# OpenTofu steps

Generated by StackToIT from `execution-plan.json`. Nothing in this folder has been run: StackToIT reads and writes files and creates, changes and deletes nothing in any cloud. Every step is carried out by a person, by OpenTofu or by a script of this folder that a person runs. Paths are relative to the output folder.

The draft is in `terraform/`. OpenTofu applies the whole draft at once and orders its blocks by their references itself; the tables list the OpenTofu steps of the plan for review, grouped by who applies them, each group in the plan's order.

The owner of an area is the person who applies it: a step is applied by the owner role the plan names for the category of the source unit its block is written from ("Applied by"), and a file whose blocks belong to two roles is applied by each role for its own blocks (the Work Board lists the same split). A step whose unit has no category in the owner table is listed last, with no role: none is guessed.

**Do not apply yet.** 4 steps wait for a decision (the tables say which). A full apply creates every block of the draft as it stands, theirs included. Apply only when every OpenTofu step of the tables is executable.

## Complete these steps before tofu apply

OpenTofu applies the whole draft in one run. It orders its own blocks by their references and does not enforce the manual steps, the STACKIT API calls or the phases of the plan: complete the steps below first, in this order.

- [ ] `MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.private` — manual step (prepare): Create the target project outside a Network Area: module.vpc.module.vpc.aws_route_table.private is replaced by STACKIT's default routing, which was observed to give a routed network the same reachability only in a project outside a Network Area. — executable: a person can start it now
- [ ] `MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.public` — manual step (prepare): Create the target project outside a Network Area: module.vpc.module.vpc.aws_route_table.public is replaced by STACKIT's default routing, which was observed to give a routed network the same reachability only in a project outside a Network Area. — executable: a person can start it now

## Before you apply

- Credentials: the STACKIT provider reads them from the environment, for example `STACKIT_SERVICE_ACCOUNT_KEY_PATH`; `terraform/README.md` says what the draft needs.
- Variables a step needs a value for (a variable without a default, or one the plan does not take as given): `alb_interval_jitter`, `dependencies_catalog_opensearch_this_plan_name`, `dependencies_catalog_opensearch_this_version`, `dependencies_catalog_rds_this_plan_name`, `dependencies_checkout_elasticache_redis_default_allowed_cidrs`, `dependencies_checkout_elasticache_redis_default_version`, `dependencies_mq_version`, `dependencies_orders_rds_this_storage_size`, `dynamodb_tables_allowed_cidrs`, `dynamodb_tables_cpu`, `dynamodb_tables_pitr_hours`, `dynamodb_tables_ram`, `dynamodb_tables_storage_gb`, `kms_access_scope`, `kms_protection`, `mongodbflex_storage_class`, `postgresflex_storage_class`, `project_id`, `retail_app_ecs_alb_this_health_ok_status`, `retail_app_ecs_alb_this_network_id_target`, `retail_app_ecs_alb_this_target_ips`, `retail_app_ecs_carts_service_task_execution_role_project_roles`, `retail_app_ecs_carts_service_task_role_project_roles`, `retail_app_ecs_catalog_service_task_execution_role_project_roles`, `retail_app_ecs_catalog_service_task_role_project_roles`, `retail_app_ecs_checkout_service_task_execution_role_project_roles`, `retail_app_ecs_checkout_service_task_role_project_roles`, `retail_app_ecs_cluster_machine_type`, `retail_app_ecs_cluster_nodes_max`, `retail_app_ecs_cluster_nodes_min`, `retail_app_ecs_orders_service_task_execution_role_project_roles`, `retail_app_ecs_orders_service_task_role_project_roles`, `retail_app_ecs_ui_service_task_execution_role_project_roles`, `retail_app_ecs_ui_service_task_role_project_roles`, `sg_retail_app_ecs_carts_service_this_name`, `sg_retail_app_ecs_catalog_service_this_name`, `sg_retail_app_ecs_checkout_service_this_name`, `sg_retail_app_ecs_orders_service_this_name`, `sg_retail_app_ecs_ui_service_this_name`, `vpc_vpc_private_count`, `vpc_vpc_private_ipv4_prefixes`, `vpc_vpc_public_count`, `vpc_vpc_public_ipv4_prefixes`.
- Variables read with the default the draft declares (check each): `availability_zones`, `default_ipv4_nameservers`, `dependencies_catalog_opensearch_this_allowed_cidrs`, `dependencies_catalog_rds_this_allowed_cidrs`, `dependencies_catalog_rds_this_version`, `dependencies_checkout_elasticache_redis_default_plan_name`, `dependencies_mq_allowed_cidrs`, `dependencies_mq_plan_name`, `dependencies_orders_rds_this_access_scope`, `dependencies_orders_rds_this_admin_roles`, `dependencies_orders_rds_this_allowed_cidrs`, `dynamodb_tables_version`, `retail_app_ecs_alb_this_labels`, `retail_app_ecs_alb_this_plan_id`, `sg_retail_app_ecs_alb_sg_this_name_prefix_labels`, `sg_retail_app_ecs_alb_this_labels`.
- Decisions to answer first: `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-WORKLOAD-PLACEMENT` (see `executive/decisions.md`).

## Commands

From the output folder:

```sh
cd terraform
tofu init
tofu validate
tofu plan -out=stackit.tfplan
tofu apply stackit.tfplan
```

## Steps

The number is the step's place among the OpenTofu steps in the plan's order.

### Applied by Network Architect

| # | Step | Phase | Resources | File | Executable | Blocked by | Variables | Risks |
|---|---|---|---|---|---|---|---|---|
| 1 | `TF/stackit_network.vpc_vpc_private` | Foundation | `stackit_network.vpc_vpc_private` | `terraform/network.tf` | no | `DEC-GEN-CONVERT-WORKLOAD-PLACEMENT` | `default_ipv4_nameservers`, `project_id`, `vpc_vpc_private_count`, `vpc_vpc_private_ipv4_prefixes` | the migration of `module.vpc.module.vpc.aws_subnet.private` is not complete with this step: 5 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (5 manual, 0 refused): `subnet-vpc-membership`, `network-topology-boundary`, `private-egress-ipv4`, `prefix`, `availability-zone`; the source creates module.vpc.module.vpc.aws_subnet.private only under a condition (applies only if its count (local.create_private_subnets ? local.len_private_subnets : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source): this step creates its target as the variables of the draft decide, so check that they create it exactly when the source's condition holds |
| 2 | `TF/stackit_network.vpc_vpc_public` | Foundation | `stackit_network.vpc_vpc_public` | `terraform/network.tf` | yes | — | `default_ipv4_nameservers`, `project_id`, `vpc_vpc_public_count`, `vpc_vpc_public_ipv4_prefixes` | the migration of `module.vpc.module.vpc.aws_subnet.public` is not complete with this step: 6 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (6 manual, 0 refused): `subnet-vpc-membership`, `network-topology-boundary`, `effective-route-table`, `private-egress-ipv4`, `prefix`, `availability-zone`; the source creates module.vpc.module.vpc.aws_subnet.public only under a condition (applies only if its count (local.create_public_subnets && (!var.one_nat_gateway_per_az \|\| local.len_public_subnets >= length(var.azs)) ? local.len_public_subnets : 0) holds when OpenTofu plans — decided by data OpenTofu reads when it plans (module.vpc.data.aws_availability_zones.available); not known from the source): this step creates its target as the variables of the draft decide, so check that they create it exactly when the source's condition holds |
| 7 | `TF/stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix` | Security | `stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix` | `terraform/security.tf` | yes | — | `project_id`, `sg_retail_app_ecs_alb_sg_this_name_prefix_labels` | the draft writes no rule for this group, so the step creates a group that enforces nothing until its rules are decided; the default of sg_retail_app_ecs_alb_sg_this_name_prefix_labels is the scan's reading of the source, not proven: set the labels you want before apply; vpc_id is not carried: the target has no equivalent (a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried); the migration of `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix` is not complete with this step: 7 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (6 manual, 1 refused): `security-group-vpc-membership`, `network-topology-boundary`, `stateful`, `rule-ports`, `standalone-rule-values`, `standalone-rule-other-sources`, `standalone-rule-empty-sources`; no block of the draft lists this group (its members are module.retail_app_ecs.module.alb.aws_lb.this (aws_lb, written without a security group)): it restricts nothing on STACKIT, so it enforces nothing until it is attached to the interfaces of the servers it stood for |
| 8 | `TF/stackit_security_group.retail_app_ecs_alb_this` | Security | `stackit_security_group.retail_app_ecs_alb_this` | `terraform/security.tf` | yes | — | `project_id`, `sg_retail_app_ecs_alb_this_labels` | the draft writes no rule for this group, so the step creates a group that enforces nothing until its rules are decided; the default of sg_retail_app_ecs_alb_this_labels is the scan's reading of the source, not proven: set the labels you want before apply; vpc_id is not carried: the target has no equivalent (a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried); the migration of `module.retail_app_ecs.module.alb.aws_security_group.this` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (3 manual, 1 refused): `security-group-vpc-membership`, `network-topology-boundary`, `stateful`, `egress-restriction`; no block of the draft lists this group (its members are module.retail_app_ecs.module.alb.aws_lb.this (aws_lb, written without a security group)): it restricts nothing on STACKIT, so it enforces nothing until it is attached to the interfaces of the servers it stood for |
| 9 | `TF/stackit_security_group.retail_app_ecs_carts_service_this` | Security | `stackit_security_group.retail_app_ecs_carts_service_this` | `terraform/security.tf` | yes | — | `project_id`, `sg_retail_app_ecs_carts_service_this_name` | vpc_id is not carried: the target has no equivalent (a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried); the migration of `module.retail_app_ecs.module.carts_service.aws_security_group.this` is not complete with this step: 7 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (6 manual, 1 refused): `security-group-vpc-membership`, `network-topology-boundary`, `stateful`, `rule-ports`, `egress-rule-protocol`, `ingress-sources`, `egress-sources`; no block of the draft lists this group (its members are module.retail_app_ecs.module.carts_service.aws_ecs_service.this (an ECS service: its tasks become pods)): it restricts nothing on STACKIT, so it enforces nothing until it is attached to the interfaces of the servers it stood for; the segmentation its tasks had is the decision DEC-GEN-CONVERT-POD-SEGMENTATION |
| 10 | `TF/stackit_security_group.retail_app_ecs_catalog_service_this` | Security | `stackit_security_group.retail_app_ecs_catalog_service_this` | `terraform/security.tf` | yes | — | `project_id`, `sg_retail_app_ecs_catalog_service_this_name` | vpc_id is not carried: the target has no equivalent (a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried); the migration of `module.retail_app_ecs.module.catalog_service.aws_security_group.this` is not complete with this step: 7 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (6 manual, 1 refused): `security-group-vpc-membership`, `network-topology-boundary`, `stateful`, `rule-ports`, `egress-rule-protocol`, `ingress-sources`, `egress-sources`; no block of the draft lists this group (its members are module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (an ECS service: its tasks become pods)): it restricts nothing on STACKIT, so it enforces nothing until it is attached to the interfaces of the servers it stood for; the segmentation its tasks had is the decision DEC-GEN-CONVERT-POD-SEGMENTATION |
| 11 | `TF/stackit_security_group.retail_app_ecs_checkout_service_this` | Security | `stackit_security_group.retail_app_ecs_checkout_service_this` | `terraform/security.tf` | yes | — | `project_id`, `sg_retail_app_ecs_checkout_service_this_name` | vpc_id is not carried: the target has no equivalent (a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried); the migration of `module.retail_app_ecs.module.checkout_service.aws_security_group.this` is not complete with this step: 7 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (6 manual, 1 refused): `security-group-vpc-membership`, `network-topology-boundary`, `stateful`, `rule-ports`, `egress-rule-protocol`, `ingress-sources`, `egress-sources`; no block of the draft lists this group (its members are module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (an ECS service: its tasks become pods)): it restricts nothing on STACKIT, so it enforces nothing until it is attached to the interfaces of the servers it stood for; the segmentation its tasks had is the decision DEC-GEN-CONVERT-POD-SEGMENTATION |
| 12 | `TF/stackit_security_group.retail_app_ecs_orders_service_this` | Security | `stackit_security_group.retail_app_ecs_orders_service_this` | `terraform/security.tf` | yes | — | `project_id`, `sg_retail_app_ecs_orders_service_this_name` | vpc_id is not carried: the target has no equivalent (a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried); the migration of `module.retail_app_ecs.module.orders_service.aws_security_group.this` is not complete with this step: 7 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (6 manual, 1 refused): `security-group-vpc-membership`, `network-topology-boundary`, `stateful`, `rule-ports`, `egress-rule-protocol`, `ingress-sources`, `egress-sources`; no block of the draft lists this group (its members are module.retail_app_ecs.module.orders_service.aws_ecs_service.this (an ECS service: its tasks become pods)): it restricts nothing on STACKIT, so it enforces nothing until it is attached to the interfaces of the servers it stood for; the segmentation its tasks had is the decision DEC-GEN-CONVERT-POD-SEGMENTATION |
| 13 | `TF/stackit_security_group.retail_app_ecs_ui_service_this` | Security | `stackit_security_group.retail_app_ecs_ui_service_this` | `terraform/security.tf` | yes | — | `project_id`, `sg_retail_app_ecs_ui_service_this_name` | vpc_id is not carried: the target has no equivalent (a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried); the migration of `module.retail_app_ecs.module.ui_service.aws_security_group.this` is not complete with this step: 7 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (6 manual, 1 refused): `security-group-vpc-membership`, `network-topology-boundary`, `stateful`, `rule-ports`, `egress-rule-protocol`, `ingress-sources`, `egress-sources`; no block of the draft lists this group (its members are module.retail_app_ecs.module.ui_service.aws_ecs_service.this (an ECS service: its tasks become pods)): it restricts nothing on STACKIT, so it enforces nothing until it is attached to the interfaces of the servers it stood for; the segmentation its tasks had is the decision DEC-GEN-CONVERT-POD-SEGMENTATION |
| 14 | `TF/stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1` | Security | `stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1` | `terraform/security.tf` | yes | — | `project_id` | the migration of `module.retail_app_ecs.module.carts_service.aws_security_group.this` is not complete with this step: 7 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (6 manual, 1 refused): `security-group-vpc-membership`, `network-topology-boundary`, `stateful`, `rule-ports`, `egress-rule-protocol`, `ingress-sources`, `egress-sources` |
| 15 | `TF/stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1` | Security | `stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1` | `terraform/security.tf` | yes | — | `project_id` | the migration of `module.retail_app_ecs.module.catalog_service.aws_security_group.this` is not complete with this step: 7 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (6 manual, 1 refused): `security-group-vpc-membership`, `network-topology-boundary`, `stateful`, `rule-ports`, `egress-rule-protocol`, `ingress-sources`, `egress-sources` |
| 16 | `TF/stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1` | Security | `stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1` | `terraform/security.tf` | yes | — | `project_id` | the migration of `module.retail_app_ecs.module.checkout_service.aws_security_group.this` is not complete with this step: 7 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (6 manual, 1 refused): `security-group-vpc-membership`, `network-topology-boundary`, `stateful`, `rule-ports`, `egress-rule-protocol`, `ingress-sources`, `egress-sources` |
| 17 | `TF/stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1` | Security | `stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1` | `terraform/security.tf` | yes | — | `project_id` | the migration of `module.retail_app_ecs.module.orders_service.aws_security_group.this` is not complete with this step: 7 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (6 manual, 1 refused): `security-group-vpc-membership`, `network-topology-boundary`, `stateful`, `rule-ports`, `egress-rule-protocol`, `ingress-sources`, `egress-sources` |
| 18 | `TF/stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1` | Security | `stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1` | `terraform/security.tf` | yes | — | `project_id` | the migration of `module.retail_app_ecs.module.ui_service.aws_security_group.this` is not complete with this step: 7 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (6 manual, 1 refused): `security-group-vpc-membership`, `network-topology-boundary`, `stateful`, `rule-ports`, `egress-rule-protocol`, `ingress-sources`, `egress-sources` |
| 42 | `TF/stackit_application_load_balancer.retail_app_ecs_alb_this` | Platform services | `stackit_application_load_balancer.retail_app_ecs_alb_this` | `terraform/loadbalancing.tf` | no | `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH` | `alb_interval_jitter`, `project_id`, `retail_app_ecs_alb_this_health_ok_status`, `retail_app_ecs_alb_this_labels`, `retail_app_ecs_alb_this_network_id_target`, `retail_app_ecs_alb_this_plan_id`, `retail_app_ecs_alb_this_target_ips` | the draft carries a value of stackit_application_load_balancer.retail_app_ecs_alb_this only as a guess (module.retail_app_ecs.module.alb.aws_lb.this subnets: the source load balancer names every instance of the repeated subnet module.vpc.module.vpc.aws_subnet.public, each a network of its own on STACKIT; the draft places the load balancer in one network (its layout choice; other layouts are a redesign): which instance is the placement is a decision): it is applied after a person confirms it; the migration of `module.retail_app_ecs.module.alb.aws_lb.this` is not complete with this step: 8 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (8 manual, 0 refused): `lb-connection-timeouts`, `network-exposure`, `client-restriction`, `request-handling`, `request-header-options`, `lb-routing-and-addressing`, `lb-subnets`, `tc-lb-name`; the support resources this step reads state 14 critical settings its block does not carry — a person decides each with this step, none is a step of its own: `module.retail_app_ecs.module.alb.aws_lb_target_group.main` deregistration_delay: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its deregistration_delay — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; `module.retail_app_ecs.module.alb.aws_lb_target_group.main` health_check.enabled: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its health_check.enabled — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; `module.retail_app_ecs.module.alb.aws_lb_target_group.main` health_check.healthy_threshold: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its health_check.healthy_threshold — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; `module.retail_app_ecs.module.alb.aws_lb_target_group.main` health_check.interval: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its health_check.interval — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; `module.retail_app_ecs.module.alb.aws_lb_target_group.main` health_check.path: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its health_check.path — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; `module.retail_app_ecs.module.alb.aws_lb_target_group.main` health_check.port: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its health_check.port — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; `module.retail_app_ecs.module.alb.aws_lb_target_group.main` health_check.protocol: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its health_check.protocol — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; `module.retail_app_ecs.module.alb.aws_lb_target_group.main` health_check.timeout: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its health_check.timeout — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; `module.retail_app_ecs.module.alb.aws_lb_target_group.main` health_check.unhealthy_threshold: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its health_check.unhealthy_threshold — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; `module.retail_app_ecs.module.alb.aws_lb_target_group.main` port: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its port — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; `module.retail_app_ecs.module.alb.aws_lb_target_group.main` protocol: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its protocol — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; `module.retail_app_ecs.module.alb.aws_lb_target_group.main` proxy_protocol_v2: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its proxy_protocol_v2 — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; `module.retail_app_ecs.module.alb.aws_lb_target_group.main` target_type: the draft writes no block for module.retail_app_ecs.module.alb.aws_lb_target_group.main, and the plan cannot show that the block of module.retail_app_ecs.module.alb.aws_lb.this carries its target_type — a person decides it with module.retail_app_ecs.module.alb.aws_lb.this; `module.retail_app_ecs.module.alb.aws_lb_target_group.main` vpc_id: a STACKIT target pool has no network of its own: the load balancer reaches the targets through the networks of its block (`terraform/loadbalancing.tf`, block `stackit_application_load_balancer.retail_app_ecs_alb_this`, target pool `retail-app-ecs-alb-main`), so the VPC of the target group is not carried as such |

### Applied by Identity Architect

| # | Step | Phase | Resources | File | Executable | Blocked by | Variables | Risks |
|---|---|---|---|---|---|---|---|---|
| 3 | `TF/stackit_kms_keyring.migrated` | Security | `stackit_kms_keyring.migrated` | `terraform/security.tf` | yes | — | `project_id` | the migration of `module.retail_app_ecs.aws_kms_key.cmk` is not complete with this step: 1 critical setting of it that the draft does not carry is a step of its own (1 manual, 0 refused): `deletion-window` |
| 4 | `TF/stackit_kms_key.retail_app_ecs_cmk` | Security | `stackit_kms_key.retail_app_ecs_cmk` | `terraform/security.tf` | yes | — | `kms_access_scope`, `kms_protection`, `project_id` | the migration of `module.retail_app_ecs.aws_kms_key.cmk` is not complete with this step: 1 critical setting of it that the draft does not carry is a step of its own (1 manual, 0 refused): `deletion-window` |
| 5 | `TF/stackit_secretsmanager_instance.migrated_secrets` | Security | `stackit_secretsmanager_instance.migrated_secrets` | `terraform/security.tf` | yes | — | `project_id` | the migration of `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db` is not complete with this step: 3 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (3 manual, 0 refused): `secret-value`, `customer-managed-key`, `tc-secretsmanager-secret-name`; the migration of `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch` is not complete with this step: 3 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (3 manual, 0 refused): `secret-value`, `customer-managed-key`, `tc-secretsmanager-secret-name`; the migration of `module.retail_app_ecs.aws_secretsmanager_secret.mq` is not complete with this step: 2 critical settings of it that the draft does not carry are steps of their own (2 manual, 0 refused): `secret-value`, `tc-secretsmanager-secret-name`; the migration of `module.retail_app_ecs.aws_secretsmanager_secret.orders_db` is not complete with this step: 2 critical settings of it that the draft does not carry are steps of their own (2 manual, 0 refused): `secret-value`, `tc-secretsmanager-secret-name` |
| 6 | `TF/stackit_secretsmanager_user.migration` | Security | `stackit_secretsmanager_user.migration` | `terraform/security.tf` | yes | — | `project_id` | the migration of `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db` is not complete with this step: 3 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (3 manual, 0 refused): `secret-value`, `customer-managed-key`, `tc-secretsmanager-secret-name`; the migration of `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch` is not complete with this step: 3 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (3 manual, 0 refused): `secret-value`, `customer-managed-key`, `tc-secretsmanager-secret-name`; the migration of `module.retail_app_ecs.aws_secretsmanager_secret.mq` is not complete with this step: 2 critical settings of it that the draft does not carry are steps of their own (2 manual, 0 refused): `secret-value`, `tc-secretsmanager-secret-name`; the migration of `module.retail_app_ecs.aws_secretsmanager_secret.orders_db` is not complete with this step: 2 critical settings of it that the draft does not carry are steps of their own (2 manual, 0 refused): `secret-value`, `tc-secretsmanager-secret-name` |
| 19 | `TF/stackit_service_account.retail_app_ecs_carts_service_task_execution_role` | Security | `stackit_service_account.retail_app_ecs_carts_service_task_execution_role` | `terraform/identity.tf` | yes | — | `project_id` | the migration of `module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-ecs` |
| 20 | `TF/stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role` | Security | `stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role` | `terraform/identity.tf` | yes | — | `project_id`, `retail_app_ecs_carts_service_task_execution_role_project_roles` | the migration of `module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-ecs` |
| 21 | `TF/stackit_service_account.retail_app_ecs_carts_service_task_role` | Security | `stackit_service_account.retail_app_ecs_carts_service_task_role` | `terraform/identity.tf` | yes | — | `project_id` | the migration of `module.retail_app_ecs.module.carts_service.aws_iam_role.task_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-customer-policy`; if production sets var.opentelemetry_enabled so that module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_agent exists (its count is `var.opentelemetry_enabled ? 1 : 0`, which reads 0 as the variables stand), it needs: its aws_iam_role_policy_attachment configuration added to stackit_service_account.retail_app_ecs_carts_service_task_role, the STACKIT target of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role (the draft writes nothing of it as the variables stand); it reads module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_agent — not drafted; decide or confirm it, and assess again with a --var-file that sets the input as production does; the support resources this step reads state 5 critical settings its block does not carry — a person decides each with this step, none is a step of its own: `module.dependencies.aws_iam_policy.carts_dynamo` path: the draft writes no block for module.dependencies.aws_iam_policy.carts_dynamo, and the plan cannot show that the block of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role carries its path — a person decides it with module.retail_app_ecs.module.carts_service.aws_iam_role.task_role; `module.dependencies.aws_iam_policy.carts_dynamo` policy: the draft writes no block for module.dependencies.aws_iam_policy.carts_dynamo, and the plan cannot show that the block of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role carries its policy — a person decides it with module.retail_app_ecs.module.carts_service.aws_iam_role.task_role; `module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_logs` policy: the draft writes no block for module.retail_app_ecs.module.carts_service.aws_iam_policy.cloudwatch_logs, and the plan cannot show that the block of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role carries its policy — a person decides it with module.retail_app_ecs.module.carts_service.aws_iam_role.task_role; `module.retail_app_ecs.module.carts_service.aws_iam_policy.ecs_exec` path: the draft writes no block for module.retail_app_ecs.module.carts_service.aws_iam_policy.ecs_exec, and the plan cannot show that the block of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role carries its path — a person decides it with module.retail_app_ecs.module.carts_service.aws_iam_role.task_role; `module.retail_app_ecs.module.carts_service.aws_iam_policy.ecs_exec` policy: the draft writes no block for module.retail_app_ecs.module.carts_service.aws_iam_policy.ecs_exec, and the plan cannot show that the block of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role carries its policy — a person decides it with module.retail_app_ecs.module.carts_service.aws_iam_role.task_role |
| 22 | `TF/stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role` | Security | `stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role` | `terraform/identity.tf` | yes | — | `project_id`, `retail_app_ecs_carts_service_task_role_project_roles` | the migration of `module.retail_app_ecs.module.carts_service.aws_iam_role.task_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-customer-policy` |
| 23 | `TF/stackit_service_account.retail_app_ecs_catalog_service_task_execution_role` | Security | `stackit_service_account.retail_app_ecs_catalog_service_task_execution_role` | `terraform/identity.tf` | yes | — | `project_id` | the migration of `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-ecs`; the support resources this step reads state 2 critical settings its block does not carry — a person decides each with this step, none is a step of its own: `module.retail_app_ecs.aws_iam_policy.catalog_policy` path: the draft writes no block for module.retail_app_ecs.aws_iam_policy.catalog_policy, and the plan cannot show that the block of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role carries its path — a person decides it with module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role; `module.retail_app_ecs.aws_iam_policy.catalog_policy` policy: the draft writes no block for module.retail_app_ecs.aws_iam_policy.catalog_policy, and the plan cannot show that the block of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role carries its policy — a person decides it with module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role |
| 24 | `TF/stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role` | Security | `stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role` | `terraform/identity.tf` | yes | — | `project_id`, `retail_app_ecs_catalog_service_task_execution_role_project_roles` | the migration of `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-ecs` |
| 25 | `TF/stackit_service_account.retail_app_ecs_catalog_service_task_role` | Security | `stackit_service_account.retail_app_ecs_catalog_service_task_role` | `terraform/identity.tf` | yes | — | `project_id` | the migration of `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-customer-policy`; if production sets var.opentelemetry_enabled so that module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_agent exists (its count is `var.opentelemetry_enabled ? 1 : 0`, which reads 0 as the variables stand), it needs: its aws_iam_role_policy_attachment configuration added to stackit_service_account.retail_app_ecs_catalog_service_task_role, the STACKIT target of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role (the draft writes nothing of it as the variables stand); it reads module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_agent — not drafted; decide or confirm it, and assess again with a --var-file that sets the input as production does; the support resources this step reads state 3 critical settings its block does not carry — a person decides each with this step, none is a step of its own: `module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_logs` policy: the draft writes no block for module.retail_app_ecs.module.catalog_service.aws_iam_policy.cloudwatch_logs, and the plan cannot show that the block of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role carries its policy — a person decides it with module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role; `module.retail_app_ecs.module.catalog_service.aws_iam_policy.ecs_exec` path: the draft writes no block for module.retail_app_ecs.module.catalog_service.aws_iam_policy.ecs_exec, and the plan cannot show that the block of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role carries its path — a person decides it with module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role; `module.retail_app_ecs.module.catalog_service.aws_iam_policy.ecs_exec` policy: the draft writes no block for module.retail_app_ecs.module.catalog_service.aws_iam_policy.ecs_exec, and the plan cannot show that the block of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role carries its policy — a person decides it with module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role |
| 26 | `TF/stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role` | Security | `stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role` | `terraform/identity.tf` | yes | — | `project_id`, `retail_app_ecs_catalog_service_task_role_project_roles` | the migration of `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-customer-policy` |
| 27 | `TF/stackit_service_account.retail_app_ecs_checkout_service_task_execution_role` | Security | `stackit_service_account.retail_app_ecs_checkout_service_task_execution_role` | `terraform/identity.tf` | yes | — | `project_id` | the migration of `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-ecs` |
| 28 | `TF/stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role` | Security | `stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role` | `terraform/identity.tf` | yes | — | `project_id`, `retail_app_ecs_checkout_service_task_execution_role_project_roles` | the migration of `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-ecs` |
| 29 | `TF/stackit_service_account.retail_app_ecs_checkout_service_task_role` | Security | `stackit_service_account.retail_app_ecs_checkout_service_task_role` | `terraform/identity.tf` | yes | — | `project_id` | the migration of `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-customer-policy`; if production sets var.opentelemetry_enabled so that module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_agent exists (its count is `var.opentelemetry_enabled ? 1 : 0`, which reads 0 as the variables stand), it needs: its aws_iam_role_policy_attachment configuration added to stackit_service_account.retail_app_ecs_checkout_service_task_role, the STACKIT target of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role (the draft writes nothing of it as the variables stand); it reads module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_agent — not drafted; decide or confirm it, and assess again with a --var-file that sets the input as production does; the support resources this step reads state 3 critical settings its block does not carry — a person decides each with this step, none is a step of its own: `module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_logs` policy: the draft writes no block for module.retail_app_ecs.module.checkout_service.aws_iam_policy.cloudwatch_logs, and the plan cannot show that the block of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role carries its policy — a person decides it with module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; `module.retail_app_ecs.module.checkout_service.aws_iam_policy.ecs_exec` path: the draft writes no block for module.retail_app_ecs.module.checkout_service.aws_iam_policy.ecs_exec, and the plan cannot show that the block of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role carries its path — a person decides it with module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; `module.retail_app_ecs.module.checkout_service.aws_iam_policy.ecs_exec` policy: the draft writes no block for module.retail_app_ecs.module.checkout_service.aws_iam_policy.ecs_exec, and the plan cannot show that the block of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role carries its policy — a person decides it with module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role |
| 30 | `TF/stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role` | Security | `stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role` | `terraform/identity.tf` | yes | — | `project_id`, `retail_app_ecs_checkout_service_task_role_project_roles` | the migration of `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-customer-policy` |
| 31 | `TF/stackit_service_account.retail_app_ecs_orders_service_task_execution_role` | Security | `stackit_service_account.retail_app_ecs_orders_service_task_execution_role` | `terraform/identity.tf` | yes | — | `project_id` | the migration of `module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-ecs`; the support resources this step reads state 2 critical settings its block does not carry — a person decides each with this step, none is a step of its own: `module.retail_app_ecs.aws_iam_policy.orders_policy` path: the draft writes no block for module.retail_app_ecs.aws_iam_policy.orders_policy, and the plan cannot show that the block of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role carries its path — a person decides it with module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role; `module.retail_app_ecs.aws_iam_policy.orders_policy` policy: the draft writes no block for module.retail_app_ecs.aws_iam_policy.orders_policy, and the plan cannot show that the block of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role carries its policy — a person decides it with module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role |
| 32 | `TF/stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role` | Security | `stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role` | `terraform/identity.tf` | yes | — | `project_id`, `retail_app_ecs_orders_service_task_execution_role_project_roles` | the migration of `module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-ecs` |
| 33 | `TF/stackit_service_account.retail_app_ecs_orders_service_task_role` | Security | `stackit_service_account.retail_app_ecs_orders_service_task_role` | `terraform/identity.tf` | yes | — | `project_id` | the migration of `module.retail_app_ecs.module.orders_service.aws_iam_role.task_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-customer-policy`; if production sets var.opentelemetry_enabled so that module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_agent exists (its count is `var.opentelemetry_enabled ? 1 : 0`, which reads 0 as the variables stand), it needs: its aws_iam_role_policy_attachment configuration added to stackit_service_account.retail_app_ecs_orders_service_task_role, the STACKIT target of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role (the draft writes nothing of it as the variables stand); it reads module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_agent — not drafted; decide or confirm it, and assess again with a --var-file that sets the input as production does; the support resources this step reads state 3 critical settings its block does not carry — a person decides each with this step, none is a step of its own: `module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_logs` policy: the draft writes no block for module.retail_app_ecs.module.orders_service.aws_iam_policy.cloudwatch_logs, and the plan cannot show that the block of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role carries its policy — a person decides it with module.retail_app_ecs.module.orders_service.aws_iam_role.task_role; `module.retail_app_ecs.module.orders_service.aws_iam_policy.ecs_exec` path: the draft writes no block for module.retail_app_ecs.module.orders_service.aws_iam_policy.ecs_exec, and the plan cannot show that the block of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role carries its path — a person decides it with module.retail_app_ecs.module.orders_service.aws_iam_role.task_role; `module.retail_app_ecs.module.orders_service.aws_iam_policy.ecs_exec` policy: the draft writes no block for module.retail_app_ecs.module.orders_service.aws_iam_policy.ecs_exec, and the plan cannot show that the block of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role carries its policy — a person decides it with module.retail_app_ecs.module.orders_service.aws_iam_role.task_role |
| 34 | `TF/stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role` | Security | `stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role` | `terraform/identity.tf` | yes | — | `project_id`, `retail_app_ecs_orders_service_task_role_project_roles` | the migration of `module.retail_app_ecs.module.orders_service.aws_iam_role.task_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-customer-policy` |
| 35 | `TF/stackit_service_account.retail_app_ecs_ui_service_task_execution_role` | Security | `stackit_service_account.retail_app_ecs_ui_service_task_execution_role` | `terraform/identity.tf` | yes | — | `project_id` | the migration of `module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-ecs` |
| 36 | `TF/stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role` | Security | `stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role` | `terraform/identity.tf` | yes | — | `project_id`, `retail_app_ecs_ui_service_task_execution_role_project_roles` | the migration of `module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-ecs` |
| 37 | `TF/stackit_service_account.retail_app_ecs_ui_service_task_role` | Security | `stackit_service_account.retail_app_ecs_ui_service_task_role` | `terraform/identity.tf` | yes | — | `project_id` | the migration of `module.retail_app_ecs.module.ui_service.aws_iam_role.task_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-customer-policy`; if production sets var.opentelemetry_enabled so that module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_agent exists (its count is `var.opentelemetry_enabled ? 1 : 0`, which reads 0 as the variables stand), it needs: its aws_iam_role_policy_attachment configuration added to stackit_service_account.retail_app_ecs_ui_service_task_role, the STACKIT target of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role (the draft writes nothing of it as the variables stand); it reads module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_agent — not drafted; decide or confirm it, and assess again with a --var-file that sets the input as production does; the support resources this step reads state 3 critical settings its block does not carry — a person decides each with this step, none is a step of its own: `module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_logs` policy: the draft writes no block for module.retail_app_ecs.module.ui_service.aws_iam_policy.cloudwatch_logs, and the plan cannot show that the block of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role carries its policy — a person decides it with module.retail_app_ecs.module.ui_service.aws_iam_role.task_role; `module.retail_app_ecs.module.ui_service.aws_iam_policy.ecs_exec` path: the draft writes no block for module.retail_app_ecs.module.ui_service.aws_iam_policy.ecs_exec, and the plan cannot show that the block of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role carries its path — a person decides it with module.retail_app_ecs.module.ui_service.aws_iam_role.task_role; `module.retail_app_ecs.module.ui_service.aws_iam_policy.ecs_exec` policy: the draft writes no block for module.retail_app_ecs.module.ui_service.aws_iam_policy.ecs_exec, and the plan cannot show that the block of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role carries its policy — a person decides it with module.retail_app_ecs.module.ui_service.aws_iam_role.task_role |
| 38 | `TF/stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role` | Security | `stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role` | `terraform/identity.tf` | yes | — | `project_id`, `retail_app_ecs_ui_service_task_role_project_roles` | the migration of `module.retail_app_ecs.module.ui_service.aws_iam_role.task_role` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (4 manual, 0 refused): `trust`, `permissions`, `iam-trust-service-workload`, `iam-managed-customer-policy` |

### Applied by Data Architect

| # | Step | Phase | Resources | File | Executable | Blocked by | Variables | Risks |
|---|---|---|---|---|---|---|---|---|
| 39 | `TF/stackit_mongodbflex_instance.dynamodb_tables` | Data services | `stackit_mongodbflex_instance.dynamodb_tables` | `terraform/data.tf` | yes | — | `dynamodb_tables_allowed_cidrs`, `dynamodb_tables_cpu`, `dynamodb_tables_pitr_hours`, `dynamodb_tables_ram`, `dynamodb_tables_storage_gb`, `dynamodb_tables_version`, `mongodbflex_storage_class`, `project_id` | the migration of `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this` is not complete with this step: 6 critical settings of it that the draft does not carry are open in 3 steps, a step standing for several of them (6 manual, 0 refused): `key-schema`, `index-projection-and-name`, `encryption-at-rest`, `point-in-time-recovery`, `ttl`, `tc-dynamodb-table-name` |
| 40 | `TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default` | Data services | `stackit_valkey_instance.dependencies_checkout_elasticache_redis_default` | `terraform/data.tf` | yes | — | `dependencies_checkout_elasticache_redis_default_allowed_cidrs`, `dependencies_checkout_elasticache_redis_default_plan_name`, `dependencies_checkout_elasticache_redis_default_version`, `project_id` | the decision DEC-GEN-CONVERT-SIZE-FROM-SOURCE is open and this step stands on its DEFAULT, option use-the-size-derived-from-the-source: StackToIT carried out the option use-the-size-derived-from-the-source for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default by default: var.dependencies_checkout_elasticache_redis_default_plan_name defaults to stackit-keyvalue-1.4.10-single (node type cache.t3.micro has 2 vCPU and 0.5 GiB (AWS price list, cache_node_sizes.json), and the source is a single node: the smallest single-node Key Value Store plan of the eu01 catalogue (2026-10-18) that holds 0.5 GiB (0.5369 GB at 10^9 bytes per GB) of memory (the plan table gives its RAM as "GB" and does not say whether a GB is 10^9 or 2^30 bytes, so the plan is chosen to hold the source's memory when a GB is 10^9 bytes, which it then also does when a GB is 2^30 bytes (it is never smaller than the source whichever way the table is read)): 1 vCPU / 4 GB RAM / 10 GB disk per node; the disk is not a figure of the source, so the smallest disk of that size is taken and the disk is open). To change it, answer this decision in decisions.yaml with choose-the-size (and set the plan in the variable), or reject the proposal: the next run then writes the variable without a default.; the decision DEC-GEN-CONVERT-EXPOSURE-WIDENED is open and this step stands on its DEFAULT, option accept-the-public-endpoint: StackToIT carried out the option accept-the-public-endpoint for stackit_valkey_instance.dependencies_checkout_elasticache_redis_default by default: the Valkey instance keeps its own public STACKIT endpoint, and only the CIDRs of var.dependencies_checkout_elasticache_redis_default_allowed_cidrs may connect; the clients of the source could not be mapped to addresses, no CIDR is invented, so the variable has no default and the step waits for the networks you list. The draft writes no default list of the clients' addresses: the rule module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed["in#in#sg#0"] is no plain allow of a complete list of clients. Name the networks the clients connect from. To change it, answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default.; the migration of `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` is not complete with this step: 9 critical settings of it that the draft does not carry are open in 4 steps, a step standing for several of them (9 manual, 0 refused): `parameter-group`, `parameter-group-default`, `failover-off`, `snapshots-off`, `at-rest-encryption-off`, `network-placement`, `seed-snapshot`, `tcp-elasticache-replication-group-transit-encryption-enabled`, `tc-elasticache-replication-group-replication-group-id`; the support resources this step reads state 1 critical setting its block does not carry — a person decides each with this step, none is a step of its own: `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_subnet_group.default` subnet_ids: the draft writes no block for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_subnet_group.default, and the plan cannot show that the block of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default carries its subnet_ids — a person decides it with module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default |
| 41 | `TF/stackit_valkey_credential.dependencies_checkout_elasticache_redis_default` | Data services | `stackit_valkey_credential.dependencies_checkout_elasticache_redis_default` | `terraform/data.tf` | yes | — | `project_id` | the migration of `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` is not complete with this step: 9 critical settings of it that the draft does not carry are open in 4 steps, a step standing for several of them (9 manual, 0 refused): `parameter-group`, `parameter-group-default`, `failover-off`, `snapshots-off`, `at-rest-encryption-off`, `network-placement`, `seed-snapshot`, `tcp-elasticache-replication-group-transit-encryption-enabled`, `tc-elasticache-replication-group-replication-group-id` |
| 45 | `TF/stackit_mariadb_instance.dependencies_catalog_rds_this` | Platform services | `stackit_mariadb_instance.dependencies_catalog_rds_this` | `terraform/data.tf` | yes | — | `dependencies_catalog_rds_this_allowed_cidrs`, `dependencies_catalog_rds_this_plan_name`, `dependencies_catalog_rds_this_version`, `project_id` | the decision DEC-GEN-CONVERT-EXPOSURE-WIDENED is open and this step stands on its DEFAULT, option accept-the-public-endpoint: StackToIT carried out the option accept-the-public-endpoint for stackit_mariadb_instance.dependencies_catalog_rds_this by default: the MariaDB instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.catalog_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_catalog_rds_this_allowed_cidrs, or answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default.; placed in the platform services phase after the OpenTofu step for stackit_ske_cluster.retail_app_ecs_cluster, which it depends on; its own phase is data services; the migration of `module.dependencies.module.catalog_rds.aws_rds_cluster.this` is not complete with this step: 14 critical settings of it that the draft does not carry are open in 5 steps, a step standing for several of them (14 manual, 0 refused): `engine`, `engine-version`, `backup-retention`, `storage-encryption`, `db-network-placement`, `admin-username-not-carried`, `admin-password`, `security-groups`, `parameter-and-option-groups`, `final-snapshot`, `member-engine`, `member-settings`, `tc-database-name`, `tcf-rds-cluster-instance--identifier`; the support resources this step reads state 1 critical setting its block does not carry — a person decides each with this step, none is a step of its own: `module.dependencies.module.catalog_rds.aws_db_subnet_group.this` subnet_ids: the draft writes no block for module.dependencies.module.catalog_rds.aws_db_subnet_group.this, and the plan cannot show that the block of module.dependencies.module.catalog_rds.aws_rds_cluster.this carries its subnet_ids — a person decides it with module.dependencies.module.catalog_rds.aws_rds_cluster.this |
| 46 | `TF/stackit_mariadb_credential.dependencies_catalog_rds_this` | Platform services | `stackit_mariadb_credential.dependencies_catalog_rds_this` | `terraform/data.tf` | yes | — | `project_id` | placed in the platform services phase after the OpenTofu step for stackit_mariadb_instance.dependencies_catalog_rds_this, which it depends on; its own phase is data services; the migration of `module.dependencies.module.catalog_rds.aws_rds_cluster.this` is not complete with this step: 14 critical settings of it that the draft does not carry are open in 5 steps, a step standing for several of them (14 manual, 0 refused): `engine`, `engine-version`, `backup-retention`, `storage-encryption`, `db-network-placement`, `admin-username-not-carried`, `admin-password`, `security-groups`, `parameter-and-option-groups`, `final-snapshot`, `member-engine`, `member-settings`, `tc-database-name`, `tcf-rds-cluster-instance--identifier` |
| 47 | `TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this` | Platform services | `stackit_opensearch_instance.dependencies_catalog_opensearch_this` | `terraform/data.tf` | no | `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE` | `dependencies_catalog_opensearch_this_allowed_cidrs`, `dependencies_catalog_opensearch_this_plan_name`, `dependencies_catalog_opensearch_this_version`, `project_id` | the decision DEC-GEN-CONVERT-EXPOSURE-WIDENED is open and this step stands on its DEFAULT, option accept-the-public-endpoint: StackToIT carried out the option accept-the-public-endpoint for stackit_opensearch_instance.dependencies_catalog_opensearch_this by default: the OpenSearch instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.catalog_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_catalog_opensearch_this_allowed_cidrs, or answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default.; placed in the platform services phase after the OpenTofu step for stackit_ske_cluster.retail_app_ecs_cluster, which it depends on; its own phase is data services; the migration of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` is not complete with this step: 14 critical settings of it that the draft does not carry are open in 6 steps, a step standing for several of them (12 manual, 2 refused): `engine-version`, `fine-grained-access`, `private-endpoint`, `encryption-at-rest`, `domain-settings`, `domain-credentials-and-keys`, `access-and-encryption-settings`, `cluster-layout-settings`, `credentials-and-keys-settings`, `network-settings`, `storage-settings`, `tc-opensearch-domain-domain-name`, `nbr-aws-opensearch-domain-policy`, `opensearch-domain-policy-resource` |
| 48 | `TF/stackit_opensearch_credential.dependencies_catalog_opensearch_this` | Platform services | `stackit_opensearch_credential.dependencies_catalog_opensearch_this` | `terraform/data.tf` | no | `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE` | `project_id` | placed in the platform services phase after the OpenTofu step for stackit_opensearch_instance.dependencies_catalog_opensearch_this, which it depends on; its own phase is data services; the migration of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` is not complete with this step: 14 critical settings of it that the draft does not carry are open in 6 steps, a step standing for several of them (12 manual, 2 refused): `engine-version`, `fine-grained-access`, `private-endpoint`, `encryption-at-rest`, `domain-settings`, `domain-credentials-and-keys`, `access-and-encryption-settings`, `cluster-layout-settings`, `credentials-and-keys-settings`, `network-settings`, `storage-settings`, `tc-opensearch-domain-domain-name`, `nbr-aws-opensearch-domain-policy`, `opensearch-domain-policy-resource` |
| 49 | `TF/stackit_postgresflex_instance.dependencies_orders_rds_this` | Platform services | `stackit_postgresflex_instance.dependencies_orders_rds_this` | `terraform/data.tf` | yes | — | `dependencies_orders_rds_this_access_scope`, `dependencies_orders_rds_this_allowed_cidrs`, `dependencies_orders_rds_this_storage_size`, `postgresflex_storage_class`, `project_id` | the decision DEC-GEN-CONVERT-SIZE-FROM-SOURCE is open and this step stands on its DEFAULT, option use-the-size-derived-from-the-source: StackToIT carried out the option use-the-size-derived-from-the-source for module.dependencies.module.orders_rds.aws_rds_cluster.this by default: flavor_id = 2.4 (module.dependencies.module.orders_rds.aws_rds_cluster.this (source class db.t3.medium) has 2 vCPU and 4 GiB (AWS price list); 2.4 is the smallest single-node PostgreSQL Flex flavor of the eu01 catalogue (2026-10-18) that covers it: 2 vCPU / 4 GiB). To change it, answer this decision in decisions.yaml with choose-the-size (and set the flavor in the variable), or reject the proposal: the next run then writes flavor_id as var.dependencies_orders_rds_this_flavor_id without a default.; the decision DEC-GEN-CONVERT-EXPOSURE-WIDENED is open and this step stands on its DEFAULT, option accept-the-public-endpoint: StackToIT carried out the option accept-the-public-endpoint for stackit_postgresflex_instance.dependencies_orders_rds_this by default: the PostgreSQL Flex instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.orders_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_orders_rds_this_allowed_cidrs, or answer this decision in decisions.yaml with use-the-network-area-only-scope or redesign-the-endpoint (or reject the proposal): the next run then writes no default.; placed in the platform services phase after the OpenTofu step for stackit_ske_cluster.retail_app_ecs_cluster, which it depends on; its own phase is data services; the migration of `module.dependencies.module.orders_rds.aws_rds_cluster.this` is not complete with this step: 9 critical settings of it that the draft does not carry are open in 5 steps, a step standing for several of them (9 manual, 0 refused): `storage-encryption`, `db-network-placement`, `admin-username-not-carried`, `admin-password`, `security-groups`, `parameter-and-option-groups`, `final-snapshot`, `member-settings`, `tcf-rds-cluster-instance--identifier`; the support resources this step reads state 1 critical setting its block does not carry — a person decides each with this step, none is a step of its own: `module.dependencies.module.orders_rds.aws_db_subnet_group.this` subnet_ids: the draft writes no block for module.dependencies.module.orders_rds.aws_db_subnet_group.this, and the plan cannot show that the block of module.dependencies.module.orders_rds.aws_rds_cluster.this carries its subnet_ids — a person decides it with module.dependencies.module.orders_rds.aws_rds_cluster.this |
| 50 | `TF/stackit_postgresflex_user.dependencies_orders_rds_this` | Platform services | `stackit_postgresflex_user.dependencies_orders_rds_this` | `terraform/data.tf` | yes | — | `dependencies_orders_rds_this_admin_roles`, `project_id` | placed in the platform services phase after the OpenTofu step for stackit_postgresflex_instance.dependencies_orders_rds_this, which it depends on; its own phase is data services; the migration of `module.dependencies.module.orders_rds.aws_rds_cluster.this` is not complete with this step: 9 critical settings of it that the draft does not carry are open in 5 steps, a step standing for several of them (9 manual, 0 refused): `storage-encryption`, `db-network-placement`, `admin-username-not-carried`, `admin-password`, `security-groups`, `parameter-and-option-groups`, `final-snapshot`, `member-settings`, `tcf-rds-cluster-instance--identifier` |
| 51 | `TF/stackit_postgresflex_database.dependencies_orders_rds_this_orders` | Platform services | `stackit_postgresflex_database.dependencies_orders_rds_this_orders` | `terraform/data.tf` | yes | — | `project_id` | placed in the platform services phase after the OpenTofu step for stackit_postgresflex_instance.dependencies_orders_rds_this, which it depends on; its own phase is data services; this step carries 1 critical setting of `module.dependencies.module.orders_rds.aws_rds_cluster.this` that the assessment passes to a person and the final artifact shows - `tc-database-name`: the source `database_name` = `orders` is written as `name` = `orders` by the draft (`terraform/data.tf`, block `stackit_postgresflex_database.dependencies_orders_rds_this_orders`): the value is the source's, the connection strings of the application that name the database are a person's to confirm; no manual step stands for it; the migration of `module.dependencies.module.orders_rds.aws_rds_cluster.this` is not complete with this step: 9 critical settings of it that the draft does not carry are open in 5 steps, a step standing for several of them (9 manual, 0 refused): `storage-encryption`, `db-network-placement`, `admin-username-not-carried`, `admin-password`, `security-groups`, `parameter-and-option-groups`, `final-snapshot`, `member-settings`, `tcf-rds-cluster-instance--identifier` |

### Applied by Platform Architect

| # | Step | Phase | Resources | File | Executable | Blocked by | Variables | Risks |
|---|---|---|---|---|---|---|---|---|
| 43 | `TF/stackit_logs_instance.logs_retention_180d` | Platform services | `stackit_logs_instance.logs_retention_180d` | `terraform/observability.tf` | yes | — | `project_id` | the setting name of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks is left to the step "Choose a static label and send the name of…"; the setting retention_in_days of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks is not carried: the target has no equivalent (the source keeps its logs for ever (it states no period, or 0); a Logs instance keeps at most 180 days, so the logs of this source are kept for 180 days here and anything older has to be archived elsewhere (for example in Object Storage) if it must be kept) |
| 44 | `TF/stackit_ske_cluster.retail_app_ecs_cluster` | Platform services | `stackit_ske_cluster.retail_app_ecs_cluster` | `terraform/kubernetes.tf` | yes | — | `availability_zones`, `project_id`, `retail_app_ecs_cluster_machine_type`, `retail_app_ecs_cluster_nodes_max`, `retail_app_ecs_cluster_nodes_min` | the migration of `module.retail_app_ecs.module.carts_service.aws_ecs_service.this` is not complete with this step: 15 critical settings of it that the draft does not carry are open in 4 steps, a step standing for several of them (15 manual, 0 refused): `service-discovery`, `task-definition`, `service-task-definition`, `service-desired-count`, `service-execute-command`, `service-network-placement`, `service-public-ip-setting`, `service-connect-values`, `td-container-definitions`, `td-container-secret-references`, `td-container-plaintext-secret-env`, `td-container-image-registry`, `td-execution-role-arn`, `td-network-mode`, `td-task-role-arn`; the migration of `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this` is not complete with this step: 15 critical settings of it that the draft does not carry are open in 4 steps, a step standing for several of them (15 manual, 0 refused): `service-discovery`, `task-definition`, `service-task-definition`, `service-desired-count`, `service-execute-command`, `service-network-placement`, `service-public-ip-setting`, `service-connect-values`, `td-container-definitions`, `td-container-secret-references`, `td-container-plaintext-secret-env`, `td-container-image-registry`, `td-execution-role-arn`, `td-network-mode`, `td-task-role-arn`; the migration of `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` is not complete with this step: 15 critical settings of it that the draft does not carry are open in 4 steps, a step standing for several of them (15 manual, 0 refused): `service-discovery`, `task-definition`, `service-task-definition`, `service-desired-count`, `service-execute-command`, `service-network-placement`, `service-public-ip-setting`, `service-connect-values`, `td-container-definitions`, `td-container-secret-references`, `td-container-plaintext-secret-env`, `td-container-image-registry`, `td-execution-role-arn`, `td-network-mode`, `td-task-role-arn`; the migration of `module.retail_app_ecs.module.orders_service.aws_ecs_service.this` is not complete with this step: 15 critical settings of it that the draft does not carry are open in 4 steps, a step standing for several of them (15 manual, 0 refused): `service-discovery`, `task-definition`, `service-task-definition`, `service-desired-count`, `service-execute-command`, `service-network-placement`, `service-public-ip-setting`, `service-connect-values`, `td-container-definitions`, `td-container-secret-references`, `td-container-plaintext-secret-env`, `td-container-image-registry`, `td-execution-role-arn`, `td-network-mode`, `td-task-role-arn`; the migration of `module.retail_app_ecs.module.ui_service.aws_ecs_service.this` is not complete with this step: 16 critical settings of it that the draft does not carry are open in 4 steps, a step standing for several of them (16 manual, 0 refused): `service-discovery`, `task-definition`, `service-task-definition`, `service-desired-count`, `service-execute-command`, `service-load-balancer-target`, `service-network-placement`, `service-public-ip-setting`, `service-connect-values`, `td-container-definitions`, `td-container-secret-references`, `td-container-plaintext-secret-env`, `td-container-image-registry`, `td-execution-role-arn`, `td-network-mode`, `td-task-role-arn`; the support resources this step reads state 2 critical settings its block does not carry — a person decides each with this step, none is a step of its own: `module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this` name: the draft writes no block for module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this, and the plan cannot show that the block of module.retail_app_ecs.module.carts_service.aws_ecs_service.this carries its name — a person decides it with module.retail_app_ecs.module.carts_service.aws_ecs_service.this; `module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this` vpc: the draft writes no block for module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this, and the plan cannot show that the block of module.retail_app_ecs.module.carts_service.aws_ecs_service.this carries its vpc — a person decides it with module.retail_app_ecs.module.carts_service.aws_ecs_service.this |
| 52 | `TF/stackit_rabbitmq_instance.dependencies_mq` | Platform services | `stackit_rabbitmq_instance.dependencies_mq` | `terraform/messaging.tf` | yes | — | `dependencies_mq_allowed_cidrs`, `dependencies_mq_plan_name`, `dependencies_mq_version`, `project_id` | the decision DEC-GEN-CONVERT-SIZE-FROM-SOURCE is open and this step stands on its DEFAULT, option use-the-size-derived-from-the-source: StackToIT carried out the option use-the-size-derived-from-the-source for module.dependencies.aws_mq_broker.mq by default: var.dependencies_mq_plan_name defaults to stackit-rabbitmq-8.16.50-replica (broker instance type mq.m5.large has 2 vCPU and 8 GiB (AWS price list, mq_broker_sizes.json), and the broker is a single instance: the smallest replica (three nodes, high availability) RabbitMQ plan of the eu01 catalogue (2026-10-18) that holds 2 vCPU and 8 GiB (8.59 GB at 10^9 bytes per GB) of memory (the plan table gives its RAM as "GB" and does not say whether a GB is 10^9 or 2^30 bytes, so the plan is chosen to hold the source's memory when a GB is 10^9 bytes, which it then also does when a GB is 2^30 bytes (it is never smaller than the source whichever way the table is read)): 8 vCPU / 16 GB RAM / 50 GB disk per node; the disk is not a figure of the source, so the smallest disk of that size is taken and the disk is open; no single-node plan of that size exists, so this replica plan adds the replicas the source does not have, and their price; this plan is larger than the one the other reading gives: reading the table's GB as a GiB, stackit-rabbitmq-4.8.50-single (4 vCPU / 8 GB RAM / 50 GB disk per node) would hold the source, and the draft is priced on the larger plan; if the table's GB is a GiB, answer choose-the-size and set stackit-rabbitmq-4.8.50-single). To change it, answer this decision in decisions.yaml with choose-the-size (and set the plan in the variable), or reject the proposal: the next run then writes the variable without a default.; the decision DEC-GEN-CONVERT-EXPOSURE-WIDENED is open and this step stands on its DEFAULT, option accept-the-public-endpoint: StackToIT carried out the option accept-the-public-endpoint for stackit_rabbitmq_instance.dependencies_mq by default: the RabbitMQ instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.orders_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_mq_allowed_cidrs, or answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default.; the migration of `module.dependencies.aws_mq_broker.mq` is not complete with this step: 8 critical settings of it that the draft does not carry are open in 4 steps, a step standing for several of them (8 manual, 0 refused): `engine-version`, `broker-network`, `network-exposure`, `broker-users`, `tc-user--password`, `tc-user--username`, `tcp-deployment-mode`, `tc-mq-broker-broker-name` |
| 53 | `TF/stackit_rabbitmq_credential.dependencies_mq` | Platform services | `stackit_rabbitmq_credential.dependencies_mq` | `terraform/messaging.tf` | yes | — | `project_id` | the migration of `module.dependencies.aws_mq_broker.mq` is not complete with this step: 8 critical settings of it that the draft does not carry are open in 4 steps, a step standing for several of them (8 manual, 0 refused): `engine-version`, `broker-network`, `network-exposure`, `broker-users`, `tc-user--password`, `tc-user--username`, `tcp-deployment-mode`, `tc-mq-broker-broker-name` |