers (14 to 18; 18 is beta in eu01, so production needs 17 or a generally available 18) and plans an upgrade for any other version. For a MySQL-compatible cluster a person tests the MySQL 8 features in use on STACKIT MariaDB.
    - `member-engine` (Platform Architect; decision register record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Cluster members must run the cluster's engine and version (AWS), which the draft follows (TODO when a member states another): the members' engine and version are what the cluster's engine and the engine version setting decide — TRANSFORMED/PRESERVED for a supported PostgreSQL version, REVIEW otherwise.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `tc-database-name` (Platform Architect; decision register record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster.database_name: Name of the initial database created in the cluster; application setup. No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract).
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `tcf-rds-cluster-instance--identifier` (Platform Architect; decision register record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster_instance.identifier (a facet of the unit): Name of the instance; it identifies the resource and changes no access, encryption, backup or availability behaviour. No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract).
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 5 critical settings of `module.dependencies.module.catalog_rds.aws_rds_cluster.this` open (the draft does not carry them): the migration of `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
- The review of the open settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (`MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect`) — {resource} = `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
  - What: Review the 4 open critical settings of `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` (aws_elasticache_replication_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`parameter-group`, `parameter-group-default`, `failover-off`, `tc-elasticache-replication-group-replication-group-id`)
  - Why: The assessment leaves 4 critical settings of `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item.
  - Needs ({needs}): `parameter-group` (record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374, Platform Architect); `parameter-group-default` (record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374, Platform Architect); `failover-off` (record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374, Platform Architect); `tc-elasticache-replication-group-replication-group-id` (record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374, Platform Architect)
  - Done when ({done when}): 4
  - Settings (4, the step is done when every one is closed):
    - `parameter-group` (Platform Architect; decision register record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374)
      - Why: A check of the knowledge base (redis parameter group) needs a value the scan cannot read statically, so it could not decide. The setting states which custom set of engine parameters (a parameter group) the cache runs with.
      - Done when: A literal value or a resolved reference in the source lets the check decide, or a person verifies the value.
    - `parameter-group-default` (Platform Architect; decision register record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A parameter group named default.\<family> carries the AWS default settings of that engine family and version, and its name can carry the topology: a group with cluster.on in its name enables cluster mode.
      - Done when: A person confirms that the defaults of the source parameter group family are what the application needs on the target and, for a cluster-mode group, treats it as the cluster-mode question.
    - `failover-off` (Platform Architect; decision register record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A single node without failover: the draft asks for the plan (plan_name is a variable), so whether the target is a Single plan is a person's choice — REVIEW, not PRESERVED.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `tc-elasticache-replication-group-replication-group-id` (Platform Architect; decision register record DEC-OPS-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The identifier of the cache replication group. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract).
      - Done when: A person confirms the instance name the target uses against what refers to the replication group id, or accepts the new name.
  - Risk ({risk}): 4 critical settings of `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` open (the draft does not carry them): the migration of `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
- The review of the open settings of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (`MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-platform-architect`) — {resource} = `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`
  - What: Review the 2 open critical settings of `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this` (aws_dynamodb_table) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`index-projection-and-name`, `tc-dynamodb-table-name`)
  - Why: The assessment leaves 2 critical settings of `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this` open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item. The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value.
  - Needs ({needs}): `index-projection-and-name` (record DEC-OPS-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE, Platform Architect); `tc-dynamodb-table-name` (record DEC-OPS-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE, Platform Architect)
  - Done when ({done when}): 2
  - Settings (2, the step is done when every one is closed):
    - `index-projection-and-name` (Platform Architect; decision register record DEC-OPS-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The projection of a secondary index (keys only, INCLUDE with its non_key_attributes, ALL) decides which attributes an index query can return, and the index name is what every Query / Scan on the index selects it by (API Query IndexName). STACKIT has no provider resource for an index (pinned provider), a person re-creates the indexes and the queries that name them in the chosen engine — REVIEW.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `tc-dynamodb-table-name` (Platform Architect; decision register record DEC-OPS-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_dynamodb_table.name: Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). No semantic of this family has verified it as carried.
      - Done when: A person confirms the name the replacement collection carries on the target against what refers to the source name, or accepts the new name.
  - Risk ({risk}): 2 critical settings of `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this` open (the draft does not carry them): the migration of `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`

#### The setting "identifier of the RDS cluster instance" of module.dependencies.module.orders_rds.aws_rds_cluster.this (`MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/tcf-rds-cluster-instance--identifier`)

- Phase: Data services
- What: Decide what the STACKIT target of `module.dependencies.module.orders_rds.aws_rds_cluster.this` (aws_rds_cluster) does for its critical setting `tcf-rds-cluster-instance--identifier`, which the draft does not carry, and set it up by hand, or record that production does not need it
- Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster_instance.identifier (a facet of the unit): Name of the instance; it identifies the resource and changes no access, encryption, backup or availability behaviour. No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract).
- Who: Platform Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to the decision register record DEC-OPS-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS (decisions.json): what the STACKIT target does for the critical setting `tcf-rds-cluster-instance--identifier`, or the accepted difference
- Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
- Source: `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- State: executable: a person can start it now
- Risk: the assessment leaves the critical setting `tcf-rds-cluster-instance--identifier` of `module.dependencies.module.orders_rds.aws_rds_cluster.this` open (REVIEW: a person decides what the target does for it): the migration of `module.dependencies.module.orders_rds.aws_rds_cluster.this` is not complete until this step is done
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

</details>

### `WP-17` — Decide and set the critical settings (data services)

- Owner: Security Architect
- Steps: 5 (5 a person can start now)
- Affected resources: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (4 different conditions).

<details>
<summary>The 5 steps of WP-17</summary>

#### Alike steps on 2 resources (aws_dynamodb_table, aws_opensearch_domain) — the setting `encryption-at-rest` of {resource} (`MAN/semantic/{resource}/encryption-at-rest`)

- Phase: Data services
- Who: Security Architect
- When: Timing to be scheduled by the owner
- State: executable: a person can start it now
- Risk: the assessment leaves the critical setting `encryption-at-rest` of `{resource}` open (REVIEW: a person decides what the target does for it): the migration of `{resource}` is not complete until this step is done
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The setting `encryption-at-rest` of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (`MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/encryption-at-rest`) — {resource} = `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
  - What: Decide what the STACKIT target of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` (aws_opensearch_domain) does for its critical setting `encryption-at-rest`, which the draft does not carry, and set it up by hand, or record that production does not need it
  - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether the data the domain stores is encrypted at rest.
  - Needs: the answer to the decision register record DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E (decisions.json): what the STACKIT target does for the critical setting `encryption-at-rest`, or the accepted difference
  - Done when: A person confirms the encryption of the STACKIT OpenSearch instance on the target; the instance has no encryption setting (pinned provider), and no STACKIT fact about it is documented here.
- The setting `encryption-at-rest` of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (`MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/encryption-at-rest`) — {resource} = `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`
  - What: Decide what the STACKIT target of `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this` (aws_dynamodb_table) does for its critical setting `encryption-at-rest`, which the draft does not carry, and set it up by hand, or record that production does not need it
  - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. It is not stated in stackit_mongodbflex_instance (no encryption attribute) whether STACKIT MongoDB Flex encrypts data at rest: REVIEW (the customer managed key setting reads the key).
  - Needs: the answer to the decision register record DEC-SEC-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE (decisions.json): what the STACKIT target does for the critical setting `encryption-at-rest`, or the accepted difference
  - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.

#### Alike steps on 3 resources (aws_elasticache_replication_group, aws_rds_cluster) — the review of the open settings of {resource} (`MAN/semantic/{resource}/open-settings-security-architect`)

- Phase: Data services
- Who: Security Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to each decision register record (decisions.json): what the STACKIT target does for the setting, or the accepted difference - {needs}
- Done when: every one of the {done when} settings is closed: each is set up on its STACKIT target and checked, or the decision that production does not need it is recorded (the condition of each is stated with its item, and `assurance/critical-semantics.json` says what closes it)
- State: executable: a person can start it now
- Risk: the assessment leaves {risk} is not complete until every one is closed; this step is the one step of them (`assurance/critical-semantics.json` says why each is open)
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The review of the open settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this (`MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect`) — {resource} = `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
  - What: Review the 3 open critical settings of `module.dependencies.module.catalog_rds.aws_rds_cluster.this` (aws_rds_cluster) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`storage-encryption`, `admin-password`, `parameter-and-option-groups`)
  - Why: The assessment leaves 3 critical settings of `module.dependencies.module.catalog_rds.aws_rds_cluster.this` open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item.
  - Needs ({needs}): `storage-encryption` (record DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS, Security Architect); `admin-password` (record DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS, Security Architect); `parameter-and-option-groups` (record DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS, Security Architect)
  - Done when ({done when}): 3
  - Settings (3, the step is done when every one is closed):
    - `storage-encryption` (Security Architect; decision register record DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: A check of the knowledge base (aurora storage encrypted mariadb) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states whether the storage of the database cluster is encrypted at rest, with the AWS-managed key because no customer key is named.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person confirms the at-rest encryption of the target database on STACKIT: the PostgreSQL Flex encryption block covers customer keys only and the default without it is not stated, and a MariaDB sandbox instance had database-level encryption off, so whether its volumes are encrypted is not stated (pinned provider).
    - `admin-password` (Security Architect; decision register record DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The source password (or its Secrets Manager management) is never copied, and no STACKIT database user takes a password: stackit_postgresflex_user and stackit_mariadb_credential compute it (password is computed and sensitive, pinned provider) and the create-user API of PostgreSQL Flex has no password field.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `parameter-and-option-groups` (Security Architect; decision register record DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no parameter-group or option-group attribute (pinned provider): the group's settings (even a default.* group of the source engine) must be mapped to the STACKIT instance's options by a person — REVIEW.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 3 critical settings of `module.dependencies.module.catalog_rds.aws_rds_cluster.this` open (the draft does not carry them): the migration of `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
- The review of the open settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (`MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-security-architect`) — {resource} = `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
  - What: Review the 2 open critical settings of `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` (aws_elasticache_replication_group) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`at-rest-encryption-off`, `tcp-elasticache-replication-group-transit-encryption-enabled`)
  - Why: The assessment leaves 2 critical settings of `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item. The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value.
  - Needs ({needs}): `at-rest-encryption-off` (record DEC-SEC-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374, Security Architect); `tcp-elasticache-replication-group-transit-encryption-enabled` (record DEC-SEC-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374, Security Architect)
  - Done when ({done when}): 2
  - Settings (2, the step is done when every one is closed):
    - `at-rest-encryption-off` (Security Architect; decision register record DEC-SEC-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. No at-rest encryption in the source; stackit_valkey_instance states nothing about at-rest encryption (pinned provider) — REVIEW, not PRESERVED.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `tcp-elasticache-replication-group-transit-encryption-enabled` (Security Architect; decision register record DEC-SEC-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_elasticache_replication_group.transit_encryption_enabled: Encryption in transit (TLS) between clients and the cache; losing it sends data and AUTH in clear. Held CRITICAL: it decides whether and with which key data or metadata is encrypted; dropping it silently could leave data unencrypted on the target.
      - Done when: A person confirms that clients reach the cache over TLS on the target, so that data and the authentication token are not sent in clear.
  - Risk ({risk}): 2 critical settings of `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` open (the draft does not carry them): the migration of `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
- The review of the open settings of module.dependencies.module.orders_rds.aws_rds_cluster.this (`MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect`) — {resource} = `module.dependencies.module.orders_rds.aws_rds_cluster.this`
  - What: Review the 3 open critical settings of `module.dependencies.module.orders_rds.aws_rds_cluster.this` (aws_rds_cluster) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`storage-encryption`, `admin-password`, `parameter-and-option-groups`)
  - Why: The assessment leaves 3 critical settings of `module.dependencies.module.orders_rds.aws_rds_cluster.this` open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item.
  - Needs ({needs}): `storage-encryption` (record DEC-SEC-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS, Security Architect); `admin-password` (record DEC-SEC-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS, Security Architect); `parameter-and-option-groups` (record DEC-SEC-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS, Security Architect)
  - Done when ({done when}): 3
  - Settings (3, the step is done when every one is closed):
    - `storage-encryption` (Security Architect; decision register record DEC-SEC-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: A check of the knowledge base (aurora storage encrypted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states whether the storage of the database cluster is encrypted at rest, with the AWS-managed key because no customer key is named.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person confirms the at-rest encryption of the target database on STACKIT: the PostgreSQL Flex encryption block covers customer keys only and the default without it is not stated, and a MariaDB sandbox instance had database-level encryption off, so whether its volumes are encrypted is not stated (pinned provider).
    - `admin-password` (Security Architect; decision register record DEC-SEC-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The source password (or its Secrets Manager management) is never copied, and no STACKIT database user takes a password: stackit_postgresflex_user and stackit_mariadb_credential compute it (password is computed and sensitive, pinned provider) and the create-user API of PostgreSQL Flex has no password field.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `parameter-and-option-groups` (Security Architect; decision register record DEC-SEC-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no parameter-group or option-group attribute (pinned provider): the group's settings (even a default.* group of the source engine) must be mapped to the STACKIT instance's options by a person — REVIEW.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 3 critical settings of `module.dependencies.module.orders_rds.aws_rds_cluster.this` open (the draft does not carry them): the migration of `module.dependencies.module.orders_rds.aws_rds_cluster.this`

</details>

### `WP-18` — Move the data and the objects to the target

- Owner: Data Architect
- Steps: 2 (1 a person can start now, 1 waits for a manual prerequisite)
- Affected resources: `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (2 different conditions).

<details>
<summary>The 2 steps of WP-18</summary>

#### The data preflight of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (`MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/preflight`)

- Phase: Data services
- What: Close what the plan lists as UNKNOWN, from the move host, with read-only commands; no password goes on a command line or into the history of the shell. Source (`valkey-cli -h \<source-host> -p \<source-port> --tls`, without --tls where the source has none): `INFO server` (the engine and its version), `INFO keyspace` and `DBSIZE` (the keys and the keys with an expiry; on every primary when cluster mode is on, listed with `CLUSTER NODES`), `INFO memory` (used_memory and maxmemory), `SCAN 0 COUNT 100` with `TYPE`, `DUMP` and `PTTL` of a few keys of each family (the commands of the copy; the types the copy has no branch for show here), and the credential the copy signs in with. Target (after the draft is applied and the instance and a service key exist; `valkey-cli -u rediss://\<target-user>@\<target-host>:\<target-port> --tls --sni \<target-host>`): `INFO server` (Valkey 8), `DBSIZE` (0) and `INFO memory`; do not expect `CONFIG`, `ACL` or `MODULE`, which a probe found denied to the service key. Check that the move host is in `parameters.sgw_acl` of the instance (remove it afterwards), reaches both ends, and that the clients of the cache are listed with the TLS and the credential each uses. Runbook section: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#preflight`.
- Why: the checks of the plan that are UNKNOWN are closed by these commands before any key moves
- Document: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md`
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the checks that are UNKNOWN and what closes each: target-memory (closed by: preflight on the source: INFO memory (used_memory, maxmemory) on every primary and the customer's statement of source.dataset.size; the plan_name the customer chooses must offer more RAM per node than the dataset needs, with the headroom the engine's own overhead and the replication buffers take); source-commands (closed by: preflight on the source: run SCAN 0 COUNT 10, DUMP and PTTL of one key and DBSIZE with the credential the copy uses; on the target RESTORE of that key with a TTL, then DEL); source-access (closed by: preflight from the move host: valkey-cli to the source endpoint (with --tls where the source has TLS) and PING, then INFO server); credentials (closed by: the application owners state which user and which commands each client needs; the credential stackit_valkey_credential.dependencies_checkout_elasticache_redis_default is written by the draft, its password is read from the sensitive output after the apply and handed to the clients by the way the customer's secrets are managed); state-or-rebuildable (closed by: the owner of the applications that use the cache states, for each key family, whether it can be lost; a cache that can start empty needs no copy and the decision of the move is answered with the customer's own tool); target-access (closed by: preflight from the move host after the instance exists: valkey-cli --tls to the target with a service key: INFO server, DBSIZE (0), INFO memory (maxmemory), and the move host's address in the access list for the time of the move); the open fields of the move:
  - (1) copy volume: UNKNOWN — supplied by Data Architect (the amount of data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default to copy: the used space measured on the source; the provisioned capacity of the source is not the amount of data; closed when the measured amount and the date of the measurement are recorded)
  - (2) change rate: UNKNOWN — supplied by Data Architect (how much data the writers of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default change per hour; closed when the rate measured over a representative period is recorded, with the time a final pass needs at that rate)
  - (3) write-freeze window: UNKNOWN — supplied by Data Architect (the window in which the writers of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default stop for the final pass; closed when the owner of the application agrees the start and the end of the window and it is recorded)
  - (4) last sync: UNKNOWN — supplied by Data Architect (the time the final pass ends and its checks hold; closed when the time of the final pass and the result of its checks are recorded)
  - (5) return point: UNKNOWN — supplied by Data Architect (the state of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default the migration returns to on a rollback: the source as it was at the write freeze, or a named snapshot or backup; closed when the return point is recorded with its time and how it is restored)
  - the checks of the copy:
  - (1) consistency check: UNKNOWN — supplied by Data Architect (how the copy of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is shown complete and unchanged after the final pass: the used space and a checksum of the data (of the files, or the row counts of the tables) agree with the source; closed when the method is agreed and its result after the final pass is recorded)
  - (2) validation on the target: UNKNOWN — supplied by Migration Owner (the test the application that uses module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default passes on STACKIT with the copied data before the cutover, agreed with the owner of the application; closed when the test passes on the target and its result is recorded)
- Done when: every UNKNOWN check of the plan is HOLDS or FAILS; the engine version, the number of keys and their memory, the types of the keys and the shards of the source are known, and the clients of the cache are listed
- Source: `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
- After: the OpenTofu step for stackit_valkey_credential.dependencies_checkout_elasticache_redis_default, the OpenTofu step for stackit_valkey_instance.dependencies_checkout_elasticache_redis_default
- State: executable: a person can start it now
- Risk: the move host in the access list is a hole until it is removed at cleanup
- Risk: a password typed on a command line stays in the history of the shell
- Risk: check client-tls FAILS: the source states transit_encryption_enabled = false: its clients connect without TLS, and the Key Value Store closes a plaintext connection (a test on 2026-09-24) and accepts TLS only, so every client switches to TLS (rediss://, the driver's TLS option, the instance's certificate authority) before the cutover; the switch is a change of the applications, which this plan cannot make
- Rollback (manual): nothing changed on either side: read-only commands and, on the target, an empty instance. The way back:
  - (1) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is kept is recorded)
  - (2) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
  - (3) data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

#### The data rehearsal of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (`MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/rehearsal`)

- Phase: Data services
- What: Rehearse the copy on a sample into a scratch Key Value Store instance of the same plan and version as the draft's instance (a second instance, deleted afterwards: the real instance must stay empty for the final copy): copy the keys of a prefix or a few thousand keys of every family with the client of the copy (`SCAN` with `MATCH`, `DUMP`, `PTTL`, `RESTORE` with the remaining time to live), note the keys a second, the bytes a second and the keys RESTORE refuses, point one copy of the application at the scratch instance with TLS and run its own test suite, and compute the freeze window from the throughput: keys / (keys a second) is the lower bound of the copy. Delete the scratch instance afterwards. Runbook section: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#rehearsal`.
- Why: the transfer lower bound leaves out the round trip of every key and the throughput into a Key Value Store is not verified; only a rehearsal measures them and shows which keys the target refuses
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the customer's statements in inputs.yaml: source.dataset.size, source.dataset.bandwidth
- Done when: the keys a second and the refused keys are recorded, the application's tests pass against the scratch instance over TLS, and the write-freeze window is agreed from them
- Source: `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
- After: the data preflight of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default
- State: executable once its manual prerequisite is done: it waits for the data preflight of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, a manual prerequisite
- Risk: a scratch instance is billed while it exists
- Rollback (manual): delete the scratch instance; the draft's instance and the source are untouched

</details>

### `WP-19` — Set up the log delivery and its labels (platform services)

- Owner: Platform Architect
- Steps: 3 (1 a person can start now, 1 waits for a manual prerequisite, 1 requires a design decision)
- Affected resources: `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks`
- Target: `stackit_logs_instance.logs_retention_180d`
- Rests on: `DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS`
- Waits for: `DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS`
- State: waits for decisions (1 of 3 steps)
- Done when: each step meets the condition stated with it below (3 different conditions).

<details>
<summary>The 3 steps of WP-19</summary>

#### The step "Configure a cold-storage log flow for…" (`MAN/logs/archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks`)

- Phase: Platform services
- What: Configure a cold-storage log flow for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: send a copy of its logs, in parallel to the Logs instance stackit_logs_instance.logs_retention_180d, to a long-term store (for example a separate Object Storage bucket) that keeps them for the retention beyond 180 days
- Why: the source keeps its logs for ever and a STACKIT Logs instance keeps at most 180 days (retention beyond 180 days is not supported by the managed service): the first 180 days are kept in the Logs instance, and the longer retention is an archive outside it, which STACKIT recommends as a cold-storage approach (a stream of the log data to a low-cost long-term store in parallel to Logs). The plan creates no archive store, configures no stream and sets no retention of the archive. The step exists only when the decision about the logs beyond 180 days chooses the archive; where the requirement is more than 180 days inside STACKIT Logs with no external archive, the archive is rejected and the migration cannot meet that requirement with STACKIT Logs alone
- Who: Platform Architect
- When: cutover prerequisite
- Needs: where the archive is kept (for example an Object Storage bucket) and the retention in days the workload needs there (the source keeps its logs for ever)
- Done when: a line the log producers of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks send is found both in the Logs instance and in the archive, and logs older than 180 days are readable from the archive
- Source: `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks`
- After: the OpenTofu step for stackit_logs_instance.logs_retention_180d
- State: not executable — requires a design decision — blocked by `DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS`; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS is answered: it is of the path archive-longer-retention-elsewhere of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks, not of a path the draft carries out by default
- Rollback (available): stop the stream to the archive and delete the archive store; the Logs instance and the logs in it are not changed

#### The step "Before any log source writes to stackit_logs_instance.logs_retention_180d" (`MAN/logs/token:stackit_logs_instance.logs_retention_180d`)

- Phase: Platform services
- What: Before any log source writes to stackit_logs_instance.logs_retention_180d: create a write access token for the instance (stackit_logs_access_token with the permission write), set the access control list of the instance, and point the shipper at the instance's ingest_url (Loki API) or ingest_otlp_url (OpenTelemetry)
- Why: the plan generates no access token: the token is a credential written to the state, its lifetime (unset, it never expires) and its permissions are choices the source does not state, and one token belongs to one instance; what an instance with no ACL entry allows is not established, so the plan sets no ACL and states no default
- Who: Platform Architect
- When: cutover prerequisite
- Needs: No input is named for this step
- Done when: a write access token for stackit_logs_instance.logs_retention_180d exists, the access control list of the instance is set, and a log line sent with the token to the ingest address of the instance is accepted
- Source: `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks`
- Target: `stackit_logs_instance.logs_retention_180d`
- After: the OpenTofu step for stackit_logs_instance.logs_retention_180d
- State: executable: a person can start it now
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### The step "Choose a static label and send the name of…" (`MAN/logs/label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks`)

- Phase: Platform services
- What: Choose a static label and send the name of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (and of its streams) from its log producers as the value of that label
- Why: STACKIT Logs has no log group or stream object that can hold a name, only labels the shipper sends (no-log-group-or-stream-object); the plan chooses no label key and reconfigures no producer
- Who: Platform Architect
- When: cutover prerequisite
- Needs: No input is named for this step
- Done when: a static label is chosen, the log producers of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks send its name as the value of that label, and a line one of them sends is found by that label
- Source: `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks`
- After: the step "Before any log source writes to stackit_logs_instance.logs_retention_180d", the OpenTofu step for stackit_logs_instance.logs_retention_180d
- State: executable once its manual prerequisite is done: it waits for the step "Before any log source writes to stackit_logs_instance.logs_retention_180d", a manual prerequisite
- Risk: this step is the one step of 1 critical setting of `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks` that the assessment leaves open and the draft does not carry: `tc-name`; no other manual or refused step stands for it, and the answer to the decision register record DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-CLOUDWATCH-LOG-GROUP-ECS-TASKS (decisions.json) is recorded with it (`assurance/critical-semantics.json` says why each is open)
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

</details>

### `WP-20` — Decide and set the critical settings (platform services)

- Owner: Identity Architect
- Steps: 6 (6 a person can start now)
- Affected resources: `module.dependencies.aws_mq_broker.mq`, `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`, `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`, `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`, `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`, `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (2 different conditions).

<details>
<summary>The 6 steps of WP-20</summary>

#### Alike steps on 6 resources (aws_ecs_service, aws_mq_broker) — the review of the open settings of {resource} (`MAN/semantic/{resource}/open-settings-identity-architect`)

- Phase: Platform services
- Why: The assessment leaves {why} open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item. The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value.
- Who: Identity Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to each decision register record (decisions.json): what the STACKIT target does for the setting, or the accepted difference - {needs}
- Done when: every one of the {done when} settings is closed: each is set up on its STACKIT target and checked, or the decision that production does not need it is recorded (the condition of each is stated with its item, and `assurance/critical-semantics.json` says what closes it)
- State: executable: a person can start it now
- Risk: the assessment leaves {risk} is not complete until every one is closed; this step is the one step of them (`assurance/critical-semantics.json` says why each is open)
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The review of the open settings of module.dependencies.aws_mq_broker.mq (`MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-identity-architect`) — {resource} = `module.dependencies.aws_mq_broker.mq`
  - What: Review the 2 open critical settings of `module.dependencies.aws_mq_broker.mq` (aws_mq_broker) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`broker-users`, `tc-user--username`)
  - Why ({why}): 2 critical settings of `module.dependencies.aws_mq_broker.mq`
  - Needs ({needs}): `broker-users` (record DEC-IAM-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ, Identity Architect); `tc-user--username` (record DEC-IAM-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ, Identity Architect)
  - Done when ({done when}): 2
  - Settings (2, the step is done when every one is closed):
    - `broker-users` (Identity Architect; decision register record DEC-IAM-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Users become stackit_rabbitmq_credential entries with generated passwords; their permissions are set by a person.
      - Done when: A person sets the permissions of each broker user on the generated RabbitMQ credentials and hands the new passwords to the clients.
    - `tc-user--username` (Identity Architect; decision register record DEC-IAM-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_mq_broker.user.username: The broker user's login identity. Held CRITICAL: it decides who or what may use, read or change the resource or the data behind it. No semantic of this family has verified it as carried.
      - Done when: A person confirms the user names the clients log in with; STACKIT generates each RabbitMQ credential's username, so the clients move to the new usernames.
  - Risk ({risk}): 2 critical settings of `module.dependencies.aws_mq_broker.mq` open (the draft does not carry them): the migration of `module.dependencies.aws_mq_broker.mq`
- The review of the open settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-identity-architect`) — {resource} = `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.carts_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`service-task-definition`, `service-execute-command`, `td-execution-role-arn`, `td-task-role-arn`)
  - Why ({why}): 4 critical settings of `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`
  - Needs ({needs}): `service-task-definition` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, Identity Architect); `service-execute-command` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, Identity Architect); `td-execution-role-arn` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, Identity Architect); `td-task-role-arn` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, Identity Architect)
  - Done when ({done when}): 4
  - Settings (4, the step is done when every one is closed):
    - `service-task-definition` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition the service runs (family:revision or ARN) becomes the Deployment's pod template; ecs_service.task_definition names it as a string, the definition itself is a separate resource a person translates.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `service-execute-command` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ECS Exec opens a shell in a running task; kubectl exec (and who may use it through RBAC) is the counterpart and is not part of the draft.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-execution-role-arn` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.execution_role_arn of the template the group builds its instances from: The role ECS uses to pull images and read the secrets it injects into the containers. Not verified as carried by any semantic of this family — reviewed.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-task-role-arn` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.task_role_arn of the template the group builds its instances from: The role the application in the containers acts as towards AWS APIs. Not verified as carried by any semantic of this family — reviewed.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 4 critical settings of `module.retail_app_ecs.module.carts_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`
- The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-identity-architect`) — {resource} = `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`service-task-definition`, `service-execute-command`, `td-execution-role-arn`, `td-task-role-arn`)
  - Why ({why}): 4 critical settings of `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`
  - Needs ({needs}): `service-task-definition` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883, Identity Architect); `service-execute-command` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883, Identity Architect); `td-execution-role-arn` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883, Identity Architect); `td-task-role-arn` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883, Identity Architect)
  - Done when ({done when}): 4
  - Settings (4, the step is done when every one is closed):
    - `service-task-definition` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition the service runs (family:revision or ARN) becomes the Deployment's pod template; ecs_service.task_definition names it as a string, the definition itself is a separate resource a person translates.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `service-execute-command` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ECS Exec opens a shell in a running task; kubectl exec (and who may use it through RBAC) is the counterpart and is not part of the draft.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-execution-role-arn` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.execution_role_arn of the template the group builds its instances from: The role ECS uses to pull images and read the secrets it injects into the containers. Not verified as carried by any semantic of this family — reviewed.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-task-role-arn` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.task_role_arn of the template the group builds its instances from: The role the application in the containers acts as towards AWS APIs. Not verified as carried by any semantic of this family — reviewed.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 4 critical settings of `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`
- The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-identity-architect`) — {resource} = `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`service-task-definition`, `service-execute-command`, `td-execution-role-arn`, `td-task-role-arn`)
  - Why ({why}): 4 critical settings of `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`
  - Needs ({needs}): `service-task-definition` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, Identity Architect); `service-execute-command` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, Identity Architect); `td-execution-role-arn` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, Identity Architect); `td-task-role-arn` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, Identity Architect)
  - Done when ({done when}): 4
  - Settings (4, the step is done when every one is closed):
    - `service-task-definition` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition the service runs (family:revision or ARN) becomes the Deployment's pod template; ecs_service.task_definition names it as a string, the definition itself is a separate resource a person translates.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `service-execute-command` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ECS Exec opens a shell in a running task; kubectl exec (and who may use it through RBAC) is the counterpart and is not part of the draft.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-execution-role-arn` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.execution_role_arn of the template the group builds its instances from: The role ECS uses to pull images and read the secrets it injects into the containers. Not verified as carried by any semantic of this family — reviewed.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-task-role-arn` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.task_role_arn of the template the group builds its instances from: The role the application in the containers acts as towards AWS APIs. Not verified as carried by any semantic of this family — reviewed.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 4 critical settings of `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`
- The review of the open settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-identity-architect`) — {resource} = `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.orders_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`service-task-definition`, `service-execute-command`, `td-execution-role-arn`, `td-task-role-arn`)
  - Why ({why}): 4 critical settings of `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`
  - Needs ({needs}): `service-task-definition` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS, Identity Architect); `service-execute-command` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS, Identity Architect); `td-execution-role-arn` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS, Identity Architect); `td-task-role-arn` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS, Identity Architect)
  - Done when ({done when}): 4
  - Settings (4, the step is done when every one is closed):
    - `service-task-definition` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition the service runs (family:revision or ARN) becomes the Deployment's pod template; ecs_service.task_definition names it as a string, the definition itself is a separate resource a person translates.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `service-execute-command` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ECS Exec opens a shell in a running task; kubectl exec (and who may use it through RBAC) is the counterpart and is not part of the draft.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-execution-role-arn` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.execution_role_arn of the template the group builds its instances from: The role ECS uses to pull images and read the secrets it injects into the containers. Not verified as carried by any semantic of this family — reviewed.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-task-role-arn` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.task_role_arn of the template the group builds its instances from: The role the application in the containers acts as towards AWS APIs. Not verified as carried by any semantic of this family — reviewed.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 4 critical settings of `module.retail_app_ecs.module.orders_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`
- The review of the open settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-identity-architect`) — {resource} = `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.ui_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`service-task-definition`, `service-execute-command`, `td-execution-role-arn`, `td-task-role-arn`)
  - Why ({why}): 4 critical settings of `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
  - Needs ({needs}): `service-task-definition` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS, Identity Architect); `service-execute-command` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS, Identity Architect); `td-execution-role-arn` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS, Identity Architect); `td-task-role-arn` (record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS, Identity Architect)
  - Done when ({done when}): 4
  - Settings (4, the step is done when every one is closed):
    - `service-task-definition` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition the service runs (family:revision or ARN) becomes the Deployment's pod template; ecs_service.task_definition names it as a string, the definition itself is a separate resource a person translates.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `service-execute-command` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ECS Exec opens a shell in a running task; kubectl exec (and who may use it through RBAC) is the counterpart and is not part of the draft.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-execution-role-arn` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.execution_role_arn of the template the group builds its instances from: The role ECS uses to pull images and read the secrets it injects into the containers. Not verified as carried by any semantic of this family — reviewed.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-task-role-arn` (Identity Architect; decision register record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.task_role_arn of the template the group builds its instances from: The role the application in the containers acts as towards AWS APIs. Not verified as carried by any semantic of this family — reviewed.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 4 critical settings of `module.retail_app_ecs.module.ui_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`

</details>

### `WP-21` — Decide and set the critical settings (platform services)

- Owner: Network Architect
- Steps: 7 (7 a person can start now)
- Affected resources: `module.dependencies.aws_mq_broker.mq`, `module.retail_app_ecs.module.alb.aws_lb.this`, `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`, `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`, `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`, `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`, `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (3 different conditions).

<details>
<summary>The 7 steps of WP-21</summary>

#### The setting `broker-network` of module.dependencies.aws_mq_broker.mq (`MAN/semantic/module.dependencies.aws_mq_broker.mq/broker-network`)

- Phase: Platform services
- What: Decide what the STACKIT target of `module.dependencies.aws_mq_broker.mq` (aws_mq_broker) does for its critical setting `broker-network`, which the draft does not carry, and set it up by hand, or record that production does not need it
- Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_rabbitmq_instance has no subnet or security-group attribute (pinned provider): clients reach the instance at the address STACKIT assigns, restricted by parameters.sgw_acl — a person decides the ranges.
- Who: Network Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to the decision register record DEC-NET-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ (decisions.json): what the STACKIT target does for the critical setting `broker-network`, or the accepted difference
- Done when: A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.
- Source: `module.dependencies.aws_mq_broker.mq`
- State: executable: a person can start it now
- Risk: the assessment leaves the critical setting `broker-network` of `module.dependencies.aws_mq_broker.mq` open (REVIEW: a person decides what the target does for it): the migration of `module.dependencies.aws_mq_broker.mq` is not complete until this step is done
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

#### Alike steps on 6 resources (aws_ecs_service, aws_lb) — the review of the open settings of {resource} (`MAN/semantic/{resource}/open-settings-network-architect`)

- Phase: Platform services
- Why: The assessment leaves {why} open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item.
- Who: Network Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to each decision register record (decisions.json): what the STACKIT target does for the setting, or the accepted difference - {needs}
- Done when: every one of the {done when} settings is closed: each is set up on its STACKIT target and checked, or the decision that production does not need it is recorded (the condition of each is stated with its item, and `assurance/critical-semantics.json` says what closes it)
- State: executable: a person can start it now
- Risk: the assessment leaves {risk} is not complete until every one is closed; this step is the one step of them (`assurance/critical-semantics.json` says why each is open)
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The review of the open settings of module.retail_app_ecs.module.alb.aws_lb.this (`MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect`) — {resource} = `module.retail_app_ecs.module.alb.aws_lb.this`
  - What: Review the 5 open critical settings of `module.retail_app_ecs.module.alb.aws_lb.this` (aws_lb) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`network-exposure`, `client-restriction`, `request-handling`, `lb-routing-and-addressing`, `lb-subnets`)
  - Why ({why}): 5 critical settings of `module.retail_app_ecs.module.alb.aws_lb.this`
  - Needs ({needs}): `network-exposure` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS, Network Architect); `client-restriction` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS, Network Architect); `request-handling` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS, Network Architect); `lb-routing-and-addressing` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS, Network Architect); `lb-subnets` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS, Network Architect)
  - Done when ({done when}): 5
  - Settings (5, the step is done when every one is closed):
    - `network-exposure` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS)
      - Why: Whether the draft carries this setting is decided by its semantic ledger entry "network exposure", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). internal not visible statically (a variable): the source states no exposure and the draft carries nothing for it; a person decides whether the STACKIT load balancer is private_network_only (REVIEW).
      - Done when: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.
    - `client-restriction` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS)
      - Why: A check of the knowledge base (lb security groups) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Who may reach the load balancer, read from the ingress rules of the security groups that filter its clients. A group reference, a prefix list, an IPv6 range or a variable is not carried: the plan lists the clients the target would block and adds the client-access manual step for the Security Architect.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person confirms the carried ranges against the source rules, or decides the open client-access step, and the regenerated draft carries the result.
    - `request-handling` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states how the load balancer treats HTTP requests that may carry a request-smuggling (desync) risk, and how it rewrites the X-Forwarded-For header before the target sees it.
      - Done when: A person confirms that the application does not depend on either behaviour: the STACKIT application load balancer has neither setting and its documentation does not state the behaviour (pinned provider), also for the AWS default values.
    - `lb-routing-and-addressing` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states how the load balancer answers DNS for clients (Availability Zone affinity), whether it still forwards to targets when AWS WAF cannot be reached (fail open), zonal shift, customer-owned address pools and IPv6 source NAT prefixes.
      - Done when: A person decides whether the STACKIT load balancer needs an equivalent for each of them, because the STACKIT application and network load balancers have no setting for any of them (pinned provider).
    - `lb-subnets` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS)
      - Why: The value is not visible statically (a case of the mapping rule for this kind of unit), so nothing is credited for it. The load balancer takes the network of its one converted subnet (networks.network_id; several subnets are lb subnets several, REVIEW): STACKIT networks are regional, one network holds what the source spread over zonal subnets.
      - Done when: A literal value or a resolved reference in the source closes it, or a person confirms the value.
  - Risk ({risk}): 5 critical settings of `module.retail_app_ecs.module.alb.aws_lb.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.alb.aws_lb.this`
- The review of the open settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-network-architect`) — {resource} = `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`
  - What: Review the 5 open critical settings of `module.retail_app_ecs.module.carts_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`service-discovery`, `service-network-placement`, `service-public-ip-setting`, `service-connect-values`, `td-network-mode`)
  - Why ({why}): 5 critical settings of `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`
  - Needs ({needs}): `service-discovery` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, Network Architect); `service-network-placement` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, Network Architect); `service-public-ip-setting` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, Network Architect); `service-connect-values` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, Network Architect); `td-network-mode` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, Network Architect)
  - Done when ({done when}): 5
  - Settings (5, the step is done when every one is closed):
    - `service-discovery` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: A check of the knowledge base (ecs service discovery) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states how ECS services find each other: AWS Cloud Map registries and namespaces, or ECS Service Connect.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person replaces the lookups with Kubernetes Services and cluster DNS on SKE.
    - `service-network-placement` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The subnets and security groups the tasks' network interfaces use (awsvpc mode); on SKE pods take the cluster's network and NetworkPolicies decide reachability — a person re-expresses the security group rules.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `service-public-ip-setting` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. assign_public_ip in either state (the public ip setting reads only true through the public address check): tasks with a public address are exposed unless a person decides the exposure on SKE explicitly (LoadBalancer services, network policies); false is the private default and is still re-checked, the draft carries no service block.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `service-connect-values` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Service Connect's switch, namespace, service names, client aliases (DNS name and port), traffic-test header rules, mTLS settings (KMS key, role, private CA) and proxy logging: an AWS-managed service mesh with no draft counterpart; discovery on SKE is Kubernetes Services and DNS, mesh features a person's choice.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-network-mode` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.network_mode of the template the group builds its instances from: How the containers are networked (awsvpc, bridge, host, none): whether each task has its own interface and security groups or shares the host's network. Not verified as carried by any semantic of this family — reviewed.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 5 critical settings of `module.retail_app_ecs.module.carts_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`
- The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-network-architect`) — {resource} = `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`
  - What: Review the 5 open critical settings of `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`service-discovery`, `service-network-placement`, `service-public-ip-setting`, `service-connect-values`, `td-network-mode`)
  - Why ({why}): 5 critical settings of `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`
  - Needs ({needs}): `service-discovery` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883, Network Architect); `service-network-placement` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883, Network Architect); `service-public-ip-setting` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883, Network Architect); `service-connect-values` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883, Network Architect); `td-network-mode` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883, Network Architect)
  - Done when ({done when}): 5
  - Settings (5, the step is done when every one is closed):
    - `service-discovery` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883)
      - Why: A check of the knowledge base (ecs service discovery) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states how ECS services find each other: AWS Cloud Map registries and namespaces, or ECS Service Connect.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person replaces the lookups with Kubernetes Services and cluster DNS on SKE.
    - `service-network-placement` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The subnets and security groups the tasks' network interfaces use (awsvpc mode); on SKE pods take the cluster's network and NetworkPolicies decide reachability — a person re-expresses the security group rules.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `service-public-ip-setting` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. assign_public_ip in either state (the public ip setting reads only true through the public address check): tasks with a public address are exposed unless a person decides the exposure on SKE explicitly (LoadBalancer services, network policies); false is the private default and is still re-checked, the draft carries no service block.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `service-connect-values` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Service Connect's switch, namespace, service names, client aliases (DNS name and port), traffic-test header rules, mTLS settings (KMS key, role, private CA) and proxy logging: an AWS-managed service mesh with no draft counterpart; discovery on SKE is Kubernetes Services and DNS, mesh features a person's choice.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-network-mode` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.network_mode of the template the group builds its instances from: How the containers are networked (awsvpc, bridge, host, none): whether each task has its own interface and security groups or shares the host's network. Not verified as carried by any semantic of this family — reviewed.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 5 critical settings of `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`
- The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-network-architect`) — {resource} = `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`
  - What: Review the 5 open critical settings of `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`service-discovery`, `service-network-placement`, `service-public-ip-setting`, `service-connect-values`, `td-network-mode`)
  - Why ({why}): 5 critical settings of `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`
  - Needs ({needs}): `service-discovery` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, Network Architect); `service-network-placement` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, Network Architect); `service-public-ip-setting` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, Network Architect); `service-connect-values` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, Network Architect); `td-network-mode` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, Network Architect)
  - Done when ({done when}): 5
  - Settings (5, the step is done when every one is closed):
    - `service-discovery` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6)
      - Why: A check of the knowledge base (ecs service discovery) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states how ECS services find each other: AWS Cloud Map registries and namespaces, or ECS Service Connect.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person replaces the lookups with Kubernetes Services and cluster DNS on SKE.
    - `service-network-placement` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The subnets and security groups the tasks' network interfaces use (awsvpc mode); on SKE pods take the cluster's network and NetworkPolicies decide reachability — a person re-expresses the security group rules.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `service-public-ip-setting` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. assign_public_ip in either state (the public ip setting reads only true through the public address check): tasks with a public address are exposed unless a person decides the exposure on SKE explicitly (LoadBalancer services, network policies); false is the private default and is still re-checked, the draft carries no service block.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `service-connect-values` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Service Connect's switch, namespace, service names, client aliases (DNS name and port), traffic-test header rules, mTLS settings (KMS key, role, private CA) and proxy logging: an AWS-managed service mesh with no draft counterpart; discovery on SKE is Kubernetes Services and DNS, mesh features a person's choice.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-network-mode` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.network_mode of the template the group builds its instances from: How the containers are networked (awsvpc, bridge, host, none): whether each task has its own interface and security groups or shares the host's network. Not verified as carried by any semantic of this family — reviewed.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 5 critical settings of `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`
- The review of the open settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-network-architect`) — {resource} = `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`
  - What: Review the 5 open critical settings of `module.retail_app_ecs.module.orders_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`service-discovery`, `service-network-placement`, `service-public-ip-setting`, `service-connect-values`, `td-network-mode`)
  - Why ({why}): 5 critical settings of `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`
  - Needs ({needs}): `service-discovery` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS, Network Architect); `service-network-placement` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS, Network Architect); `service-public-ip-setting` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS, Network Architect); `service-connect-values` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS, Network Architect); `td-network-mode` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS, Network Architect)
  - Done when ({done when}): 5
  - Settings (5, the step is done when every one is closed):
    - `service-discovery` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: A check of the knowledge base (ecs service discovery) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states how ECS services find each other: AWS Cloud Map registries and namespaces, or ECS Service Connect.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person replaces the lookups with Kubernetes Services and cluster DNS on SKE.
    - `service-network-placement` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The subnets and security groups the tasks' network interfaces use (awsvpc mode); on SKE pods take the cluster's network and NetworkPolicies decide reachability — a person re-expresses the security group rules.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `service-public-ip-setting` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. assign_public_ip in either state (the public ip setting reads only true through the public address check): tasks with a public address are exposed unless a person decides the exposure on SKE explicitly (LoadBalancer services, network policies); false is the private default and is still re-checked, the draft carries no service block.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `service-connect-values` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Service Connect's switch, namespace, service names, client aliases (DNS name and port), traffic-test header rules, mTLS settings (KMS key, role, private CA) and proxy logging: an AWS-managed service mesh with no draft counterpart; discovery on SKE is Kubernetes Services and DNS, mesh features a person's choice.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-network-mode` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.network_mode of the template the group builds its instances from: How the containers are networked (awsvpc, bridge, host, none): whether each task has its own interface and security groups or shares the host's network. Not verified as carried by any semantic of this family — reviewed.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 5 critical settings of `module.retail_app_ecs.module.orders_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`
- The review of the open settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect`) — {resource} = `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
  - What: Review the 6 open critical settings of `module.retail_app_ecs.module.ui_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`service-discovery`, `service-load-balancer-target`, `service-network-placement`, `service-public-ip-setting`, `service-connect-values`, `td-network-mode`)
  - Why ({why}): 6 critical settings of `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
  - Needs ({needs}): `service-discovery` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS, Network Architect); `service-load-balancer-target` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS, Network Architect); `service-network-placement` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS, Network Architect); `service-public-ip-setting` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS, Network Architect); `service-connect-values` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS, Network Architect); `td-network-mode` (record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS, Network Architect)
  - Done when ({done when}): 6
  - Settings (6, the step is done when every one is closed):
    - `service-discovery` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: A check of the knowledge base (ecs service discovery) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states how ECS services find each other: AWS Cloud Map registries and namespaces, or ECS Service Connect.
      - Done when: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person replaces the lookups with Kubernetes Services and cluster DNS on SKE.
    - `service-load-balancer-target` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states which container and port receive the load balancer's traffic, the target group or classic load balancer name, and the blue/green listener rules and role: the wiring becomes a Kubernetes Service / Ingress selector and a STACKIT load balancer target pool, written by a person (the draft has no service block to carry it).
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `service-network-placement` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The subnets and security groups the tasks' network interfaces use (awsvpc mode); on SKE pods take the cluster's network and NetworkPolicies decide reachability — a person re-expresses the security group rules.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `service-public-ip-setting` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. assign_public_ip in either state (the public ip setting reads only true through the public address check): tasks with a public address are exposed unless a person decides the exposure on SKE explicitly (LoadBalancer services, network policies); false is the private default and is still re-checked, the draft carries no service block.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `service-connect-values` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Service Connect's switch, namespace, service names, client aliases (DNS name and port), traffic-test header rules, mTLS settings (KMS key, role, private CA) and proxy logging: an AWS-managed service mesh with no draft counterpart; discovery on SKE is Kubernetes Services and DNS, mesh features a person's choice.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-network-mode` (Network Architect; decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.network_mode of the template the group builds its instances from: How the containers are networked (awsvpc, bridge, host, none): whether each task has its own interface and security groups or shares the host's network. Not verified as carried by any semantic of this family — reviewed.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 6 critical settings of `module.retail_app_ecs.module.ui_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`

</details>

### `WP-22` — Decide and set the critical settings (platform services)

- Owner: Platform Architect
- Steps: 7 (7 a person can start now)
- Affected resources: `module.dependencies.aws_mq_broker.mq`, `module.retail_app_ecs.module.alb.aws_lb.this`, `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`, `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`, `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`, `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`, `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (2 different conditions).

<details>
<summary>The 7 steps of WP-22</summary>

#### Alike steps on 7 resources (aws_ecs_service, aws_lb, aws_mq_broker) — the review of the open settings of {resource} (`MAN/semantic/{resource}/open-settings-platform-architect`)

- Phase: Platform services
- Why: The assessment leaves {why} open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item. The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value.
- Who: Platform Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to each decision register record (decisions.json): what the STACKIT target does for the setting, or the accepted difference - {needs}
- Done when: every one of the {done when} settings is closed: each is set up on its STACKIT target and checked, or the decision that production does not need it is recorded (the condition of each is stated with its item, and `assurance/critical-semantics.json` says what closes it)
- State: executable: a person can start it now
- Risk: the assessment leaves {risk} is not complete until every one is closed; this step is the one step of them (`assurance/critical-semantics.json` says why each is open)
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The review of the open settings of module.dependencies.aws_mq_broker.mq (`MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect`) — {resource} = `module.dependencies.aws_mq_broker.mq`
  - What: Review the 3 open critical settings of `module.dependencies.aws_mq_broker.mq` (aws_mq_broker) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`engine-version`, `tcp-deployment-mode`, `tc-mq-broker-broker-name`)
  - Why ({why}): 3 critical settings of `module.dependencies.aws_mq_broker.mq`
  - Needs ({needs}): `engine-version` (record DEC-OPS-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ, Platform Architect); `tcp-deployment-mode` (record DEC-OPS-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ, Platform Architect); `tc-mq-broker-broker-name` (record DEC-OPS-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ, Platform Architect)
  - Done when ({done when}): 3
  - Settings (3, the step is done when every one is closed):
    - `engine-version` (Platform Architect; decision register record DEC-OPS-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_rabbitmq_instance takes a STACKIT RabbitMQ version (the draft asks for it: rabbitmq_version) — which versions STACKIT offers is not in the rule's evidence.
      - Done when: A person picks the RabbitMQ version for the target instance, since the versions STACKIT offers are not stated for this move.
    - `tcp-deployment-mode` (Platform Architect; decision register record DEC-OPS-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_mq_broker.deployment_mode: The family's own setting for high availability already reads this as critical: it selects single instance vs. active standby multi az vs. cluster multi az, i.e. whether the broker survives an AZ failure at all. Held CRITICAL: it decides capacity, delivery guarantees, retry or failure handling that consumers depend on.
      - Done when: A person decides whether the target must survive a zone failure as the source deployment mode did, and finds out which RabbitMQ plan, if any, gives that, since the zone spread of the plans is not stated.
    - `tc-mq-broker-broker-name` (Platform Architect; decision register record DEC-OPS-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The name of the message broker. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract).
      - Done when: A person confirms the broker name the target uses against what refers to the source broker name, or accepts the new name.
  - Risk ({risk}): 3 critical settings of `module.dependencies.aws_mq_broker.mq` open (the draft does not carry them): the migration of `module.dependencies.aws_mq_broker.mq`
- The review of the open settings of module.retail_app_ecs.module.alb.aws_lb.this (`MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-platform-architect`) — {resource} = `module.retail_app_ecs.module.alb.aws_lb.this`
  - What: Review the 3 open critical settings of `module.retail_app_ecs.module.alb.aws_lb.this` (aws_lb) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`lb-connection-timeouts`, `request-header-options`, `tc-lb-name`)
  - Why ({why}): 3 critical settings of `module.retail_app_ecs.module.alb.aws_lb.this`
  - Needs ({needs}): `lb-connection-timeouts` (record DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS, Platform Architect); `request-header-options` (record DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS, Platform Architect); `tc-lb-name` (record DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS, Platform Architect)
  - Done when ({done when}): 3
  - Settings (3, the step is done when every one is closed):
    - `lb-connection-timeouts` (Platform Architect; decision register record DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_lb.idle_timeout and client_keep_alive (aws 6.66.0): how long the load balancer lets a client connection idle and how long it keeps it open. The STACKIT application load balancer has no such attribute and the draft does not carry them - REVIEW: a person decides whether the applications behind the load balancer (long polling, streaming, WebSockets, slow requests) cope with the STACKIT default. aws_alb, the alias type, is not read here.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `request-header-options` (Platform Architect; decision register record DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states which extra headers the load balancer adds to the request the target receives (TLS version and cipher suite, the client port in X-Forwarded-For) and whether it keeps the original Host header.
      - Done when: A person decides, for each setting, what the STACKIT load balancer or the application does instead, because the STACKIT application load balancer has no setting that adds, rewrites or renames a request header towards its targets (pinned provider).
    - `tc-lb-name` (Platform Architect; decision register record DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_lb.name: Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). No semantic of this family has verified it as carried.
      - Done when: A person confirms the name the load balancer carries on the target against what refers to the source name, or accepts the new name.
  - Risk ({risk}): 3 critical settings of `module.retail_app_ecs.module.alb.aws_lb.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.alb.aws_lb.this`
- The review of the open settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-platform-architect`) — {resource} = `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`
  - What: Review the 2 open critical settings of `module.retail_app_ecs.module.carts_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`task-definition`, `service-desired-count`)
  - Why ({why}): 2 critical settings of `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`
  - Needs ({needs}): `task-definition` (record DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, no owner role stated); `service-desired-count` (record DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, Platform Architect)
  - Done when ({done when}): 2
  - Settings (2, the step is done when every one is closed):
    - `task-definition` (Platform Architect; decision register record DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The ECS task definition: the containers a service runs, with their CPU and memory, environment, secrets and health checks.
      - Done when: A person translates the task definition into Kubernetes Deployments and Services on SKE (CPU and memory, environment, secrets and health checks become manifest fields); the rule names a Cloud Foundry push as the other way for a simple web app.
    - `service-desired-count` (Platform Architect; decision register record DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. desired_count is the number of tasks ECS keeps running (ecs_service docs: 'Number of instances of the task definition to place and keep running'); on SKE it becomes Deployment replicas or a HorizontalPodAutoscaler floor. The draft writes it as the replicas of the Deployment in kubernetes/\<service>/manifests.yaml when it is a literal number (a HorizontalPodAutoscaler owns the count where the service has a scaling target and policy the draft translates; a number that is not visible statically is a REQUIRED_ token) — a person confirms the number, REVIEW.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 2 critical settings of `module.retail_app_ecs.module.carts_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`
- The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-platform-architect`) — {resource} = `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`
  - What: Review the 2 open critical settings of `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`task-definition`, `service-desired-count`)
  - Why ({why}): 2 critical settings of `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`
  - Needs ({needs}): `task-definition` (record DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883, no owner role stated); `service-desired-count` (record DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883, Platform Architect)
  - Done when ({done when}): 2
  - Settings (2, the step is done when every one is closed):
    - `task-definition` (Platform Architect; decision register record DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The ECS task definition: the containers a service runs, with their CPU and memory, environment, secrets and health checks.
      - Done when: A person translates the task definition into Kubernetes Deployments and Services on SKE (CPU and memory, environment, secrets and health checks become manifest fields); the rule names a Cloud Foundry push as the other way for a simple web app.
    - `service-desired-count` (Platform Architect; decision register record DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. desired_count is the number of tasks ECS keeps running (ecs_service docs: 'Number of instances of the task definition to place and keep running'); on SKE it becomes Deployment replicas or a HorizontalPodAutoscaler floor. The draft writes it as the replicas of the Deployment in kubernetes/\<service>/manifests.yaml when it is a literal number (a HorizontalPodAutoscaler owns the count where the service has a scaling target and policy the draft translates; a number that is not visible statically is a REQUIRED_ token) — a person confirms the number, REVIEW.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 2 critical settings of `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`
- The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-platform-architect`) — {resource} = `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`
  - What: Review the 2 open critical settings of `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`task-definition`, `service-desired-count`)
  - Why ({why}): 2 critical settings of `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`
  - Needs ({needs}): `task-definition` (record DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, no owner role stated); `service-desired-count` (record DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, Platform Architect)
  - Done when ({done when}): 2
  - Settings (2, the step is done when every one is closed):
    - `task-definition` (Platform Architect; decision register record DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The ECS task definition: the containers a service runs, with their CPU and memory, environment, secrets and health checks.
      - Done when: A person translates the task definition into Kubernetes Deployments and Services on SKE (CPU and memory, environment, secrets and health checks become manifest fields); the rule names a Cloud Foundry push as the other way for a simple web app.
    - `service-desired-count` (Platform Architect; decision register record DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. desired_count is the number of tasks ECS keeps running (ecs_service docs: 'Number of instances of the task definition to place and keep running'); on SKE it becomes Deployment replicas or a HorizontalPodAutoscaler floor. The draft writes it as the replicas of the Deployment in kubernetes/\<service>/manifests.yaml when it is a literal number (a HorizontalPodAutoscaler owns the count where the service has a scaling target and policy the draft translates; a number that is not visible statically is a REQUIRED_ token) — a person confirms the number, REVIEW.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 2 critical settings of `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`
- The review of the open settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-platform-architect`) — {resource} = `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`
  - What: Review the 2 open critical settings of `module.retail_app_ecs.module.orders_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`task-definition`, `service-desired-count`)
  - Why ({why}): 2 critical settings of `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`
  - Needs ({needs}): `task-definition` (record DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS, no owner role stated); `service-desired-count` (record DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS, Platform Architect)
  - Done when ({done when}): 2
  - Settings (2, the step is done when every one is closed):
    - `task-definition` (Platform Architect; decision register record DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The ECS task definition: the containers a service runs, with their CPU and memory, environment, secrets and health checks.
      - Done when: A person translates the task definition into Kubernetes Deployments and Services on SKE (CPU and memory, environment, secrets and health checks become manifest fields); the rule names a Cloud Foundry push as the other way for a simple web app.
    - `service-desired-count` (Platform Architect; decision register record DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. desired_count is the number of tasks ECS keeps running (ecs_service docs: 'Number of instances of the task definition to place and keep running'); on SKE it becomes Deployment replicas or a HorizontalPodAutoscaler floor. The draft writes it as the replicas of the Deployment in kubernetes/\<service>/manifests.yaml when it is a literal number (a HorizontalPodAutoscaler owns the count where the service has a scaling target and policy the draft translates; a number that is not visible statically is a REQUIRED_ token) — a person confirms the number, REVIEW.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 2 critical settings of `module.retail_app_ecs.module.orders_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`
- The review of the open settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-platform-architect`) — {resource} = `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
  - What: Review the 2 open critical settings of `module.retail_app_ecs.module.ui_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`task-definition`, `service-desired-count`)
  - Why ({why}): 2 critical settings of `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
  - Needs ({needs}): `task-definition` (record DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS, no owner role stated); `service-desired-count` (record DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS, Platform Architect)
  - Done when ({done when}): 2
  - Settings (2, the step is done when every one is closed):
    - `task-definition` (Platform Architect; decision register record DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The ECS task definition: the containers a service runs, with their CPU and memory, environment, secrets and health checks.
      - Done when: A person translates the task definition into Kubernetes Deployments and Services on SKE (CPU and memory, environment, secrets and health checks become manifest fields); the rule names a Cloud Foundry push as the other way for a simple web app.
    - `service-desired-count` (Platform Architect; decision register record DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. desired_count is the number of tasks ECS keeps running (ecs_service docs: 'Number of instances of the task definition to place and keep running'); on SKE it becomes Deployment replicas or a HorizontalPodAutoscaler floor. The draft writes it as the replicas of the Deployment in kubernetes/\<service>/manifests.yaml when it is a literal number (a HorizontalPodAutoscaler owns the count where the service has a scaling target and policy the draft translates; a number that is not visible statically is a REQUIRED_ token) — a person confirms the number, REVIEW.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 2 critical settings of `module.retail_app_ecs.module.ui_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`

</details>

### `WP-23` — Decide and set the critical settings (platform services)

- Owner: Security Architect
- Steps: 6 (6 a person can start now)
- Affected resources: `module.dependencies.aws_mq_broker.mq`, `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`, `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`, `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`, `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`, `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (2 different conditions).

<details>
<summary>The 6 steps of WP-23</summary>

#### Alike steps on 6 resources (aws_ecs_service, aws_mq_broker) — the review of the open settings of {resource} (`MAN/semantic/{resource}/open-settings-security-architect`)

- Phase: Platform services
- Why: The assessment leaves {why} open and the draft does not carry them: a person decides what the target does for each. Each setting states its own reason with its item. The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value.
- Who: Security Architect
- When: Timing to be scheduled by the owner
- Needs: the answer to each decision register record (decisions.json): what the STACKIT target does for the setting, or the accepted difference - {needs}
- Done when: every one of the {done when} settings is closed: each is set up on its STACKIT target and checked, or the decision that production does not need it is recorded (the condition of each is stated with its item, and `assurance/critical-semantics.json` says what closes it)
- State: executable: a person can start it now
- Risk: the assessment leaves {risk} is not complete until every one is closed; this step is the one step of them (`assurance/critical-semantics.json` says why each is open)
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The review of the open settings of module.dependencies.aws_mq_broker.mq (`MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-security-architect`) — {resource} = `module.dependencies.aws_mq_broker.mq`
  - What: Review the 2 open critical settings of `module.dependencies.aws_mq_broker.mq` (aws_mq_broker) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`network-exposure`, `tc-user--password`)
  - Why ({why}): 2 critical settings of `module.dependencies.aws_mq_broker.mq`
  - Needs ({needs}): `network-exposure` (record DEC-GEN-CONVERT-EXPOSURE-WIDENED, Security Architect); `tc-user--password` (record DEC-SEC-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ, Security Architect)
  - Done when ({done when}): 2
  - Settings (2, the step is done when every one is closed):
    - `network-exposure` (Security Architect; decision register record DEC-GEN-CONVERT-EXPOSURE-WIDENED)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The broker is either reachable from the public internet or only from private networks.
      - Done when: A person sets which networks may reach the STACKIT RabbitMQ instance with its access list (a list of CIDR networks); the draft sets none.
    - `tc-user--password` (Security Architect; decision register record DEC-SEC-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_mq_broker.user.password: The broker user's login credential; a literal secret. Held CRITICAL: it carries or names a credential; the value is never copied and a person re-creates it on the target. No semantic of this family has verified it as carried.
      - Done when: A person hands the clients the password of the generated target credential instead of the literal in the source.
  - Risk ({risk}): 2 critical settings of `module.dependencies.aws_mq_broker.mq` open (the draft does not carry them): the migration of `module.dependencies.aws_mq_broker.mq`
- The review of the open settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect`) — {resource} = `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.carts_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`td-container-definitions`, `td-container-secret-references`, `td-container-plaintext-secret-env`, `td-container-image-registry`)
  - Why ({why}): 4 critical settings of `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`
  - Needs ({needs}): `td-container-definitions` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, Security Architect); `td-container-secret-references` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, Security Architect); `td-container-plaintext-secret-env` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, Security Architect); `td-container-image-registry` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, Security Architect)
  - Done when ({done when}): 4
  - Settings (4, the step is done when every one is closed):
    - `td-container-definitions` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.container_definitions of the unit that runs the task. The containers of the task: images, commands, environment, secret references, ports, health checks, log configuration - the workload itself, and where its credentials are injected. Decide per container: the image and where it lives, command and entry point, environment, ports and health check, cpu/memory as requests and limits, and the log destination; the secret references and the plaintext secrets among the environment entries are read by the settings of the secret references and of the plaintext secrets, the registry by the setting of the image registry. The unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) through this setting (the target does not carry it: it is in the class redesign), so what the reference becomes is part of this setting.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-container-secret-references` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition's container_definitions state secret references (the `secrets` list: name and valueFrom, "the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store", AWS ECS API reference, Secret). A person decides first which STACKIT Secrets Manager instance holds each referenced secret (stackit_secretsmanager_instance, pinned provider: name, acls, kms_key; the secret entries themselves have no Terraform resource in the pinned provider, they are created through the API or the portal, and their VALUES are never in the Terraform sources - a person copies them). Second, a person decides how the pods read them (the STACKIT Secrets Manager authenticates with Vault-compatible tokens and AppRole, docs.stackit.cloud/products/security/secrets-manager/; ECS injects valueFrom into environment variables when the container starts, and no STACKIT equivalent of that injection is stated on the documentation page checked 2026-10-06, so the Kubernetes Secret or the in-pod fetch is a design of its own).
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-container-plaintext-secret-env` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An `environment` entry whose NAME looks like a credential (password, secret, token, api key, private key, credential) carries a non-empty plaintext value in the task definition (a name heuristic, not a proof: the value is never shown). Decide: whether the value is a secret; if it is, it must not be copied into a Kubernetes manifest or a Terraform variable default but stored in a STACKIT Secrets Manager entry and the plaintext copy in the AWS state and task definition rotated.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-container-image-registry` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A container image comes from Amazon ECR (a `.dkr.ecr.` or public.ecr.aws registry host) or needs `repositoryCredentials`. The images are not moved by the draft and a pod on STACKIT cannot assume the ECR pull rights of the ECS execution role. Decide: where the images live on STACKIT (the STACKIT Container Registry has a GA API, the Container Registry API specification, but no Terraform resource in pinned provider; a registry of your choice works too), how they are copied, and the pull secret the cluster uses.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 4 critical settings of `module.retail_app_ecs.module.carts_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`
- The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect`) — {resource} = `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`td-container-definitions`, `td-container-secret-references`, `td-container-plaintext-secret-env`, `td-container-image-registry`)
  - Why ({why}): 4 critical settings of `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`
  - Needs ({needs}): `td-container-definitions` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883, Security Architect); `td-container-secret-references` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883, Security Architect); `td-container-plaintext-secret-env` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883, Security Architect); `td-container-image-registry` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883, Security Architect)
  - Done when ({done when}): 4
  - Settings (4, the step is done when every one is closed):
    - `td-container-definitions` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.container_definitions of the unit that runs the task. The containers of the task: images, commands, environment, secret references, ports, health checks, log configuration - the workload itself, and where its credentials are injected. Decide per container: the image and where it lives, command and entry point, environment, ports and health check, cpu/memory as requests and limits, and the log destination; the secret references and the plaintext secrets among the environment entries are read by the settings of the secret references and of the plaintext secrets, the registry by the setting of the image registry. The unit names 2 resources through this setting whose references the draft does not resolve: module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db (aws_secretsmanager_secret_version), module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch (aws_secretsmanager_secret_version). What each reference becomes is part of this setting.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-container-secret-references` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition's container_definitions state secret references (the `secrets` list: name and valueFrom, "the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store", AWS ECS API reference, Secret). A person decides first which STACKIT Secrets Manager instance holds each referenced secret (stackit_secretsmanager_instance, pinned provider: name, acls, kms_key; the secret entries themselves have no Terraform resource in the pinned provider, they are created through the API or the portal, and their VALUES are never in the Terraform sources - a person copies them). Second, a person decides how the pods read them (the STACKIT Secrets Manager authenticates with Vault-compatible tokens and AppRole, docs.stackit.cloud/products/security/secrets-manager/; ECS injects valueFrom into environment variables when the container starts, and no STACKIT equivalent of that injection is stated on the documentation page checked 2026-10-06, so the Kubernetes Secret or the in-pod fetch is a design of its own).
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-container-plaintext-secret-env` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An `environment` entry whose NAME looks like a credential (password, secret, token, api key, private key, credential) carries a non-empty plaintext value in the task definition (a name heuristic, not a proof: the value is never shown). Decide: whether the value is a secret; if it is, it must not be copied into a Kubernetes manifest or a Terraform variable default but stored in a STACKIT Secrets Manager entry and the plaintext copy in the AWS state and task definition rotated.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-container-image-registry` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A container image comes from Amazon ECR (a `.dkr.ecr.` or public.ecr.aws registry host) or needs `repositoryCredentials`. The images are not moved by the draft and a pod on STACKIT cannot assume the ECR pull rights of the ECS execution role. Decide: where the images live on STACKIT (the STACKIT Container Registry has a GA API, the Container Registry API specification, but no Terraform resource in pinned provider; a registry of your choice works too), how they are copied, and the pull secret the cluster uses.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 4 critical settings of `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`
- The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-security-architect`) — {resource} = `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`td-container-definitions`, `td-container-secret-references`, `td-container-plaintext-secret-env`, `td-container-image-registry`)
  - Why ({why}): 4 critical settings of `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`
  - Needs ({needs}): `td-container-definitions` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, Security Architect); `td-container-secret-references` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, Security Architect); `td-container-plaintext-secret-env` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, Security Architect); `td-container-image-registry` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, Security Architect)
  - Done when ({done when}): 4
  - Settings (4, the step is done when every one is closed):
    - `td-container-definitions` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.container_definitions of the unit that runs the task. The containers of the task: images, commands, environment, secret references, ports, health checks, log configuration - the workload itself, and where its credentials are injected. Decide per container: the image and where it lives, command and entry point, environment, ports and health check, cpu/memory as requests and limits, and the log destination; the secret references and the plaintext secrets among the environment entries are read by the settings of the secret references and of the plaintext secrets, the registry by the setting of the image registry.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-container-secret-references` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition's container_definitions state secret references (the `secrets` list: name and valueFrom, "the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store", AWS ECS API reference, Secret). A person decides first which STACKIT Secrets Manager instance holds each referenced secret (stackit_secretsmanager_instance, pinned provider: name, acls, kms_key; the secret entries themselves have no Terraform resource in the pinned provider, they are created through the API or the portal, and their VALUES are never in the Terraform sources - a person copies them). Second, a person decides how the pods read them (the STACKIT Secrets Manager authenticates with Vault-compatible tokens and AppRole, docs.stackit.cloud/products/security/secrets-manager/; ECS injects valueFrom into environment variables when the container starts, and no STACKIT equivalent of that injection is stated on the documentation page checked 2026-10-06, so the Kubernetes Secret or the in-pod fetch is a design of its own).
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-container-plaintext-secret-env` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An `environment` entry whose NAME looks like a credential (password, secret, token, api key, private key, credential) carries a non-empty plaintext value in the task definition (a name heuristic, not a proof: the value is never shown). Decide: whether the value is a secret; if it is, it must not be copied into a Kubernetes manifest or a Terraform variable default but stored in a STACKIT Secrets Manager entry and the plaintext copy in the AWS state and task definition rotated.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-container-image-registry` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A container image comes from Amazon ECR (a `.dkr.ecr.` or public.ecr.aws registry host) or needs `repositoryCredentials`. The images are not moved by the draft and a pod on STACKIT cannot assume the ECR pull rights of the ECS execution role. Decide: where the images live on STACKIT (the STACKIT Container Registry has a GA API, the Container Registry API specification, but no Terraform resource in pinned provider; a registry of your choice works too), how they are copied, and the pull secret the cluster uses.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 4 critical settings of `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`
- The review of the open settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect`) — {resource} = `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.orders_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`td-container-definitions`, `td-container-secret-references`, `td-container-plaintext-secret-env`, `td-container-image-registry`)
  - Why ({why}): 4 critical settings of `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`
  - Needs ({needs}): `td-container-definitions` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS, Security Architect); `td-container-secret-references` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS, Security Architect); `td-container-plaintext-secret-env` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS, Security Architect); `td-container-image-registry` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS, Security Architect)
  - Done when ({done when}): 4
  - Settings (4, the step is done when every one is closed):
    - `td-container-definitions` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.container_definitions of the unit that runs the task. The containers of the task: images, commands, environment, secret references, ports, health checks, log configuration - the workload itself, and where its credentials are injected. Decide per container: the image and where it lives, command and entry point, environment, ports and health check, cpu/memory as requests and limits, and the log destination; the secret references and the plaintext secrets among the environment entries are read by the settings of the secret references and of the plaintext secrets, the registry by the setting of the image registry. The unit names 2 resources through this setting whose references the draft does not resolve: module.retail_app_ecs.aws_secretsmanager_secret_version.mq (aws_secretsmanager_secret_version), module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db (aws_secretsmanager_secret_version). What each reference becomes is part of this setting.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-container-secret-references` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition's container_definitions state secret references (the `secrets` list: name and valueFrom, "the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store", AWS ECS API reference, Secret). A person decides first which STACKIT Secrets Manager instance holds each referenced secret (stackit_secretsmanager_instance, pinned provider: name, acls, kms_key; the secret entries themselves have no Terraform resource in the pinned provider, they are created through the API or the portal, and their VALUES are never in the Terraform sources - a person copies them). Second, a person decides how the pods read them (the STACKIT Secrets Manager authenticates with Vault-compatible tokens and AppRole, docs.stackit.cloud/products/security/secrets-manager/; ECS injects valueFrom into environment variables when the container starts, and no STACKIT equivalent of that injection is stated on the documentation page checked 2026-10-06, so the Kubernetes Secret or the in-pod fetch is a design of its own).
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-container-plaintext-secret-env` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An `environment` entry whose NAME looks like a credential (password, secret, token, api key, private key, credential) carries a non-empty plaintext value in the task definition (a name heuristic, not a proof: the value is never shown). Decide: whether the value is a secret; if it is, it must not be copied into a Kubernetes manifest or a Terraform variable default but stored in a STACKIT Secrets Manager entry and the plaintext copy in the AWS state and task definition rotated.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-container-image-registry` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A container image comes from Amazon ECR (a `.dkr.ecr.` or public.ecr.aws registry host) or needs `repositoryCredentials`. The images are not moved by the draft and a pod on STACKIT cannot assume the ECR pull rights of the ECS execution role. Decide: where the images live on STACKIT (the STACKIT Container Registry has a GA API, the Container Registry API specification, but no Terraform resource in pinned provider; a registry of your choice works too), how they are copied, and the pull secret the cluster uses.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 4 critical settings of `module.retail_app_ecs.module.orders_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`
- The review of the open settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (`MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-security-architect`) — {resource} = `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
  - What: Review the 4 open critical settings of `module.retail_app_ecs.module.ui_service.aws_ecs_service.this` (aws_ecs_service) that the draft does not carry, and decide for each what the STACKIT target does: set it up by hand, or record that production does not need it (`td-container-definitions`, `td-container-secret-references`, `td-container-plaintext-secret-env`, `td-container-image-registry`)
  - Why ({why}): 4 critical settings of `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
  - Needs ({needs}): `td-container-definitions` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS, Security Architect); `td-container-secret-references` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS, Security Architect); `td-container-plaintext-secret-env` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS, Security Architect); `td-container-image-registry` (record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS, Security Architect)
  - Done when ({done when}): 4
  - Settings (4, the step is done when every one is closed):
    - `td-container-definitions` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.container_definitions of the unit that runs the task. The containers of the task: images, commands, environment, secret references, ports, health checks, log configuration - the workload itself, and where its credentials are injected. Decide per container: the image and where it lives, command and entry point, environment, ports and health check, cpu/memory as requests and limits, and the log destination; the secret references and the plaintext secrets among the environment entries are read by the settings of the secret references and of the plaintext secrets, the registry by the setting of the image registry.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-container-secret-references` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition's container_definitions state secret references (the `secrets` list: name and valueFrom, "the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store", AWS ECS API reference, Secret). A person decides first which STACKIT Secrets Manager instance holds each referenced secret (stackit_secretsmanager_instance, pinned provider: name, acls, kms_key; the secret entries themselves have no Terraform resource in the pinned provider, they are created through the API or the portal, and their VALUES are never in the Terraform sources - a person copies them). Second, a person decides how the pods read them (the STACKIT Secrets Manager authenticates with Vault-compatible tokens and AppRole, docs.stackit.cloud/products/security/secrets-manager/; ECS injects valueFrom into environment variables when the container starts, and no STACKIT equivalent of that injection is stated on the documentation page checked 2026-10-06, so the Kubernetes Secret or the in-pod fetch is a design of its own).
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-container-plaintext-secret-env` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An `environment` entry whose NAME looks like a credential (password, secret, token, api key, private key, credential) carries a non-empty plaintext value in the task definition (a name heuristic, not a proof: the value is never shown). Decide: whether the value is a secret; if it is, it must not be copied into a Kubernetes manifest or a Terraform variable default but stored in a STACKIT Secrets Manager entry and the plaintext copy in the AWS state and task definition rotated.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
    - `td-container-image-registry` (Security Architect; decision register record DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS)
      - Why: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A container image comes from Amazon ECR (a `.dkr.ecr.` or public.ecr.aws registry host) or needs `repositoryCredentials`. The images are not moved by the draft and a pod on STACKIT cannot assume the ECR pull rights of the ECS execution role. Decide: where the images live on STACKIT (the STACKIT Container Registry has a GA API, the Container Registry API specification, but no Terraform resource in pinned provider; a registry of your choice works too), how they are copied, and the pull secret the cluster uses.
      - Done when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
  - Risk ({risk}): 4 critical settings of `module.retail_app_ecs.module.ui_service.aws_ecs_service.this` open (the draft does not carry them): the migration of `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`

</details>

### `WP-24` — Set up by hand the resources the draft writes nothing for (platform services)

- Owner: Platform Architect
- Steps: 3 (3 a person can start now)
- Affected resources: `module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events`, `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights`, `module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs`
- State: a person can start it now
- Done when: each step meets the condition stated with it below (3 different conditions).

<details>
<summary>The 3 steps of WP-24</summary>

#### Alike steps on 3 resources (aws_cloudwatch_event_rule, aws_cloudwatch_log_group, aws_cloudwatch_log_resource_policy) — the manual migration of {resource} (`MAN/unit/{resource}`)

- Phase: Platform services
- What: Decide how {what} moves to STACKIT and set its target up by hand, or record that it needs none: the draft writes no resource for it
- Why: Decided when OpenTofu plans: its count is `(var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0`, which reads 0 as the variables stand, so the draft writes no resource for it. It is not dropped: assess again with a --var-file that sets the input, or decide it after a plan.
- Who: Platform Architect
- When: applies only if its count ((var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0) holds when OpenTofu plans — off with the defaults of var.container_insights_setting, var.lifecycle_events_enabled; it exists only if a variable file (-var-file), -var or TF_VAR_container_insights_setting/TF_VAR_lifecycle_events_enabled switches it on, and this scan saw no such value
- Needs: whether {resource} exists in production, and with how many instances: the value production gives var.container_insights_setting, var.lifecycle_events_enabled
- Done when: the STACKIT counterpart of {resource} is set up and checked, or the decision that it needs none is recorded
- State: executable: a person can start it now
- Risk: the assessment classifies {risk}: no step of this plan creates its target
- Risk: {resource} reads 0 instances as the variables of the source stand, so the draft writes no resource for it; it exists in production only if the condition holds there (applies only if its count ((var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0) holds when OpenTofu plans — off with the defaults of var.container_insights_setting, var.lifecycle_events_enabled; it exists only if a variable file (-var-file), -var or TF_VAR_container_insights_setting/TF_VAR_lifecycle_events_enabled switches it on, and this scan saw no such value)
- Rollback (manual): the plan does not know how this step is undone: the person who carries it out records how

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The manual migration of module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events (`MAN/unit/module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events`) — {resource} = `module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events`
  - What ({what}): module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events (aws_cloudwatch_event_rule)
  - Risk: the assessment says: Event-pattern rules react to AWS service events that do not exist on STACKIT. The producer has to publish its own events (e.g. to RabbitMQ) and the consumer subscribes explicitly.
  - Risk ({risk}): module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events as redesign
  - Risk: if production sets var.container_insights_setting, var.lifecycle_events_enabled so that module.retail_app_ecs.aws_cloudwatch_event_target.ecs_events_target exists (its count is `(var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0`, which reads 0 as the variables stand), it needs: its aws_cloudwatch_event_target configuration decided with module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events, for which the draft writes no resource either; it reads module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights, module.retail_app_ecs.random_id.eventbridge_suffix — not drafted; decide or confirm it, and assess again with a --var-file that sets the inputs as production does
- The manual migration of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights (`MAN/unit/module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights`) — {resource} = `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights`
  - What ({what}): module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights (aws_cloudwatch_log_group)
  - Risk: the assessment says: Log groups become label sets in a STACKIT Logs instance (a label-based Grafana Loki store written over OTLP or the Loki API, retention in days for the whole instance). STACKIT has no log group or stream object: a group's name survives only as a label the shipper sends. Agents switch from the CloudWatch agent to a documented shipper (Grafana Alloy, OpenTelemetry Collector, Vector or Fluent Bit); log groups that keep their logs for the same number of days share one instance.
  - Risk ({risk}): module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights as reconfigure
- The manual migration of module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs (`MAN/unit/module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs`) — {resource} = `module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs`
  - What ({what}): module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs (aws_cloudwatch_log_resource_policy)
  - Risk: the assessment says: The resource-policy JSON (which AWS service principal may put logs into this account/log group) has no counterpart shape in STACKIT: log ingestion is instead authenticated per producer with a stackit_logs_access_token bearer token. A person re-establishes the same write-access relationship by issuing a token to each log-shipping producer.
  - Risk ({risk}): module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs as reconfigure

</details>

### `WP-25` — Cluster access (platform services)

- Owner: Platform Architect
- Steps: 1 (1 a person can start now)
- Affected resources: `module.retail_app_ecs.aws_ecs_cluster.cluster`, `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`, `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`, `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`, `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`, `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
- State: a person can start it now
- Done when: every step of terraform/handover/cluster-access/kubeconfig.md is done and its checks hold

<details>
<summary>The 1 step of WP-25</summary>

#### The step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health" (`MAN/draft/handover/cluster-access/kubeconfig-md`)

- Phase: Platform services
- What: Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health
- Why: the draft writes no kubeconfig (it would keep an admin credential in the Terraform state): a person fetches one when it is needed
- Document: `terraform/handover/cluster-access/kubeconfig.md`
- Who: Platform Architect
- When: Timing to be scheduled by the owner
- Needs: No input is named for this step
- Done when: every step of terraform/handover/cluster-access/kubeconfig.md is done and its checks hold
- Source: `module.retail_app_ecs.aws_ecs_cluster.cluster`, `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`, `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`, `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`, `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`, `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
- After: the OpenTofu step for stackit_ske_cluster.retail_app_ecs_cluster
- State: executable: a person can start it now
- Rollback (manual): the plan does not know how this step is undone: terraform/handover/cluster-access/kubeconfig.md says how where it has a rollback step, else the person who carries it out records how

</details>

### `WP-26` — Move the data and the objects to the target

- Owner: Data Architect
- Steps: 6 (2 a person can start now, 2 wait for a manual prerequisite, 2 require a design decision)
- Affected resources: `module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- Rests on: `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`
- Waits for: `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`
- State: waits for decisions (2 of 6 steps)
- Done when: each step meets the condition stated with it below (6 different conditions).

<details>
<summary>The 6 steps of WP-26</summary>

#### Alike steps on 2 resources (aws_rds_cluster) — the data preflight of {resource} (`MAN/data/{resource}/preflight`)

- Phase: Platform services
- Who: Data Architect
- When: Timing to be scheduled by the owner
- State: executable: a person can start it now

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The data preflight of module.dependencies.module.catalog_rds.aws_rds_cluster.this (`MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/preflight`) — {resource} = `module.dependencies.module.catalog_rds.aws_rds_cluster.this`; After: the OpenTofu step for stackit_mariadb_credential.dependencies_catalog_rds_this, the OpenTofu step for stackit_mariadb_instance.dependencies_catalog_rds_this
  - What: Close what the plan lists as UNKNOWN, from the move host, with read-only statements; no password goes on a command line (the client prompts for it). Source (`mysql --host=\<source-host> --port=\<source-port> --user=\<source-user> --password`): `SELECT VERSION();`, `SELECT table_schema, table_collation, COUNT(*) FROM information_schema.tables GROUP BY 1, 2;` and the same over `information_schema.columns` for the collations the columns use, `SELECT routine_schema, routine_type, COUNT(*) FROM information_schema.routines GROUP BY 1, 2;` and the triggers, events and views the same way, the DEFINER accounts (`SELECT DISTINCT definer FROM information_schema.routines`, and for the views and events), `SELECT user, host, plugin FROM mysql.user ORDER BY 1, 2;` and `SHOW GRANTS FOR '\<user>'@'\<host>';` for each (names and plugins, never the authentication string), `SELECT @@GLOBAL.sql_mode, @@GLOBAL.time_zone, @@GLOBAL.gtid_mode;`, `SHOW DATABASES;` and the engines and the tables without a primary key (the queries of the check table-engines-and-keys). Target (after the draft is applied and the instance and its service key exist; `mysql --host=\<target-host> --port=\<target-port> --user=\<target-user> --password --database=\<target-database>`): `SELECT VERSION();`, `SELECT @@GLOBAL.sql_mode, @@GLOBAL.time_zone;`, `SHOW VARIABLES LIKE 'character_set%';`, `SHOW VARIABLES LIKE 'collation%';`, `SHOW COLLATION WHERE Collation LIKE 'utf8mb4%0900%';` and `SHOW GRANTS;`. Check that the move host is in `parameters.sgw_acl` of the instance (remove it afterwards), reaches both ends and uses the custom port of the instance's service key. Runbook section: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md#preflight`.
  - Why: the checks of the plan that are UNKNOWN are closed by these statements before any data moves
  - Document: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md`
  - Needs: the checks that are UNKNOWN and what closes each: version-gap (closed by: preflight on the source and the target: SELECT VERSION(); and the application's own test suite against a MariaDB instance of the offered series (the rehearsal)); charset-collation (closed by: preflight on the source: SELECT table_schema, table_collation, COUNT(*) FROM information_schema.tables GROUP BY 1, 2; SELECT character_set_name, collation_name, COUNT(*) FROM information_schema.columns GROUP BY 1, 2; on the target: SHOW COLLATION WHERE Collation LIKE 'utf8mb4%0900%'; SHOW VARIABLES LIKE 'character_set%'; SHOW VARIABLES LIKE 'collation%'); stored-programs (closed by: preflight on the source: SELECT routine_schema, routine_type, COUNT(*) FROM information_schema.routines GROUP BY 1, 2; SELECT trigger_schema, COUNT(*) FROM information_schema.triggers GROUP BY 1; SELECT event_schema, COUNT(*) FROM information_schema.events GROUP BY 1; SELECT table_schema, COUNT(*) FROM information_schema.views GROUP BY 1); definer-accounts (closed by: preflight on the source: SELECT DISTINCT definer FROM information_schema.routines UNION SELECT DISTINCT definer FROM information_schema.views UNION SELECT DISTINCT definer FROM information_schema.events, and the definer of every trigger (SHOW TRIGGERS, or mysql.proc where it is readable); on the target: SHOW GRANTS; for the user of the service key); users-and-grants (closed by: preflight on the source (names and the authentication plugin, never the authentication string): SELECT user, host, plugin FROM mysql.user ORDER BY 1, 2; then SHOW GRANTS FOR '\<user>'@'\<host>'; for each; on the target: SHOW GRANTS; for the user of the service key); sql-mode (closed by: preflight on both sides: SELECT @@GLOBAL.sql_mode; and, on the source, SELECT DISTINCT sql_mode FROM information_schema.routines (the mode each routine was defined with)); time-zone (closed by: preflight on both sides: SELECT @@GLOBAL.time_zone, @@SESSION.time_zone, @@system_time_zone, NOW(), UTC_TIMESTAMP(); on the target also SELECT CONVERT_TZ('2026-01-01 12:00:00', 'UTC', '\<zone>');); binlog-format (closed by: preflight on the source: SHOW VARIABLES LIKE 'log_bin'; SHOW VARIABLES LIKE 'binlog_format'; the owner of the source changes the parameter group, and on Aurora MySQL the cluster parameter group (the parameter is static there, so a reboot)); gtid-in-dump (closed by: preflight on the source: SELECT @@GLOBAL.gtid_mode;); table-engines-and-keys (closed by: preflight on the source: SELECT table_schema, engine, COUNT(*) FROM information_schema.tables WHERE table_type = 'BASE TABLE' AND table_schema NOT IN ('mysql', 'information_schema', 'performance_schema', 'sys') GROUP BY 1, 2; and the tables without a primary key: SELECT t.table_schema, t.table_name FROM information_schema.tables t LEFT JOIN information_schema.table_constraints c ON c.table_schema = t.table_schema AND c.table_name = t.table_name AND c.constraint_type = 'PRIMARY KEY' WHERE t.table_type = 'BASE TABLE' AND c.constraint_name IS NULL AND t.table_schema NOT IN ('mysql', 'information_schema', 'performance_schema', 'sys')); target-databases (closed by: preflight on the source: SHOW DATABASES; the names against the default database of the target instance (the name in the connection string of its service key); the customer decides, for each other database, between declaring it in the custom parameter `databases` of the instance (Portal) and moving its tables into the default database (an application change)); network-acl (closed by: preflight from the move host: mysql --host=\<source-host> --port=\<source-port> to the source and mysql --host=\<target-host> --port=\<target-port> to the target (host and port from the connection string of the service key), and the move host's address in the access list for the time of the move); the open fields of the move:
    - (1) copy volume: UNKNOWN — supplied by Data Architect (the amount of data of module.dependencies.module.catalog_rds.aws_rds_cluster.this to copy: the used space measured on the source; the provisioned capacity of the source is not the amount of data; closed when the measured amount and the date of the measurement are recorded)
    - (2) change rate: UNKNOWN — supplied by Data Architect (how much data the writers of module.dependencies.module.catalog_rds.aws_rds_cluster.this change per hour; closed when the rate measured over a representative period is recorded, with the time a final pass needs at that rate)
    - (3) write-freeze window: UNKNOWN — supplied by Data Architect (the window in which the writers of module.dependencies.module.catalog_rds.aws_rds_cluster.this stop for the final pass; closed when the owner of the application agrees the start and the end of the window and it is recorded)
    - (4) last sync: UNKNOWN — supplied by Data Architect (the time the final pass ends and its checks hold; closed when the time of the final pass and the result of its checks are recorded)
    - (5) return point: UNKNOWN — supplied by Data Architect (the state of module.dependencies.module.catalog_rds.aws_rds_cluster.this the migration returns to on a rollback: the source as it was at the write freeze, or a named snapshot or backup; closed when the return point is recorded with its time and how it is restored)
    - the checks of the copy:
    - (1) consistency check: UNKNOWN — supplied by Data Architect (how the copy of module.dependencies.module.catalog_rds.aws_rds_cluster.this is shown complete and unchanged after the final pass: the used space and a checksum of the data (of the files, or the row counts of the tables) agree with the source; closed when the method is agreed and its result after the final pass is recorded)
    - (2) validation on the target: UNKNOWN — supplied by Migration Owner (the test the application that uses module.dependencies.module.catalog_rds.aws_rds_cluster.this passes on STACKIT with the copied data before the cutover, agreed with the owner of the application; closed when the test passes on the target and its result is recorded)
  - Done when: every UNKNOWN check of the plan is HOLDS or FAILS; each collation of the source is known on the target or changed, each DEFINER account exists on the target or is settled, and the databases of the source have a place on the target
  - Risk: the move host in the access list is a hole until it is removed at cleanup
  - Risk: a password typed on a command line stays in the history of the shell
  - Risk: placed in the platform services phase after the OpenTofu step for stackit_mariadb_credential.dependencies_catalog_rds_this, which it depends on; its own phase is data services
  - Rollback (manual): nothing changed on either side: read-only statements and, on the target, an empty instance. The way back:
    - (1) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.catalog_rds.aws_rds_cluster.this is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.catalog_rds.aws_rds_cluster.this is kept is recorded)
    - (2) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
    - (3) data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.catalog_rds.aws_rds_cluster.this before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)
- The data preflight of module.dependencies.module.orders_rds.aws_rds_cluster.this (`MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/preflight`) — {resource} = `module.dependencies.module.orders_rds.aws_rds_cluster.this`; After: the OpenTofu step for stackit_postgresflex_database.dependencies_orders_rds_this_orders, the OpenTofu step for stackit_postgresflex_instance.dependencies_orders_rds_this, the OpenTofu step for stackit_postgresflex_user.dependencies_orders_rds_this
  - What: Preflight of the data move of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this: close the checks the plan lists as UNKNOWN (versions, extensions, roles, network and TLS) with read-only queries on the source and on the target, before any data moves. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#decide-and-check`.
  - Why: the checks of the plan that are UNKNOWN are closed by these queries before any data moves
  - Document: `terraform/handover/database-dependencies_orders_rds_this/data-move.md`
  - Needs: the checks that are UNKNOWN and what closes each: extensions (closed by: preflight: on the source SELECT extname, extversion FROM pg_extension ORDER BY 1; on the target SHOW extwlist.extensions; and trust the target); roles (closed by: preflight on the source: \du and \dp list the roles and grants the application uses; they are created as stackit_postgresflex_user resources and the grants are issued again); network-tls (closed by: preflight from the move host: psql to the source and to the target with PGSSLMODE=require); lr-enabled (closed by: preflight on the source: SHOW rds.logical_replication; (the owner of the source changes it in the parameter group and reboots it)); lr-replica-identity (closed by: preflight on the source: list the tables without a primary key (pg_class / pg_index, relkind 'r', outside pg_catalog and information_schema)); lr-subscription-privilege (closed by: preflight on the empty target: CREATE SUBSCRIPTION stacktoit_probe CONNECTION 'host=localhost dbname=x' PUBLICATION p WITH (connect = false); then ALTER SUBSCRIPTION stacktoit_probe SET (slot_name = NONE); DROP SUBSCRIPTION stacktoit_probe; if the first is refused, dump/restore is the only defined method); lr-target-reaches-source (closed by: the rehearsal: a subscription from a scratch database of the target to a copy of the source); replication-cannot-catch-up (closed by: the customer states source.dataset.size, source.dataset.bandwidth and source.dataset.write_rate; the rehearsal measures the real throughput); the open fields of the move:
    - (1) copy volume: UNKNOWN — supplied by Data Architect (the amount of data of module.dependencies.module.orders_rds.aws_rds_cluster.this to copy: the used space measured on the source; the provisioned capacity of the source is not the amount of data; closed when the measured amount and the date of the measurement are recorded)
    - (2) change rate: UNKNOWN — supplied by Data Architect (how much data the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this change per hour; closed when the rate measured over a representative period is recorded, with the time a final pass needs at that rate)
    - (3) write-freeze window: UNKNOWN — supplied by Data Architect (the window in which the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this stop for the final pass; closed when the owner of the application agrees the start and the end of the window and it is recorded)
    - (4) last sync: UNKNOWN — supplied by Data Architect (the time the final pass ends and its checks hold; closed when the time of the final pass and the result of its checks are recorded)
    - (5) return point: UNKNOWN — supplied by Data Architect (the state of module.dependencies.module.orders_rds.aws_rds_cluster.this the migration returns to on a rollback: the source as it was at the write freeze, or a named snapshot or backup; closed when the return point is recorded with its time and how it is restored)
    - the checks of the copy:
    - (1) consistency check: UNKNOWN — supplied by Data Architect (how the copy of module.dependencies.module.orders_rds.aws_rds_cluster.this is shown complete and unchanged after the final pass: the used space and a checksum of the data (of the files, or the row counts of the tables) agree with the source; closed when the method is agreed and its result after the final pass is recorded)
    - (2) validation on the target: UNKNOWN — supplied by Migration Owner (the test the application that uses module.dependencies.module.orders_rds.aws_rds_cluster.this passes on STACKIT with the copied data before the cutover, agreed with the owner of the application; closed when the test passes on the target and its result is recorded)
  - Done when: every UNKNOWN check of the plan is HOLDS or FAILS; the extension list of the source is compared with `SHOW extwlist.extensions;` of the target and each difference is settled
  - Risk: the move host in network.acl is a hole until it is removed at cleanup
  - Risk: placed in the platform services phase after the OpenTofu step for stackit_postgresflex_database.dependencies_orders_rds_this_orders, which it depends on; its own phase is data services
  - Rollback (manual): nothing changed on either side: read-only queries and, on the target, an empty database. The way back:
    - (1) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.orders_rds.aws_rds_cluster.this is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.orders_rds.aws_rds_cluster.this is kept is recorded)
    - (2) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
    - (3) data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.orders_rds.aws_rds_cluster.this before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

#### Alike steps on 2 resources (aws_rds_cluster) — the data rehearsal of {resource} (`MAN/data/{resource}/rehearsal`)

- Phase: Platform services
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the customer's statements in inputs.yaml: source.dataset.size, source.dataset.bandwidth
- State: executable once its manual prerequisite is done: it waits for the data preflight of {resource}, a manual prerequisite
- Risk: placed in the platform services phase after the data preflight of {resource}, which it depends on; its own phase is data services

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The data rehearsal of module.dependencies.module.catalog_rds.aws_rds_cluster.this (`MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/rehearsal`) — {resource} = `module.dependencies.module.catalog_rds.aws_rds_cluster.this`; After: the data preflight of module.dependencies.module.catalog_rds.aws_rds_cluster.this
  - What: Rehearse the dump and the load into a scratch instance of the same plan and version as the draft's instance (a second STACKIT MariaDB instance, deleted afterwards: the real instance must stay empty for the final load) from a copy of the source (a restore of a snapshot into a scratch RDS or Aurora database, so that production is not loaded): `mysqldump --host=\<source-host> --port=\<source-port> --user=\<source-user> --password --single-transaction --routines --triggers --events --set-gtid-purged=OFF --no-tablespaces --databases \<database-1> \<database-2> --result-file=\<dump-file>.sql`, then `mysql --host=\<target-host> --port=\<target-port> --user=\<target-user> --password --database=\<target-database> < \<dump-file>.sql 2> load.log` into the scratch instance. Note the elapsed time of the dump, of the load and of the verification, read every line of `load.log`, run the application's own test suite against the scratch instance, and compare the routines, triggers, events and views that were created with the source's. Delete the scratch instance and the dump afterwards. Runbook section: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md#rehearsal`.
  - Why: the transfer lower bound leaves out the load, the index build and the verification, and the throughput into STACKIT MariaDB is not verified; only a rehearsal measures them and shows which statements the target refuses
  - Done when: the elapsed times are recorded, every error of the load is settled, the application's tests pass against the scratch instance and the write-freeze window is agreed from them
  - Risk: a scratch instance is billed while it exists
  - Rollback (manual): delete the scratch instance and the dump file; the draft's instance and the source are untouched
- The data rehearsal of module.dependencies.module.orders_rds.aws_rds_cluster.this (`MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/rehearsal`) — {resource} = `module.dependencies.module.orders_rds.aws_rds_cluster.this`; After: the data preflight of module.dependencies.module.orders_rds.aws_rds_cluster.this
  - What: Rehearse the move of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this into a scratch database of stackit_postgresflex_instance.dependencies_orders_rds_this from a copy of the source, and time each part of it. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#prepare-the-target`.
  - Why: the transfer lower bound leaves out restore, index build and verification, and the throughput is not verified on STACKIT; only a rehearsal measures them
  - Done when: the elapsed times of each part are recorded and the write-freeze window is agreed from them
  - Rollback (manual): drop the scratch database; the draft's database and the source are untouched

#### The initial copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication (`MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/initial-copy/logical-replication`)

- Phase: Platform services
- What: Copy the existing data of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this by logical replication: copy the schema, publish on the source and subscribe from the target, and wait until every table is copied. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#method-b-logical-replication`.
- Why: the subscription copies the existing rows and then follows the changes, so the freeze later only has to wait for the lag to reach 0
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to
- Done when: every table of the target is in state `r` and the replication slot of the source is active
- Source: `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- After: the data rehearsal of module.dependencies.module.orders_rds.aws_rds_cluster.this
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`; it also comes after the data rehearsal of module.dependencies.module.orders_rds.aws_rds_cluster.this, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: a change and a reboot of the source
- Risk: a slot nobody reads fills the storage of the source
- Risk: schema changes freeze from here on
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path replicate-with-the-engine-replication of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Risk: placed in the platform services phase after the data rehearsal of module.dependencies.module.orders_rds.aws_rds_cluster.this, which it depends on; its own phase is data services
- Rollback (manual): drop the subscription on the target (`DROP SUBSCRIPTION stacktoit_move;`), the publication and the slot on the source, and set `rds.logical_replication` back with a second reboot of the source; the source is otherwise unchanged

#### The replication watch of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication (`MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/delta-sync/logical-replication`)

- Phase: Platform services
- What: Keep the replication of module.dependencies.module.orders_rds.aws_rds_cluster.this running and watch its lag and the free storage of the source until the write freeze. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#method-b-logical-replication`.
- Why: replication keeps running until the freeze; counts on the changing source differ by the changes in flight, so the exact comparison is made inside the freeze
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the customer's statements in inputs.yaml: source.dataset.write_rate
- Done when: the lag stays bounded and the free storage of the source does not fall
- Source: `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- After: the initial copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`; it also comes after the initial copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: a growing lag means the copy does not catch up at this write rate
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path replicate-with-the-engine-replication of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Risk: placed in the platform services phase after the initial copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication, which it depends on; its own phase is data services
- Rollback (manual): as the initial copy: drop the subscription, the publication and the slot

</details>

### `WP-27` — Kubernetes apply (workloads)

- Owner: Platform Architect
- Steps: 5 (5 require a design decision)
- Affected resources: `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`, `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`, `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`, `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`, `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
- Waits for: `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- State: waits for decisions
- Done when: each step meets the condition stated with it below (5 different conditions).

<details>
<summary>The 5 steps of WP-27</summary>

#### The step "Fill in the required inputs of kubernetes/carts/manifests.yaml and apply it to…" (`MAN/draft/kubernetes/carts/manifests-yaml`)

- Phase: Workloads
- What: Fill in the required inputs of kubernetes/carts/manifests.yaml and apply it to the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n \<namespace> -f \<manifest file>
- Why: the draft writes Kubernetes manifests for a workload of the source, not Terraform: a person applies them to the cluster
- Document: `terraform/kubernetes/carts/manifests.yaml`
- Who: Platform Architect
- When: Timing to be scheduled by the owner
- Needs: No input is named for this step
- Done when: every step of terraform/kubernetes/carts/manifests.yaml is done and its checks hold
- Source: `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`
- After: the step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health", the step "Design the security attachment of…", the OpenTofu step for stackit_ske_cluster.retail_app_ecs_cluster
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`; it also comes after the step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health", the step "Design the security attachment of…", manual prerequisites
- Rollback (manual): the plan does not know how this step is undone: terraform/kubernetes/carts/manifests.yaml says how where it has a rollback step, else the person who carries it out records how

#### The step "Fill in the required inputs of kubernetes/catalog/manifests.yaml and apply it…" (`MAN/draft/kubernetes/catalog/manifests-yaml`)

- Phase: Workloads
- What: Fill in the required inputs of kubernetes/catalog/manifests.yaml and apply it to the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n \<namespace> -f \<manifest file>
- Why: the draft writes Kubernetes manifests for a workload of the source, not Terraform: a person applies them to the cluster
- Document: `terraform/kubernetes/catalog/manifests.yaml`
- Who: Platform Architect
- When: Timing to be scheduled by the owner
- Needs: No input is named for this step
- Done when: every step of terraform/kubernetes/catalog/manifests.yaml is done and its checks hold
- Source: `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`
- After: the step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health", the step "Design the security attachment of…", the OpenTofu step for stackit_ske_cluster.retail_app_ecs_cluster
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`; it also comes after the step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health", the step "Design the security attachment of…", manual prerequisites
- Rollback (manual): the plan does not know how this step is undone: terraform/kubernetes/catalog/manifests.yaml says how where it has a rollback step, else the person who carries it out records how

#### The step "Fill in the required inputs of kubernetes/checkout/manifests.yaml and apply it…" (`MAN/draft/kubernetes/checkout/manifests-yaml`)

- Phase: Workloads
- What: Fill in the required inputs of kubernetes/checkout/manifests.yaml and apply it to the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n \<namespace> -f \<manifest file>
- Why: the draft writes Kubernetes manifests for a workload of the source, not Terraform: a person applies them to the cluster
- Document: `terraform/kubernetes/checkout/manifests.yaml`
- Who: Platform Architect
- When: Timing to be scheduled by the owner
- Needs: No input is named for this step
- Done when: every step of terraform/kubernetes/checkout/manifests.yaml is done and its checks hold
- Source: `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`
- After: the step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health", the step "Design the security attachment of…", the OpenTofu step for stackit_ske_cluster.retail_app_ecs_cluster
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`; it also comes after the step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health", the step "Design the security attachment of…", manual prerequisites
- Rollback (manual): the plan does not know how this step is undone: terraform/kubernetes/checkout/manifests.yaml says how where it has a rollback step, else the person who carries it out records how

#### The step "Fill in the required inputs of kubernetes/orders/manifests.yaml and apply it to…" (`MAN/draft/kubernetes/orders/manifests-yaml`)

- Phase: Workloads
- What: Fill in the required inputs of kubernetes/orders/manifests.yaml and apply it to the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n \<namespace> -f \<manifest file>
- Why: the draft writes Kubernetes manifests for a workload of the source, not Terraform: a person applies them to the cluster
- Document: `terraform/kubernetes/orders/manifests.yaml`
- Who: Platform Architect
- When: Timing to be scheduled by the owner
- Needs: No input is named for this step
- Done when: every step of terraform/kubernetes/orders/manifests.yaml is done and its checks hold
- Source: `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`
- After: the step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health", the step "Design the security attachment of…", the OpenTofu step for stackit_ske_cluster.retail_app_ecs_cluster
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`; it also comes after the step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health", the step "Design the security attachment of…", manual prerequisites
- Rollback (manual): the plan does not know how this step is undone: terraform/kubernetes/orders/manifests.yaml says how where it has a rollback step, else the person who carries it out records how

#### The step "Fill in the required inputs of kubernetes/ui/manifests.yaml and apply it to the…" (`MAN/draft/kubernetes/ui/manifests-yaml`)

- Phase: Workloads
- What: Fill in the required inputs of kubernetes/ui/manifests.yaml and apply it to the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n \<namespace> -f \<manifest file>
- Why: the draft writes Kubernetes manifests for a workload of the source, not Terraform: a person applies them to the cluster
- Document: `terraform/kubernetes/ui/manifests.yaml`
- Who: Platform Architect
- When: Timing to be scheduled by the owner
- Needs: No input is named for this step
- Done when: every step of terraform/kubernetes/ui/manifests.yaml is done and its checks hold
- Source: `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
- After: the step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health", the step "Design the security attachment of…", the OpenTofu step for stackit_ske_cluster.retail_app_ecs_cluster
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`; it also comes after the step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health", the step "Design the security attachment of…", manual prerequisites
- Rollback (manual): the plan does not know how this step is undone: terraform/kubernetes/ui/manifests.yaml says how where it has a rollback step, else the person who carries it out records how

</details>

### `WP-28` — Move the data and the objects to the target

- Owner: Data Architect
- Steps: 22 (22 require a design decision)
- Affected resources: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- Rests on: `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`
- Waits for: `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`
- State: waits for decisions
- Done when: each step meets the condition stated with it below (15 different conditions).

<details>
<summary>The 22 steps of WP-28</summary>

#### The final copy of the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine (`MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/client-import`)

- Phase: Cutover
- What: Inside the freeze, copy the indices of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this to stackit_opensearch_instance.dependencies_catalog_opensearch_this with the reindex operation of the service, as the OpenSearch how-to "Migrate data from Elasticsearch to OpenSearch 2" describes. Runbook section: `terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#final-sync-client-import`.
- Why: the draft creates the instance empty and the service documents the reindex operation as the way in; the plan does not know the indices, their size or the access between the source and the target
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the indices to move, their size and the access of the target to the source; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: every index of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is in stackit_opensearch_instance.dependencies_catalog_opensearch_this and the reindex reported no failure
- Source: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
- After: the write freeze of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`; it also comes after the write freeze of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: the how-to of the service has an Elasticsearch instance as the source of the reindex: an OpenSearch domain as the source of the same operation is an inference, not a statement of the page
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, not of the path the draft carries out by default
- Rollback (manual): the writers are stopped, not removed, and a reindex reads the source, so the source is the way back until the reconcile records GO: put the writers back on it; before another attempt delete the indices the reindex wrote into stackit_opensearch_instance.dependencies_catalog_opensearch_this

#### The data reconciliation of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine (`MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/client-import`)

- Phase: Cutover
- What: Reconcile module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this and stackit_opensearch_instance.dependencies_catalog_opensearch_this with the writers stopped (the number of documents of every index on each side, a checksum or a sample of their content, and one read the application does) and record GO or NO-GO. Runbook section: `terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#reconcile-client-import`.
- Why: the copy is made by a tool the plan knows nothing of, so the plan states no check of that tool; the comparison of the two sides with the writers stopped is the check that does not depend on it
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to
- Done when: the records and the sample match on both sides, the read the application does returns the same on both, and the owner records GO
- Checks after the transfer (4, the owner records GO only when every one passes): written once, in `terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md`, the section "Verification: the checks after the transfer" under "Reconcile (client-import)", with the id, the command, the expected result and what is not provided of each; execution-plan.json holds the same checks as data
- Source: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
- After: the final copy of the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`; it also comes after the final copy of the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, not of the path the draft carries out by default
- Rollback (manual): NO-GO: start the writers again against the untouched source; the target holds only a copy

#### The final copy of the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own (`MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/own-tool`)

- Phase: Cutover
- What: Copy the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this to stackit_opensearch_instance.dependencies_catalog_opensearch_this with the migration tool or the replication you chose: write its steps, the checks before the move, the freeze window it needs and the way back. Runbook section: `terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#final-sync-own-tool`.
- Why: the draft creates the instance empty and the plan knows nothing of a tool of your own, so it holds the step and the person who chose the tool writes the steps
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the tool, its steps, the checks before the move, the freeze window and the way back, from the person who runs it; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is in stackit_opensearch_instance.dependencies_catalog_opensearch_this and the checks of the tool hold
- Source: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
- After: the write freeze of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`; it also comes after the write freeze of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, not of the path the draft carries out by default
- Rollback (manual): the writers are stopped, not removed, and nothing the plan does changes the source, so the source is the way back until the reconcile records GO: put the writers back on it; before another attempt remove the indices the tool wrote into stackit_opensearch_instance.dependencies_catalog_opensearch_this (the draft created it empty); check that the tool you chose does not change the source, since the plan knows nothing of it

#### The data reconciliation of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own (`MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/own-tool`)

- Phase: Cutover
- What: Reconcile module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this and stackit_opensearch_instance.dependencies_catalog_opensearch_this with the writers stopped (the number of documents of every index on each side, a checksum or a sample of their content, and one read the application does) and record GO or NO-GO. Runbook section: `terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#reconcile-own-tool`.
- Why: the copy is made by a tool the plan knows nothing of, so the plan states no check of that tool; the comparison of the two sides with the writers stopped is the check that does not depend on it
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to
- Done when: the records and the sample match on both sides, the read the application does returns the same on both, and the owner records GO
- Checks after the transfer (4, the owner records GO only when every one passes): written once, in `terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md`, the section "Verification: the checks after the transfer" under "Reconcile (own-tool)", with the id, the command, the expected result and what is not provided of each; execution-plan.json holds the same checks as data
- Source: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
- After: the final copy of the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`; it also comes after the final copy of the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, not of the path the draft carries out by default
- Rollback (manual): NO-GO: start the writers again against the untouched source; the target holds only a copy

#### The final copy of the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore (`MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/dump-restore`)

- Phase: Cutover
- What: Dump inside the freeze: `mysqldump --host=\<source-host> --port=\<source-port> --user=\<source-user> --password --single-transaction --routines --triggers --events --set-gtid-purged=OFF --no-tablespaces --databases \<database-1> \<database-2> --result-file=\<dump-file>.sql`. `--set-gtid-purged=OFF` leaves the GTID statements out, which MariaDB does not take, and `--no-tablespaces` leaves out the CREATE TABLESPACE statements, which MariaDB does not support for InnoDB. The target instance must be empty before the load (the STACKIT how-to of the restore says so): load the dump with the mysql client, as the user of the instance's service key, into the empty instance: `mysql --host=\<target-host> --port=\<target-port> --user=\<target-user> --password --database=\<target-database> < \<dump-file>.sql 2> load.log`, and read every line of `load.log`. A DEFINER account that does not exist on the target, a collation the target does not know and a database the target does not have are the errors the checks name: each is settled by a person, never by skipping the object. Runbook section: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md#final-sync-dump-restore`.
- Why: the dump is a consistent snapshot of the moment it starts; inside the freeze it is the final state of the source
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the customer's statements in inputs.yaml: source.dataset.downtime; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: the load finished, every database of the source is in the instance, and every error in load.log is settled
- Source: `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
- After: the write freeze of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`; it also comes after the write freeze of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: the freeze lasts as long as the dump and the load
- Risk: the connection of a session idle for 60 minutes is dropped by the service
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.catalog_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Rollback (manual): the source is current to the freeze and untouched: put the writers back on it; before another attempt remove what the load wrote into the instance, or recreate it empty (the instance must be empty for the load)

#### The data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore (`MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/dump-restore`)

- Phase: Cutover
- What: Both sides, with the writers stopped: per-table counts (`SELECT CONCAT('SELECT ''', table_schema, '.', table_name, ''' AS tbl, COUNT(*) FROM `', table_schema, '`.`', table_name, '`;') FROM information_schema.tables WHERE table_type = 'BASE TABLE' AND table_schema NOT IN ('mysql', 'information_schema', 'performance_schema', 'sys');` and run what it prints; the table_rows of information_schema are estimates, not counts), for each table that matters an aggregate of its content (`SELECT COUNT(*), MIN(\<key>), MAX(\<key>), SUM(\<numeric-column>) FROM \<schema>.\<table>;`; a `CHECKSUM TABLE` value is compared only where both servers have been shown to agree on a sample in the rehearsal), the number of routines, triggers, events and views on each side (the queries of the preflight) and their definitions (`SHOW CREATE \<type> \<name>;`), `SELECT @@GLOBAL.sql_mode, @@GLOBAL.time_zone;` equal where they are meant to be, a TIMESTAMP column and a DATETIME column of one row read in the same session time zone, and one read query the application itself runs on its most important data, `\<application-query>`: the query and the answer are the customer's, the source does not state them. Record GO or NO-GO. Runbook section: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md#reconcile-dump-restore`.
- Why: the move is accepted only when the numbers equal on both sides and the objects behave as on the source; a mismatch is a NO-GO
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to
- Done when: counts, content aggregates, the objects and the application query agree: GO
- Checks after the transfer (5, the owner records GO only when every one passes): written once, in `terraform/handover/database-dependencies_catalog_rds_this/data-move.md`, the section "Verification: the checks after the transfer" under "Reconcile (dump-restore)", with the id, the command, the expected result and what is not provided of each; execution-plan.json holds the same checks as data
- Source: `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
- After: the final copy of the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`; it also comes after the final copy of the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.catalog_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Rollback (manual): on NO-GO take the rollback without switching anything: the clients still point at the source, which is current to the freeze

#### The final copy of the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own (`MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/own-tool`)

- Phase: Cutover
- What: Copy the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this to stackit_mariadb_instance.dependencies_catalog_rds_this with the migration tool or the replication you chose: write its steps, the checks before the move, the freeze window it needs and the way back. Runbook section: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md#final-sync-own-tool`.
- Why: the draft creates the instance empty and the plan knows nothing of a tool of your own, so it holds the step and the person who chose the tool writes the steps
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the tool, its steps, the checks before the move, the freeze window and the way back, from the person who runs it; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this is in stackit_mariadb_instance.dependencies_catalog_rds_this and the checks of the tool hold
- Source: `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
- After: the write freeze of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`; it also comes after the write freeze of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.catalog_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Rollback (manual): the writers are stopped, not removed, and nothing the plan does changes the source database, so the source database is the way back until the reconcile records GO: put the writers back on it; before another attempt drop what the tool wrote into the databases of stackit_mariadb_instance.dependencies_catalog_rds_this (the draft created them empty); check that the tool you chose does not change the source database, since the plan knows nothing of it

#### The data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own (`MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/own-tool`)

- Phase: Cutover
- What: Both sides, with the writers stopped: per-table counts (`SELECT CONCAT('SELECT ''', table_schema, '.', table_name, ''' AS tbl, COUNT(*) FROM `', table_schema, '`.`', table_name, '`;') FROM information_schema.tables WHERE table_type = 'BASE TABLE' AND table_schema NOT IN ('mysql', 'information_schema', 'performance_schema', 'sys');` and run what it prints; the table_rows of information_schema are estimates, not counts), for each table that matters an aggregate of its content (`SELECT COUNT(*), MIN(\<key>), MAX(\<key>), SUM(\<numeric-column>) FROM \<schema>.\<table>;`; a `CHECKSUM TABLE` value is compared only where both servers have been shown to agree on a sample in the rehearsal), the number of routines, triggers, events and views on each side (the queries of the preflight) and their definitions (`SHOW CREATE \<type> \<name>;`), `SELECT @@GLOBAL.sql_mode, @@GLOBAL.time_zone;` equal where they are meant to be, a TIMESTAMP column and a DATETIME column of one row read in the same session time zone, and one read query the application itself runs on its most important data, `\<application-query>`: the query and the answer are the customer's, the source does not state them. Record GO or NO-GO. Runbook section: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md#reconcile-own-tool`.
- Why: the move is accepted only when the numbers equal on both sides and the objects behave as on the source; a mismatch is a NO-GO
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to
- Done when: counts, content aggregates, the objects and the application query agree: GO
- Checks after the transfer (5, the owner records GO only when every one passes): written once, in `terraform/handover/database-dependencies_catalog_rds_this/data-move.md`, the section "Verification: the checks after the transfer" under "Reconcile (own-tool)", with the id, the command, the expected result and what is not provided of each; execution-plan.json holds the same checks as data
- Source: `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
- After: the final copy of the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`; it also comes after the final copy of the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.catalog_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Rollback (manual): on NO-GO take the rollback without switching anything: the clients still point at the source, which is current to the freeze

#### The final copy of the data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine (`MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/final-sync/client-import`)

- Phase: Cutover
- What: Inside the freeze, copy every key of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default to stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with a client that you run, not with the `MIGRATE` command: iterate the keys of the source with `SCAN` (never `KEYS`), read each key with `DUMP` and its remaining time to live with `PTTL`, and write it into stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with `RESTORE` (the TTL in milliseconds, 0 for a key that has none, and without `REPLACE`), after you isolated the source (no application connected to it) and took a backup of it. The source shows one shard (it states num_cache_clusters, which the provider documents as conflicting with num_node_groups): the copy iterates one node, the primary. Runbook section: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#final-sync-client-import`.
- Why: the draft creates the instance empty; the tutorial "Migrate data to a new instance" of the service migrates a STACKIT Redis instance by the MIGRATE command or by a script, and the plan holds a copy by a client that rests on commands the source's service lists as supported (below); the plan does not know the number of keys, their names or types, or the network between the source and the target
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the number of keys, the network path from the host that runs the client to the source and to the target, and the downtime the business accepts; Precondition, checked by a person before the copy (the plan reads no network of the source and the target, so reachability is not claimed): the host that runs the client must reach the source and the host and port of stackit_valkey_instance.dependencies_checkout_elasticache_redis_default that its service key states (the tutorial says to use the exact host of the credentials for the source and the target; it names the backend host only for MIGRATE, whose connection is made by the source, and states nothing more for a client, so confirm the target host with a first connection); the access list the draft writes for stackit_valkey_instance.dependencies_checkout_elasticache_redis_default (parameters.sgw_acl, from var.dependencies_checkout_elasticache_redis_default_allowed_cidrs, which has no default) must admit the address the client connects from, and the tutorial does not say how that list applies to the backend route, so confirm it with a first connection from that address; and stackit_valkey_instance.dependencies_checkout_elasticache_redis_default must be empty (the tutorial: "Do not insert any data into the target instance until the migration and consistency checks are fully completed"); the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: every key of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is in stackit_valkey_instance.dependencies_checkout_elasticache_redis_default: the client reported no error and the comparison of the two key spaces ends in GO
- Source: `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
- After: the write freeze of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`; it also comes after the write freeze of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: the tutorial's main strategy is the MIGRATE command with its COPY option, piped from a KEYS '*' listing; the plan does not use it because it holds no statement that the source allows MIGRATE (for Amazon ElastiCache the page below says it does not), and the tutorial's listing with KEYS is not used either
- Risk: DUMP returns a serialized value that holds an RDB version and a checksum and no expire time (valkey.io/commands/dump), RESTORE fails when the version or the checksum does not match (valkey.io/commands/restore), and PTTL answers -1 for a key without expire and -2 for a key that is gone (valkey.io/commands/pttl): the client restores a key without expire with a TTL of 0, skips a key that is gone and counts it, and reports a key that RESTORE refuses; try the first keys before the whole copy
- Risk: RESTORE without REPLACE refuses a key that already exists ("Target key name is busy", valkey.io/commands/restore): that is what shows a second attempt on a target that still holds keys, so remove them first (the way back below); SCAN may return a key more than once (valkey.io/commands/scan), and the second RESTORE of such a key is not an error of the copy
- Risk: the plan has not run this copy against a Key Value Store: that the service accepts RESTORE is inferred from the tutorial's MIGRATE ... COPY, which ends in a RESTORE on the target (valkey.io/commands/migrate), not from a statement of the service
- Risk: the tutorial recommends a manual backup of the source before the migration, kept until the consistency of the target is confirmed
- Risk: the source does not say whether this cache holds only what the application rebuilds or also data that exists nowhere else (sessions, locks, counters, queues), so the plan keeps the copy rather than assuming the cache can start empty
- Risk: the tutorial's source is a STACKIT Redis instance (its TLS, backend-host and key-listing steps are those of STACKIT); an Amazon ElastiCache or MemoryDB source of the same steps is an inference, not a statement of the page
- Risk: the Amazon ElastiCache page lists migrate among the commands it does not make available for caches running Redis OSS (with sync, psync, replicaof, bgsave, save and config) and does not state that restriction for Valkey caches; the plan takes MIGRATE as available for no ElastiCache engine and copies the keys with a client on every one; the same page lists DUMP, RESTORE, SCAN, PTTL, INFO and DBSIZE among the commands serverless caches support, and its lists of restricted commands name none of them
- Risk: the script copy_redis.py of the tutorial (the plan has read it: it lists the keys with SCAN, reads each key by its type and writes it with SET, RPUSH, SADD, HSET or ZADD, and sets the TTL in whole seconds) does not use KEYS, but it has a branch only for strings, lists, sets, hashes and sorted sets, so it copies nothing for a key of another type (a stream, for one), it decodes every key name as UTF-8, and it opens one connection to one source host; count the keys of each type on the source before you choose it over the client above
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, not of the path the draft carries out by default
- Rollback (manual): the writers are stopped, not removed, and the copy only reads the source with SCAN, DUMP and PTTL, so the source cache is the way back until the reconcile records GO: put the writers back on it; before another attempt remove the keys the client wrote into stackit_valkey_instance.dependencies_checkout_elasticache_redis_default (the draft created it empty)

#### The data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine (`MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/client-import`)

- Phase: Cutover
- What: Reconcile module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default and stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with the writers stopped (`DBSIZE` and `INFO KEYSPACE` on both sides: the number of keys and the keys and expires values must be equal, where the cache returns the section; the sorted lists of the keys of both, each listed with `SCAN` and never `KEYS`: their difference must be empty; and one read the application does) and record GO or NO-GO. Runbook section: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#reconcile-client-import`.
- Why: the comparison of the two sides with the writers stopped is the check of the tutorial of the service (INFO KEYSPACE and the lists of the keys, which the plan makes with SCAN where the tutorial uses KEYS) and does not depend on the way the keys were copied
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to
- Done when: the records and the sample match on both sides, the read the application does returns the same on both, and the owner records GO
- Checks after the transfer (4, the owner records GO only when every one passes): written once, in `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md`, the section "Verification: the checks after the transfer" under "Reconcile (client-import)", with the id, the command, the expected result and what is not provided of each; execution-plan.json holds the same checks as data
- Source: `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
- After: the final copy of the data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`; it also comes after the final copy of the data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, not of the path the draft carries out by default
- Rollback (manual): NO-GO: start the writers again against the untouched source; the target holds only a copy

#### The final copy of the data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own (`MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/final-sync/own-tool`)

- Phase: Cutover
- What: Copy the data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default to stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with the migration tool or the replication you chose: write its steps, the checks before the move, the freeze window it needs and the way back. Runbook section: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#final-sync-own-tool`.
- Why: the draft creates the instance empty and the plan knows nothing of a tool of your own, so it holds the step and the person who chose the tool writes the steps
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the tool, its steps, the checks before the move, the freeze window and the way back, from the person who runs it; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: the data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is in stackit_valkey_instance.dependencies_checkout_elasticache_redis_default and the checks of the tool hold
- Source: `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
- After: the write freeze of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`; it also comes after the write freeze of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, not of the path the draft carries out by default
- Rollback (manual): the writers are stopped, not removed, and nothing the plan does changes the source cache, so the source cache is the way back until the reconcile records GO: put the writers back on it; before another attempt remove the keys the tool wrote into stackit_valkey_instance.dependencies_checkout_elasticache_redis_default (the draft created it empty); check that the tool you chose does not change the source cache, since the plan knows nothing of it

#### The data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own (`MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/own-tool`)

- Phase: Cutover
- What: Reconcile module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default and stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with the writers stopped (`DBSIZE` and `INFO KEYSPACE` on both sides: the number of keys and the keys and expires values must be equal, where the cache returns the section; the sorted lists of the keys of both, each listed with `SCAN` and never `KEYS`: their difference must be empty; and one read the application does) and record GO or NO-GO. Runbook section: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#reconcile-own-tool`.
- Why: the comparison of the two sides with the writers stopped is the check of the tutorial of the service (INFO KEYSPACE and the lists of the keys, which the plan makes with SCAN where the tutorial uses KEYS) and does not depend on the way the keys were copied
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to
- Done when: the records and the sample match on both sides, the read the application does returns the same on both, and the owner records GO
- Checks after the transfer (4, the owner records GO only when every one passes): written once, in `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md`, the section "Verification: the checks after the transfer" under "Reconcile (own-tool)", with the id, the command, the expected result and what is not provided of each; execution-plan.json holds the same checks as data
- Source: `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
- After: the final copy of the data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`; it also comes after the final copy of the data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, not of the path the draft carries out by default
- Rollback (manual): NO-GO: start the writers again against the untouched source; the target holds only a copy

#### The export of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own (`MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/export/own-tool`)

- Phase: Cutover
- What: Inside the freeze, export the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) to S3 with the DynamoDB export to S3, which requires point-in-time recovery, and the source does not state point-in-time recovery for this table (the provider's default is off): a request for a table without it fails with PointInTimeRecoveryUnavailableException. Switch recovery on first (a change to the AWS table that this plan does not make) and request the export only after it is on, using `aws dynamodb export-table-to-point-in-time --table-arn \<table ARN> --s3-bucket \<bucket> --s3-prefix \<prefix> --export-format DYNAMODB_JSON`; keep the manifest-summary.json (its itemCount is the count the comparison uses). Without the export, read the table in full with Scan, which consumes the read capacity of the table, and count the items you write out. Runbook section: `terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#export-own-tool`.
- Why: the writers are stopped, so the export holds the last write; the export to S3 reads the table's continuous backups and consumes none of its read capacity, and the plan holds no other way to read a table in full
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the S3 bucket the export is written to and the account that may write to it, the table ARN, the size of the table and the time the business accepts the freeze to last; the open fields of the move:
  - (1) copy volume: UNKNOWN — supplied by Data Architect (the amount of data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this to copy: the used space measured on the source; the provisioned capacity of the source is not the amount of data; closed when the measured amount and the date of the measurement are recorded)
  - (2) change rate: UNKNOWN — supplied by Data Architect (how much data the writers of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this change per hour; closed when the rate measured over a representative period is recorded, with the time a final pass needs at that rate)
  - (3) write-freeze window: UNKNOWN — supplied by Data Architect (the window in which the writers of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this stop for the final pass; closed when the owner of the application agrees the start and the end of the window and it is recorded)
  - (4) last sync: UNKNOWN — supplied by Data Architect (the time the final pass ends and its checks hold; closed when the time of the final pass and the result of its checks are recorded)
  - (5) return point: UNKNOWN — supplied by Data Architect (the state of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this the migration returns to on a rollback: the source as it was at the write freeze, or a named snapshot or backup; closed when the return point is recorded with its time and how it is restored)
  - the checks of the copy:
  - (1) consistency check: UNKNOWN — supplied by Data Architect (how the copy of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is shown complete and unchanged after the final pass: the used space and a checksum of the data (of the files, or the row counts of the tables) agree with the source; closed when the method is agreed and its result after the final pass is recorded)
  - (2) validation on the target: UNKNOWN — supplied by Migration Owner (the test the application that uses module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this passes on STACKIT with the copied data before the cutover, agreed with the owner of the application; closed when the test passes on the target and its result is recorded)
- Done when: the export of the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) is COMPLETED and its manifest-summary.json states the item count that the comparison uses
- Source: `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`
- After: the write freeze of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`; it also comes after the write freeze of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: no service level agreement guarantees the completion time of an export (AWS: How export to S3 works), so the plan cannot compute how long the freeze lasts: it lasts at least as long as the export, the conversion and the import together
- Risk: an export is not transactionally consistent: a transaction can be torn between two exports (AWS: Requesting a table export); with the writers stopped before the export no transaction is in flight, which is why the export is inside the freeze and not before it
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, not of the path the draft carries out by default
- Rollback (manual): nothing changed on either side: the writers are stopped, not removed, the table is untouched and the export is a read; delete the exported objects from the bucket before another attempt. The way back:
  - (1) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is kept is recorded)
  - (2) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
  - (3) data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

#### The conversion of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own (`MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/transform/own-tool`)

- Phase: Cutover
- What: Convert the export of the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) into documents of the collection of stackit_mongodbflex_instance.dynamodb_tables with a script of your own: unwrap the type descriptors of the DynamoDB JSON (S, N, B, BOOL, NULL, M, L, SS, NS, BS) into BSON values; make the key id the _id (or a unique index on id); keep numbers in the BSON type that holds them: a DynamoDB number has up to 38 digits of precision and a decimal128 has 34, so a value of more than 34 significant digits cannot be a decimal128 without rounding (keep it as a string, as AWS advises beyond 38 digits, or report it); turn a string set, a number set and a binary set (SS, NS, BS) into an array: a set holds unique values in no order and an array does not, so the application code that relies on set operations changes; plan the secondary indexes global secondary index idx_global_customerId (customerId) as MongoDB indexes on the collection (a local index shares the key of the table, so its index leads with the table's partition key); projections are not carried (a MongoDB index finds whole documents); the item size needs no check in this direction: DynamoDB holds an item of up to 400 KB and a BSON document holds up to 16 mebibytes; the consistency the application needs is its own decision: a read of DynamoDB is eventually consistent unless the request asks for a strongly consistent read, and a global secondary index is eventually consistent only; MongoDB's read concern and read preference are chosen by the application's driver. Runbook section: `terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#conversion-own-tool`.
- Why: a DynamoDB item is not a document: the export wraps each value in a type descriptor and DynamoDB has types, keys, indexes and expiry that MongoDB holds differently; nothing in a copy tool names these, so the plan states each one this table has
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the script and the MongoDB driver it uses, the collection name, and for each attribute that holds a number the largest number of digits it ever holds
- Done when: every item of the export of the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) is converted into a document, or is reported with the reason it was not (a number of more than 34 digits, an item the script cannot read), and the count of documents plus the count of reports equals the itemCount of the export
- Source: `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`
- After: the export of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`; it also comes after the export of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: a DynamoDB number of more than 34 significant digits does not fit a decimal128: the plan cannot see the values, so the script counts such values and either keeps them as strings or reports them
- Risk: a set (SS, NS, BS) becomes an array: unique values and no order are guarantees of a set that an array does not give
- Risk: the conversion is the script of a person; the plan names what it must handle and runs nothing
- Risk: a global secondary index of DynamoDB is eventually consistent and may be sparse; a MongoDB index is updated with the write, and an item without the index's attributes is left out of a partial or sparse index only if the person builds it so
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, not of the path the draft carries out by default
- Rollback (manual): the conversion only reads the export and writes files: delete them, the table and the instance are untouched

#### The final copy of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own (`MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/final-sync/own-tool`)

- Phase: Cutover
- What: Load the documents of the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) into the collection of stackit_mongodbflex_instance.dynamodb_tables (STACKIT MongoDB Flex) with a MongoDB client of your choice (mongoimport, or a driver script), then create its indexes. Runbook section: `terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#final-sync-own-tool`.
- Why: the draft creates the instance empty; the STACKIT documentation read documents no import of a dump into MongoDB Flex (the service has no restore-from-source attribute), so the plan names no tool of the service and writes no command of its own: the instance is a MongoDB instance and a MongoDB client reaches it at the host and port of its user
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the converted documents, the user and the access list of the instance (the draft's acl variable lists the networks that may connect), and the indexes the conversion named; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: every document of the conversion of the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) is in the collection and the indexes the conversion named exist: the keys, then the index of the global secondary index idx_global_customerId (customerId)
- Source: `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`
- After: the conversion of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`; it also comes after the conversion of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: build the indexes after the load, not before it: each index is built once over loaded documents (MongoDB allows at most 64 indexes on a collection)
- Risk: the draft lists the clients that may connect as the variable acl and gives no user: the person creates the user of the instance and the clients (the load and the applications) come from networks that list contains
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, not of the path the draft carries out by default
- Rollback (manual): the writers are stopped, not removed, and nothing the plan does changes the source, so the source is the way back until the reconcile records GO: put the writers back on it; before another attempt remove what the tool wrote into stackit_mongodbflex_instance.dynamodb_tables (the draft created it empty); check that the tool you chose does not change the source, since the plan knows nothing of it

#### The data reconciliation of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own (`MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/reconcile/own-tool`)

- Phase: Cutover
- What: Reconcile the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) and the collection of stackit_mongodbflex_instance.dynamodb_tables with the writers stopped: the number of documents in the collection must equal the itemCount of the export (manifest-summary.json), less the items the conversion reported, a sample of keys must read the same items on both sides, and the application's read of one item must return the same on both; record GO or NO-GO. Runbook section: `terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#reconcile-own-tool`.
- Why: the copy is made by a tool the plan knows nothing of, so the plan states no check of that tool; the comparison of the two sides with the writers stopped is the check that does not depend on it
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to
- Done when: the records and the sample match on both sides, the read the application does returns the same on both, and the owner records GO
- Checks after the transfer (4, the owner records GO only when every one passes): written once, in `terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md`, the section "Verification: the checks after the transfer" under "Reconcile (own-tool)", with the id, the command, the expected result and what is not provided of each; execution-plan.json holds the same checks as data
- Source: `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`
- After: the final copy of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`; it also comes after the final copy of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, not of the path the draft carries out by default
- Rollback (manual): NO-GO: start the writers again against the untouched source; the target holds only a copy

#### The final copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore (`MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/dump-restore`)

- Phase: Cutover
- What: Inside the freeze, dump module.dependencies.module.orders_rds.aws_rds_cluster.this and restore the dump into stackit_postgresflex_instance.dependencies_orders_rds_this, and settle every error of the restore. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#method-a-dumprestore`.
- Why: the dump is a consistent snapshot of the moment it starts; inside the freeze it is the final state of the source
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the customer's statements in inputs.yaml: source.dataset.downtime; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: pg_restore finished and every error in restore.log is settled
- Source: `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- After: the write freeze of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`; it also comes after the write freeze of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: the freeze lasts as long as the dump and the restore
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Rollback (manual): the source is current to the freeze and untouched: put the writers back on it; drop and recreate the target database for another attempt

#### The data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore (`MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/dump-restore`)

- Phase: Cutover
- What: Reconcile module.dependencies.module.orders_rds.aws_rds_cluster.this and stackit_postgresflex_instance.dependencies_orders_rds_this with the writers stopped (row counts, checksums, sequences and one query the application runs) and record GO or NO-GO. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#verify-with-the-application`.
- Why: the move is accepted only when the numbers equal on both sides; a mismatch is a NO-GO
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to
- Done when: counts, checksums, sequences and the application query agree: GO
- Checks after the transfer (5, the owner records GO only when every one passes): written once, in `terraform/handover/database-dependencies_orders_rds_this/data-move.md`, the section "Checks after the transfer", with the id, the command, the expected result and what is not provided of each; execution-plan.json holds the same checks as data
- Source: `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- After: the final copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`; it also comes after the final copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Rollback (manual): on NO-GO take the rollback without switching anything: the clients still point at the source, which is current to the freeze

#### The final copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication (`MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/logical-replication`)

- Phase: Cutover
- What: Inside the freeze, wait until the replication of module.dependencies.module.orders_rds.aws_rds_cluster.this has no lag, copy the sequences to stackit_postgresflex_instance.dependencies_orders_rds_this and disable the subscription. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#cutover-window`.
- Why: sequences are not replicated: without setval the first insert on the target repeats a key
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the customer's statements in inputs.yaml: source.dataset.downtime; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: the lag was 0, the sequences on the target are not lower than the source's, the subscription is disabled
- Source: `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- After: the write freeze of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`; it also comes after the write freeze of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path replicate-with-the-engine-replication of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Rollback (manual): the slot is still on the source and the source untouched: put the writers back on the source

#### The data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication (`MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/logical-replication`)

- Phase: Cutover
- What: Reconcile module.dependencies.module.orders_rds.aws_rds_cluster.this and stackit_postgresflex_instance.dependencies_orders_rds_this with the writers stopped (row counts, checksums, sequences and one query the application runs) and record GO or NO-GO. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#verify-with-the-application`.
- Why: the move is accepted only when the numbers equal on both sides; a mismatch is a NO-GO
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to
- Done when: counts, checksums, sequences and the application query agree: GO
- Checks after the transfer (7, the owner records GO only when every one passes): written once, in `terraform/handover/database-dependencies_orders_rds_this/data-move.md`, the section "Checks after the transfer", with the id, the command, the expected result and what is not provided of each; execution-plan.json holds the same checks as data
- Source: `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- After: the final copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`; it also comes after the final copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path replicate-with-the-engine-replication of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Rollback (manual): on NO-GO take the rollback without switching anything: the clients still point at the source, which is current to the freeze

#### The final copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own (`MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/own-tool`)

- Phase: Cutover
- What: Copy the data of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this with the migration tool or the replication you chose: write its steps, the checks before the move, the freeze window it needs and the way back
- Why: the draft creates the instance empty and the plan knows nothing of a tool of your own, so it holds the step and the person who chose the tool writes the steps
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the tool, its steps, the checks before the move, the freeze window and the way back, from the person who runs it; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: the data of module.dependencies.module.orders_rds.aws_rds_cluster.this is in stackit_postgresflex_instance.dependencies_orders_rds_this and the checks of the tool hold
- Source: `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- After: the write freeze of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`; it also comes after the write freeze of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Rollback (manual): the writers are stopped, not removed, and nothing the plan does changes the source, so the source is the way back until the reconcile records GO: put the writers back on it; before another attempt drop what the tool wrote into the databases of stackit_postgresflex_instance.dependencies_orders_rds_this (the draft created them empty); check that the tool you chose does not change the source, since the plan knows nothing of it

#### The data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own (`MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/own-tool`)

- Phase: Cutover
- What: Reconcile module.dependencies.module.orders_rds.aws_rds_cluster.this and stackit_postgresflex_instance.dependencies_orders_rds_this with the writers stopped (row counts, checksums, sequences and one query the application runs) and record GO or NO-GO. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#verify-with-the-application`.
- Why: the move is accepted only when the numbers equal on both sides; a mismatch is a NO-GO
- Who: Data Architect
- When: Timing to be scheduled by the owner
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to
- Done when: counts, checksums, sequences and the application query agree: GO
- Checks after the transfer (5, the owner records GO only when every one passes): written once, in `terraform/handover/database-dependencies_orders_rds_this/data-move.md`, the section "Checks after the transfer", with the id, the command, the expected result and what is not provided of each; execution-plan.json holds the same checks as data
- Source: `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- After: the final copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`; it also comes after the final copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Rollback (manual): on NO-GO take the rollback without switching anything: the clients still point at the source, which is current to the freeze

</details>

### `WP-29` — Move the data and the objects to the target

- Owner: Migration Owner
- Steps: 10 (10 require a design decision)
- Affected resources: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- Rests on: `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`
- Waits for: `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`
- State: waits for decisions
- Done when: no client writes to the source, for each of its steps.

<details>
<summary>The 10 steps of WP-29</summary>

#### The write freeze of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine (`MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/client-import`)

- Phase: Cutover
- What: Freeze the writers of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: `terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#write-freeze-client-import`.
- Why: the last copy and the comparison of the two sides are made with the writers stopped, and the source stays untouched so the way back needs nothing on the source
- Document: `terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md`
- Who: Migration Owner
- When: Timing to be scheduled by the owner
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: no client writes to the source
- Source: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
- After: the OpenTofu step for stackit_opensearch_credential.dependencies_catalog_opensearch_this, the OpenTofu step for stackit_opensearch_instance.dependencies_catalog_opensearch_this
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, not of the path the draft carries out by default
- Rollback (manual): start the writers again against the source: nothing was changed

#### The write freeze of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own (`MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/own-tool`)

- Phase: Cutover
- What: Freeze the writers of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: `terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#write-freeze-own-tool`.
- Why: the last copy and the comparison of the two sides are made with the writers stopped, and the source stays untouched so the way back needs nothing on the source
- Who: Migration Owner
- When: Timing to be scheduled by the owner
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: no client writes to the source
- Source: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
- After: the OpenTofu step for stackit_opensearch_credential.dependencies_catalog_opensearch_this, the OpenTofu step for stackit_opensearch_instance.dependencies_catalog_opensearch_this
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, not of the path the draft carries out by default
- Rollback (manual): start the writers again against the source: nothing was changed

#### The write freeze of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore (`MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/dump-restore`)

- Phase: Cutover
- What: List who writes (`SELECT user, host, db, command, COUNT(*) FROM information_schema.processlist WHERE db IN ('\<database-1>', '\<database-2>') GROUP BY 1, 2, 3, 4;`) and record the connection settings of every client where they can be restored from. Then stop the writers at the application (services, jobs, migrations, cron, replicas that write). Do not make the source read-only and do not change it. Check: `SELECT COUNT(*) FROM information_schema.processlist WHERE db IN ('\<database-1>', '\<database-2>') AND command <> 'Sleep' AND id <> CONNECTION_ID();` is 0. Runbook section: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md#write-freeze-dump-restore`.
- Why: the source stays read-write and untouched, so the way back needs nothing on the source; with the writers stopped no ALTER, CREATE, DROP, RENAME or TRUNCATE runs during the dump
- Who: Migration Owner
- When: Timing to be scheduled by the owner
- Needs: the customer's statements in inputs.yaml: source.dataset.downtime; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: no client writes to the source
- Source: `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
- After: the data rehearsal of module.dependencies.module.catalog_rds.aws_rds_cluster.this
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`; it also comes after the data rehearsal of module.dependencies.module.catalog_rds.aws_rds_cluster.this, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.catalog_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Rollback (manual): start the writers again against the source: nothing was changed

#### The write freeze of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own (`MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/own-tool`)

- Phase: Cutover
- What: List who writes (`SELECT user, host, db, command, COUNT(*) FROM information_schema.processlist WHERE db IN ('\<database-1>', '\<database-2>') GROUP BY 1, 2, 3, 4;`) and record the connection settings of every client where they can be restored from. Then stop the writers at the application (services, jobs, migrations, cron, replicas that write). Do not make the source read-only and do not change it. Check: `SELECT COUNT(*) FROM information_schema.processlist WHERE db IN ('\<database-1>', '\<database-2>') AND command <> 'Sleep' AND id <> CONNECTION_ID();` is 0. Runbook section: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md#write-freeze-own-tool`.
- Why: the source stays read-write and untouched, so the way back needs nothing on the source; with the writers stopped no ALTER, CREATE, DROP, RENAME or TRUNCATE runs during the dump
- Who: Migration Owner
- When: Timing to be scheduled by the owner
- Needs: the customer's statements in inputs.yaml: source.dataset.downtime; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: no client writes to the source
- Source: `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
- After: the data rehearsal of module.dependencies.module.catalog_rds.aws_rds_cluster.this
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`; it also comes after the data rehearsal of module.dependencies.module.catalog_rds.aws_rds_cluster.this, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.catalog_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Rollback (manual): start the writers again against the source: nothing was changed

#### The write freeze of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine (`MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/write-freeze/client-import`)

- Phase: Cutover
- What: Freeze the writers of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#write-freeze-client-import`.
- Why: the last copy and the comparison of the two sides are made with the writers stopped, and the source stays untouched so the way back needs nothing on the source
- Who: Migration Owner
- When: Timing to be scheduled by the owner
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: no client writes to the source
- Source: `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
- After: the data rehearsal of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the OpenTofu step for stackit_valkey_instance.dependencies_checkout_elasticache_redis_default
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`; it also comes after the data rehearsal of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, not of the path the draft carries out by default
- Rollback (manual): start the writers again against the source: nothing was changed

#### The write freeze of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own (`MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/write-freeze/own-tool`)

- Phase: Cutover
- What: Freeze the writers of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#write-freeze-own-tool`.
- Why: the last copy and the comparison of the two sides are made with the writers stopped, and the source stays untouched so the way back needs nothing on the source
- Who: Migration Owner
- When: Timing to be scheduled by the owner
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: no client writes to the source
- Source: `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
- After: the data rehearsal of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the OpenTofu step for stackit_valkey_instance.dependencies_checkout_elasticache_redis_default
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`; it also comes after the data rehearsal of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, not of the path the draft carries out by default
- Rollback (manual): start the writers again against the source: nothing was changed

#### The write freeze of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own (`MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/write-freeze/own-tool`)

- Phase: Cutover
- What: Freeze the writers of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: `terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#write-freeze-own-tool`.
- Why: the last copy and the comparison of the two sides are made with the writers stopped, and the source stays untouched so the way back needs nothing on the source
- Document: `terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md`
- Who: Migration Owner
- When: Timing to be scheduled by the owner
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: no client writes to the source
- Source: `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`
- After: the OpenTofu step for stackit_mongodbflex_instance.dynamodb_tables
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, not of the path the draft carries out by default
- Rollback (manual): start the writers again against the source: nothing was changed

#### The write freeze of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore (`MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/dump-restore`)

- Phase: Cutover
- What: Freeze the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#cutover-window`.
- Why: the source stays read-write and untouched, so the way back needs nothing on the source
- Who: Migration Owner
- When: Timing to be scheduled by the owner
- Needs: the customer's statements in inputs.yaml: source.dataset.downtime; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: no client writes to the source
- Source: `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- After: the data rehearsal of module.dependencies.module.orders_rds.aws_rds_cluster.this
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`; it also comes after the data rehearsal of module.dependencies.module.orders_rds.aws_rds_cluster.this, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Rollback (manual): start the writers again against the source: nothing was changed

#### The write freeze of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication (`MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/logical-replication`)

- Phase: Cutover
- What: Freeze the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#cutover-window`.
- Why: the source stays read-write and untouched, so the way back needs nothing on the source
- Who: Migration Owner
- When: Timing to be scheduled by the owner
- Needs: the customer's statements in inputs.yaml: source.dataset.downtime; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: no client writes to the source
- Source: `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- After: the replication watch of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`; it also comes after the replication watch of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path replicate-with-the-engine-replication of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Rollback (manual): start the writers again against the source: nothing was changed

#### The write freeze of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own (`MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/own-tool`)

- Phase: Cutover
- What: Freeze the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#cutover-window`.
- Why: the source stays read-write and untouched, so the way back needs nothing on the source
- Who: Migration Owner
- When: Timing to be scheduled by the owner
- Needs: the customer's statements in inputs.yaml: source.dataset.downtime; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: no client writes to the source
- Source: `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- After: the data rehearsal of module.dependencies.module.orders_rds.aws_rds_cluster.this
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`; it also comes after the data rehearsal of module.dependencies.module.orders_rds.aws_rds_cluster.this, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path migrate-with-a-tool-of-my-own of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Rollback (manual): start the writers again against the source: nothing was changed

</details>

### `WP-30` — Switch the data consumers to the target

- Owner: Data Architect
- Steps: 4 (4 require a design decision)
- Affected resources: `module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- Target: `stackit_mariadb_instance.dependencies_catalog_rds_this`, `stackit_mongodbflex_instance.dynamodb_tables`, `stackit_postgresflex_database.dependencies_orders_rds_this_orders`, `stackit_postgresflex_instance.dependencies_orders_rds_this`, `stackit_valkey_instance.dependencies_checkout_elasticache_redis_default`
- Waits for: `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`
- State: waits for decisions
- Done when: each step meets the condition stated with it below (4 different conditions).

<details>
<summary>The 4 steps of WP-30</summary>

#### The switch of the applications that use module.dependencies.module.catalog_rds.aws_rds_cluster.this (`MAN/cutover/connection/module.dependencies.module.catalog_rds.aws_rds_cluster.this`)

- Phase: Cutover
- What: Switch the connection of the applications of module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) to its STACKIT copy stackit_mariadb_instance.dependencies_catalog_rds_this: change the connection string (host, port, database name and credentials) in the configuration of every application that uses it (the source references it from module.retail_app_ecs.aws_secretsmanager_secret.catalog_db; an application outside the source is not read). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.dependencies.module.catalog_rds.aws_rds_cluster.this.endpoint (host): stackit_mariadb_credential.dependencies_catalog_rds_this.host; module.dependencies.module.catalog_rds.aws_rds_cluster.this.reader_endpoint (reader endpoint): stackit_mariadb_instance.dependencies_catalog_rds_this has no reader endpoint attribute (its connection_info holds the write endpoint only); module.dependencies.module.catalog_rds.aws_rds_cluster.this.port (port): stackit_mariadb_credential.dependencies_catalog_rds_this.port; module.dependencies.module.catalog_rds.aws_rds_cluster.this.database_name (database name): the name of a database of the instance: the draft writes no database block for this unit; module.dependencies.module.catalog_rds.aws_rds_cluster.this.master_username (user name): stackit_mariadb_credential.dependencies_catalog_rds_this.username. Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, attribute secret_string in module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db reads module.dependencies.module.catalog_rds.aws_rds_cluster.this through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read
- Why: the copy on STACKIT is used only once the applications connect to it: until then they read and write module.dependencies.module.catalog_rds.aws_rds_cluster.this in AWS, and the copy drifts from the source
- Who: Data Architect
- When: after the data move, in the maintenance window, before the checks of the verification
- Needs: the applications outside the source that use module.dependencies.module.catalog_rds.aws_rds_cluster.this and where each one configures the connection string (host, port, database name and credentials); the places the source reads are in the step, and the values of stackit_mariadb_instance.dependencies_catalog_rds_this and its credentials; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: every application that used module.dependencies.module.catalog_rds.aws_rds_cluster.this connects to stackit_mariadb_instance.dependencies_catalog_rds_this, and module.dependencies.module.catalog_rds.aws_rds_cluster.this receives no reads or writes (its connection or request metrics show none)
- Source: `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
- Target: `stackit_mariadb_instance.dependencies_catalog_rds_this`
- After: the data preflight of module.dependencies.module.catalog_rds.aws_rds_cluster.this, the data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore, the data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own, the OpenTofu step for stackit_mariadb_credential.dependencies_catalog_rds_this, the OpenTofu step for stackit_mariadb_instance.dependencies_catalog_rds_this
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`; it also comes after the data preflight of module.dependencies.module.catalog_rds.aws_rds_cluster.this, the data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore, the data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own, manual prerequisites; and, as the plan states: the risks listed below
- Risk: the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures module.dependencies.module.catalog_rds.aws_rds_cluster.this
- Rollback (manual): change the configuration of the applications back to module.dependencies.module.catalog_rds.aws_rds_cluster.this: it stays in place until the GO of the rollback decision step; what they wrote to stackit_mariadb_instance.dependencies_catalog_rds_this in the meantime is not in AWS. The way back:
  - (1) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.catalog_rds.aws_rds_cluster.this is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.catalog_rds.aws_rds_cluster.this is kept is recorded)
  - (2) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
  - (3) data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.catalog_rds.aws_rds_cluster.this before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

#### The switch of the applications that use module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (`MAN/cutover/connection/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`)

- Phase: Cutover
- What: Switch the connection of the applications of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) to its STACKIT copy stackit_valkey_instance.dependencies_checkout_elasticache_redis_default: change the endpoint (host and port) and the password or auth token in the configuration of every application that uses it (the source references it from module.retail_app_ecs.module.checkout_service.aws_ecs_service.this; an application outside the source is not read). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default.primary_endpoint_address (host), module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default.configuration_endpoint_address (host), module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default.reader_endpoint_address (reader endpoint), module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default.port (port): stackit_valkey_instance.dependencies_checkout_elasticache_redis_default has no host or port attribute (and no reader endpoint): the host and port are attributes of a stackit_valkey_credential, which the draft writes for the instance, and the provider schema gives host and load_balanced_host no description and no STACKIT page read says which of them a client connects to, so none is mapped. Where the source reads it, and what each place reads after the switch: (1) module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu, attribute alarm_name reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (2) module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu, attribute dimensions reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (3) module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory, attribute alarm_name reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (4) module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory, attribute dimensions reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (5) module.dependencies.module.checkout_elasticache_redis.module.dns.aws_route53_record.default, attribute records reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (6) module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read
- Why: the copy on STACKIT is used only once the applications connect to it: until then they read and write module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default in AWS, and the copy drifts from the source
- Who: Data Architect
- When: after the data move, in the maintenance window, before the checks of the verification
- Needs: the applications outside the source that use module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default and where each one configures the endpoint (host and port) and the password or auth token; the places the source reads are in the step, and the values of stackit_valkey_instance.dependencies_checkout_elasticache_redis_default and its credentials; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: every application that used module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default connects to stackit_valkey_instance.dependencies_checkout_elasticache_redis_default, and module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default receives no reads or writes (its connection or request metrics show none)
- Source: `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
- Target: `stackit_valkey_instance.dependencies_checkout_elasticache_redis_default`
- After: the data preflight of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine, the data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own, the OpenTofu step for stackit_valkey_credential.dependencies_checkout_elasticache_redis_default, the OpenTofu step for stackit_valkey_instance.dependencies_checkout_elasticache_redis_default
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`; it also comes after the data preflight of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine, the data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own, manual prerequisites; and, as the plan states: the risks listed below
- Risk: the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default
- Rollback (manual): change the configuration of the applications back to module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: it stays in place until the GO of the rollback decision step; what they wrote to stackit_valkey_instance.dependencies_checkout_elasticache_redis_default in the meantime is not in AWS. The way back:
  - (1) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is kept is recorded)
  - (2) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
  - (3) data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

#### The switch of the applications that use module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (`MAN/cutover/connection/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`)

- Phase: Cutover
- What: Switch the applications of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) to its STACKIT copy stackit_mongodbflex_instance.dynamodb_tables: this is a change of code before it is a change of configuration. Rewrite the data access layer of every application that uses it (the source references it from module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.carts_service.aws_iam_role.task_role, module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; an application outside the source is not read) from the DynamoDB API (GetItem, PutItem, UpdateItem, DeleteItem, Query, Scan, BatchWriteItem, TransactWriteItems, condition and update expressions) to a MongoDB driver, then change the connection string of the instance, the collection name and the credentials
- Why: the copy on STACKIT is used only once the applications connect to it: until then they read and write module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this in AWS, and the copy drifts from the source
- Who: Data Architect
- When: after the data move, in the maintenance window, before the checks of the verification
- Needs: the applications that use module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this and the calls of the DynamoDB API each one makes, the MongoDB driver each one will use, and the values of stackit_mongodbflex_instance.dynamodb_tables and its credentials; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: every application that used module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this runs its rewritten data access layer against stackit_mongodbflex_instance.dynamodb_tables and its tests pass there, and module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this receives no reads or writes (its request metrics show none)
- Source: `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`
- Target: `stackit_mongodbflex_instance.dynamodb_tables`
- After: the export of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own, the data reconciliation of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own, the OpenTofu step for stackit_mongodbflex_instance.dynamodb_tables
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`; it also comes after the export of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own, the data reconciliation of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own, manual prerequisites; and, as the plan states: the risks listed below
- Risk: the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this
- Risk: the table moves as an alternative, not an equivalent: key design, capacity modes, conditional writes and transaction semantics do not carry over (the knowledge base, rule aws.dynamodb_table, REDESIGN), so the code change is built and tested against the STACKIT instance before the window in which this step runs
- Rollback (manual): change the configuration of the applications back to module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this: it stays in place until the GO of the rollback decision step; what they wrote to stackit_mongodbflex_instance.dynamodb_tables in the meantime is not in AWS. The way back:
  - (1) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is kept is recorded)
  - (2) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
  - (3) data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

#### The switch of the applications that use module.dependencies.module.orders_rds.aws_rds_cluster.this (`MAN/cutover/connection/module.dependencies.module.orders_rds.aws_rds_cluster.this`)

- Phase: Cutover
- What: Switch the connection of the applications of module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) to its STACKIT copy stackit_postgresflex_instance.dependencies_orders_rds_this, stackit_postgresflex_database.dependencies_orders_rds_this_orders: change the connection string (host, port, database name and credentials) in the configuration of every application that uses it (the source references it from module.retail_app_ecs.aws_secretsmanager_secret.orders_db; an application outside the source is not read). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.dependencies.module.orders_rds.aws_rds_cluster.this.endpoint (host): stackit_postgresflex_instance.dependencies_orders_rds_this.connection_info.write.host; module.dependencies.module.orders_rds.aws_rds_cluster.this.reader_endpoint (reader endpoint): stackit_postgresflex_instance.dependencies_orders_rds_this has no reader endpoint attribute (its connection_info holds the write endpoint only); module.dependencies.module.orders_rds.aws_rds_cluster.this.port (port): stackit_postgresflex_instance.dependencies_orders_rds_this.connection_info.write.port; module.dependencies.module.orders_rds.aws_rds_cluster.this.database_name (database name): stackit_postgresflex_database.dependencies_orders_rds_this_orders.name; module.dependencies.module.orders_rds.aws_rds_cluster.this.master_username (user name): stackit_postgresflex_user.dependencies_orders_rds_this.username (its password is a sensitive attribute of the same block: it is read from the state or the output the draft writes, never copied into a configuration by hand). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.aws_secretsmanager_secret.orders_db, attribute secret_string in module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db reads module.dependencies.module.orders_rds.aws_rds_cluster.this through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read
- Why: the copy on STACKIT is used only once the applications connect to it: until then they read and write module.dependencies.module.orders_rds.aws_rds_cluster.this in AWS, and the copy drifts from the source
- Who: Data Architect
- When: after the data move, in the maintenance window, before the checks of the verification
- Needs: the applications outside the source that use module.dependencies.module.orders_rds.aws_rds_cluster.this and where each one configures the connection string (host, port, database name and credentials); the places the source reads are in the step, and the values of stackit_postgresflex_instance.dependencies_orders_rds_this, stackit_postgresflex_database.dependencies_orders_rds_this_orders and its credentials; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: every application that used module.dependencies.module.orders_rds.aws_rds_cluster.this connects to stackit_postgresflex_instance.dependencies_orders_rds_this, stackit_postgresflex_database.dependencies_orders_rds_this_orders, and module.dependencies.module.orders_rds.aws_rds_cluster.this receives no reads or writes (its connection or request metrics show none)
- Source: `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- Target: `stackit_postgresflex_database.dependencies_orders_rds_this_orders`, `stackit_postgresflex_instance.dependencies_orders_rds_this`
- After: the data preflight of module.dependencies.module.orders_rds.aws_rds_cluster.this, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own, the OpenTofu step for stackit_postgresflex_database.dependencies_orders_rds_this_orders, the OpenTofu step for stackit_postgresflex_instance.dependencies_orders_rds_this, the OpenTofu step for stackit_postgresflex_user.dependencies_orders_rds_this
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`; it also comes after the data preflight of module.dependencies.module.orders_rds.aws_rds_cluster.this, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own, manual prerequisites; and, as the plan states: the risks listed below
- Risk: the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures module.dependencies.module.orders_rds.aws_rds_cluster.this
- Rollback (manual): change the configuration of the applications back to module.dependencies.module.orders_rds.aws_rds_cluster.this: it stays in place until the GO of the rollback decision step; what they wrote to stackit_postgresflex_instance.dependencies_orders_rds_this, stackit_postgresflex_database.dependencies_orders_rds_this_orders in the meantime is not in AWS. The way back:
  - (1) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.orders_rds.aws_rds_cluster.this is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.orders_rds.aws_rds_cluster.this is kept is recorded)
  - (2) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
  - (3) data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.orders_rds.aws_rds_cluster.this before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

</details>

### `WP-31` — Switch the data consumers to the target

- Owner: Identity Architect
- Steps: 4 (4 require a design decision)
- Affected resources: `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db`, `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch`, `module.retail_app_ecs.aws_secretsmanager_secret.mq`, `module.retail_app_ecs.aws_secretsmanager_secret.orders_db`
- Target: `stackit_secretsmanager_instance.migrated_secrets`
- Waits for: `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- State: waits for decisions
- Done when: each step meets the condition stated with it below (4 different conditions).

<details>
<summary>The 4 steps of WP-31</summary>

#### Alike steps on 4 resources (aws_secretsmanager_secret) — the switch of the applications that use {resource} (`MAN/cutover/connection/{resource}`)

- Phase: Cutover
- What: Switch the applications that read the secret {what} through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read
- Why: the copy on STACKIT is read only once the applications read it there: until then they read {resource} in AWS, and a rotation on either side is not seen by the other
- Who: Identity Architect
- When: after the secret is written on STACKIT, in the maintenance window, before the checks of the verification
- Needs: the applications outside the source that read {resource} and where each one configures its ARN or name (the places the source reads are in the step), and the credentials each application reads the Vault path with (the draft writes one Secrets Manager user, the migration user with write access for the WriteSecret step, and none for an application); the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: every application that read {done when} receives no new read (its CloudTrail events show no GetSecretValue call; CloudTrail records all API calls of Secrets Manager: docs.aws.amazon.com/secretsmanager/latest/userguide/retrieve-ct-entries.html, read 2026-10-31)
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`; it also comes after the cutover readiness step, the {state}, manual prerequisites; and, as the plan states: the risks listed below
- Risk: the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures {resource}
- Risk: the value on STACKIT is the document the person supplied to the WriteSecret step, not a copy kept in step with {resource}: a rotation after the switch happens on STACKIT only
- Rollback (manual): change the configuration of the applications back to the ARN or name of {resource}: it stays in place until the GO of the rollback decision step; a value written to or rotated on STACKIT in the meantime is not in AWS. The way back:
  - (1) source retention: UNKNOWN — supplied by Migration Owner ({resource} is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which {resource} is kept is recorded)
  - (2) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
  - (3) data written to the target: UNKNOWN — supplied by Identity Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to {resource} before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)
- After, for every step: the cutover readiness step, the OpenTofu step for stackit_secretsmanager_instance.migrated_secrets, the OpenTofu step for stackit_secretsmanager_user.migration

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (`MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db`) — {resource} = `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db`; Target: `stackit_secretsmanager_instance.migrated_secrets`; also after: the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, the review of the open settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, the setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db
  - What ({what}): module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (aws_secretsmanager_secret) to its STACKIT copy: change the reference to the secret (its ARN or its name) in the configuration of every application that reads it (the source reads it from module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; an application outside the source is not read) so that it reads the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.retail_app_ecs.aws_secretsmanager_secret.catalog_db.arn (secret's ARN): no ARN exists on STACKIT Secrets Manager; the secret is read by the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this reads module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db
  - Done when ({done when}): module.retail_app_ecs.aws_secretsmanager_secret.catalog_db reads the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id), and module.retail_app_ecs.aws_secretsmanager_secret.catalog_db
  - State ({state}): review of the open settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, the setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db
- The switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (`MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch`) — {resource} = `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch`; Target: `stackit_secretsmanager_instance.migrated_secrets`; also after: the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, the review of the open settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, the setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch
  - What ({what}): module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (aws_secretsmanager_secret) to its STACKIT copy: change the reference to the secret (its ARN or its name) in the configuration of every application that reads it (the source reads it from module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; an application outside the source is not read) so that it reads the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch.arn (secret's ARN): no ARN exists on STACKIT Secrets Manager; the secret is read by the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this reads module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch
  - Done when ({done when}): module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch reads the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch) of stackit_secretsmanager_instance.migrated_secrets (its instance_id), and module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch
  - State ({state}): review of the open settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, the setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch
- The switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.mq (`MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.mq`) — {resource} = `module.retail_app_ecs.aws_secretsmanager_secret.mq`; Target: `stackit_secretsmanager_instance.migrated_secrets`; also after: the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq, the setting `secret-value` of module.retail_app_ecs.aws_secretsmanager_secret.mq, the setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.mq
  - What ({what}): module.retail_app_ecs.aws_secretsmanager_secret.mq (aws_secretsmanager_secret) to its STACKIT copy: change the reference to the secret (its ARN or its name) in the configuration of every application that reads it (the source reads it from module.retail_app_ecs.module.orders_service.aws_ecs_service.this; an application outside the source is not read) so that it reads the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.retail_app_ecs.aws_secretsmanager_secret.mq.arn (secret's ARN): no ARN exists on STACKIT Secrets Manager; the secret is read by the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.orders_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this reads module.retail_app_ecs.aws_secretsmanager_secret_version.mq
  - Done when ({done when}): module.retail_app_ecs.aws_secretsmanager_secret.mq reads the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq) of stackit_secretsmanager_instance.migrated_secrets (its instance_id), and module.retail_app_ecs.aws_secretsmanager_secret.mq
  - State ({state}): setting `secret-value` of module.retail_app_ecs.aws_secretsmanager_secret.mq, the setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.mq
- The switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.orders_db (`MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.orders_db`) — {resource} = `module.retail_app_ecs.aws_secretsmanager_secret.orders_db`; Target: `stackit_secretsmanager_instance.migrated_secrets`; also after: the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db, the setting `secret-value` of module.retail_app_ecs.aws_secretsmanager_secret.orders_db, the setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.orders_db
  - What ({what}): module.retail_app_ecs.aws_secretsmanager_secret.orders_db (aws_secretsmanager_secret) to its STACKIT copy: change the reference to the secret (its ARN or its name) in the configuration of every application that reads it (the source reads it from module.retail_app_ecs.module.orders_service.aws_ecs_service.this; an application outside the source is not read) so that it reads the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.retail_app_ecs.aws_secretsmanager_secret.orders_db.arn (secret's ARN): no ARN exists on STACKIT Secrets Manager; the secret is read by the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.orders_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this reads module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db
  - Done when ({done when}): module.retail_app_ecs.aws_secretsmanager_secret.orders_db reads the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id), and module.retail_app_ecs.aws_secretsmanager_secret.orders_db
  - State ({state}): setting `secret-value` of module.retail_app_ecs.aws_secretsmanager_secret.orders_db, the setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.orders_db

</details>

### `WP-32` — Confirm that the cutover can start and that it is complete

- Owner: Migration Owner
- Steps: 2 (1 requires a design decision, 1 is not executable as the plan stands)
- Waits for: `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- State: not executable as the plan stands (1 of 2 steps)
- Done when: each step meets the condition stated with it below (2 different conditions).

<details>
<summary>The 2 steps of WP-32</summary>

#### The cutover readiness step (`MAN/cutover/readiness`)

- Phase: Cutover
- What: Confirm that every workload step and every data move of the plan is done (the steps this one follows) before the first switch of the cutover: the plan does not know which workloads and data stores each entry point serves, so every switch waits for all of them
- Why: a switch that sends the clients to a workload that is not built yet, or to a store whose data is not moved yet, is an outage; the switches start from one confirmed state
- Who: Migration Owner
- When: after the steps it follows, before the maintenance window of the first switch
- Needs: the state of each step this one follows (done or not), from the people who carry them out
- Done when: every step this one follows is recorded as done, and the owner records that the cutover can start
- After: the data reconciliation of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine, the data reconciliation of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own, the data preflight of module.dependencies.module.catalog_rds.aws_rds_cluster.this, the data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore, the data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own, the data preflight of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine, the data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own, the export of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own, the data reconciliation of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own, the data preflight of module.dependencies.module.orders_rds.aws_rds_cluster.this, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own, the step "Fill in the required inputs of kubernetes/carts/manifests.yaml and apply it to…", the step "Fill in the required inputs of kubernetes/catalog/manifests.yaml and apply it…", the step "Fill in the required inputs of kubernetes/checkout/manifests.yaml and apply it…", the step "Fill in the required inputs of kubernetes/orders/manifests.yaml and apply it to…", the step "Fill in the required inputs of kubernetes/ui/manifests.yaml and apply it to the…"
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`; it also comes after the data reconciliation of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine, the data reconciliation of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own, the data preflight of module.dependencies.module.catalog_rds.aws_rds_cluster.this, the data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore, the data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own, the data preflight of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine, the data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own, the export of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own, the data reconciliation of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own, the data preflight of module.dependencies.module.orders_rds.aws_rds_cluster.this, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own, the step "Fill in the required inputs of kubernetes/carts/manifests.yaml and apply it to…", the step "Fill in the required inputs of kubernetes/catalog/manifests.yaml and apply it…", the step "Fill in the required inputs of kubernetes/checkout/manifests.yaml and apply it…", the step "Fill in the required inputs of kubernetes/orders/manifests.yaml and apply it to…", the step "Fill in the required inputs of kubernetes/ui/manifests.yaml and apply it to the…", manual prerequisites
- Rollback (available): a confirmation changes nothing

#### The cutover completion step (`MAN/cutover/complete`)

- Phase: Cutover
- What: Confirm that every switch of the cutover is done (the steps this one follows) before the checks of the data stores and queues start: the plan does not know which applications use which store, so each such check waits for every switch
- Why: a check of a store's consumers run while some clients still reach AWS reads a mix of both: the checks start from one confirmed state
- Who: Migration Owner
- When: after the steps it follows, at the end of the maintenance window
- Needs: the state of each switch this one follows (done or not), from the people who carry them out
- Done when: every switch this one follows is recorded as done, and the owner records that the cutover is complete
- After: the switch of the applications that use module.dependencies.module.catalog_rds.aws_rds_cluster.this, the switch of the applications that use module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the switch of the applications that use module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, the switch of the applications that use module.dependencies.module.orders_rds.aws_rds_cluster.this, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.mq, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.orders_db, the switch of the consumers of module.dependencies.aws_mq_broker.mq, the drain of the queue of module.dependencies.aws_mq_broker.mq, the traffic switch of module.dependencies.aws_mq_broker.mq, the traffic switch of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the traffic switch of module.retail_app_ecs.module.alb.aws_lb.this
- State: not executable as the plan stands: it waits for step 242, which no answer makes executable as the plan stands; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Rollback (available): a confirmation changes nothing

</details>

### `WP-33` — Switch the clients to the target

- Owner: Network Architect
- Steps: 3 (2 require a design decision, 1 is not executable as the plan stands)
- Affected resources: `module.dependencies.aws_mq_broker.mq`, `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `module.retail_app_ecs.module.alb.aws_lb.this`
- Target: `stackit_application_load_balancer.retail_app_ecs_alb_this`, `stackit_opensearch_instance.dependencies_catalog_opensearch_this`, `stackit_rabbitmq_instance.dependencies_mq`
- Waits for: `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- State: not executable as the plan stands (1 of 3 steps)
- Done when: each step meets the condition stated with it below (3 different conditions).

<details>
<summary>The 3 steps of WP-33</summary>

#### Alike steps on 2 resources (aws_lb, aws_mq_broker) — the traffic switch of {resource} (`MAN/cutover/{resource}`)

- Phase: Cutover
- Who: Network Architect
- When: after the steps it follows, in the maintenance window
- Needs: a maintenance window agreed with the owner of the application, and the TTL of each DNS name the clients resolve for {resource} lowered ahead of the switch (a resolver keeps the old address for one TTL), and the list of the clients outside the source and where each one configures the address (the places the source reads are in the step); the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Risk: the plan does not read whether {resource} is reached from the internet or only inside the network: its clients are switched either way
- Risk: the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures {resource}
- After, for every step: the cutover readiness step

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The traffic switch of module.dependencies.aws_mq_broker.mq (`MAN/cutover/module.dependencies.aws_mq_broker.mq`) — {resource} = `module.dependencies.aws_mq_broker.mq`; Target: `stackit_rabbitmq_instance.dependencies_mq`; also after: the setting `broker-network` of module.dependencies.aws_mq_broker.mq, the review of the open settings of module.dependencies.aws_mq_broker.mq, the review of the open settings of module.dependencies.aws_mq_broker.mq, the review of the open settings of module.dependencies.aws_mq_broker.mq, the OpenTofu step for stackit_rabbitmq_credential.dependencies_mq, the OpenTofu step for stackit_rabbitmq_instance.dependencies_mq
  - What: Switch the producers of module.dependencies.aws_mq_broker.mq (aws_mq_broker) from its AWS address (the instances[*].endpoints of module.dependencies.aws_mq_broker.mq) to the endpoint of the STACKIT instance (the host and port of a credential of stackit_rabbitmq_instance.dependencies_mq (stackit_rabbitmq_credential; the draft writes one for the instance: read its host and port after the apply)): change the clients' configuration (no Route 53 record of the source points to module.dependencies.aws_mq_broker.mq: a DNS record outside the source, or the address the clients are configured with). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.aws_secretsmanager_secret.mq, attribute secret_string in module.retail_app_ecs.aws_secretsmanager_secret_version.mq reads module.dependencies.aws_mq_broker.mq through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read. The consumers stay on the AWS broker until its queues are drained (the drain of the broker), and only then follow
  - Why: the clients of module.dependencies.aws_mq_broker.mq keep reaching AWS until their address is changed: creating the STACKIT resources moves no traffic. The producers move first so that nothing new reaches the AWS broker while its consumers empty it
  - Done when: every producer sends to the STACKIT instance and module.dependencies.aws_mq_broker.mq receives no new message
  - State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`; it also comes after the cutover readiness step, the setting `broker-network` of module.dependencies.aws_mq_broker.mq, the review of the open settings of module.dependencies.aws_mq_broker.mq, the review of the open settings of module.dependencies.aws_mq_broker.mq, the review of the open settings of module.dependencies.aws_mq_broker.mq, manual prerequisites; and, as the plan states: the risks listed below
  - Risk: the queues, exchanges and bindings of the broker (its definitions) exist on the STACKIT instance before the producers move: a message published to an exchange that routes it to no queue is dropped, or returned to a publisher that asks for it (RabbitMQ: publishers), and the plan does not move the definitions with the messages
  - Rollback (manual): change the clients' configuration back to the AWS address (the instances[*].endpoints of module.dependencies.aws_mq_broker.mq): the AWS resources stay in place until the GO of the rollback decision step, so reverting the switch moves the traffic back. The way back:
    - (1) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.aws_mq_broker.mq is not retired until the GO recorded at the rollback decision step; how long it is kept after that is the owner's; closed when the date until which module.dependencies.aws_mq_broker.mq is kept is recorded)
    - (2) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
    - (3) data written to the target: UNKNOWN — supplied by Network Architect (the switch moves requests, not data: whether the switched clients write through the STACKIT address, and where those writes are stored; closed when the owner of the application records whether the clients write and, if they do, whether their writes are copied back to AWS on a rollback or accepted as lost)
- The traffic switch of module.retail_app_ecs.module.alb.aws_lb.this (`MAN/cutover/module.retail_app_ecs.module.alb.aws_lb.this`) — {resource} = `module.retail_app_ecs.module.alb.aws_lb.this`; Target: `stackit_application_load_balancer.retail_app_ecs_alb_this`; also after: the review of the open settings of module.retail_app_ecs.module.alb.aws_lb.this, the review of the open settings of module.retail_app_ecs.module.alb.aws_lb.this, the OpenTofu step for stackit_application_load_balancer.retail_app_ecs_alb_this
  - What: Switch the traffic of module.retail_app_ecs.module.alb.aws_lb.this (aws_lb) from its AWS address (the dns_name of module.retail_app_ecs.module.alb.aws_lb.this) to its STACKIT address (the external_address of stackit_application_load_balancer.retail_app_ecs_alb_this): change the clients' configuration (no Route 53 record of the source points to module.retail_app_ecs.module.alb.aws_lb.this: a DNS record outside the source, or the address the clients are configured with). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.alb.aws_wafv2_web_acl_association.this, attribute resource_arn reads module.retail_app_ecs.module.alb.aws_lb.this.arn (the ARN); after the switch: no ARN exists on STACKIT (the access and wiring steps of the unit decide what replaces it)
  - Why: the clients of module.retail_app_ecs.module.alb.aws_lb.this keep reaching AWS until their address is changed: creating the STACKIT resources moves no traffic
  - Done when: requests of the clients reach the external_address of stackit_application_load_balancer.retail_app_ecs_alb_this (its access logs or metrics show them) and the dns_name of module.retail_app_ecs.module.alb.aws_lb.this receives none
  - State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`; it also comes after the cutover readiness step, the routing precondition of module.vpc.module.vpc.aws_route_table.public, the review of the open settings of module.retail_app_ecs.module.alb.aws_lb.this, the review of the open settings of module.retail_app_ecs.module.alb.aws_lb.this, manual prerequisites; and, as the plan states: the risks listed below
  - Rollback (manual): change the clients' configuration back to the AWS address (the dns_name of module.retail_app_ecs.module.alb.aws_lb.this): the AWS resources stay in place until the GO of the rollback decision step, so reverting the switch moves the traffic back. The way back:
    - (1) source retention: UNKNOWN — supplied by Migration Owner (module.retail_app_ecs.module.alb.aws_lb.this is not retired until the GO recorded at the rollback decision step; how long it is kept after that is the owner's; closed when the date until which module.retail_app_ecs.module.alb.aws_lb.this is kept is recorded)
    - (2) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
    - (3) data written to the target: UNKNOWN — supplied by Network Architect (the switch moves requests, not data: whether the switched clients write through the STACKIT address, and where those writes are stored; closed when the owner of the application records whether the clients write and, if they do, whether their writes are copied back to AWS on a rollback or accepted as lost)

#### The traffic switch of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (`MAN/cutover/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`)

- Phase: Cutover
- What: Switch the clients (the applications that index and search) of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) from its AWS address (the endpoint of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this) to the endpoint of the STACKIT instance (the host and port of a credential of stackit_opensearch_instance.dependencies_catalog_opensearch_this (stackit_opensearch_credential; the draft writes one for the instance: read its host and port after the apply)): change the clients' configuration (no Route 53 record of the source points to module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: a DNS record outside the source, or the address the clients are configured with). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this reads module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read
- Why: the clients of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this keep reaching AWS until their address is changed: creating the STACKIT resources moves no traffic
- Who: Network Architect
- When: after the steps it follows, in the maintenance window
- Needs: a maintenance window agreed with the owner of the application, and the TTL of each DNS name the clients resolve for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this lowered ahead of the switch (a resolver keeps the old address for one TTL), and the list of the clients outside the source and where each one configures the address (the places the source reads are in the step); the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: requests of the clients reach the host and port of a credential of stackit_opensearch_instance.dependencies_catalog_opensearch_this (stackit_opensearch_credential; the draft writes one for the instance: read its host and port after the apply) (its access logs or metrics show them) and the endpoint of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this receives none
- Source: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
- Target: `stackit_opensearch_instance.dependencies_catalog_opensearch_this`
- After: the cutover readiness step, the final copy of the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine, the final copy of the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own, the data reconciliation of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine, the data reconciliation of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own, the write freeze of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine, the write freeze of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own, the setting `encryption-at-rest` of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the review of the open settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the review of the open settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the review of the open settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the refusal of the setting `credentials-and-keys-settings` of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the refusal of the setting `domain-credentials-and-keys` of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the OpenTofu step for stackit_opensearch_credential.dependencies_catalog_opensearch_this, the OpenTofu step for stackit_opensearch_instance.dependencies_catalog_opensearch_this
- State: not executable as the plan stands: the risks listed below; it also waits for `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Risk: the plan does not read whether module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is reached from the internet or only inside the network: its clients are switched either way
- Risk: the plan reads the places of the source that are listed in the step, not an application outside the source and not a value a place builds with a function or a text; the owner of the applications lists what is outside the source and says where each of them configures module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this
- Rollback (manual): change the clients' configuration back to the AWS address (the endpoint of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): the AWS resources stay in place until the GO of the rollback decision step, so reverting the switch moves the traffic back. The way back:
  - (1) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is not retired until the GO recorded at the rollback decision step; how long it is kept after that is the owner's; closed when the date until which module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is kept is recorded)
  - (2) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
  - (3) data written to the target: UNKNOWN — supplied by Network Architect (the switch moves requests, not data: whether the switched clients write through the STACKIT address, and where those writes are stored; closed when the owner of the application records whether the clients write and, if they do, whether their writes are copied back to AWS on a rollback or accepted as lost)

</details>

### `WP-34` — Switch the message producers and consumers to the target

- Owner: Platform Architect
- Steps: 2 (2 require a design decision)
- Affected resources: `module.dependencies.aws_mq_broker.mq`
- Waits for: `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- State: waits for decisions
- Done when: each step meets the condition stated with it below (2 different conditions).

<details>
<summary>The 2 steps of WP-34</summary>

#### The drain of the queue of module.dependencies.aws_mq_broker.mq (`MAN/cutover/messaging-drain/module.dependencies.aws_mq_broker.mq`)

- Phase: Cutover
- What: Drain the queues of the AWS broker module.dependencies.aws_mq_broker.mq (aws_mq_broker): its consumers go on reading them, with no producer sending to the broker any more, until every queue holds no message. Read the depth in CloudWatch: Amazon MQ for RabbitMQ publishes MessageCount (the sum of the ready and the unacknowledged messages) for the broker and, on 3.x brokers, for each queue (the dimensions Queue and VirtualHost; on 4.x brokers the figures of a queue come from the Prometheus endpoint), and Amazon MQ for ActiveMQ publishes QueueSize and InFlightCount for each queue and TotalMessageCount for the broker. An inactive durable topic subscriber (InactiveDurableTopicSubscribersCount) holds messages that only its own client can read: connect it to the AWS broker until it has read them. The plan does not read the names of the queues of the broker
- Why: the messages in module.dependencies.aws_mq_broker.mq are drained, not copied: the definitions of a broker are exported and imported, its messages are not, a message still in a queue when the consumers move is read by nobody, and retiring the broker deletes it
- Who: Platform Architect
- When: after the producers moved, in the maintenance window, before the switch of the consumers
- Needs: the queues of module.dependencies.aws_mq_broker.mq and their consumers, the durable topic subscribers, the longest time the business lets the drain take, and what is done with a message no consumer can process
- Done when: every queue of module.dependencies.aws_mq_broker.mq reports no ready and no unacknowledged (in-flight) message with no producer sending to it, and no inactive durable subscriber holds a message
- Source: `module.dependencies.aws_mq_broker.mq`
- After: the traffic switch of module.dependencies.aws_mq_broker.mq
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`; it also comes after the traffic switch of module.dependencies.aws_mq_broker.mq, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: how long the drain takes is not computable: it depends on the depth of the queues of module.dependencies.aws_mq_broker.mq and on the rate of their consumers, which the source does not state
- Risk: a message that no consumer can process (a poison message) keeps its queue non-empty: the person who runs the drain decides what happens to it, and the plan reads no dead-letter queue of a broker
- Rollback (manual): the drain only reads: point the producers back at module.dependencies.aws_mq_broker.mq (their switch says how); what the consumers already processed is processed, and what the producers sent to the STACKIT instance in the meantime is not in AWS

#### The switch of the consumers of module.dependencies.aws_mq_broker.mq (`MAN/cutover/messaging-consumers/module.dependencies.aws_mq_broker.mq`)

- Phase: Cutover
- What: Switch the consumers of the broker module.dependencies.aws_mq_broker.mq (aws_mq_broker) to the endpoint of the STACKIT instance (the host and port of a credential of stackit_rabbitmq_instance.dependencies_mq (stackit_rabbitmq_credential; the draft writes one for the instance: read its host and port after the apply)) once every queue of the AWS broker is empty: change the endpoint and the credentials in their configuration, start them against the STACKIT instance and stop the consumers that read the AWS broker
- Why: the consumers read the AWS broker module.dependencies.aws_mq_broker.mq until their configuration points to the STACKIT instance; they move after its queues are empty so that no message stays behind
- Who: Platform Architect
- When: after the drain, in the maintenance window, before the checks of the verification
- Needs: the consumers of module.dependencies.aws_mq_broker.mq and where each one configures the endpoint and the credentials, and the values of the STACKIT instance (its credential: the broker users are not carried); the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: every consumer of module.dependencies.aws_mq_broker.mq reads from the STACKIT instance and none reads the AWS broker, and the AWS broker stays empty
- Source: `module.dependencies.aws_mq_broker.mq`
- After: the drain of the queue of module.dependencies.aws_mq_broker.mq
- State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`; it also comes after the drain of the queue of module.dependencies.aws_mq_broker.mq, a manual prerequisite; and, as the plan states: the risks listed below
- Risk: the plan does not read which applications consume from module.dependencies.aws_mq_broker.mq or where they configure it: the owner of the application lists them
- Rollback (manual): change the consumers back to module.dependencies.aws_mq_broker.mq: its queues are empty and it stays in place until the GO of the rollback decision step, and the producers are switched back as their own step says; what the producers sent to the STACKIT instance in the meantime is not in AWS. The way back:
  - (1) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.aws_mq_broker.mq is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.aws_mq_broker.mq is kept is recorded)
  - (2) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
  - (3) data written to the target: UNKNOWN — supplied by Platform Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.aws_mq_broker.mq before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

</details>

### `WP-35` — Check the migrated estate and decide go or rollback

- Owner: Data Architect
- Steps: 5 (5 are not executable as the plan stands)
- Affected resources: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- Target: `stackit_mariadb_instance.dependencies_catalog_rds_this`, `stackit_mongodbflex_instance.dynamodb_tables`, `stackit_opensearch_instance.dependencies_catalog_opensearch_this`, `stackit_postgresflex_database.dependencies_orders_rds_this_orders`, `stackit_postgresflex_instance.dependencies_orders_rds_this`, `stackit_valkey_instance.dependencies_checkout_elasticache_redis_default`
- Waits for: `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- State: not executable as the plan stands
- Done when: the counts of the source and the target agree, the application reads the migrated records and a test write is read back, for each of its steps.

<details>
<summary>The 5 steps of WP-35</summary>

#### The data check of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (`MAN/verify/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`)

- Phase: Verification
- What: Check that the application reads the data migrated from module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) on its STACKIT target stackit_opensearch_instance.dependencies_catalog_opensearch_this and that what it writes there is read back
- Why: the data move of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is done only when its consumers work on the copy: a partial copy or a write that still goes to AWS shows here, before the source is retired
- Who: Data Architect
- When: after the cutover and the data move
- Needs: the reads and writes that show the data is complete (row or object counts of the source and the target, a test record), from the owner of the data
- Done when: the counts of the source and the target agree, the application reads the migrated records and a test write is read back
- Source: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
- Target: `stackit_opensearch_instance.dependencies_catalog_opensearch_this`
- After: the cutover completion step, the data reconciliation of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine, the data reconciliation of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own, the OpenTofu step for stackit_opensearch_credential.dependencies_catalog_opensearch_this, the OpenTofu step for stackit_opensearch_instance.dependencies_catalog_opensearch_this
- State: not executable as the plan stands: it waits for step 244, which no answer makes executable as the plan stands; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Rollback (available): a check changes nothing; remove the test record it wrote

#### The data check of module.dependencies.module.catalog_rds.aws_rds_cluster.this (`MAN/verify/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this`)

- Phase: Verification
- What: Check that the application reads the data migrated from module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) on its STACKIT target stackit_mariadb_instance.dependencies_catalog_rds_this and that what it writes there is read back
- Why: the data move of module.dependencies.module.catalog_rds.aws_rds_cluster.this is done only when its consumers work on the copy: a partial copy or a write that still goes to AWS shows here, before the source is retired
- Who: Data Architect
- When: after the cutover and the data move
- Needs: the reads and writes that show the data is complete (row or object counts of the source and the target, a test record), from the owner of the data
- Done when: the counts of the source and the target agree, the application reads the migrated records and a test write is read back
- Source: `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
- Target: `stackit_mariadb_instance.dependencies_catalog_rds_this`
- After: the cutover completion step, the data preflight of module.dependencies.module.catalog_rds.aws_rds_cluster.this, the data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore, the data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own, the OpenTofu step for stackit_mariadb_credential.dependencies_catalog_rds_this, the OpenTofu step for stackit_mariadb_instance.dependencies_catalog_rds_this
- State: not executable as the plan stands: it waits for step 244, which no answer makes executable as the plan stands; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Rollback (available): a check changes nothing; remove the test record it wrote

#### The data check of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (`MAN/verify/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`)

- Phase: Verification
- What: Check that the application reads the data migrated from module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) on its STACKIT target stackit_valkey_instance.dependencies_checkout_elasticache_redis_default and that what it writes there is read back
- Why: the data move of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is done only when its consumers work on the copy: a partial copy or a write that still goes to AWS shows here, before the source is retired
- Who: Data Architect
- When: after the cutover and the data move
- Needs: the reads and writes that show the data is complete (row or object counts of the source and the target, a test record), from the owner of the data
- Done when: the counts of the source and the target agree, the application reads the migrated records and a test write is read back
- Source: `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
- Target: `stackit_valkey_instance.dependencies_checkout_elasticache_redis_default`
- After: the cutover completion step, the data preflight of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine, the data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own, the OpenTofu step for stackit_valkey_credential.dependencies_checkout_elasticache_redis_default, the OpenTofu step for stackit_valkey_instance.dependencies_checkout_elasticache_redis_default
- State: not executable as the plan stands: it waits for step 244, which no answer makes executable as the plan stands; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Rollback (available): a check changes nothing; remove the test record it wrote

#### The data check of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (`MAN/verify/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`)

- Phase: Verification
- What: Check that the application reads the data migrated from module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) on its STACKIT target stackit_mongodbflex_instance.dynamodb_tables and that what it writes there is read back
- Why: the data move of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is done only when its consumers work on the copy: a partial copy or a write that still goes to AWS shows here, before the source is retired
- Who: Data Architect
- When: after the cutover and the data move
- Needs: the reads and writes that show the data is complete (row or object counts of the source and the target, a test record), from the owner of the data
- Done when: the counts of the source and the target agree, the application reads the migrated records and a test write is read back
- Source: `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`
- Target: `stackit_mongodbflex_instance.dynamodb_tables`
- After: the cutover completion step, the export of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own, the data reconciliation of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own, the OpenTofu step for stackit_mongodbflex_instance.dynamodb_tables
- State: not executable as the plan stands: it waits for step 244, which no answer makes executable as the plan stands; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Rollback (available): a check changes nothing; remove the test record it wrote

#### The data check of module.dependencies.module.orders_rds.aws_rds_cluster.this (`MAN/verify/data/module.dependencies.module.orders_rds.aws_rds_cluster.this`)

- Phase: Verification
- What: Check that the application reads the data migrated from module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) on its STACKIT target stackit_postgresflex_instance.dependencies_orders_rds_this, stackit_postgresflex_database.dependencies_orders_rds_this_orders and that what it writes there is read back
- Why: the data move of module.dependencies.module.orders_rds.aws_rds_cluster.this is done only when its consumers work on the copy: a partial copy or a write that still goes to AWS shows here, before the source is retired
- Who: Data Architect
- When: after the cutover and the data move
- Needs: the reads and writes that show the data is complete (row or object counts of the source and the target, a test record), from the owner of the data
- Done when: the counts of the source and the target agree, the application reads the migrated records and a test write is read back
- Source: `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- Target: `stackit_postgresflex_database.dependencies_orders_rds_this_orders`, `stackit_postgresflex_instance.dependencies_orders_rds_this`
- After: the cutover completion step, the data preflight of module.dependencies.module.orders_rds.aws_rds_cluster.this, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own, the OpenTofu step for stackit_postgresflex_database.dependencies_orders_rds_this_orders, the OpenTofu step for stackit_postgresflex_instance.dependencies_orders_rds_this, the OpenTofu step for stackit_postgresflex_user.dependencies_orders_rds_this
- State: not executable as the plan stands: it waits for step 244, which no answer makes executable as the plan stands; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Rollback (available): a check changes nothing; remove the test record it wrote

</details>

### `WP-36` — Check the migrated estate and decide go or rollback

- Owner: Migration Owner
- Steps: 1 (1 is not executable as the plan stands)
- Waits for: `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- State: not executable as the plan stands
- Done when: the owner records GO or ROLLBACK, with the date and the result of each check

<details>
<summary>The 1 step of WP-36</summary>

#### The rollback decision step (`MAN/verify/rollback-decision`)

- Phase: Verification
- What: Decide GO or ROLLBACK for the migration once every check of the verification is done: GO lets the source resources be retired, ROLLBACK reverts the cutover and keeps AWS serving
- Why: reverting the cutover is a change of addresses only while the AWS resources exist; after the first decommission step the way back is a rebuild from backups
- Who: Migration Owner
- When: after every check of the verification
- Needs: the results of the checks of the verification (the endpoint check of module.retail_app_ecs.module.alb.aws_lb.this, the endpoint check of module.dependencies.aws_mq_broker.mq, the endpoint check of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the data check of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, the data check of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the data check of module.dependencies.module.catalog_rds.aws_rds_cluster.this, the data check of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the data check of module.dependencies.module.orders_rds.aws_rds_cluster.this, the DNS check of module.retail_app_ecs.module.carts_service.aws_ecs_service.this, the DNS check of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, the DNS check of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, the DNS check of module.retail_app_ecs.module.orders_service.aws_ecs_service.this, the DNS check of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, the security acceptance of module.retail_app_ecs.module.alb.aws_lb.this, the security acceptance of module.retail_app_ecs.module.carts_service.aws_security_group.this, the security acceptance of module.retail_app_ecs.module.catalog_service.aws_security_group.this, the security acceptance of module.retail_app_ecs.module.checkout_service.aws_security_group.this, the security acceptance of module.retail_app_ecs.module.orders_service.aws_security_group.this, the security acceptance of module.retail_app_ecs.module.ui_service.aws_security_group.this), and the criteria for GO the owner set before the cutover; the maintenance window is not given: the plan states none and invents none; state the window, the blackout days and the longest downtime of one switch with ops.maintenance_window in the inputs file (inputs-template.yaml shows the empty answer), then run again
- Done when: the owner records GO or ROLLBACK, with the date and the result of each check
- After: the switch of the applications that use module.dependencies.module.catalog_rds.aws_rds_cluster.this, the switch of the applications that use module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the switch of the applications that use module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, the switch of the applications that use module.dependencies.module.orders_rds.aws_rds_cluster.this, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.mq, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.orders_db, the switch of the consumers of module.dependencies.aws_mq_broker.mq, the drain of the queue of module.dependencies.aws_mq_broker.mq, the traffic switch of module.dependencies.aws_mq_broker.mq, the traffic switch of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the traffic switch of module.retail_app_ecs.module.alb.aws_lb.this, the data reconciliation of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine, the data reconciliation of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own, the data preflight of module.dependencies.module.catalog_rds.aws_rds_cluster.this, the data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore, the data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own, the data preflight of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine, the data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own, the export of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own, the data reconciliation of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own, the data preflight of module.dependencies.module.orders_rds.aws_rds_cluster.this, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own, the security acceptance of module.retail_app_ecs.module.alb.aws_lb.this, the security acceptance of module.retail_app_ecs.module.carts_service.aws_security_group.this, the security acceptance of module.retail_app_ecs.module.catalog_service.aws_security_group.this, the security acceptance of module.retail_app_ecs.module.checkout_service.aws_security_group.this, the security acceptance of module.retail_app_ecs.module.orders_service.aws_security_group.this, the security acceptance of module.retail_app_ecs.module.ui_service.aws_security_group.this, the data check of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the data check of module.dependencies.module.catalog_rds.aws_rds_cluster.this, the data check of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the data check of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, the data check of module.dependencies.module.orders_rds.aws_rds_cluster.this, the DNS check of module.retail_app_ecs.module.carts_service.aws_ecs_service.this, the DNS check of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, the DNS check of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, the DNS check of module.retail_app_ecs.module.orders_service.aws_ecs_service.this, the DNS check of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, the endpoint check of module.dependencies.aws_mq_broker.mq, the endpoint check of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the endpoint check of module.retail_app_ecs.module.alb.aws_lb.this
- State: not executable as the plan stands: the risks listed below; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Risk: the decision point follows every check of the verification (each is also an action-complete precondition); the retirement steps depend on it, and through it on the checks
- Rollback (manual): on ROLLBACK, revert each cutover step as its rollback says (the traffic switch of module.retail_app_ecs.module.alb.aws_lb.this, the traffic switch of module.dependencies.aws_mq_broker.mq, the drain of the queue of module.dependencies.aws_mq_broker.mq, the switch of the consumers of module.dependencies.aws_mq_broker.mq, the traffic switch of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the switch of the applications that use module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, the switch of the applications that use module.dependencies.module.catalog_rds.aws_rds_cluster.this, the switch of the applications that use module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the switch of the applications that use module.dependencies.module.orders_rds.aws_rds_cluster.this, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.mq, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.orders_db) and start no decommission step; on GO nothing is reverted

</details>

### `WP-37` — Check the migrated estate and decide go or rollback

- Owner: Network Architect
- Steps: 8 (7 require a design decision, 1 is not executable as the plan stands)
- Affected resources: `module.dependencies.aws_mq_broker.mq`, `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `module.retail_app_ecs.module.alb.aws_lb.this`, `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`, `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`, `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`, `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`, `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
- Target: `stackit_application_load_balancer.retail_app_ecs_alb_this`, `stackit_opensearch_instance.dependencies_catalog_opensearch_this`, `stackit_rabbitmq_instance.dependencies_mq`
- Waits for: `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- State: not executable as the plan stands (1 of 8 steps)
- Done when: each step meets the condition stated with it below (6 different conditions).

<details>
<summary>The 8 steps of WP-37</summary>

#### Alike steps on 5 resources (aws_ecs_service) — the DNS check of {resource} (`MAN/verify/dns/{resource}`)

- Phase: Verification
- What: Check from inside the cluster that the {what} resolve to what stands for them on STACKIT
- Why: the source VPC resolver answers names that only it knows (a private zone, a Cloud Map namespace, a Service Connect alias, the endpoint host of a data store) and the draft's networks resolve public names only: a name that does not resolve, or resolves elsewhere, breaks service discovery and the connections of the application, and it shows here before the source is retired
- Who: Network Architect
- Done when: every name resolves from a pod of {done when} to the address recorded for it on STACKIT, and the application opens its connections through it
- State: not executable — requires a design decision — blocked by {state}, a manual prerequisite
- Rollback (available): a check changes nothing

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The DNS check of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (`MAN/verify/dns/module.retail_app_ecs.module.carts_service.aws_ecs_service.this`) — {resource} = `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`; After: the step "Fill in the required inputs of kubernetes/carts/manifests.yaml and apply it to…"
  - What ({what}): 1 name(s) the application carts resolves in the source VPC (carts)
  - When: after the manifests of carts are applied
  - Needs: a pod of carts to resolve from (kubectl exec, or a debug container), and the address each name must resolve to, from the owner of the application and the Network Architect:
    - (1) resolve carts: UNKNOWN — supplied by Network Architect (the address carts resolves to from a pod of carts, compared with what stands for it on STACKIT: carts.\<namespace>.svc.cluster.local (the Kubernetes Service carts; carts from a pod of the same namespace). resolve, from a pod of a client of carts, carts and carts.\<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service carts (kubectl get service carts); closed when the address the name resolves to is recorded and the application connects through it)
  - Done when ({done when}): carts
  - State ({state}): `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`; it also comes after the step "Fill in the required inputs of kubernetes/carts/manifests.yaml and apply it to…"
- The DNS check of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (`MAN/verify/dns/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`) — {resource} = `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`; After: the step "Fill in the required inputs of kubernetes/catalog/manifests.yaml and apply it…"
  - What ({what}): 3 name(s) the application catalog resolves in the source VPC (the endpoint host of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch), the endpoint host of module.dependencies.module.catalog_rds.aws_rds_cluster.this (Aurora), catalog)
  - When: after the manifests of catalog are applied
  - Needs: a pod of catalog to resolve from (kubectl exec, or a debug container), and the address each name must resolve to, from the owner of the application and the Network Architect:
    - (1) resolve the endpoint host of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch) resolves to from a pod of catalog, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_opensearch_instance.dependencies_catalog_opensearch_this (OpenSearch) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of catalog, the host of stackit_opensearch_instance.dependencies_catalog_opensearch_this and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it)
    - (2) resolve the endpoint host of module.dependencies.module.catalog_rds.aws_rds_cluster.this (Aurora): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.module.catalog_rds.aws_rds_cluster.this (Aurora) resolves to from a pod of catalog, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_mariadb_instance.dependencies_catalog_rds_this (MariaDB) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of catalog, the host of stackit_mariadb_instance.dependencies_catalog_rds_this and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it)
    - (3) resolve catalog: UNKNOWN — supplied by Network Architect (the address catalog resolves to from a pod of catalog, compared with what stands for it on STACKIT: catalog.\<namespace>.svc.cluster.local (the Kubernetes Service catalog; catalog from a pod of the same namespace). resolve, from a pod of a client of catalog, catalog and catalog.\<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service catalog (kubectl get service catalog); closed when the address the name resolves to is recorded and the application connects through it)
  - Done when ({done when}): catalog
  - State ({state}): `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`; it also comes after the step "Fill in the required inputs of kubernetes/catalog/manifests.yaml and apply it…"
- The DNS check of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (`MAN/verify/dns/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`) — {resource} = `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`; After: the step "Fill in the required inputs of kubernetes/checkout/manifests.yaml and apply it…"
  - What ({what}): 2 name(s) the application checkout resolves in the source VPC (the endpoint host of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (ElastiCache), checkout)
  - When: after the manifests of checkout are applied
  - Needs: a pod of checkout to resolve from (kubectl exec, or a debug container), and the address each name must resolve to, from the owner of the application and the Network Architect:
    - (1) resolve the endpoint host of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (ElastiCache): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (ElastiCache) resolves to from a pod of checkout, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_valkey_instance.dependencies_checkout_elasticache_redis_default (Key Value Store (Valkey)) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of checkout, the host of stackit_valkey_instance.dependencies_checkout_elasticache_redis_default and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it)
    - (2) resolve checkout: UNKNOWN — supplied by Network Architect (the address checkout resolves to from a pod of checkout, compared with what stands for it on STACKIT: checkout.\<namespace>.svc.cluster.local (the Kubernetes Service checkout; checkout from a pod of the same namespace). resolve, from a pod of a client of checkout, checkout and checkout.\<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service checkout (kubectl get service checkout); closed when the address the name resolves to is recorded and the application connects through it)
  - Done when ({done when}): checkout
  - State ({state}): `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`; it also comes after the step "Fill in the required inputs of kubernetes/checkout/manifests.yaml and apply it…"
- The DNS check of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (`MAN/verify/dns/module.retail_app_ecs.module.orders_service.aws_ecs_service.this`) — {resource} = `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`; After: the step "Fill in the required inputs of kubernetes/orders/manifests.yaml and apply it to…"
  - What ({what}): 3 name(s) the application orders resolves in the source VPC (the endpoint host of module.dependencies.aws_mq_broker.mq (Amazon MQ), the endpoint host of module.dependencies.module.orders_rds.aws_rds_cluster.this (Aurora), orders)
  - When: after the manifests of orders are applied
  - Needs: a pod of orders to resolve from (kubectl exec, or a debug container), and the address each name must resolve to, from the owner of the application and the Network Architect:
    - (1) resolve the endpoint host of module.dependencies.aws_mq_broker.mq (Amazon MQ): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.aws_mq_broker.mq (Amazon MQ) resolves to from a pod of orders, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_rabbitmq_instance.dependencies_mq (RabbitMQ) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of orders, the host of stackit_rabbitmq_instance.dependencies_mq and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it)
    - (2) resolve the endpoint host of module.dependencies.module.orders_rds.aws_rds_cluster.this (Aurora): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.module.orders_rds.aws_rds_cluster.this (Aurora) resolves to from a pod of orders, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_postgresflex_instance.dependencies_orders_rds_this (PostgreSQL Flex) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of orders, the host of stackit_postgresflex_instance.dependencies_orders_rds_this and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it)
    - (3) resolve orders: UNKNOWN — supplied by Network Architect (the address orders resolves to from a pod of orders, compared with what stands for it on STACKIT: orders.\<namespace>.svc.cluster.local (the Kubernetes Service orders; orders from a pod of the same namespace). resolve, from a pod of a client of orders, orders and orders.\<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service orders (kubectl get service orders); closed when the address the name resolves to is recorded and the application connects through it)
  - Done when ({done when}): orders
  - State ({state}): `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`; it also comes after the step "Fill in the required inputs of kubernetes/orders/manifests.yaml and apply it to…"
- The DNS check of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (`MAN/verify/dns/module.retail_app_ecs.module.ui_service.aws_ecs_service.this`) — {resource} = `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`; After: the step "Fill in the required inputs of kubernetes/ui/manifests.yaml and apply it to the…"
  - What ({what}): 1 name(s) the application ui resolves in the source VPC (ui)
  - When: after the manifests of ui are applied
  - Needs: a pod of ui to resolve from (kubectl exec, or a debug container), and the address each name must resolve to, from the owner of the application and the Network Architect:
    - (1) resolve ui: UNKNOWN — supplied by Network Architect (the address ui resolves to from a pod of ui, compared with what stands for it on STACKIT: ui.\<namespace>.svc.cluster.local (the Kubernetes Service ui; ui from a pod of the same namespace). resolve, from a pod of a client of ui, ui and ui.\<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service ui (kubectl get service ui); closed when the address the name resolves to is recorded and the application connects through it)
  - Done when ({done when}): ui
  - State ({state}): `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`; it also comes after the step "Fill in the required inputs of kubernetes/ui/manifests.yaml and apply it to the…"

#### Alike steps on 2 resources (aws_lb, aws_mq_broker) — the endpoint check of {resource} (`MAN/verify/endpoint/{resource}`)

- Phase: Verification
- Why: a switched entry point that does not answer is an outage: the check decides whether the cutover holds or is reverted
- Who: Network Architect
- Needs: the requests that show the application works (a health path, a test account, the expected answers), from the owner of the application
- Done when: every request answers over the STACKIT address with the status and content the AWS address gave
- Rollback (available): a check changes nothing
- After, for every step: the switch of the applications that use module.dependencies.module.catalog_rds.aws_rds_cluster.this, the switch of the applications that use module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the switch of the applications that use module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, the switch of the applications that use module.dependencies.module.orders_rds.aws_rds_cluster.this, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.mq, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.orders_db

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The endpoint check of module.dependencies.aws_mq_broker.mq (`MAN/verify/endpoint/module.dependencies.aws_mq_broker.mq`) — {resource} = `module.dependencies.aws_mq_broker.mq`; Target: `stackit_rabbitmq_instance.dependencies_mq`; also after: the switch of the consumers of module.dependencies.aws_mq_broker.mq
  - What: Check that the host and port of a credential of stackit_rabbitmq_instance.dependencies_mq (stackit_rabbitmq_credential; the draft writes one for the instance: read its host and port after the apply) answers the requests the clients of module.dependencies.aws_mq_broker.mq send, over the STACKIT address, as the instances[*].endpoints of module.dependencies.aws_mq_broker.mq did
  - When: right after the switch of the consumers of module.dependencies.aws_mq_broker.mq
  - State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`; it also comes after the switch of the applications that use module.dependencies.module.catalog_rds.aws_rds_cluster.this, the switch of the applications that use module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the switch of the applications that use module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, the switch of the applications that use module.dependencies.module.orders_rds.aws_rds_cluster.this, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.mq, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.orders_db, the switch of the consumers of module.dependencies.aws_mq_broker.mq, manual prerequisites
- The endpoint check of module.retail_app_ecs.module.alb.aws_lb.this (`MAN/verify/endpoint/module.retail_app_ecs.module.alb.aws_lb.this`) — {resource} = `module.retail_app_ecs.module.alb.aws_lb.this`; Target: `stackit_application_load_balancer.retail_app_ecs_alb_this`; also after: the traffic switch of module.retail_app_ecs.module.alb.aws_lb.this
  - What: Check that the external_address of stackit_application_load_balancer.retail_app_ecs_alb_this answers the requests the clients of module.retail_app_ecs.module.alb.aws_lb.this send, over the STACKIT address, as the dns_name of module.retail_app_ecs.module.alb.aws_lb.this did
  - When: right after the traffic switch of module.retail_app_ecs.module.alb.aws_lb.this
  - State: not executable — requires a design decision — blocked by `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`; it also comes after the switch of the applications that use module.dependencies.module.catalog_rds.aws_rds_cluster.this, the switch of the applications that use module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the switch of the applications that use module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, the switch of the applications that use module.dependencies.module.orders_rds.aws_rds_cluster.this, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.mq, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.orders_db, the traffic switch of module.retail_app_ecs.module.alb.aws_lb.this, manual prerequisites

#### The endpoint check of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (`MAN/verify/endpoint/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`)

- Phase: Verification
- What: Check that the host and port of a credential of stackit_opensearch_instance.dependencies_catalog_opensearch_this (stackit_opensearch_credential; the draft writes one for the instance: read its host and port after the apply) answers the requests the clients of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this send, over the STACKIT address, as the endpoint of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this did
- Why: a switched entry point that does not answer is an outage: the check decides whether the cutover holds or is reverted
- Who: Network Architect
- When: right after the traffic switch of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this
- Needs: the requests that show the application works (a health path, a test account, the expected answers), from the owner of the application
- Done when: every request answers over the STACKIT address with the status and content the AWS address gave
- Source: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
- Target: `stackit_opensearch_instance.dependencies_catalog_opensearch_this`
- After: the switch of the applications that use module.dependencies.module.catalog_rds.aws_rds_cluster.this, the switch of the applications that use module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the switch of the applications that use module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, the switch of the applications that use module.dependencies.module.orders_rds.aws_rds_cluster.this, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.mq, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.orders_db, the traffic switch of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this
- State: not executable as the plan stands: it waits for step 242, which no answer makes executable as the plan stands; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Rollback (available): a check changes nothing

</details>

### `WP-38` — Retire the source resources

- Owner: Data Architect
- Steps: 9 (9 are not executable as the plan stands)
- Affected resources: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- Rests on: `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`
- Waits for: `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- State: not executable as the plan stands
- Done when: each step meets the condition stated with it below (8 different conditions).

<details>
<summary>The 9 steps of WP-38</summary>

#### The cleanup of the data move of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore (`MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/cleanup/dump-restore`)

- Phase: Decommission
- What: Only after the target has run in production for the period the customer decides and the way back is no longer wanted: remove the move host from `parameters.sgw_acl` of the instance; delete the dump file `\<dump-file>.sql` and `load.log` (the dump holds the data); keep a final snapshot of the source for the retention the customer decides before anything is deleted; delete the scratch instance of the rehearsal if it still exists; and replace the credential of the service key if it was ever on a ticket or in a file. Runbook section: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md#clean-up-dump-restore`.
- Why: the move leaves an access-list entry, copies of the data and possibly a scratch instance behind; none of them stays
- Who: Data Architect
- When: after the owner records GO at the end of the verification, and once the way back is no longer wanted
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to
- Done when: no dump file is left, the move host is out of the access list, the scratch instance is deleted and the credentials are replaced where they were exposed
- Source: `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
- After: the data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore, the rollback decision step
- State: not executable as the plan stands: the risks listed below; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Risk: the source is not deleted in the same hour as the cutover
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.catalog_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Rollback (manual): after the cleanup the way back is the final snapshot of the source; there is no other

#### The cleanup of the data move of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine (`MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/cleanup/client-import`)

- Phase: Decommission
- What: Only after the target has run in production for the period the customer decides and the way back is no longer wanted: remove the move host from `parameters.sgw_acl` of the instance; delete the files the copy wrote and the snapshot of the source that was taken as the fail-safe once the target is confirmed; delete the scratch instance of the rehearsal if it still exists; and replace the credential of the service key if it was ever on a ticket or in a file. The source cache is deleted only when its owner decides, after a final snapshot kept for the retention the customer decides. Runbook section: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#clean-up-client-import`.
- Why: the move leaves an access-list entry, copies of the data and possibly a scratch instance behind; none of them stays
- Who: Data Architect
- When: after the owner records GO at the end of the verification, and once the way back is no longer wanted
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to
- Done when: no copy of the data is left, the move host is out of the access list, the scratch instance is deleted and the credentials are replaced where they were exposed
- Source: `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
- After: the data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine, the rollback decision step
- State: not executable as the plan stands: the risks listed below; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Risk: the source cache is not deleted in the same hour as the cutover
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, not of the path the draft carries out by default
- Rollback (manual): after the cleanup the way back is the final snapshot of the source cache; there is no other

#### The cleanup of the data move of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore (`MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/dump-restore`)

- Phase: Decommission
- What: Clean up what the move of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this leaves behind (the move host in the access list, the dump files, and for a replication the subscription, the publication and the slot) once the way back is no longer wanted. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#after-acceptance`.
- Why: the move leaves a publication, a slot, a parameter, an ACL entry and copies of the data behind; none of them stays
- Who: Data Architect
- When: after the owner records GO at the end of the verification, and once the way back is no longer wanted
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to
- Done when: no slot, subscription, publication or dump file is left, the move host is out of the ACL, the credentials are rotated
- Source: `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- After: the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore, the rollback decision step
- State: not executable as the plan stands: the risks listed below; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Risk: the source is not deleted in the same hour as the cutover
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path export-and-import-with-the-engine-clients of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Rollback (manual): after the cleanup the way back is the final snapshot of the source; there is no other

#### The cleanup of the data move of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication (`MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/logical-replication`)

- Phase: Decommission
- What: Clean up what the move of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this leaves behind (the move host in the access list, the dump files, and for a replication the subscription, the publication and the slot) once the way back is no longer wanted. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#after-acceptance`.
- Why: the move leaves a publication, a slot, a parameter, an ACL entry and copies of the data behind; none of them stays
- Who: Data Architect
- When: after the owner records GO at the end of the verification, and once the way back is no longer wanted
- Needs: the answer of DEC-GEN-CONVERT-DATA-MOVEMENT in decisions.yaml, which names the path this step belongs to
- Done when: no slot, subscription, publication or dump file is left, the move host is out of the ACL, the credentials are rotated
- Source: `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- After: the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication, the rollback decision step
- State: not executable as the plan stands: the risks listed below; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Risk: the source is not deleted in the same hour as the cutover
- Risk: this step holds only once DEC-GEN-CONVERT-DATA-MOVEMENT is answered: it is of the path replicate-with-the-engine-replication of module.dependencies.module.orders_rds.aws_rds_cluster.this, not of the path the draft carries out by default
- Rollback (manual): after the cleanup the way back is the final snapshot of the source; there is no other

#### The retirement of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (`MAN/decommission/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`)

- Phase: Decommission
- What: Retire module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) with its parts module.dependencies.module.catalog_opensearch.aws_opensearch_domain_policy.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it
- Why: module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this keeps costing money and can still take traffic or writes after the cutover, so the two copies drift apart; StackToIT deletes nothing (it is read-only): a person retires it
- Who: Data Architect
- When: after the GO recorded at the rollback decision step
- Needs: the final backup of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, kept for a number of days the owner decides (the plan states no default), and the GO recorded at the rollback decision step
- Done when: module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this no longer exists in the AWS account and its charges stop on the bill
- Source: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
- After: the traffic switch of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the data reconciliation of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine, the data reconciliation of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own, the retirement of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, the setting `encryption-at-rest` of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the review of the open settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the review of the open settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the review of the open settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the data check of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the endpoint check of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the rollback decision step, the refusal of the setting `credentials-and-keys-settings` of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the refusal of the setting `domain-credentials-and-keys` of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the OpenTofu step for stackit_opensearch_credential.dependencies_catalog_opensearch_this, the OpenTofu step for stackit_opensearch_instance.dependencies_catalog_opensearch_this
- State: not executable as the plan stands: the risks listed below; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Risk: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement
- Rollback (impossible): the plan cannot bring module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this back: only the final backup the owner kept restores its data, into a new resource

#### The retirement of module.dependencies.module.catalog_rds.aws_rds_cluster.this (`MAN/decommission/module.dependencies.module.catalog_rds.aws_rds_cluster.this`)

- Phase: Decommission
- What: Retire module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) with its parts module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it
- Why: module.dependencies.module.catalog_rds.aws_rds_cluster.this keeps costing money and can still take traffic or writes after the cutover, so the two copies drift apart; StackToIT deletes nothing (it is read-only): a person retires it
- Who: Data Architect
- When: after the GO recorded at the rollback decision step
- Needs: the final backup of module.dependencies.module.catalog_rds.aws_rds_cluster.this, kept for a number of days the owner decides (the plan states no default), and the GO recorded at the rollback decision step
- Done when: module.dependencies.module.catalog_rds.aws_rds_cluster.this no longer exists in the AWS account and its charges stop on the bill
- Source: `module.dependencies.module.catalog_rds.aws_rds_cluster.this`
- After: the switch of the applications that use module.dependencies.module.catalog_rds.aws_rds_cluster.this, the cleanup of the data move of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore, the data preflight of module.dependencies.module.catalog_rds.aws_rds_cluster.this, the data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore, the data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own, the retirement of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, the setting `admin-username-not-carried` of module.dependencies.module.catalog_rds.aws_rds_cluster.this, the review of the open settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this, the review of the open settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this, the review of the open settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this, the review of the open settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this, the data check of module.dependencies.module.catalog_rds.aws_rds_cluster.this, the rollback decision step, the OpenTofu step for stackit_mariadb_credential.dependencies_catalog_rds_this, the OpenTofu step for stackit_mariadb_instance.dependencies_catalog_rds_this
- State: not executable as the plan stands: the risks listed below; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Risk: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement
- Risk: the source states skip_final_snapshot = true: AWS takes no final snapshot when it is deleted, so the data is gone with it unless a backup was taken before; take the final backup this step needs yourself, before the delete
- Rollback (impossible): the plan cannot bring module.dependencies.module.catalog_rds.aws_rds_cluster.this back: only the final backup the owner kept restores its data, into a new resource

#### The retirement of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (`MAN/decommission/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`)

- Phase: Decommission
- What: Retire module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it
- Why: module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default keeps costing money and can still take traffic or writes after the cutover, so the two copies drift apart; StackToIT deletes nothing (it is read-only): a person retires it
- Who: Data Architect
- When: after the GO recorded at the rollback decision step
- Needs: the final backup of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, kept for a number of days the owner decides (the plan states no default), and the GO recorded at the rollback decision step
- Done when: module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default no longer exists in the AWS account and its charges stop on the bill
- Source: `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`
- After: the switch of the applications that use module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the cleanup of the data move of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine, the data preflight of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine, the data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own, the retirement of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, the setting `network-placement` of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the review of the open settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the review of the open settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the review of the open settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the data check of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the rollback decision step, the OpenTofu step for stackit_valkey_credential.dependencies_checkout_elasticache_redis_default, the OpenTofu step for stackit_valkey_instance.dependencies_checkout_elasticache_redis_default
- State: not executable as the plan stands: the risks listed below; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Risk: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement
- Rollback (impossible): the plan cannot bring module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default back: only the final backup the owner kept restores its data, into a new resource

#### The retirement of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (`MAN/decommission/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`)

- Phase: Decommission
- What: Retire module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it
- Why: module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this keeps costing money and can still take traffic or writes after the cutover, so the two copies drift apart; StackToIT deletes nothing (it is read-only): a person retires it
- Who: Data Architect
- When: after the GO recorded at the rollback decision step
- Needs: the final backup of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, kept for a number of days the owner decides (the plan states no default), and the GO recorded at the rollback decision step
- Done when: module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this no longer exists in the AWS account and its charges stop on the bill
- Source: `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`
- After: the switch of the applications that use module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, the export of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own, the data reconciliation of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own, the retirement of module.retail_app_ecs.module.carts_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role, the retirement of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role, the setting `encryption-at-rest` of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, the review of the open settings of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, the review of the open settings of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, the data check of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, the rollback decision step, the OpenTofu step for stackit_mongodbflex_instance.dynamodb_tables
- State: not executable as the plan stands: the risks listed below; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Risk: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement
- Rollback (impossible): the plan cannot bring module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this back: only the final backup the owner kept restores its data, into a new resource

#### The retirement of module.dependencies.module.orders_rds.aws_rds_cluster.this (`MAN/decommission/module.dependencies.module.orders_rds.aws_rds_cluster.this`)

- Phase: Decommission
- What: Retire module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) with its parts module.dependencies.module.orders_rds.aws_rds_cluster_instance.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it
- Why: module.dependencies.module.orders_rds.aws_rds_cluster.this keeps costing money and can still take traffic or writes after the cutover, so the two copies drift apart; StackToIT deletes nothing (it is read-only): a person retires it
- Who: Data Architect
- When: after the GO recorded at the rollback decision step
- Needs: the final backup of module.dependencies.module.orders_rds.aws_rds_cluster.this, kept for a number of days the owner decides (the plan states no default), and the GO recorded at the rollback decision step
- Done when: module.dependencies.module.orders_rds.aws_rds_cluster.this no longer exists in the AWS account and its charges stop on the bill
- Source: `module.dependencies.module.orders_rds.aws_rds_cluster.this`
- After: the switch of the applications that use module.dependencies.module.orders_rds.aws_rds_cluster.this, the cleanup of the data move of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore, the cleanup of the data move of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication, the data preflight of module.dependencies.module.orders_rds.aws_rds_cluster.this, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication, the data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own, the retirement of module.retail_app_ecs.aws_secretsmanager_secret.orders_db, the setting `admin-username-not-carried` of module.dependencies.module.orders_rds.aws_rds_cluster.this, the setting `final-snapshot` of module.dependencies.module.orders_rds.aws_rds_cluster.this, the review of the open settings of module.dependencies.module.orders_rds.aws_rds_cluster.this, the review of the open settings of module.dependencies.module.orders_rds.aws_rds_cluster.this, the setting "identifier of the RDS cluster instance" of module.dependencies.module.orders_rds.aws_rds_cluster.this, the data check of module.dependencies.module.orders_rds.aws_rds_cluster.this, the rollback decision step, the OpenTofu step for stackit_postgresflex_database.dependencies_orders_rds_this_orders, the OpenTofu step for stackit_postgresflex_instance.dependencies_orders_rds_this, the OpenTofu step for stackit_postgresflex_user.dependencies_orders_rds_this
- State: not executable as the plan stands: the risks listed below; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Risk: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement
- Risk: the source states skip_final_snapshot = true: AWS takes no final snapshot when it is deleted, so the data is gone with it unless a backup was taken before; take the final backup this step needs yourself, before the delete
- Rollback (impossible): the plan cannot bring module.dependencies.module.orders_rds.aws_rds_cluster.this back: only the final backup the owner kept restores its data, into a new resource

</details>

### `WP-39` — Retire the source resources

- Owner: Identity Architect
- Steps: 15 (15 are not executable as the plan stands)
- Affected resources: `module.retail_app_ecs.aws_kms_key.cmk`, `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db`, `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch`, `module.retail_app_ecs.aws_secretsmanager_secret.mq`, `module.retail_app_ecs.aws_secretsmanager_secret.orders_db`, `module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role`, `module.retail_app_ecs.module.carts_service.aws_iam_role.task_role`, `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role`, `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role`, `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role`, `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role`, `module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role`, `module.retail_app_ecs.module.orders_service.aws_iam_role.task_role`, `module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role`, `module.retail_app_ecs.module.ui_service.aws_iam_role.task_role`
- Waits for: `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- State: not executable as the plan stands
- Done when: each step meets the condition stated with it below (15 different conditions).

<details>
<summary>The 15 steps of WP-39</summary>

#### Alike steps on 15 resources (aws_iam_role, aws_kms_key, aws_secretsmanager_secret) — the retirement of {resource} (`MAN/decommission/{resource}`)

- Phase: Decommission
- What: Retire {what} in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it
- Why: {resource} keeps costing money and can still take traffic or writes after the cutover, so the two copies drift apart; StackToIT deletes nothing (it is read-only): a person retires it
- Who: Identity Architect
- When: after the GO recorded at the rollback decision step
- Needs: the GO recorded at the rollback decision step
- Done when: {resource} no longer exists in the AWS account and its charges stop on the bill
- State: not executable as the plan stands: the risks listed below; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Risk: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement
- Rollback (manual): re-create {resource} from the source configuration; what it held beyond its configuration is not restored
- After, for every step: the rollback decision step

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The retirement of module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role (`MAN/decommission/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role`) — {resource} = `module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role`; also after: the retirement of module.retail_app_ecs.module.carts_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role, the OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role, the OpenTofu step for stackit_service_account.retail_app_ecs_carts_service_task_execution_role
  - What ({what}): module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_execution_role_policy
- The retirement of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role (`MAN/decommission/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role`) — {resource} = `module.retail_app_ecs.module.carts_service.aws_iam_role.task_role`; also after: the retirement of module.retail_app_ecs.module.carts_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role, the OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role, the OpenTofu step for stackit_service_account.retail_app_ecs_carts_service_task_role
  - What ({what}): module.retail_app_ecs.module.carts_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.ecs_exec, module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_role_additional
- The retirement of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role (`MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role`) — {resource} = `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role`; also after: the retirement of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role, the OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role, the OpenTofu step for stackit_service_account.retail_app_ecs_catalog_service_task_execution_role
  - What ({what}): module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_additional, module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_policy
- The retirement of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (`MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db`) — {resource} = `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db`; also after: the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, the retirement of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role, the review of the open settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, the setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, the OpenTofu step for stackit_secretsmanager_instance.migrated_secrets, the OpenTofu step for stackit_secretsmanager_user.migration
  - What ({what}): module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (aws_secretsmanager_secret) with its parts module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db
- The retirement of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (`MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch`) — {resource} = `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch`; also after: the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, the retirement of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role, the review of the open settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, the setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, the OpenTofu step for stackit_secretsmanager_instance.migrated_secrets, the OpenTofu step for stackit_secretsmanager_user.migration
  - What ({what}): module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (aws_secretsmanager_secret) with its parts module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch
- The retirement of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role (`MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role`) — {resource} = `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role`; also after: the retirement of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role, the OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role, the OpenTofu step for stackit_service_account.retail_app_ecs_catalog_service_task_role
  - What ({what}): module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.ecs_exec
- The retirement of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role (`MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role`) — {resource} = `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role`; also after: the retirement of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role, the OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role, the OpenTofu step for stackit_service_account.retail_app_ecs_checkout_service_task_execution_role
  - What ({what}): module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_execution_role_policy
- The retirement of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role (`MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role`) — {resource} = `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role`; also after: the retirement of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role, the OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role, the OpenTofu step for stackit_service_account.retail_app_ecs_checkout_service_task_role
  - What ({what}): module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.ecs_exec, module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_role_additional
- The retirement of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role (`MAN/decommission/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role`) — {resource} = `module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role`; also after: the retirement of module.retail_app_ecs.module.orders_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role, the OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role, the OpenTofu step for stackit_service_account.retail_app_ecs_orders_service_task_execution_role
  - What ({what}): module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_additional, module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_policy
- The retirement of module.retail_app_ecs.aws_kms_key.cmk (`MAN/decommission/module.retail_app_ecs.aws_kms_key.cmk`) — {resource} = `module.retail_app_ecs.aws_kms_key.cmk`; also after: the retirement of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, the retirement of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, the retirement of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role, the retirement of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role, the setting `deletion-window` of module.retail_app_ecs.aws_kms_key.cmk, the OpenTofu step for stackit_kms_key.retail_app_ecs_cmk, the OpenTofu step for stackit_kms_keyring.migrated
  - What ({what}): module.retail_app_ecs.aws_kms_key.cmk (aws_kms_key)
- The retirement of module.retail_app_ecs.aws_secretsmanager_secret.mq (`MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.mq`) — {resource} = `module.retail_app_ecs.aws_secretsmanager_secret.mq`; also after: the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.mq, the retirement of module.retail_app_ecs.module.orders_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role, the setting `secret-value` of module.retail_app_ecs.aws_secretsmanager_secret.mq, the setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.mq, the OpenTofu step for stackit_secretsmanager_instance.migrated_secrets, the OpenTofu step for stackit_secretsmanager_user.migration
  - What ({what}): module.retail_app_ecs.aws_secretsmanager_secret.mq (aws_secretsmanager_secret) with its parts module.retail_app_ecs.aws_secretsmanager_secret_version.mq
- The retirement of module.retail_app_ecs.aws_secretsmanager_secret.orders_db (`MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.orders_db`) — {resource} = `module.retail_app_ecs.aws_secretsmanager_secret.orders_db`; also after: the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db, the switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.orders_db, the retirement of module.retail_app_ecs.module.orders_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role, the setting `secret-value` of module.retail_app_ecs.aws_secretsmanager_secret.orders_db, the setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.orders_db, the OpenTofu step for stackit_secretsmanager_instance.migrated_secrets, the OpenTofu step for stackit_secretsmanager_user.migration
  - What ({what}): module.retail_app_ecs.aws_secretsmanager_secret.orders_db (aws_secretsmanager_secret) with its parts module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db
- The retirement of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role (`MAN/decommission/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role`) — {resource} = `module.retail_app_ecs.module.orders_service.aws_iam_role.task_role`; also after: the retirement of module.retail_app_ecs.module.orders_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role, the OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role, the OpenTofu step for stackit_service_account.retail_app_ecs_orders_service_task_role
  - What ({what}): module.retail_app_ecs.module.orders_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.ecs_exec
- The retirement of module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role (`MAN/decommission/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role`) — {resource} = `module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role`; also after: the retirement of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role, the OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role, the OpenTofu step for stackit_service_account.retail_app_ecs_ui_service_task_execution_role
  - What ({what}): module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.task_execution_role_policy
- The retirement of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role (`MAN/decommission/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role`) — {resource} = `module.retail_app_ecs.module.ui_service.aws_iam_role.task_role`; also after: the retirement of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role, the OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role, the OpenTofu step for stackit_service_account.retail_app_ecs_ui_service_task_role
  - What ({what}): module.retail_app_ecs.module.ui_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.ecs_exec

</details>

### `WP-40` — Retire the source resources

- Owner: Network Architect
- Steps: 21 (21 are not executable as the plan stands)
- Affected resources: `module.dependencies.aws_security_group.catalog_opensearch_sg`, `module.dependencies.aws_security_group.mq`, `module.dependencies.module.catalog_rds.aws_security_group.this`, `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd`, `module.dependencies.module.orders_rds.aws_security_group.this`, `module.retail_app_ecs.module.alb.aws_lb.this`, `module.retail_app_ecs.module.alb.aws_security_group.this`, `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`, `module.retail_app_ecs.module.carts_service.aws_security_group.this`, `module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `module.retail_app_ecs.module.orders_service.aws_security_group.this`, `module.retail_app_ecs.module.ui_service.aws_security_group.this`, `module.vpc.module.vpc.aws_eip.nat`, `module.vpc.module.vpc.aws_internet_gateway.this`, `module.vpc.module.vpc.aws_nat_gateway.this`, `module.vpc.module.vpc.aws_route_table.private`, `module.vpc.module.vpc.aws_route_table.public`, `module.vpc.module.vpc.aws_subnet.private`, `module.vpc.module.vpc.aws_subnet.public`, `module.vpc.module.vpc.aws_vpc.this`
- Waits for: `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`, `DEC-GEN-CONVERT-WORKLOAD-PLACEMENT`, `DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST`
- State: not executable as the plan stands
- Done when: each step meets the condition stated with it below (21 different conditions).

<details>
<summary>The 21 steps of WP-40</summary>

#### Alike steps on 16 resources (aws_eip, aws_internet_gateway, aws_lb and 5 more kinds) — the retirement of {resource} (`MAN/decommission/{resource}`)

- Phase: Decommission
- What: Retire {what} in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it
- Why: {resource} keeps costing money and can still take traffic or writes after the cutover, so the two copies drift apart; StackToIT deletes nothing (it is read-only): a person retires it
- Who: Network Architect
- Needs: the GO recorded at the rollback decision step
- Done when: {resource} no longer exists in the AWS account and its charges stop on the bill
- State: not executable as the plan stands: the risks listed below; it also waits for {state}
- Risk: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement
- Rollback (manual): re-create {resource} from the source configuration; what it held beyond its configuration is not restored
- After, for every step: the rollback decision step

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The retirement of module.retail_app_ecs.module.alb.aws_lb.this (`MAN/decommission/module.retail_app_ecs.module.alb.aws_lb.this`) — {resource} = `module.retail_app_ecs.module.alb.aws_lb.this`; also after: the traffic switch of module.retail_app_ecs.module.alb.aws_lb.this, the security acceptance of module.retail_app_ecs.module.alb.aws_lb.this, the review of the open settings of module.retail_app_ecs.module.alb.aws_lb.this, the review of the open settings of module.retail_app_ecs.module.alb.aws_lb.this, the endpoint check of module.retail_app_ecs.module.alb.aws_lb.this, the OpenTofu step for stackit_application_load_balancer.retail_app_ecs_alb_this
  - What ({what}): module.retail_app_ecs.module.alb.aws_lb.this (aws_lb) with its parts module.retail_app_ecs.module.alb.aws_lb_listener.frontend_http_tcp
  - When: after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- The retirement of module.retail_app_ecs.module.alb.aws_security_group.this (`MAN/decommission/module.retail_app_ecs.module.alb.aws_security_group.this`) — {resource} = `module.retail_app_ecs.module.alb.aws_security_group.this`; also after: the retirement of module.retail_app_ecs.module.alb.aws_lb.this, the review of the open settings of module.retail_app_ecs.module.alb.aws_security_group.this, the refusal of module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 more, the OpenTofu step for stackit_security_group.retail_app_ecs_alb_this
  - What ({what}): module.retail_app_ecs.module.alb.aws_security_group.this (aws_security_group)
  - When: after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- The retirement of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix (`MAN/decommission/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`) — {resource} = `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`; also after: the retirement of module.retail_app_ecs.module.alb.aws_lb.this, the step "Re-create the rules beyond the known set of group…", the step "Re-create the rules beyond the known set of group…", the step "Place the source rule…", the step "Place the source rule…", the review of the open settings of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, the refusal of module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 more, the OpenTofu step for stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix
  - What ({what}): module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix (aws_security_group) with its parts module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules
  - When: after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- The retirement of module.dependencies.aws_security_group.catalog_opensearch_sg (`MAN/decommission/module.dependencies.aws_security_group.catalog_opensearch_sg`) — {resource} = `module.dependencies.aws_security_group.catalog_opensearch_sg`; also after: the retirement of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the review of the open settings of module.dependencies.aws_security_group.catalog_opensearch_sg, the refusal of module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 more
  - What ({what}): module.dependencies.aws_security_group.catalog_opensearch_sg (aws_security_group) with its parts module.dependencies.aws_security_group_rule.allow_https_from_client
  - When: after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- The retirement of module.dependencies.module.catalog_rds.aws_security_group.this (`MAN/decommission/module.dependencies.module.catalog_rds.aws_security_group.this`) — {resource} = `module.dependencies.module.catalog_rds.aws_security_group.this`; also after: the retirement of module.dependencies.module.catalog_rds.aws_rds_cluster.this, the review of the open settings of module.dependencies.module.catalog_rds.aws_security_group.this, the refusal of module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 more
  - What ({what}): module.dependencies.module.catalog_rds.aws_security_group.this (aws_security_group) with its parts module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress
  - When: after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- The retirement of module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd (`MAN/decommission/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd`) — {resource} = `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd`; also after: the retirement of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the review of the open settings of module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, the refusal of module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 more
  - What ({what}): module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd (aws_security_group) with its parts module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed
  - When: after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- The retirement of module.dependencies.aws_security_group.mq (`MAN/decommission/module.dependencies.aws_security_group.mq`) — {resource} = `module.dependencies.aws_security_group.mq`; also after: the retirement of module.dependencies.aws_mq_broker.mq, the review of the open settings of module.dependencies.aws_security_group.mq, the refusal of module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 more
  - What ({what}): module.dependencies.aws_security_group.mq (aws_security_group) with its parts module.dependencies.aws_security_group_rule.mq
  - When: after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- The retirement of module.dependencies.module.orders_rds.aws_security_group.this (`MAN/decommission/module.dependencies.module.orders_rds.aws_security_group.this`) — {resource} = `module.dependencies.module.orders_rds.aws_security_group.this`; also after: the retirement of module.dependencies.module.orders_rds.aws_rds_cluster.this, the review of the open settings of module.dependencies.module.orders_rds.aws_security_group.this, the refusal of module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 more
  - What ({what}): module.dependencies.module.orders_rds.aws_security_group.this (aws_security_group) with its parts module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress
  - When: after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- The retirement of module.vpc.module.vpc.aws_route_table.private (`MAN/decommission/module.vpc.module.vpc.aws_route_table.private`) — {resource} = `module.vpc.module.vpc.aws_route_table.private`; also after: the decision step of module.vpc.module.vpc.aws_route_table.private, the routing precondition of module.vpc.module.vpc.aws_route_table.private, the review of the open settings of module.vpc.module.vpc.aws_route_table.private
  - What ({what}): module.vpc.module.vpc.aws_route_table.private (aws_route_table) with its parts module.vpc.module.vpc.aws_route.private_nat_gateway, module.vpc.module.vpc.aws_route_table_association.private
  - When: applies only if its count (local.create_private_subnets && local.max_subnet_length > 0 ? local.nat_gateway_count : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source; after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`, `DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST`
- The retirement of module.vpc.module.vpc.aws_nat_gateway.this (`MAN/decommission/module.vpc.module.vpc.aws_nat_gateway.this`) — {resource} = `module.vpc.module.vpc.aws_nat_gateway.this`; also after: the retirement of module.vpc.module.vpc.aws_route_table.private, the review of the open settings of module.vpc.module.vpc.aws_nat_gateway.this
  - What ({what}): module.vpc.module.vpc.aws_nat_gateway.this (aws_nat_gateway)
  - When: after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`, `DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST`
- The retirement of module.vpc.module.vpc.aws_eip.nat (`MAN/decommission/module.vpc.module.vpc.aws_eip.nat`) — {resource} = `module.vpc.module.vpc.aws_eip.nat`; also after: the retirement of module.vpc.module.vpc.aws_nat_gateway.this, the setting `public-address` of module.vpc.module.vpc.aws_eip.nat
  - What ({what}): module.vpc.module.vpc.aws_eip.nat (aws_eip)
  - When: after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`, `DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST`
- The retirement of module.vpc.module.vpc.aws_route_table.public (`MAN/decommission/module.vpc.module.vpc.aws_route_table.public`) — {resource} = `module.vpc.module.vpc.aws_route_table.public`; also after: the routing precondition of module.vpc.module.vpc.aws_route_table.public, the review of the open settings of module.vpc.module.vpc.aws_route_table.public
  - What ({what}): module.vpc.module.vpc.aws_route_table.public (aws_route_table) with its parts module.vpc.module.vpc.aws_route.public_internet_gateway, module.vpc.module.vpc.aws_route_table_association.public
  - When: applies only if its count (local.create_public_subnets ? local.num_public_route_tables : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source; after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- The retirement of module.vpc.module.vpc.aws_internet_gateway.this (`MAN/decommission/module.vpc.module.vpc.aws_internet_gateway.this`) — {resource} = `module.vpc.module.vpc.aws_internet_gateway.this`; also after: the retirement of module.vpc.module.vpc.aws_eip.nat, the retirement of module.vpc.module.vpc.aws_nat_gateway.this, the retirement of module.vpc.module.vpc.aws_route_table.public, the setting `network-topology-boundary` of module.vpc.module.vpc.aws_internet_gateway.this
  - What ({what}): module.vpc.module.vpc.aws_internet_gateway.this (aws_internet_gateway)
  - When: applies only if its count (local.create_public_subnets && var.create_igw ? 1 : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source; after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`, `DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST`
- The retirement of module.vpc.module.vpc.aws_subnet.private (`MAN/decommission/module.vpc.module.vpc.aws_subnet.private`) — {resource} = `module.vpc.module.vpc.aws_subnet.private`; also after: the retirement of module.dependencies.aws_mq_broker.mq, the retirement of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, the retirement of module.dependencies.module.catalog_rds.aws_rds_cluster.this, the retirement of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, the retirement of module.dependencies.module.orders_rds.aws_rds_cluster.this, the retirement of module.retail_app_ecs.module.carts_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.orders_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, the retirement of module.vpc.module.vpc.aws_route_table.private, the setting `availability-zone` of module.vpc.module.vpc.aws_subnet.private, the review of the open settings of module.vpc.module.vpc.aws_subnet.private, the OpenTofu step for stackit_network.vpc_vpc_private
  - What ({what}): module.vpc.module.vpc.aws_subnet.private (aws_subnet)
  - When: applies only if its count (local.create_private_subnets ? local.len_private_subnets : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source; after the GO recorded at the rollback decision step
  - State ({state}): 16 decisions: `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE` and 13 more (decision group `BS-5a0c205434b4` of execution-plan.json)
- The retirement of module.vpc.module.vpc.aws_subnet.public (`MAN/decommission/module.vpc.module.vpc.aws_subnet.public`) — {resource} = `module.vpc.module.vpc.aws_subnet.public`; also after: the retirement of module.retail_app_ecs.module.alb.aws_lb.this, the retirement of module.vpc.module.vpc.aws_nat_gateway.this, the retirement of module.vpc.module.vpc.aws_route_table.public, the setting `availability-zone` of module.vpc.module.vpc.aws_subnet.public, the review of the open settings of module.vpc.module.vpc.aws_subnet.public, the OpenTofu step for stackit_network.vpc_vpc_public
  - What ({what}): module.vpc.module.vpc.aws_subnet.public (aws_subnet)
  - When: applies only if its count (local.create_public_subnets && (!var.one_nat_gateway_per_az || local.len_public_subnets >= length(var.azs)) ? local.len_public_subnets : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source; after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`, `DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST`
- The retirement of module.vpc.module.vpc.aws_vpc.this (`MAN/decommission/module.vpc.module.vpc.aws_vpc.this`) — {resource} = `module.vpc.module.vpc.aws_vpc.this`; also after: the retirement of module.dependencies.aws_security_group.catalog_opensearch_sg, the retirement of module.dependencies.aws_security_group.mq, the retirement of module.dependencies.module.catalog_rds.aws_security_group.this, the retirement of module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, the retirement of module.dependencies.module.orders_rds.aws_security_group.this, the retirement of module.retail_app_ecs.module.alb.aws_lb.this, the retirement of module.retail_app_ecs.module.alb.aws_security_group.this, the retirement of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, the retirement of module.retail_app_ecs.module.carts_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.carts_service.aws_security_group.this, the retirement of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.catalog_service.aws_security_group.this, the retirement of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.checkout_service.aws_security_group.this, the retirement of module.retail_app_ecs.module.orders_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.orders_service.aws_security_group.this, the retirement of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.ui_service.aws_security_group.this, the retirement of module.vpc.module.vpc.aws_internet_gateway.this, the retirement of module.vpc.module.vpc.aws_route_table.private, the retirement of module.vpc.module.vpc.aws_route_table.public, the retirement of module.vpc.module.vpc.aws_subnet.private, the retirement of module.vpc.module.vpc.aws_subnet.public, the setting `dns-settings` of module.vpc.module.vpc.aws_vpc.this, the review of the open settings of module.vpc.module.vpc.aws_vpc.this
  - What ({what}): module.vpc.module.vpc.aws_vpc.this (aws_vpc) with its parts module.vpc.module.vpc.aws_default_network_acl.this, module.vpc.module.vpc.aws_default_route_table.default, module.vpc.module.vpc.aws_default_security_group.this
  - When: after the GO recorded at the rollback decision step
  - State ({state}): 16 decisions: `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE` and 13 more (decision group `BS-5a0c205434b4` of execution-plan.json)

#### The retirement of module.retail_app_ecs.module.carts_service.aws_security_group.this (`MAN/decommission/module.retail_app_ecs.module.carts_service.aws_security_group.this`)

- Phase: Decommission
- What: Retire module.retail_app_ecs.module.carts_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it
- Why: module.retail_app_ecs.module.carts_service.aws_security_group.this keeps costing money and can still take traffic or writes after the cutover, so the two copies drift apart; StackToIT deletes nothing (it is read-only): a person retires it
- Who: Network Architect
- When: after the GO recorded at the rollback decision step
- Needs: the GO recorded at the rollback decision step
- Done when: module.retail_app_ecs.module.carts_service.aws_security_group.this no longer exists in the AWS account and its charges stop on the bill
- Source: `module.retail_app_ecs.module.carts_service.aws_security_group.this`
- After: the retirement of module.retail_app_ecs.module.carts_service.aws_ecs_service.this, the security acceptance of module.retail_app_ecs.module.carts_service.aws_security_group.this, the step "Design the security attachment of…", the review of the open settings of module.retail_app_ecs.module.carts_service.aws_security_group.this, the rollback decision step, the refusal of module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 more, the OpenTofu step for stackit_security_group.retail_app_ecs_carts_service_this, the OpenTofu step for stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1
- State: not executable as the plan stands: the risks listed below; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Risk: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement
- Rollback (manual): re-create module.retail_app_ecs.module.carts_service.aws_security_group.this from the source configuration; what it held beyond its configuration is not restored

#### The retirement of module.retail_app_ecs.module.catalog_service.aws_security_group.this (`MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_security_group.this`)

- Phase: Decommission
- What: Retire module.retail_app_ecs.module.catalog_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it
- Why: module.retail_app_ecs.module.catalog_service.aws_security_group.this keeps costing money and can still take traffic or writes after the cutover, so the two copies drift apart; StackToIT deletes nothing (it is read-only): a person retires it
- Who: Network Architect
- When: after the GO recorded at the rollback decision step
- Needs: the GO recorded at the rollback decision step
- Done when: module.retail_app_ecs.module.catalog_service.aws_security_group.this no longer exists in the AWS account and its charges stop on the bill
- Source: `module.retail_app_ecs.module.catalog_service.aws_security_group.this`
- After: the retirement of module.dependencies.aws_security_group.catalog_opensearch_sg, the retirement of module.dependencies.module.catalog_rds.aws_security_group.this, the retirement of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, the security acceptance of module.retail_app_ecs.module.catalog_service.aws_security_group.this, the step "Design the security attachment of…", the review of the open settings of module.retail_app_ecs.module.catalog_service.aws_security_group.this, the rollback decision step, the refusal of module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 more, the OpenTofu step for stackit_security_group.retail_app_ecs_catalog_service_this, the OpenTofu step for stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1
- State: not executable as the plan stands: the risks listed below; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Risk: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement
- Rollback (manual): re-create module.retail_app_ecs.module.catalog_service.aws_security_group.this from the source configuration; what it held beyond its configuration is not restored

#### The retirement of module.retail_app_ecs.module.checkout_service.aws_security_group.this (`MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_security_group.this`)

- Phase: Decommission
- What: Retire module.retail_app_ecs.module.checkout_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it
- Why: module.retail_app_ecs.module.checkout_service.aws_security_group.this keeps costing money and can still take traffic or writes after the cutover, so the two copies drift apart; StackToIT deletes nothing (it is read-only): a person retires it
- Who: Network Architect
- When: after the GO recorded at the rollback decision step
- Needs: the GO recorded at the rollback decision step
- Done when: module.retail_app_ecs.module.checkout_service.aws_security_group.this no longer exists in the AWS account and its charges stop on the bill
- Source: `module.retail_app_ecs.module.checkout_service.aws_security_group.this`
- After: the retirement of module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, the retirement of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, the security acceptance of module.retail_app_ecs.module.checkout_service.aws_security_group.this, the step "Design the security attachment of…", the review of the open settings of module.retail_app_ecs.module.checkout_service.aws_security_group.this, the rollback decision step, the refusal of module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 more, the OpenTofu step for stackit_security_group.retail_app_ecs_checkout_service_this, the OpenTofu step for stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1
- State: not executable as the plan stands: the risks listed below; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Risk: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement
- Rollback (manual): re-create module.retail_app_ecs.module.checkout_service.aws_security_group.this from the source configuration; what it held beyond its configuration is not restored

#### The retirement of module.retail_app_ecs.module.orders_service.aws_security_group.this (`MAN/decommission/module.retail_app_ecs.module.orders_service.aws_security_group.this`)

- Phase: Decommission
- What: Retire module.retail_app_ecs.module.orders_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it
- Why: module.retail_app_ecs.module.orders_service.aws_security_group.this keeps costing money and can still take traffic or writes after the cutover, so the two copies drift apart; StackToIT deletes nothing (it is read-only): a person retires it
- Who: Network Architect
- When: after the GO recorded at the rollback decision step
- Needs: the GO recorded at the rollback decision step
- Done when: module.retail_app_ecs.module.orders_service.aws_security_group.this no longer exists in the AWS account and its charges stop on the bill
- Source: `module.retail_app_ecs.module.orders_service.aws_security_group.this`
- After: the retirement of module.dependencies.aws_security_group.mq, the retirement of module.dependencies.module.orders_rds.aws_security_group.this, the retirement of module.retail_app_ecs.module.orders_service.aws_ecs_service.this, the security acceptance of module.retail_app_ecs.module.orders_service.aws_security_group.this, the step "Design the security attachment of…", the review of the open settings of module.retail_app_ecs.module.orders_service.aws_security_group.this, the rollback decision step, the refusal of module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 more, the OpenTofu step for stackit_security_group.retail_app_ecs_orders_service_this, the OpenTofu step for stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1
- State: not executable as the plan stands: the risks listed below; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Risk: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement
- Rollback (manual): re-create module.retail_app_ecs.module.orders_service.aws_security_group.this from the source configuration; what it held beyond its configuration is not restored

#### The retirement of module.retail_app_ecs.module.ui_service.aws_security_group.this (`MAN/decommission/module.retail_app_ecs.module.ui_service.aws_security_group.this`)

- Phase: Decommission
- What: Retire module.retail_app_ecs.module.ui_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it
- Why: module.retail_app_ecs.module.ui_service.aws_security_group.this keeps costing money and can still take traffic or writes after the cutover, so the two copies drift apart; StackToIT deletes nothing (it is read-only): a person retires it
- Who: Network Architect
- When: after the GO recorded at the rollback decision step
- Needs: the GO recorded at the rollback decision step
- Done when: module.retail_app_ecs.module.ui_service.aws_security_group.this no longer exists in the AWS account and its charges stop on the bill
- Source: `module.retail_app_ecs.module.ui_service.aws_security_group.this`
- After: the retirement of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, the security acceptance of module.retail_app_ecs.module.ui_service.aws_security_group.this, the step "Design the security attachment of…", the review of the open settings of module.retail_app_ecs.module.ui_service.aws_security_group.this, the rollback decision step, the refusal of module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 more, the OpenTofu step for stackit_security_group.retail_app_ecs_ui_service_this, the OpenTofu step for stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1
- State: not executable as the plan stands: the risks listed below; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- Risk: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement
- Rollback (manual): re-create module.retail_app_ecs.module.ui_service.aws_security_group.this from the source configuration; what it held beyond its configuration is not restored

</details>

### `WP-41` — Retire the source resources

- Owner: Platform Architect
- Steps: 11 (11 are not executable as the plan stands)
- Affected resources: `module.dependencies.aws_mq_broker.mq`, `module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events`, `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights`, `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks`, `module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs`, `module.retail_app_ecs.aws_ecs_cluster.cluster`, `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`, `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`, `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`, `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`, `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`
- Waits for: `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`, `DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS`
- State: not executable as the plan stands
- Done when: each step meets the condition stated with it below (11 different conditions).

<details>
<summary>The 11 steps of WP-41</summary>

#### Alike steps on 11 resources (aws_cloudwatch_event_rule, aws_cloudwatch_log_group, aws_cloudwatch_log_resource_policy and 3 more kinds) — the retirement of {resource} (`MAN/decommission/{resource}`)

- Phase: Decommission
- What: Retire {what} in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it
- Why: {resource} keeps costing money and can still take traffic or writes after the cutover, so the two copies drift apart; StackToIT deletes nothing (it is read-only): a person retires it
- Who: Platform Architect
- Needs: the GO recorded at the rollback decision step
- Done when: {resource} no longer exists in the AWS account and its charges stop on the bill
- State: not executable as the plan stands: the risks listed below; it also waits for `DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`, `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this`, {state}
- Risk: StackToIT performs none of this: it deletes nothing in any cloud, and no step of this plan automates the retirement
- Rollback (manual): re-create {resource} from the source configuration; what it held beyond its configuration is not restored
- After, for every step: the rollback decision step

The steps, each by its name, with the resource that stands for {resource} above, its target objects, the steps it comes after besides those above and the lines that are its own (for a line above with a placeholder in braces, what stands for it):

- The retirement of module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events (`MAN/decommission/module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events`) — {resource} = `module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events`; also after: the manual migration of module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events
  - What ({what}): module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events (aws_cloudwatch_event_rule)
  - When: applies only if its count ((var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0) holds when OpenTofu plans — off with the defaults of var.container_insights_setting, var.lifecycle_events_enabled; it exists only if a variable file (-var-file), -var or TF_VAR_container_insights_setting/TF_VAR_lifecycle_events_enabled switches it on, and this scan saw no such value; after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
  - Risk: module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events reads 0 instances as the variables of the source stand: the step applies only if it exists (applies only if its count ((var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0) holds when OpenTofu plans — off with the defaults of var.container_insights_setting, var.lifecycle_events_enabled; it exists only if a variable file (-var-file), -var or TF_VAR_container_insights_setting/TF_VAR_lifecycle_events_enabled switches it on, and this scan saw no such value)
- The retirement of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights (`MAN/decommission/module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights`) — {resource} = `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights`; also after: the manual migration of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights
  - What ({what}): module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights (aws_cloudwatch_log_group)
  - When: applies only if its count ((var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0) holds when OpenTofu plans — off with the defaults of var.container_insights_setting, var.lifecycle_events_enabled; it exists only if a variable file (-var-file), -var or TF_VAR_container_insights_setting/TF_VAR_lifecycle_events_enabled switches it on, and this scan saw no such value; after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
  - Risk: module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights reads 0 instances as the variables of the source stand: the step applies only if it exists (applies only if its count ((var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0) holds when OpenTofu plans — off with the defaults of var.container_insights_setting, var.lifecycle_events_enabled; it exists only if a variable file (-var-file), -var or TF_VAR_container_insights_setting/TF_VAR_lifecycle_events_enabled switches it on, and this scan saw no such value)
- The retirement of module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs (`MAN/decommission/module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs`) — {resource} = `module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs`; also after: the manual migration of module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs
  - What ({what}): module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs (aws_cloudwatch_log_resource_policy)
  - When: applies only if its count ((var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0) holds when OpenTofu plans — off with the defaults of var.container_insights_setting, var.lifecycle_events_enabled; it exists only if a variable file (-var-file), -var or TF_VAR_container_insights_setting/TF_VAR_lifecycle_events_enabled switches it on, and this scan saw no such value; after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
  - Risk: module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs reads 0 instances as the variables of the source stand: the step applies only if it exists (applies only if its count ((var.container_insights_setting == "enhanced" && var.lifecycle_events_enabled) ? 1 : 0) holds when OpenTofu plans — off with the defaults of var.container_insights_setting, var.lifecycle_events_enabled; it exists only if a variable file (-var-file), -var or TF_VAR_container_insights_setting/TF_VAR_lifecycle_events_enabled switches it on, and this scan saw no such value)
- The retirement of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (`MAN/decommission/module.retail_app_ecs.module.ui_service.aws_ecs_service.this`) — {resource} = `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`; also after: the step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health", the step "Fill in the required inputs of kubernetes/ui/manifests.yaml and apply it to the…", the step "Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this pulls…", the step "Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this gets…", the step "Design the security attachment of…", the review of the open settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, the DNS check of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, the OpenTofu step for stackit_ske_cluster.retail_app_ecs_cluster
  - What ({what}): module.retail_app_ecs.module.ui_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this
  - When: after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- The retirement of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (`MAN/decommission/module.retail_app_ecs.module.carts_service.aws_ecs_service.this`) — {resource} = `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`; also after: the retirement of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, the step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health", the step "Fill in the required inputs of kubernetes/carts/manifests.yaml and apply it to…", the step "Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this…", the step "Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this gets…", the step "Design the security attachment of…", the review of the open settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this, the DNS check of module.retail_app_ecs.module.carts_service.aws_ecs_service.this, the OpenTofu step for stackit_ske_cluster.retail_app_ecs_cluster
  - What ({what}): module.retail_app_ecs.module.carts_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this
  - When: after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- The retirement of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (`MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`) — {resource} = `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`; also after: the retirement of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, the step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health", the step "Fill in the required inputs of kubernetes/catalog/manifests.yaml and apply it…", the step "Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this…", the step "Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this…", the step "Design the security attachment of…", the review of the open settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, the DNS check of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, the OpenTofu step for stackit_ske_cluster.retail_app_ecs_cluster
  - What ({what}): module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this
  - When: after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- The retirement of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (`MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`) — {resource} = `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`; also after: the retirement of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, the step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health", the step "Fill in the required inputs of kubernetes/checkout/manifests.yaml and apply it…", the step "Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this…", the step "Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this…", the step "Design the security attachment of…", the review of the open settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, the DNS check of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, the OpenTofu step for stackit_ske_cluster.retail_app_ecs_cluster
  - What ({what}): module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this
  - When: after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- The retirement of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (`MAN/decommission/module.retail_app_ecs.module.orders_service.aws_ecs_service.this`) — {resource} = `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`; also after: the retirement of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, the step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health", the step "Fill in the required inputs of kubernetes/orders/manifests.yaml and apply it to…", the step "Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this…", the step "Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this…", the step "Design the security attachment of…", the review of the open settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this, the review of the open settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this, the DNS check of module.retail_app_ecs.module.orders_service.aws_ecs_service.this, the OpenTofu step for stackit_ske_cluster.retail_app_ecs_cluster
  - What ({what}): module.retail_app_ecs.module.orders_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this
  - When: after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- The retirement of module.retail_app_ecs.aws_ecs_cluster.cluster (`MAN/decommission/module.retail_app_ecs.aws_ecs_cluster.cluster`) — {resource} = `module.retail_app_ecs.aws_ecs_cluster.cluster`; also after: the retirement of module.retail_app_ecs.module.carts_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.orders_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, the step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health", the OpenTofu step for stackit_ske_cluster.retail_app_ecs_cluster
  - What ({what}): module.retail_app_ecs.aws_ecs_cluster.cluster (aws_ecs_cluster)
  - When: after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- The retirement of module.dependencies.aws_mq_broker.mq (`MAN/decommission/module.dependencies.aws_mq_broker.mq`) — {resource} = `module.dependencies.aws_mq_broker.mq`; also after: the switch of the consumers of module.dependencies.aws_mq_broker.mq, the drain of the queue of module.dependencies.aws_mq_broker.mq, the traffic switch of module.dependencies.aws_mq_broker.mq, the retirement of module.retail_app_ecs.aws_secretsmanager_secret.mq, the setting `broker-network` of module.dependencies.aws_mq_broker.mq, the review of the open settings of module.dependencies.aws_mq_broker.mq, the review of the open settings of module.dependencies.aws_mq_broker.mq, the review of the open settings of module.dependencies.aws_mq_broker.mq, the endpoint check of module.dependencies.aws_mq_broker.mq, the OpenTofu step for stackit_rabbitmq_credential.dependencies_mq, the OpenTofu step for stackit_rabbitmq_instance.dependencies_mq
  - What ({what}): module.dependencies.aws_mq_broker.mq (aws_mq_broker)
  - When: after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`
- The retirement of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (`MAN/decommission/module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks`) — {resource} = `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks`; also after: the retirement of module.retail_app_ecs.module.carts_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role, the retirement of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role, the retirement of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role, the retirement of module.retail_app_ecs.module.orders_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role, the retirement of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, the retirement of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role, the step "Configure a cold-storage log flow for…", the step "Choose a static label and send the name of…", the step "Before any log source writes to stackit_logs_instance.logs_retention_180d", the OpenTofu step for stackit_logs_instance.logs_retention_180d
  - What ({what}): module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (aws_cloudwatch_log_group)
  - When: after the GO recorded at the rollback decision step
  - State ({state}): `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this`, `DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS`

</details>

## Not migrated

### The refusal of module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 more (`REF/root/security-group-membership-parity`)

- Source capability: the VPC membership (the critical setting `security-group-vpc-membership`) of 12 AWS security groups: `module.retail_app_ecs.module.alb.aws_security_group.this`, `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`, `module.retail_app_ecs.module.carts_service.aws_security_group.this`, `module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `module.retail_app_ecs.module.orders_service.aws_security_group.this`, `module.retail_app_ecs.module.ui_service.aws_security_group.this`, `module.dependencies.aws_security_group.catalog_opensearch_sg`, `module.dependencies.aws_security_group.mq`, `module.dependencies.module.catalog_rds.aws_security_group.this`, `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd`, `module.dependencies.module.orders_rds.aws_security_group.this`; 7 of the drafted STACKIT security groups are orphaned (no block of the draft attaches the group, so its rules restrict nothing on STACKIT as drafted): `stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix`, `stackit_security_group.retail_app_ecs_alb_this`, `stackit_security_group.retail_app_ecs_carts_service_this`, `stackit_security_group.retail_app_ecs_catalog_service_this`, `stackit_security_group.retail_app_ecs_checkout_service_this`, `stackit_security_group.retail_app_ecs_orders_service_this`, `stackit_security_group.retail_app_ecs_ui_service_this`
- Reason: the target's scope model differs from the source's, so the source's boundary has no one-to-one counterpart (`TARGET_SCOPE_MODEL_DIFFERS`)
- Missing on the target: network-scoped security group: a STACKIT security group belongs to the project, not to a network, so the VPC boundary of the source groups is one design parity gap of the target for the whole estate, with alternatives; the draft still writes each group and its rules
- Why: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.; This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.
- Redesign direction: close it once for the estate by one of these alternatives: confirm that the estate has one VPC (the project the draft creates is then that VPC's boundary, and the setting closes); give each source VPC a STACKIT project of its own, joined through a Network Area where their networks must reach each other; or keep one project and attach each group only to the interfaces of the networks that replace its VPC, with no rule's remote_security_group_id naming a group whose members sit in a network the source VPC kept apart. A difference that is accepted instead (the groups stay project-wide) is recorded as an accepted design difference, with who accepted it and why, never as equivalent
- Source: `module.dependencies.aws_security_group.catalog_opensearch_sg`, `module.dependencies.aws_security_group.mq`, `module.dependencies.module.catalog_rds.aws_security_group.this`, `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd`, `module.dependencies.module.orders_rds.aws_security_group.this`, `module.retail_app_ecs.module.alb.aws_security_group.this`, `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`, `module.retail_app_ecs.module.carts_service.aws_security_group.this`, `module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `module.retail_app_ecs.module.orders_service.aws_security_group.this`, `module.retail_app_ecs.module.ui_service.aws_security_group.this`
- State: permanently unsupported: refused, not migrated (not executable)
- Risk: what would close it, as the assessment says: A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.
- Risk: this step is the root cause `security-group-membership-parity` (ROOT_BLOCKER) of 12 units that the target holds the same way, each a dependent (PROPAGATED_IMPACT): `module.retail_app_ecs.module.alb.aws_security_group.this`, `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`, `module.retail_app_ecs.module.carts_service.aws_security_group.this`, `module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `module.retail_app_ecs.module.orders_service.aws_security_group.this`, `module.retail_app_ecs.module.ui_service.aws_security_group.this`, `module.dependencies.aws_security_group.catalog_opensearch_sg`, `module.dependencies.aws_security_group.mq`, `module.dependencies.module.catalog_rds.aws_security_group.this`, `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd`, `module.dependencies.module.orders_rds.aws_security_group.this`; each keeps its own line in `coverage.units.critical_semantics` and in `assurance/critical-semantics.json`, with this step as its disposition (the decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS holds `module.retail_app_ecs.module.alb.aws_security_group.this`; the decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862 holds `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`; the decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF holds `module.retail_app_ecs.module.carts_service.aws_security_group.this`; the decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F holds `module.retail_app_ecs.module.catalog_service.aws_security_group.this`; the decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F holds `module.retail_app_ecs.module.checkout_service.aws_security_group.this`; the decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3 holds `module.retail_app_ecs.module.orders_service.aws_security_group.this`; the decision register record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS holds `module.retail_app_ecs.module.ui_service.aws_security_group.this`; the decision register record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG holds `module.dependencies.aws_security_group.catalog_opensearch_sg`; the decision register record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ holds `module.dependencies.aws_security_group.mq`; the decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS holds `module.dependencies.module.catalog_rds.aws_security_group.this`; the decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0 holds `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd`; the decision register record DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS holds `module.dependencies.module.orders_rds.aws_security_group.this`)
- Risk: the migration of `module.retail_app_ecs.module.alb.aws_security_group.this`, `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`, `module.retail_app_ecs.module.carts_service.aws_security_group.this`, `module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `module.retail_app_ecs.module.orders_service.aws_security_group.this`, `module.retail_app_ecs.module.ui_service.aws_security_group.this`, `module.dependencies.aws_security_group.catalog_opensearch_sg`, `module.dependencies.aws_security_group.mq`, `module.dependencies.module.catalog_rds.aws_security_group.this`, `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd`, `module.dependencies.module.orders_rds.aws_security_group.this` is not complete until one of the alternatives is taken for the estate or the difference is recorded as accepted; an accepted difference stays a difference, never equivalence
- Rollback (available): nothing is done: a refused step creates nothing

### The refusal of the setting `credentials-and-keys-settings` of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (`REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/credentials-and-keys-settings`)

- Source capability: the critical setting `credentials-and-keys-settings` of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
- Reason: the target has no counterpart that carries this setting of the source (`TARGET_SETTING_UNSUPPORTED`)
- Missing on the target: counterpart that carries the setting `credentials-and-keys-settings` of aws_opensearch_domain (the knowledge base marks it UNSUPPORTED)
- Why: The mapping rule for this kind of unit found a setting the target has no counterpart for. The IAM master user, the master user name and password, the customer KMS key and the custom endpoint certificate, read where they are set whatever their value. STACKIT generates the OpenSearch credential (stackit_opensearch_credential username and password are computed), offers no customer KMS key for the instance and no custom endpoint certificate (pinned provider) - UNSUPPORTED; a password is never carried.
- Redesign direction: To be defined by the architect
- Source: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
- State: permanently unsupported: refused, not migrated (not executable)
- Risk: what would close it, as the assessment says: A person accepts the difference or the design changes: nothing in the source can make the target carry it.
- Risk: the migration of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` is not complete: STACKIT does not carry its critical setting `credentials-and-keys-settings`, which a redesign or an accepted difference has to settle
- Rollback (available): nothing is done: a refused step creates nothing

### The refusal of the setting `domain-credentials-and-keys` of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (`REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/domain-credentials-and-keys`)

- Source capability: the critical setting `domain-credentials-and-keys` of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
- Reason: the target has no counterpart that carries this setting of the source (`TARGET_SETTING_UNSUPPORTED`)
- Missing on the target: counterpart that carries the setting `domain-credentials-and-keys` of aws_opensearch_domain (the knowledge base marks it UNSUPPORTED)
- Why: The mapping rule for this kind of unit found a setting the target has no counterpart for. STACKIT generates the OpenSearch credential (stackit_opensearch_credential username and password are computed), offers no customer KMS key for the instance and no custom endpoint certificate (pinned provider) — UNSUPPORTED.
- Redesign direction: To be defined by the architect
- Source: `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`
- State: permanently unsupported: refused, not migrated (not executable)
- Risk: what would close it, as the assessment says: A person accepts the difference or the design changes: nothing in the source can make the target carry it.
- Risk: the migration of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` is not complete: STACKIT does not carry its critical setting `domain-credentials-and-keys`, which a redesign or an accepted difference has to settle
- Rollback (available): nothing is done: a refused step creates nothing


The draft writes no resource for these source resources; each is a manual step above, carried out by a person: `module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events`, `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights`, `module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs`.

## STACKIT API scripts

The plan holds 4 STACKIT API steps. Each is a script of this package that a person runs; StackToIT has run none of them. The state says how far the step has come, and `execution/README.md` says what each state means.

Operator checks before running a script that is not verified live: the endpoint it calls, the project it acts in and the read before the write (what the read before the write finds, or that the call reads nothing before it writes). The head of each script names its own values.

- The STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (`API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db`) — `execution/api/secrets-manager-vault/001-writesecret.sh`: generated, tested offline
- The STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (`API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch`) — `execution/api/secrets-manager-vault/002-writesecret.sh`: generated, tested offline
- The STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq (`API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq`) — `execution/api/secrets-manager-vault/003-writesecret.sh`: generated, tested offline
- The STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db (`API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db`) — `execution/api/secrets-manager-vault/004-writesecret.sh`: generated, tested offline