# Decisions > PROPOSAL — generated by StackToIT Assess. Architect review required before any decision. Run `f6267c3f-2848-4aa5-89df-5fee8b15b3b9` · source digest `sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70` PROPOSAL: a record groups the open decisions of the plans of the draft by the part of the draft they concern and the kind of the decision, or the units that leave one critical semantic of one contract open, or the manual actions of the plans by kind, or the open statements of the plans about units they write no resource for by the reason of the statement. It is a view: nothing here changes the draft, target-plan.json, a gate, or any class, confidence or eligibility, and every critical semantic stays open in the assessment. A review of a plan-decision record acts on the execution plan only, by its effect (issue #205): an answer whose option is what the draft already carries out (ACK_CURRENT_ARTIFACT) frees the steps that wait for the decision; an option that changes the draft (REGENERATE_REQUIRED) or a redesign keeps them held until the draft is regenerated with it, a manual alternative frees only the manual step that carries it out, and a refused opt-in to an API resolves to the draft's own path (the steps of the API path are not taken). The draft itself is unchanged by any answer. Decision register: BUILT. Records group four lists: the open decisions of the plans of the draft this run wrote, by the part of the draft (security group, routing, identity, logs, server) and the kind of the decision (plan decisions); the open critical semantics of the units, by the contract family and the semantic (critical semantics); the manual actions of the plans, by the part of the draft and the kind of the action (manual actions); and the open statements of the plans about units they write no resource for (a redesign, a review, a block, a failed model, or a step beside a unit whose draft a converter writes), by the part of the draft and the reason (plan statements). Plan decisions and manual actions cover only drafted units whose draft passed StackToIT's own checks, and only the families whose draft this run wrote from a plan: a family with no plan has none to list. A plan statement covers a unit the plan writes nothing for, whether or not a draft check ran over it; a statement that leaves nothing to a person (a unit the plan does not draft and no manual action of it names) is counted apart from the records and is no record. A record shows the review of an overlay beside the open state the engine reached; a review closes no critical semantic and changes no draft, target plan, gate, class, confidence or eligibility. An accepted plan decision frees the steps of the execution plan that wait for it only when the answer's effect acknowledges the current draft; an option that changes the draft keeps them held until the draft is regenerated with it. Records of the family "convert" are decisions of the converter's own generators, outside every plan: a constraint conflict (a variable whose consumers' STACKIT bounds exclude one another keeps the source default) and an ambiguous selection (the source does not prove which instance, interface, key pair, gateway, peer, subnet, proxy, URL map or health check it means, so the draft holds a required variable without a default); the unit that owns one is not automation-eligible. They are listed for a drafted unit whose plan checks did not fail. 16 decisions to make (9 plan decisions, 5 manual actions, 2 plan statements, 2 of them with the draft's DEFAULT to confirm or change) · 2 defaults to confirm (other records, no step waits for them) · 48 units to review (308 critical settings: 307 to decide (25 of them are conditional), 1 confirm only), on 48 units. Records: 11 plan decision records, 95 critical setting records, 5 manual action records, 2 plan statement records (17 more statements leave nothing to a person and are no record). Records by status: open 113 · partial 0 · accepted 0 · stale 0 · rejected 0. Review: no decisions file was given with this run (stacktoit assess --decisions FILE); every record is open. Every record carries three states that are set independently of each other: a review never changes the design state or the validation state. - **Review state** — architect reviewed: a review of the decisions file, bound to this run (source digest, knowledge base and members all hold), covers every member of the record and accepts or rejects it; the outcome is the status and the review of the record. unreviewed: none was given, it covers only some members, or its binding no longer holds. A review never closes a plan decision, a critical semantic or a manual action. - **Design state** — open: this run's plan or draft still carries the item. design resolved: stated only for an entry of the decisions file that this run's register does not hold, written for another source digest and the same knowledge base, in a run that read the plans of a generated draft without a degraded reading: the item is gone from the plan or draft of the later source. It is inferred from the absent id, so an id misspelled in the file reads the same way; a review never sets it. - **Validation state** — technical validation passed: this run ran tofu validate on the draft, it passed, and the record belongs to a family of the draft (security group, routing, identity or logs) that the validation covered. not validated: tofu validate was not asked for, did not run, or the record is a critical semantic of the source, which a schema check of the draft does not cover. failed: tofu validate rejected the draft that holds the family. It is a static check against the pinned provider schema, not target behaviour and not approval. Each record also states its applications (a group the run suggested from the source is labelled PROPOSED: a suggestion, not an application you confirmed), its wave (the dependency order of the units, a technical order and not a schedule) and where its approval stands (STALE where the answer no longer holds, with the reason), and each option states its trade-off. The Decisions page states the same facts of each record. The records are in decisions.json; migration/decisions.csv is the flat form of the same records. ## Plan decisions · convert (9 records, 24 open items, 0 accepted; status open) Every record under this heading states the same for these fields, and its table does not repeat them: | Field | Value | |---|---| | Source | plan decisions of the draft | | Family | convert | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Required by phase | before the pilot | | Blocking effect | the target design stays open: a field of the draft waits for this decision | | Affected applications | 0 | | Approval | not approved: no decisions file was given with this run | ### ambiguous instance selection (1 record) #### DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION Why: The converter could not prove which instance of a repeated resource the source means (1 converter decision): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides. | Field | Value | |---|---| | Kind | `ambiguous instance selection` | | Owner role | Platform Architect | | Plan decisions | 1 | | Affected units | 1 | | Applications touched | `ui` (PROPOSED) | | Wave | wave 3 · steps in platform services | | What an answer frees | No answer frees a step by itself; the answer that frees most frees 3 steps together with other open decisions; 63 of the 66 steps it holds stay held whatever is decided (the plan does not let them run). | | Options | 2, listed below | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:7d4ce9ee9ce1f3acbba48c88c829f6eb66a62259ada1ad27007786228edd5d9d` | **Options** (2) Options come from the knowledge base (decision-kinds.yaml; knowledge-base evidence, not in this folder), each with the sources it rests on. Choosing one in the decisions file changes no draft, no target-plan.json and no class, confidence or eligibility; its execution effect decides what the answer does to the step of the execution plan that waits for the decision: an option the draft already carries out frees it, an option that changes the draft keeps it held until the draft is regenerated with that option, and an option with no stated effect frees nothing. - `set-the-selector-to-one-instance`: Set the selector variable to the index of the instance the source means. The attribute takes one id, so one instance is meant; a person sets the selector variable the draft declares to the index of that instance, and the step is applied as the draft writes it (it needs the variable as an input). No other instance is referenced. **Trade-off:** the draft already carries it out, so the answer frees the steps that wait for it; in this run it frees 3 steps only together with other open decisions. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29, read 2026-10-23: network_id (String) The network ID to which the network interface is associated. - `reference-another-resource`: Reference another resource than the candidates. None of the instances of the repeated resource is what the source means; the reference is changed in the draft (to another block, or a block of its own) before the step is applied. **Trade-off:** it changes the draft: the draft is generated again with it, and the steps stay held until then; in this run it frees no step. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29, read 2026-10-23: network_id (String) The network ID to which the network interface is associated. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (2) - the reference reaches stackit_network.vpc_vpc_public, a repeated resource (count or for_each), and nothing in the source proves which instance it means; no instance is assumed and the variable has no default - which instance of the repeated resource the source means (its index among the candidates the selector variable's description lists) **Plan decisions** (1) - alias `convert:module.retail_app_ecs.module.alb.aws_lb.this:network_id:AMBIGUOUS_INSTANCE_SELECTION` **Affected units** (1) - `module.retail_app_ecs.module.alb.aws_lb.this` ### api opt in (1 record) #### DEC-GEN-CONVERT-API-OPT-IN Why: The plan calls a STACKIT API that is not generally available (alpha, beta, or a release status its documentation does not state), which may change or be withdrawn, so it makes those calls only after you allow them (1 API): until you answer, the calls and the steps of their path wait. Allowing carries them out; refusing keeps the draft's own path where the API's path is an alternative beside it, and leaves the question open where the API is the only carrier of what its call sets. No block of the draft waits for it, and no unit's eligibility rests on it. | Field | Value | |---|---| | Kind | `api opt in` | | Owner role | Platform Architect | | Plan decisions | 1 | | Affected units | 4 | | Applications touched | `orders` (PROPOSED); module.retail_app_ecs.aws_secretsmanager_secret.catalog_db is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders; module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders | | Wave | waves 2 to 5 · steps in security | | What an answer frees | The answer that frees most frees 4 steps by itself and 6 steps more together with other open decisions; 64 of the 74 steps it holds stay held whatever is decided (the plan does not let them run). | | Options | 1, listed below | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:e38398c0e3d250ba5bc2f41d119954b6cca973ef84267dcb555af7fa66082039` | **Options** (1) Options come from the knowledge base (decision-kinds.yaml; knowledge-base evidence, not in this folder), each with the sources it rests on. Choosing one in the decisions file changes no draft, no target-plan.json and no class, confidence or eligibility; its execution effect decides what the answer does to the step of the execution plan that waits for the decision: an option the draft already carries out frees it, an option that changes the draft keeps it held until the draft is regenerated with that option, and an option with no stated effect frees nothing. - `allow-calls-of-the-api`: Allow the calls of the API for this migration. The calls of the API the plan states are made as the plan writes them (the request documents of the execution package), and the steps of their path are taken; the migration then depends on an API that may change or vanish. **Trade-off:** the draft already carries it out, so the answer frees the steps that wait for it; in this run it frees 4 steps by itself and 6 steps more together with other open decisions. - SOURCE_CODE_VERIFIED, https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/functions/v1alpha/functions.json#L767-L771, read 2026-10-23: "info": {"description": "This API provides endpoints for managing STACKIT Functions.", "title": "STACKIT Functions Core API", "version": "1alpha"} **Required evidence (the plan's reasons, then what the knowledge base asks for)** (2) - the Secrets Manager Vault-compatible API is of a maturity that is not established (its documentation states no release status and its product documentation does not establish it as generally available): the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db wait for this decision; the draft's own blocks do not - the platform's consent to depend on an API that may change or vanish (alpha, beta, or a maturity the documentation does not establish) **Plan decisions** (1) - alias `convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN` **Affected units** (4) - `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db` - `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch` - `module.retail_app_ecs.aws_secretsmanager_secret.mq` - `module.retail_app_ecs.aws_secretsmanager_secret.orders_db` ### data movement (1 record) #### DEC-GEN-CONVERT-DATA-MOVEMENT Why: The method that moves the data of a store (a database, a cache, a search domain, or the objects of a bucket) to its STACKIT service is a person's choice (5 converter decisions): the steps of each method are in the plan where the planner covers the store (a PostgreSQL database and an S3 bucket, each with the runbook of the move), and the plan holds one manual step the person writes where it does not; the steps of the move wait for the choice. The choice decides how the data is moved, not whether it is: every method is work a person does by hand, so the unit that owns one keeps a manual data-migration step, and answering it does not make the unit automation-eligible. | Field | Value | |---|---| | Kind | `data movement` | | Owner role | Data Architect | | Plan decisions | 5 | | Affected units | 5 | | Applications touched | `catalog` (PROPOSED), `checkout` (PROPOSED), `orders` (PROPOSED); module.dependencies.module.catalog_rds.aws_rds_cluster.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders; module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: carts, checkout | | Wave | waves 1 to 4 · steps in platform services, cutover, decommission | | What an answer frees | The answer that frees most frees 18 steps by itself and 14 steps more together with other open decisions; 82 of the 114 steps it holds stay held (65 steps whatever is decided; the rest need another option, a regenerated draft or a path of a person). | | Options | 3, listed below | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:bd6dc33bd3777ba67c03a89361624334a25a61983906190c138fe87904c08a32` | **Options** (3) Options come from the knowledge base (decision-kinds.yaml; knowledge-base evidence, not in this folder), each with the sources it rests on. Choosing one in the decisions file changes no draft, no target-plan.json and no class, confidence or eligibility; its execution effect decides what the answer does to the step of the execution plan that waits for the decision: an option the draft already carries out frees it, an option that changes the draft keeps it held until the draft is regenerated with that option, and an option with no stated effect frees nothing. - `export-and-import-with-the-engine-clients`: Export the data from the source and import it with the clients of the target engine. A person exports the data from the source and imports it into the STACKIT instance with the clients of its engine during a window the business accepts, then checks that the copy is complete; the clients reach the instance at the host and port its credential states. The source and the target engine may differ (DynamoDB to MongoDB Flex), so the export is converted where they do. The plan holds the steps of this option as typed steps: for a PostgreSQL database, for a MySQL, MariaDB or Aurora MySQL database moving to MariaDB and for an RDS for SQL Server database moving to SQLServer Flex (the native backup, its copy to a STACKIT S3 bucket and the import_database call) the preflight, the rehearsal, the write freeze, the dump or backup and the restore or import inside it, the reconcile and the cleanup; for an ElastiCache, MemoryDB or ElastiCache serverless cache moving to a Key Value Store the preflight, the rehearsal, the write freeze, the copy by a client, the reconcile and the cleanup; for an Amazon Aurora DSQL cluster moving to PostgreSQL Flex the preflight, the rehearsal, the write freeze, the copy of the tables by a client (the schema from the catalogs of the cluster, or from pg_dump --schema-only where the preflight shows that it works, and the rows through the PostgreSQL protocol: no AWS page read documents a dump of a cluster), the reconcile and the cleanup; for an OpenSearch store the write freeze, the copy and the reconcile. The decision offers this option only for a store whose STACKIT service documents a way in with such clients: PostgreSQL Flex (for an Aurora DSQL cluster, which has no change stream, this option and the tool of the customer's own are the only ones; the replication of the engine is not offered), MariaDB (the mysql client loads a dump into an empty instance), SQLServer Flex (a .bak file imported with import_database), Key Value Store (the tutorial migrates a Redis instance by the MIGRATE command; for an ElastiCache source, where AWS lists migrate among the commands unavailable for caches running Redis OSS, the copy is a client that iterates the keys with SCAN and copies each with DUMP, PTTL and RESTORE; for a MemoryDB source, where AWS lists migrate, sync, psync, bgsave, save and config among the unavailable commands and the cluster mode is always on, the same client copy runs against every shard primary found with CLUSTER NODES or CLUSTER SLOTS, with TLS where the source has it and an ACL user that reaches every key; whether DUMP, RESTORE and PTTL run on a standard MemoryDB cluster is not stated by AWS, and for a member of a multi-Region cluster, whose page lists PTTL as unsupported, the step says the TTLs are not carried) and OpenSearch (the reindex operation). For a store without a documented way in (MongoDB Flex, a memcached cache) it is not offered and the decision offers the tool of the customer's own alone. **Trade-off:** a person carries it out: the answer frees only the manual step that does; in this run it frees 12 steps by itself and 3 steps more together with other open decisions. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57, read 2026-10-23: Read-Only: host (String), hosts (List of String), ..., port (Number), uri (String, Sensitive) - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_user.md#L59-L63, read 2026-10-23: Read-Only: host (String), ..., port (Number), uri (String, Sensitive) - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_credential.md#L51-L57, read 2026-10-23: Read-Only: host (String), hosts (List of String), ..., port (Number), ..., uri (String, Sensitive) - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_credential.md#L51-L57, read 2026-10-23: Read-Only: host (String), hosts (List of String), load_balanced_host (String), ..., port (Number), uri (String, Sensitive) Connection URI. - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/databases/mariadb/how-tos/backup-and-restore/, read 2026-10-30: Connect to the database and import the backup. - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/databases/sqlserver-flex/how-tos/import-database-backup-from-stackit-s3-into-sqlserver-flex/, read 2026-10-30: You have uploaded the database to be imported as .bak file(s) to the STACKIT S3 bucket - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/, read 2026-10-30: The main strategy to migrate the whole dataset from the source to the target is based on the MIGRATE command. - OFFICIAL_DOCUMENTED, https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/SupportedCommands.html, read 2026-10-30: For caches running Redis OSS, the following commands are unavailable: - OFFICIAL_DOCUMENTED, https://docs.aws.amazon.com/memorydb/latest/devguide/restrictedcommands.html, read 2026-10-30: To deliver a managed service experience, MemoryDB restricts access to certain commands that require advanced privileges. The following commands are unavailable: - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/databases/opensearch/how-tos/migrate-elasticsearch-data-to-an-opensearch2-service-instance/, read 2026-10-30: to use the `reindex` Data Operation - `replicate-with-the-engine-replication`: Replicate the data with the replication of the source engine until the cutover. A person sets up the replication of the source engine so that the STACKIT instance follows the source while the application keeps writing to the source (for PostgreSQL, logical replication: the schema is copied first with pg_dump --schema-only, a publication on the source and a subscription on the target copy the existing rows and then the changes, and the sequences are copied inside the write freeze because they are not replicated). The source needs a change and a reboot to turn replication on, and the target must be able to reach the source. Inside the write freeze the person waits until the target has caught up, compares both sides and switches the clients, then removes the replication. For a PostgreSQL database the plan holds the steps of this option (the initial copy, the watch of the lag, the freeze, the final copy, the reconcile and the cleanup); for an S3 bucket this option is not available, because S3 Replication copies between Amazon S3 buckets and no STACKIT bucket is documented as a destination (the plan holds the two copy tools instead); for any other engine this option is not offered, because no STACKIT service other than PostgreSQL Flex documents the replication of a source engine into it (MariaDB, Key Value Store, OpenSearch and MongoDB Flex document none, and the SQLServer Flex page on transactional replication describes an on-premises publisher and does not name Amazon RDS as one), so the decision of such a store offers the export and the import with the engine clients where its service documents them, and the tool of the customer's own. **Trade-off:** a person carries it out: the answer frees only the manual step that does; in this run it frees 6 steps by itself. - OFFICIAL_DOCUMENTED, https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html, read 2026-10-30: You can use replication to enable automatic, asynchronous copying of objects across Amazon S3 buckets. - OFFICIAL_DOCUMENTED, https://www.postgresql.org/docs/current/logical-replication-restrictions.html, read 2026-10-29: The database schema and DDL commands are not replicated. The initial schema can be copied by hand using pg_dump --schema-only. - OFFICIAL_DOCUMENTED, https://www.postgresql.org/docs/current/logical-replication-restrictions.html, read 2026-10-29: Sequence data is not replicated. - OFFICIAL_DOCUMENTED, https://www.postgresql.org/docs/current/sql-createsubscription.html, read 2026-10-29: To be able to create a subscription, you must have the privileges of the pg_create_subscription role, as well as CREATE privileges on the current database. - OFFICIAL_DOCUMENTED, https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html, read 2026-10-29: Set the rds.logical_replication static parameter to 1. - OFFICIAL_DOCUMENTED, https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html, read 2026-10-29: Reboot the DB instance for the static rds.logical_replication parameter to take effect. - `migrate-with-a-tool-of-my-own`: Move the data with a migration tool or a replication of the owner's own. A person moves the data with a tool or a replication they run (for example a change-data-capture replication that keeps the copy in step until the cutover), writes its steps, the checks before the move, the cutover window and the way back, and carries them out. The STACKIT instance is reached at the host and port its credential states. The plan holds that work as typed steps: the write freeze of the source, the copy as one step whose commands the person writes, and the reconcile that compares both sides; the source stays the way back until the reconcile records GO, which a person checks, since the plan cannot know that the tool leaves the source unchanged. A memcached cache holds a confirmation instead of a copy. A bucket repeated by count or for_each has neither a reconcile nor any other option: its instances and the buckets they move to are not named, so the plan holds the one manual step, which the person writes for each instance after naming them. **Trade-off:** a person carries it out: the answer frees only the manual step that does; in this run it frees 18 steps by itself and 14 steps more together with other open decisions. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57, read 2026-10-23: Read-Only: host (String), hosts (List of String), ..., port (Number), uri (String, Sensitive) **Required evidence (the plan's reasons, then what the knowledge base asks for)** (6) - StackToIT moves no data and writes no runbook for aws_dynamodb_table to STACKIT MongoDB Flex; the data-movement register lists module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with the mechanism UNKNOWN, and the source states neither the size of the data nor the downtime the business tolerates nor the consistency the application needs - StackToIT moves no data and writes no runbook for aws_opensearch_domain to STACKIT OpenSearch; the data-movement register lists module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the mechanism UNKNOWN, and the source states neither the size of the data nor the downtime the business tolerates nor the consistency the application needs - the plan defines both methods of the engine (a dump restored inside the write freeze, and a logical replication that follows the changes until the freeze) and keeps them open: which one applies depends on the size of the data, the write rate and the downtime the business accepts, and the source states none of them; the steps of the methods wait for the answer - the plan defines the one method the STACKIT MariaDB pages document, a dump loaded with the mysql client into the empty instance, and the customer's own tool; the replication of the binary log is refused because no STACKIT page documents it; STACKIT has no managed MySQL, so a MySQL source is an engine change whose collations, DEFINER accounts, accounts and settings the checks of the plan name, and the size of the data, the downtime the business accepts and the consistency the application needs are not in the source; the steps wait for the answer - the plan defines the one method the STACKIT pages and the ElastiCache pages allow together, a copy of the keys by a client (SCAN, DUMP, PTTL, RESTORE) inside the write freeze, and the customer's own tool; loading an exported snapshot is refused because no STACKIT page or API takes an RDB file, and following the source as a replica is refused because neither end offers it; the source does not say whether the cache holds only what the application rebuilds, the size of the data, the downtime the business accepts or the shards the keys are spread over, and the Key Value Store has no sharding; the steps wait for the answer - the size of the data, the downtime the business tolerates and the consistency the application needs, to choose the method and the cutover window **Plan decisions** (5) - `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` (alias `convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:data:DATA_MOVEMENT`) - `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this` (alias `convert:module.dependencies.module.catalog_rds.aws_rds_cluster.this:data:DATA_MOVEMENT`) - `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` (alias `convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:data:DATA_MOVEMENT`) - `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this` (alias `convert:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this:data:DATA_MOVEMENT`) - `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this` (alias `convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:data:DATA_MOVEMENT`) **Affected units** (5) - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` - `module.dependencies.module.catalog_rds.aws_rds_cluster.this` - `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` - `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this` - `module.dependencies.module.orders_rds.aws_rds_cluster.this` ### engine version downgrade (1 record) #### DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE Why: The source runs an engine version newer than every version STACKIT offers in the region (1 converter decision): a snapshot of the newer engine is not restored into the older one, so the step that creates the instance waits until a person chooses how the data reaches the offered version (re-read from the source), runs the engine self-managed on SKE, or waits for the version; the unit that owns one is not automation-eligible until then. | Field | Value | |---|---| | Kind | `engine version downgrade` | | Owner role | Data Architect | | Plan decisions | 1 | | Affected units | 1 | | Applications touched | `catalog` (PROPOSED) | | Wave | wave 4 · steps in platform services | | What an answer frees | The answer that frees most frees 2 steps by itself and 17 steps more together with other open decisions; 65 of the 84 steps it holds stay held whatever is decided (the plan does not let them run). | | Options | 3, listed below | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:da0e0583e3f086831a47b05396b1d30756583e8d7f3d4dd2b89e37050a55f030` | **Options** (3) Options come from the knowledge base (decision-kinds.yaml; knowledge-base evidence, not in this folder), each with the sources it rests on. Choosing one in the decisions file changes no draft, no target-plan.json and no class, confidence or eligibility; its execution effect decides what the answer does to the step of the execution plan that waits for the decision: an option the draft already carries out frees it, an option that changes the draft keeps it held until the draft is regenerated with that option, and an option with no stated effect frees nothing. - `move-the-data-into-the-offered-version`: Move the data into the version STACKIT offers, by re-reading it from the source. The instance is created with the version STACKIT offers (the draft's version variable is set to it, e.g. 2 for OpenSearch), and the data is re-read from the source rather than restored from a snapshot: an OpenSearch index is reindexed from the source (or the application writes to both during the cutover), a database is exported and imported with the clients of the engine. A snapshot of the newer engine is not restored into the older one. The applications are tested against the older version first; whether they work is not known from the source. **Trade-off:** the draft already carries it out, so the answer frees the steps that wait for it; in this run it frees 2 steps by itself and 17 steps more together with other open decisions. - OFFICIAL_DOCUMENTED, https://docs.opensearch.org/latest/tuning-your-cluster/availability-and-recovery/snapshots/snapshot-restore/, read 2026-10-26: Restoring a snapshot to an older version of OpenSearch is not supported. Snapshots are only forward compatible by one major version. - OFFICIAL_DOCUMENTED, https://www.postgresql.org/docs/current/app-pgdump.html, read 2026-10-26: Also, it is not guaranteed that pg_dump's output can be loaded into a server of an older major version — not even if the dump was taken from a server of that version. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_instance.md#L35, read 2026-10-26: version (String) The service version. - `run-the-engine-self-managed-on-ske`: Run the source's engine version yourself on SKE (self-managed). The managed STACKIT instance is not used: the customer runs the engine at the source's version on a STACKIT Kubernetes Engine cluster (an operator or a chart of its own) and operates it (upgrades, backups, monitoring). The draft does not write that workload, so it is changed (the managed instance removed, the workload added) before the step is applied. **Trade-off:** it changes the draft: the draft is generated again with it, and the steps stay held until then; in this run it frees no step. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L55, read 2026-10-26: node_pools (Attributes List) One or more node_pool block as defined below. - `wait-for-the-version`: Wait until STACKIT offers the source's version. The unit stays where it is until the region's catalogue lists the source's version; the draft is then regenerated against the new catalogue (the version check compares again), and the step stays blocked until then. STACKIT announces new service versions in the release notes of the service (OpenSearch: "STACKIT OpenSearch2 is now available", May 15, 2023); no date for a newer version is stated. **Trade-off:** it changes the draft: the draft is generated again with it, and the steps stay held until then; in this run it frees no step. - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/databases/opensearch/release-notes/, read 2026-10-26: May 15, 2023 We are happy to announce our new service releases for STACKIT OpenSearch2 The Service are offered with completely new Service Plans. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (3) - the source runs OpenSearch 3.3 (engine_version), newer than every version the eu01 catalogue (2026-10-18) lists for stackit_opensearch_instance (2): a snapshot of 3.3 cannot be restored into 2 (OpenSearch restores a snapshot into the same or a newer version only); reindex from the source, or write to both during the cutover (dual-write), is the path; whether the clients work against 2 is unknown - whether the applications and their client libraries work against the older engine version STACKIT offers (queries, mappings, plugins, protocol features) - the size of the data and the downtime the business tolerates, to choose between re-reading the data from the source and writing to both during the cutover **Plan decisions** (1) - alias `convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:version:ENGINE_VERSION_DOWNGRADE` **Affected units** (1) - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` ### exposure widened (1 record) #### DEC-GEN-CONVERT-EXPOSURE-WIDENED Why: The draft turns an endpoint that is private in the source into a public one on STACKIT (5 converter decisions): the step that creates it is not executable until a person accepts the exposure or chooses what the target offers instead, and the unit that owns one is not automation-eligible until then. It also holds the open critical semantic that the knowledge base leaves open for the same question of the same unit (the same ledger row): an answer to this record answers both, and the semantic stays open in assurance/critical-semantics.json, where a review closes nothing. | Field | Value | |---|---| | Kind | `exposure widened` | | Owner role | Security Architect | | Plan decisions | 6 | | Affected units | 5 | | Applications touched | `catalog` (PROPOSED), `checkout` (PROPOSED), `orders` (PROPOSED); module.dependencies.module.catalog_rds.aws_rds_cluster.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders | | Wave | wave 4 · steps in data services, platform services | | Options | 3, listed below | | Recommended option | none | | DEFAULT (change if wrong) | `accept-the-public-endpoint`, answered by DEFAULT: StackToIT carried out the option accept-the-public-endpoint for stackit_rabbitmq_instance.dependencies_mq by default: the RabbitMQ instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.orders_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_mq_allowed_cidrs, or answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default. | | DEFAULT (change if wrong) | `accept-the-public-endpoint`, answered by DEFAULT: StackToIT carried out the option accept-the-public-endpoint for stackit_opensearch_instance.dependencies_catalog_opensearch_this by default: the OpenSearch instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.catalog_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_catalog_opensearch_this_allowed_cidrs, or answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default. | | DEFAULT (change if wrong) | `accept-the-public-endpoint`, answered by DEFAULT: StackToIT carried out the option accept-the-public-endpoint for stackit_mariadb_instance.dependencies_catalog_rds_this by default: the MariaDB instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.catalog_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_catalog_rds_this_allowed_cidrs, or answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default. | | DEFAULT (change if wrong) | `accept-the-public-endpoint`, answered by DEFAULT: StackToIT carried out the option accept-the-public-endpoint for stackit_valkey_instance.dependencies_checkout_elasticache_redis_default by default: the Valkey instance keeps its own public STACKIT endpoint, and only the CIDRs of var.dependencies_checkout_elasticache_redis_default_allowed_cidrs may connect; the clients of the source could not be mapped to addresses, no CIDR is invented, so the variable has no default and the step waits for the networks you list. The draft writes no default list of the clients' addresses: the rule module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed["in#in#sg#0"] is no plain allow of a complete list of clients. Name the networks the clients connect from. To change it, answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default. | | DEFAULT (change if wrong) | `accept-the-public-endpoint`, answered by DEFAULT: StackToIT carried out the option accept-the-public-endpoint for stackit_postgresflex_instance.dependencies_orders_rds_this by default: the PostgreSQL Flex instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.orders_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_orders_rds_this_allowed_cidrs, or answer this decision in decisions.yaml with use-the-network-area-only-scope or redesign-the-endpoint (or reject the proposal): the next run then writes no default. | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:423e4ba2d45f712b067c92f5838a736429f1ad4d536c2a73854bfed78e11de19` | **Options** (3) Options come from the knowledge base (decision-kinds.yaml; knowledge-base evidence, not in this folder), each with the sources it rests on. Choosing one in the decisions file changes no draft, no target-plan.json and no class, confidence or eligibility; its execution effect decides what the answer does to the step of the execution plan that waits for the decision: an option the draft already carries out frees it, an option that changes the draft keeps it held until the draft is regenerated with that option, and an option with no stated effect frees nothing. - `accept-the-public-endpoint`: Accept the public endpoint, limited by its access list. **DEFAULT (change if wrong):** the draft carries this option out and the record stays open. The endpoint the draft writes is applied as written: the instance (or the Kubernetes API) is reached at its public address, and only the IP networks of its access list may connect (acl of stackit_postgresflex_instance and stackit_sqlserverflex_instance, sgw_acl of stackit_mariadb_instance, extensions.acl.allowed_cidrs of stackit_ske_cluster; parameters.sgw_acl of stackit_valkey_instance (Key Value Store), stackit_opensearch_instance, stackit_rabbitmq_instance and stackit_redis_instance, a comma-separated list of IP networks in CIDR notation, left to the default when the draft states none). The exposure is wider than the source's and the difference is accepted. Maturity: for stackit_ske_cluster this is the ACL-restricted public control plane: GA, not the source's private endpoint (the ACL how-to, last updated Aug 19, 2026, carries no Private Preview or beta notice, and says ACLs only control access to the API of the public control plane); the provider documents acl and sgw_acl of the data services without a preview notice. For an Application Load Balancer: it is created with the access control the draft writes, options.access_control.allowed_source_ranges, one set of source ranges for the whole load balancer (or none, where the draft can prove no range), so it admits more clients than the source's security groups; the restriction the set cannot express is the client-access manual step of the plan behind this decision, which follows the load balancer. The draft carries this option out BY DEFAULT for the Kubernetes API of a cluster whose source endpoint is private (stackit_ske_cluster, extensions.acl): of the three options it is the only one that is production grade (the ACL-restricted public control plane is GA, the network-area-only control plane is a Private Preview on request, not recommended for production, and cannot be combined with the ACL extension) and it is fail-closed, because only the CIDRs of the access list may connect. The decision stays OPEN with this option marked DEFAULT; the access list stays a required variable with no default (no CIDR is invented, and neither the cluster's own egress addresses nor a STACKIT range is a fallback, because the source's private clients are the admin and CI networks only the customer knows) that refuses an empty list, so the step of the cluster waits for the networks the person lists and not for the decision. The draft carries it out by default for a managed data service (stackit_postgresflex_instance, stackit_sqlserverflex_instance, stackit_mariadb_instance, stackit_mongodbflex_instance, stackit_valkey_instance, stackit_opensearch_instance, stackit_rabbitmq_instance, stackit_redis_instance) as well, on the same grounds and only when all of these hold: the decision is open and no review declines it; the access list the block writes (acl, sgw_acl) is one variable the draft wrote, of type list(string), with no default, that refuses an empty list, an empty entry and null; and the draft could not derive the clients' addresses (where every client is a drafted cluster or a drafted server with a public address the access list already has those addresses as its default, and the decision stands on that default). Of the options, accept-the-public-endpoint is the only one that is generally available for every data service (the network-area-only scope is a Private Preview for enabled accounts and exists for PostgreSQL Flex and SQL Server Flex only), and with a required, non-empty list it is fail-closed: only the CIDRs the person lists may connect. No CIDR is invented, and STACKIT's documented service ranges are no fallback. The default applies to a source that is private and to one whose exposure cannot be read, because the draft writes the same fail-closed endpoint for both. The access-scope variable of PostgreSQL Flex and SQL Server Flex keeps no default, and the critical network exposure of the unit stays open for the assurance until a review that chooses this option also states an exposure_acceptance (its statement and scope), which records the public endpoint as an accepted design change naming the reviewer, never as an equivalent. A review that names another option for the record, or rejects the proposal, declines the default. A cluster whose source endpoint is public gets no decision: its public_access_cidrs are the access list. **Trade-off:** A public endpoint needs a security approval (Security Architect) and its own access list; the draft already carries it out, so the answer frees the steps that wait for it. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_instance.md#L105, read 2026-10-22: acl (List of String) The Access Control List (ACL) for the PostgresFlex instance. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/sqlserverflex_instance.md#L93, read 2026-10-22: acl (List of String) List of IPV4 cidr. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_instance.md#L64, read 2026-10-22: sgw_acl (String) Comma separated list of IP networks in CIDR notation which are allowed to access this instance. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L162, read 2026-10-22: Nested Schema for extensions.acl — Required: allowed_cidrs (List of String) Specify a list of CIDRs to whitelist. enabled (Boolean) Is ACL enabled? - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_instance.md#L79, read 2026-10-26: sgw_acl (String) Comma separated list of IP networks in CIDR notation which are allowed to access this instance. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_instance.md#L68, read 2026-10-26: sgw_acl (String) Comma separated list of IP networks in CIDR notation which are allowed to access this instance. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/rabbitmq_instance.md#L70, read 2026-10-26: sgw_acl (String) Comma separated list of IP networks in CIDR notation which are allowed to access this instance. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/redis_instance.md#L82, read 2026-10-26: sgw_acl (String) Comma separated list of IP networks in CIDR notation which are allowed to access this instance. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L469, read 2026-10-26: access_control (Attributes) Use this option to limit the IP ranges that can use the Application Load Balancer. ... allowed_source_ranges (Set of String) Application Load Balancer is accessible only from an IP address in this range. - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/runtime/kubernetes-engine/how-tos/configure-access-control-for-your-cluster/, read 2026-10-26: ACLs only control access to the API of the public control plane. You cannot combine ACLs with a private control plane (accessScope: "SNA"), because the two features are mutually exclusive. You can use ACLs with a public cluster, or use a private cluster without ACLs. (page last updated on Aug 19, 2026; the page carries no Private Preview or beta notice) - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/runtime/kubernetes-engine/how-tos/enable-private-clusters/, read 2026-10-29: This feature is currently in Private Preview and available only upon request. It is under active development, subject to breaking changes without prior notice, and not recommended for production use. ... Private clusters (accessScope: "SNA") and the ACL extension (extensions.acl.enabled = true) are mutually exclusive and cannot be combined. (page last updated on Oct 1, 2026; the default for the Kubernetes API of a private EKS endpoint is the ACL-restricted public control plane because it is the only option of the decision that is GA) - `use-the-network-area-only-scope`: Use the network-area-only scope (SNA) instead of the public endpoint (Private Preview, on request). Maturity by target. stackit_ske_cluster: SNA private control plane: Private Preview, on request, not for production, no ACL extension (private preview; the documentation says the feature is available only upon request, is under active development, subject to breaking changes without prior notice, and not recommended for production use, and that a private cluster and the ACL extension are mutually exclusive: the GA way to restrict the Kubernetes API is the ACL-restricted public control plane, which is not the source's private endpoint). stackit_postgresflex_instance and stackit_sqlserverflex_instance: private preview (the provider documents access_scope as a private preview for enabled accounts). stackit_mariadb_instance, stackit_valkey_instance, stackit_opensearch_instance, stackit_rabbitmq_instance, stackit_redis_instance and stackit_application_load_balancer: not offered (no access scope; the redesign option applies). What the option means: The endpoint is reachable only inside a STACKIT Network Area: access_scope = SNA of stackit_postgresflex_instance and stackit_sqlserverflex_instance, network.control_plane.access_scope = SNA of stackit_ske_cluster (immutable). The scope is a private preview, permitted for enabled accounts only (a request of another account is rejected). The draft does not write it, so the draft is regenerated (or changed) with the scope before the step is applied. The pinned provider documents no access scope for stackit_mariadb_instance: there it is a redesign. Neither does it for stackit_valkey_instance (Key Value Store), stackit_opensearch_instance, stackit_rabbitmq_instance or stackit_redis_instance, whose access is set by parameters.sgw_acl only (the pinned STACKIT provider schema): for a private cache, search domain or broker there is no network-area-only option: the way out is a redesign, so the draft is changed before the step is applied. Neither does it for stackit_application_load_balancer, whose options are access_control, ephemeral_address, observability and private_network_only (accessible only via a private network address, not changeable after creation): there the way out is a redesign (a private load balancer, or the restriction in front of it), so the draft is regenerated or changed before the step is applied. **Trade-off:** it changes the draft: the draft is generated again with it, and the steps stay held until then. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_instance.md#L104, read 2026-10-22: access_scope (String) The network access scope of the instance. This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected. Possible values are: PUBLIC, SNA. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/sqlserverflex_instance.md#L92, read 2026-10-22: access_scope (String) The network access scope of the instance. This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected. Possible values are: PUBLIC, SNA. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L249, read 2026-10-22: access_scope (String) Access scope of the control plane. It defines if the Kubernetes control plane is public or only available inside a STACKIT Network Area. This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected.Possible values are: PUBLIC, SNA. The field is immutable! - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/runtime/kubernetes-engine/how-tos/enable-private-clusters/, read 2026-10-26: This feature is currently in Private Preview and available only upon request. It is under active development, subject to breaking changes without prior notice, and not recommended for production use. Private Preview products and features are available “as is” and might have limited support. ... Private clusters (accessScope: "SNA") and the ACL extension (extensions.acl.enabled = true) are mutually exclusive and cannot be combined. (page last updated on Oct 1, 2026) - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/networking/, read 2026-10-26: By default, your Kubernetes control plane is exposed to the public internet. This is equivalent to setting accessScope: "PUBLIC". If you set accessScope: "SNA" instead, your Kubernetes control plane will only be exposed within the SNA. This is called a private SKE cluster. ... Private clusters ("accessScope": "SNA") and the ACL extension ("acl": { "enabled": true }) are mutually exclusive. If you need the ACL extension, you can’t use a private cluster. (page last updated on Oct 14, 2026) - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_instance.md, read 2026-10-22: searched mariadb_instance.md for access_scope, SNA and private: no match; its access is set by parameters.sgw_acl only (knowledge-base evidence, not in this folder) - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L469, read 2026-10-26: access_control (Attributes) Use this option to limit the IP ranges that can use the Application Load Balancer. ... allowed_source_ranges (Set of String) Application Load Balancer is accessible only from an IP address in this range. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_instance.md, read 2026-10-26: searched valkey_instance.md for access_scope, SNA and private: no match; its access is set by parameters.sgw_acl only (knowledge-base evidence, not in this folder) - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_instance.md, read 2026-10-26: searched opensearch_instance.md for access_scope, SNA and private: no match; its access is set by parameters.sgw_acl only (knowledge-base evidence, not in this folder) - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/rabbitmq_instance.md, read 2026-10-26: searched rabbitmq_instance.md for access_scope, SNA and private: no match; its access is set by parameters.sgw_acl only (knowledge-base evidence, not in this folder) - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/redis_instance.md, read 2026-10-26: searched redis_instance.md for access_scope, SNA and private: no match; its access is set by parameters.sgw_acl only (knowledge-base evidence, not in this folder) - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L472, read 2026-10-26: searched application_load_balancer.md for access_scope and SNA: no match; Nested Schema for options lists access_control, ephemeral_address, observability and private_network_only (Boolean) Application Load Balancer is accessible only via a private network ip address. Not changeable after creation. (knowledge-base evidence, not in this folder) - `redesign-the-endpoint`: Redesign how the clients reach the endpoint (no private option offered or not usable). Neither the GA option (a public endpoint limited by an access list, wider than the source's) nor the Private Preview option (SNA: on request, not for production, and for stackit_ske_cluster not together with the ACL extension) is taken: a person designs how the clients reach the endpoint and carries it out, and the drafted step stays held until the design is recorded. Not offered: stackit_mariadb_instance, stackit_valkey_instance, stackit_opensearch_instance, stackit_rabbitmq_instance, stackit_redis_instance and stackit_application_load_balancer offer no network-area-only scope, so a redesign is the only way to a private endpoint there. For the Kubernetes API of stackit_ske_cluster the documentation names the source addresses an ACL has to allow (corporate NAT gateways, VPN egress addresses, bastion hosts, CI/CD pipeline egress addresses); a private cluster is a design only after STACKIT enabled the Private Preview for the project and the owner has accepted its maturity and the loss of the ACL extension. **Trade-off:** a person carries it out: the answer frees only the manual step that does. - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/runtime/kubernetes-engine/how-tos/configure-access-control-for-your-cluster/, read 2026-10-26: Make sure to allow the source IPs that actually reach the Kubernetes API server. This includes corporate NAT gateways, VPN egress addresses, bastion hosts, and CI/CD pipeline egress addresses. - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/runtime/kubernetes-engine/how-tos/enable-private-clusters/, read 2026-10-26: Open a ticket with STACKIT Support to request access for your organization or project. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (7) - the exposure of the source module.dependencies.module.catalog_rds.aws_rds_cluster.this is not readable (it states no publicly_accessible setting, or one that a variable without a value or a default decides), so the source is not proven publicly accessible and the draft does not take it as public; the STACKIT instance has its own IPv4 endpoint outside the project network, limited by its access list, which is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods) by default, so the exposure is a decision and not a preserved property - the exposure of the source module.dependencies.module.orders_rds.aws_rds_cluster.this is not readable (it states no publicly_accessible setting, or one that a variable without a value or a default decides), so the source is not proven publicly accessible and the draft does not take it as public; the STACKIT instance has its own IPv4 endpoint outside the project network, limited by its access list, which is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods) by default, so the exposure is a decision and not a preserved property - the source module.dependencies.aws_mq_broker.mq is private (the broker states publicly_accessible = false: it is reached from inside the VPC that hosts its subnets) and the STACKIT RabbitMQ instance has its own endpoint outside the project network, limited only by parameters.sgw_acl; a list the plan does not give is replaced by STACKIT's default ACL, which admits every STACKIT customer's addresses (the draft's variable has the empty list as its default, which the block replaces by the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods)); the endpoint is wider than the source's and the difference is an accepted change in exposure, not a preserved property - the source module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is private (the domain states vpc_options: it is reached from inside its VPC) and the STACKIT OpenSearch instance has its own endpoint outside the project network, limited only by parameters.sgw_acl; a list the plan does not give is replaced by STACKIT's default ACL, which admits every STACKIT customer's addresses (the draft's variable has the empty list as its default, which the block replaces by the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods)); the endpoint is wider than the source's and the difference is an accepted change in exposure, not a preserved property - the source module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is private (Amazon ElastiCache has no public endpoint: the cache is reached from inside its VPC through its subnet group) and the STACKIT Valkey instance has its own endpoint outside the project network, limited only by parameters.sgw_acl; a list the plan does not give is replaced by STACKIT's default ACL, which admits every STACKIT customer's addresses (the draft's variable has no default and rejects an empty list, so the list is yours); the endpoint is wider than the source's and the difference is an accepted change in exposure, not a preserved property - whether the clients of the source endpoint can reach a public address limited by an access list, or need the endpoint inside the network (and, for the network-area-only scope, that the STACKIT account is enabled for the private preview) - for an Application Load Balancer: the client ranges the source security groups admit on each listener port, and the addresses of the clients they name by a group reference or a prefix list **Plan decisions** (6) - `DEC-GEN-CONVERT-EXPOSURE-WIDENED/module.dependencies.aws_mq_broker.mq` (alias `convert:module.dependencies.aws_mq_broker.mq:exposure:EXPOSURE_WIDENED`) - `DEC-GEN-CONVERT-EXPOSURE-WIDENED/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` (alias `convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:exposure:EXPOSURE_WIDENED`) - `DEC-GEN-CONVERT-EXPOSURE-WIDENED/module.dependencies.module.catalog_rds.aws_rds_cluster.this` (alias `convert:module.dependencies.module.catalog_rds.aws_rds_cluster.this:exposure:EXPOSURE_WIDENED`) - `DEC-GEN-CONVERT-EXPOSURE-WIDENED/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` (alias `convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:exposure:EXPOSURE_WIDENED`) - `DEC-GEN-CONVERT-EXPOSURE-WIDENED/module.dependencies.module.orders_rds.aws_rds_cluster.this` (alias `convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:exposure:EXPOSURE_WIDENED`) - `module.dependencies.aws_mq_broker.mq|network-exposure` **Affected units** (5) - `module.dependencies.aws_mq_broker.mq` - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` - `module.dependencies.module.catalog_rds.aws_rds_cluster.this` - `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` - `module.dependencies.module.orders_rds.aws_rds_cluster.this` ### ingress exposure path (1 record) #### DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH Why: The converter could not prove what the source means by the ingress exposure path (1 converter decision): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides. | Field | Value | |---|---| | Kind | `ingress exposure path` | | Owner role | Network Architect | | Plan decisions | 1 | | Affected units | 1 | | Applications touched | `ui` (PROPOSED) | | Wave | wave 3 · steps in platform services | | What an answer frees | No answer frees a step by itself; the answer that frees most frees 3 steps together with other open decisions; 63 of the 66 steps it holds stay held whatever is decided (the plan does not let them run). | | Options | 3, listed below | | Recommended option | `nodeport-alb-target-pool` | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:d7bf04a14592c56905fb4aaaf64310c4a399ab5a50cefaace7cdb6f7435abf4a` | **Options** (3) Options come from the knowledge base (decision-kinds.yaml; knowledge-base evidence, not in this folder), each with the sources it rests on. Choosing one in the decisions file changes no draft, no target-plan.json and no class, confidence or eligibility; its execution effect decides what the answer does to the step of the execution plan that waits for the decision: an option the draft already carries out frees it, an option that changes the draft keeps it held until the draft is regenerated with that option, and an option with no stated effect frees nothing. - `nodeport-alb-target-pool`: Keep the draft: a NodePort Service of each workload and the target pool on its node port at the private IPs of the cluster's nodes. **DEFAULT (change if wrong):** the draft carries this option out and the record stays open. Nobody answered it: confirm it with a review that names it, or choose another option. The manifest of each workload writes a Service of type NodePort with the node port the target pool of the drafted Application Load Balancer listens on, and the pool's targets are the private IPs of the nodes of the SKE cluster, which a person sets and keeps current: the nodes change as the node pool scales and is updated, and a node missing from the list receives no traffic. The health check of the pool reaches the pods through the same node port. The draft applies as written once the IPs are set. **Trade-off:** the draft already carries it out, so the answer frees the steps that wait for it; in this run it frees 3 steps only together with other open decisions. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L420, read 2026-10-23: ip (String) Private target IP, which must by unique within a target pool. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L70-L76, read 2026-10-26: Read-Only: egress_address_ranges, id, kubernetes_version_used, pod_address_ranges, service_account_issuer (searched the resource documentation: no attribute holds the addresses of the nodes) - SOURCE_CODE_VERIFIED, https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L88, read 2026-10-26: type = "NodePort" (the Service of the workload a STACKIT Application Load Balancer reaches on SKE) - `ingress-controller-behind-alb`: Run an Ingress controller on the cluster and put the load balancer in front of it. An Ingress controller (for example ingress-nginx, installed by a Helm release) runs on the SKE cluster and routes the requests by Ingress rules to the ClusterIP Services of the workloads; the load balancer reaches the controller, on the controller's node port at the private IPs of the nodes (the target pool of the draft changed to that port) or through the controller's own Service of type LoadBalancer. The draft writes neither the controller nor the Ingress rules: a person carries it out, and the load balancer's step stays held. **Trade-off:** a person carries it out: the answer frees only the manual step that does; in this run it frees no step. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L420, read 2026-10-23: ip (String) Private target IP, which must by unique within a target pool. - SOURCE_CODE_VERIFIED, https://github.com/stackitcloud/professional-service/blob/main/examples/ske-nginx-rate-limit/070-helm.tf#L15-L18, read 2026-10-26: resource "helm_release" "ingress_nginx" { name = "ingress-nginx" repository = "https://kubernetes.github.io/ingress-nginx" chart = "ingress-nginx" - `stackit-alb-ingress-controller`: Use the STACKIT ALB as the Ingress: the SKE Application Load Balancer extension. The Application Load Balancer extension of the SKE cluster is enabled (extensions.application_load_balancer.enabled of stackit_ske_cluster; in private preview, only for enabled accounts) and each workload gets an Ingress of an IngressClass of the controller stackit.cloud/alb-ingress over a Service of type NodePort, the only network mode the controller supports; the controller provisions the Application Load Balancer through the STACKIT API, so the stackit_application_load_balancer block of the draft is not applied. The draft writes neither the extension nor the Ingress: a person carries it out, and the load balancer's step stays held. **Trade-off:** a person carries it out: the answer frees only the manual step that does; in this run it frees no step. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L171, read 2026-10-26: `enabled` (Boolean) Enables the application load balancer extension. Note: This feature is in private preview. Enabling application load balancer extension is only possible for enabled accounts. Otherwise the request will be rejected. - SOURCE_CODE_VERIFIED, https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/ARCHITECTURE.md#L5, read 2026-10-26: The STACKIT ALB Controller implements the standard Kubernetes Ingress controller pattern: it watches `IngressClass` and `Ingress` objects and translates them into a fully managed STACKIT Application Load Balancer. - SOURCE_CODE_VERIFIED, https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L25-L33, read 2026-10-26: # Mandatory; NodePort is currently the only supported network mode. "alb.stackit.cloud/network-mode" = "NodePort" ... controller = "stackit.cloud/alb-ingress" - SOURCE_CODE_VERIFIED, https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L88, read 2026-10-26: type = "NodePort" (the Service of the workload a STACKIT Application Load Balancer reaches on SKE) **Required evidence (the plan's reasons, then what the knowledge base asks for)** (4) - a STACKIT target pool reaches its targets by private IP and the SKE cluster exports no node address to Terraform, so a Kubernetes workload is reachable from the load balancer only through a node port at the IPs of the nodes, which change as the node pool scales and is updated, or through an Ingress controller; the source registered the tasks of the service by their own IPs (awsvpc) - for the drafted path: the private IPs of the nodes of the SKE cluster the target pool lists, and who keeps them current as the node pool scales and is updated - for an Ingress controller: the controller, how the load balancer reaches it (its node port at the node IPs, or its own Service of type LoadBalancer) and the Ingress rules of each workload - for the STACKIT ALB as the Ingress: that the account may enable the Application Load Balancer extension of SKE (private preview), and the IngressClass and Ingress of each workload **Plan decisions** (1) - alias `convert:module.retail_app_ecs.module.alb.aws_lb.this:target_pools:INGRESS_EXPOSURE_PATH` **Affected units** (1) - `module.retail_app_ecs.module.alb.aws_lb.this` ### pod segmentation (1 record) #### DEC-GEN-CONVERT-POD-SEGMENTATION Why: The converter could not prove what the source means by the pod segmentation (5 converter decisions): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides. | Field | Value | |---|---| | Kind | `pod segmentation` | | Owner role | Security Architect | | Plan decisions | 5 | | Affected units | 5 | | Applications touched | `carts` (PROPOSED), `checkout` (PROPOSED), `orders` (PROPOSED), `ui` (PROPOSED); module.retail_app_ecs.module.catalog_service.aws_security_group.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders | | Wave | wave 2 · steps in security | | What an answer frees | The answer that frees most frees 20 steps by itself and 11 steps more together with other open decisions; 65 of the 96 steps it holds stay held whatever is decided (the plan does not let them run). | | Options | 3, listed below | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:29854ad7b6a2cfd7733fbf071811c930e5023b74bc53cbea83bece2408c8973d` | **Options** (3) Options come from the knowledge base (decision-kinds.yaml; knowledge-base evidence, not in this folder), each with the sources it rests on. Choosing one in the decisions file changes no draft, no target-plan.json and no class, confidence or eligibility; its execution effect decides what the answer does to the step of the execution plan that waits for the decision: an option the draft already carries out frees it, an option that changes the draft keeps it held until the draft is regenerated with that option, and an option with no stated effect frees nothing. - `generate-networkpolicy-from-the-group-rules`: Carry the segmentation as a Kubernetes NetworkPolicy written from the rules of the source group. A NetworkPolicy per workload admits the traffic the rules of the source group allowed and nothing else, so the segmentation moves from the interface of the task to the pod. The sources read state that SKE applies NetworkPolicy objects (a default-deny policy of its own in kube-system, and a request to add policies for custom workloads) and give no statement about the policy engine in a workload's namespace, which is checked on the cluster. The draft does not write the NetworkPolicy in this build: a person writes it from the rules of the drafted group, and the group stays a record of what the source allowed. **Trade-off:** a person carries it out: the answer frees only the manual step that does; in this run it frees 20 steps by itself and 11 steps more together with other open decisions. - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/, read 2026-10-26: With Kubernetes 1.33 there will be a new deny-all NetworkPolicy introduced, which blocks Network Traffic in the namespace kube-system. If there is custom workload in the namespace, please apply additional NetworkPolicies for Ingress and Egress. - SOURCE_CODE_VERIFIED, https://github.com/stackitcloud/professional-service/blob/main/examples/ske-s3-csi-juicefs/README.md#L59, read 2026-10-26: SKE (Gardener) enforces a default-deny `NetworkPolicy` in `kube-system`. - `security-group-on-the-nodes`: Carry the segmentation as a STACKIT security group on the nodes (coarser than the source). A security group acts on the network interface that lists it, so on a node and on every pod of it, not on one workload: it is coarser than the source group, which acted on the interface of each task. The provider resource of the cluster has no security group attribute, on the cluster or on a node pool, so the draft cannot write it, and whether the interfaces of the nodes can list a group by another route is not stated by the sources read: a person establishes that with STACKIT before choosing it. **Trade-off:** a person carries it out: the answer frees only the manual step that does; in this run it frees 20 steps by itself and 11 steps more together with other open decisions. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L40, read 2026-10-26: `security_group_ids` (List of String) The list of security group UUIDs. If security is set to false, setting this field will lead to an error. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md, read 2026-10-26: (searched the resource documentation of stackit_ske_cluster, its node_pools nested schema included, and the pinned provider schema 0.120.0: no security group attribute) - `accept-no-segmentation`: Accept that the pods run without the segmentation the source group gave the tasks. The group is created as the draft writes it and is attached to nothing; no policy of the draft restricts the traffic to or from the pods, so what the cluster admits to them is its own default, which the sources read do not state for a workload namespace. The loss of the source's restriction is a difference, recorded as accepted with who accepted it and why, never as equivalent. **Trade-off:** the draft already carries it out, so the answer frees the steps that wait for it; in this run it frees 20 steps by itself and 11 steps more together with other open decisions. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L40, read 2026-10-26: `security_group_ids` (List of String) The list of security group UUIDs. If security is set to false, setting this field will lead to an error. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md, read 2026-10-26: (searched the resource documentation of stackit_ske_cluster, its node_pools nested schema included, and the pinned provider schema 0.120.0: no security group attribute) **Required evidence (the plan's reasons, then what the knowledge base asks for)** (4) - the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision) - for each workload the record names: the traffic the source group allowed to and from its tasks (the rules of the drafted group) and which of those rules the target still needs - for a NetworkPolicy: that the cluster enforces NetworkPolicy objects in the workload's namespace, and the labels of the pods the policy selects - for a security group on the nodes: whether the network interfaces of the nodes of the cluster can list a STACKIT security group at all (the provider resource of the cluster has no attribute for it), and that its rules then act on every pod of a node **Plan decisions** (5) - `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this` (alias `convert:module.retail_app_ecs.module.carts_service.aws_security_group.this:security-group:POD_SEGMENTATION`) - `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this` (alias `convert:module.retail_app_ecs.module.catalog_service.aws_security_group.this:security-group:POD_SEGMENTATION`) - `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this` (alias `convert:module.retail_app_ecs.module.checkout_service.aws_security_group.this:security-group:POD_SEGMENTATION`) - `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this` (alias `convert:module.retail_app_ecs.module.orders_service.aws_security_group.this:security-group:POD_SEGMENTATION`) - `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this` (alias `convert:module.retail_app_ecs.module.ui_service.aws_security_group.this:security-group:POD_SEGMENTATION`) **Affected units** (5) - `module.retail_app_ecs.module.carts_service.aws_security_group.this` - `module.retail_app_ecs.module.catalog_service.aws_security_group.this` - `module.retail_app_ecs.module.checkout_service.aws_security_group.this` - `module.retail_app_ecs.module.orders_service.aws_security_group.this` - `module.retail_app_ecs.module.ui_service.aws_security_group.this` ### size from source (1 record) #### DEC-GEN-CONVERT-SIZE-FROM-SOURCE Why: The draft derives a plan or a machine type from the size the source states and writes it as the default of a variable (3 converter decisions): the steps that read the variable run on that default until a person confirms it or sets another size, and the price on the cost page is the price of the default. The source states the size of its own offer, not the load, so the size is a proposal. | Field | Value | |---|---| | Kind | `size from source` | | Owner role | Platform Architect | | Plan decisions | 3 | | Affected units | 3 | | Applications touched | `checkout` (PROPOSED), `orders` (PROPOSED) | | Wave | wave 4 · steps in data services, platform services | | Options | 2, listed below | | Recommended option | none | | DEFAULT (change if wrong) | `use-the-size-derived-from-the-source`, answered by DEFAULT: StackToIT carried out the option use-the-size-derived-from-the-source for module.dependencies.aws_mq_broker.mq by default: var.dependencies_mq_plan_name defaults to stackit-rabbitmq-8.16.50-replica (broker instance type mq.m5.large has 2 vCPU and 8 GiB (AWS price list, mq_broker_sizes.json), and the broker is a single instance: the smallest replica (three nodes, high availability) RabbitMQ plan of the eu01 catalogue (2026-10-18) that holds 2 vCPU and 8 GiB (8.59 GB at 10^9 bytes per GB) of memory (the plan table gives its RAM as "GB" and does not say whether a GB is 10^9 or 2^30 bytes, so the plan is chosen to hold the source's memory when a GB is 10^9 bytes, which it then also does when a GB is 2^30 bytes (it is never smaller than the source whichever way the table is read)): 8 vCPU / 16 GB RAM / 50 GB disk per node; the disk is not a figure of the source, so the smallest disk of that size is taken and the disk is open; no single-node plan of that size exists, so this replica plan adds the replicas the source does not have, and their price; this plan is larger than the one the other reading gives: reading the table's GB as a GiB, stackit-rabbitmq-4.8.50-single (4 vCPU / 8 GB RAM / 50 GB disk per node) would hold the source, and the draft is priced on the larger plan; if the table's GB is a GiB, answer choose-the-size and set stackit-rabbitmq-4.8.50-single). To change it, answer this decision in decisions.yaml with choose-the-size (and set the plan in the variable), or reject the proposal: the next run then writes the variable without a default. | | DEFAULT (change if wrong) | `use-the-size-derived-from-the-source`, answered by DEFAULT: StackToIT carried out the option use-the-size-derived-from-the-source for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default by default: var.dependencies_checkout_elasticache_redis_default_plan_name defaults to stackit-keyvalue-1.4.10-single (node type cache.t3.micro has 2 vCPU and 0.5 GiB (AWS price list, cache_node_sizes.json), and the source is a single node: the smallest single-node Key Value Store plan of the eu01 catalogue (2026-10-18) that holds 0.5 GiB (0.5369 GB at 10^9 bytes per GB) of memory (the plan table gives its RAM as "GB" and does not say whether a GB is 10^9 or 2^30 bytes, so the plan is chosen to hold the source's memory when a GB is 10^9 bytes, which it then also does when a GB is 2^30 bytes (it is never smaller than the source whichever way the table is read)): 1 vCPU / 4 GB RAM / 10 GB disk per node; the disk is not a figure of the source, so the smallest disk of that size is taken and the disk is open). To change it, answer this decision in decisions.yaml with choose-the-size (and set the plan in the variable), or reject the proposal: the next run then writes the variable without a default. | | DEFAULT (change if wrong) | `use-the-size-derived-from-the-source`, answered by DEFAULT: StackToIT carried out the option use-the-size-derived-from-the-source for module.dependencies.module.orders_rds.aws_rds_cluster.this by default: flavor_id = 2.4 (module.dependencies.module.orders_rds.aws_rds_cluster.this (source class db.t3.medium) has 2 vCPU and 4 GiB (AWS price list); 2.4 is the smallest single-node PostgreSQL Flex flavor of the eu01 catalogue (2026-10-18) that covers it: 2 vCPU / 4 GiB). To change it, answer this decision in decisions.yaml with choose-the-size (and set the flavor in the variable), or reject the proposal: the next run then writes flavor_id as var.dependencies_orders_rds_this_flavor_id without a default. | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:68bd3fec47f2c8f8025a99a3b80707342357b42589bda9f46be69f7182fb9730` | **Options** (2) Options come from the knowledge base (decision-kinds.yaml; knowledge-base evidence, not in this folder), each with the sources it rests on. Choosing one in the decisions file changes no draft, no target-plan.json and no class, confidence or eligibility; its execution effect decides what the answer does to the step of the execution plan that waits for the decision: an option the draft already carries out frees it, an option that changes the draft keeps it held until the draft is regenerated with that option, and an option with no stated effect frees nothing. - `use-the-size-derived-from-the-source`: Keep the plan or machine type the draft derived from the size of the source. **DEFAULT (change if wrong):** the draft carries this option out and the record stays open. The draft already writes the derived plan, flavor or machine type (as the default of the variable for a plan or a machine type, as the literal of the block for a database flavor), said as DEFAULT on the block: the instance or the pool is created with it and the cost page prices it. Confirming it accepts the proposal as the starting size of the target; it does not say that the size carries the load, which the source does not state, and the disk of a plan is the smallest of that size. The memory was compared in bytes: the API states the memory of a PostgreSQL Flex and a SQL Server Flex flavor in Gibibyte, the unit of the source; the plan tables of Key Value Store and RabbitMQ and the MongoDB Flex flavors state their RAM as GB without defining it, so the draft took the plan or flavor that holds the source's memory when a GB is 10^9 bytes (it then holds it when a GB is 2^30 bytes as well) and says where that made it larger than the reading of a GB as a GiB; a machine type's memory is the catalogue's ram_mb read as MiB, an inference the API does not state. The next run writes the same default. **Trade-off:** the draft already carries it out, so the answer frees the steps that wait for it. - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/databases/key-value-store/reference/service-plans/, read 2026-11-02: Single-node service plans do not provide this grade of high availability. Therefore, we strongly advise against using them in production environments. - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/databases/key-value-store/reference/service-plans/, read 2026-11-02: Service Plan \| High availability \| Number of nodes \| vCPU per node \| RAM (GB) per node \| Disk (GB) per node; keyvalue-1.2.10-Replica \| yes \| 3 \| 1 \| 2 \| 10; keyvalue-2.8.250-Replica-HiPerf \| yes \| 3 \| 2 (dedicated) \| 8 \| 250; keyvalue-1.4.10-Single \| no \| 1 \| 1 \| 4 \| 10 (the cells of the table, joined with ' \| ') - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/messaging/rabbitmq/reference/service-plans/, read 2026-11-02: Service Plan \| High availability \| Number of nodes \| vCPU per node \| RAM (GB) per node \| Disk per node; RabbitMQ-1.2.10-Replica \| yes \| 3 \| 1 \| 2 \| 10; RabbitMQ-2.4.10-Single \| no \| 1 \| 2 \| 4 \| 10; RabbitMQ-8.16.100-replica-HiPerf \| yes \| 3 \| 8¹ \| 16 \| 100; ^1dedicated CPU for highest performance (the cells of the table, joined with ' \| ') - SOURCE_CODE_VERIFIED, https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/ske/v2/ske.json#L2048, read 2026-11-02: Machine.type: "For valid types please take a look at [provider-options](#tag/ProviderOptions/operation/SkeService_GetProviderOptions) `machineTypes`." (provider options: machineTypes, "List of available machine types", each with architecture, cpu, gpu, memory and name) - SOURCE_CODE_VERIFIED, https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L1408, read 2026-11-02: flavor.memory: "The memory of the instance in Gibibyte." - SOURCE_CODE_VERIFIED, https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/sqlserverflex/v3/sqlserverflex.json#L1455, read 2026-11-02: flavor.memory: "The memory of the instance in Gibibyte." - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/databases/mongodb-flex/reference/flavors-and-performance-classes/, read 2026-11-02: Replica set: Description \| ID \| CPU \| RAM (GB); Tiny, Compute optimized \| 1.2 \| 1 \| 2; Tiny, Database optimized \| 1.4 \| 1 \| 4 (the cells of the table, joined with ' \| '; the page defines GB nowhere and the mongodb-flex v2 spec types `memory` as an int32 without a description) - SOURCE_CODE_VERIFIED, https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/iaas/v2/iaas.json#L3660, read 2026-11-02: SizeInMB: "Size in Megabyte." (the ram of a MachineType); project quota ram: "Amount of server RAM in MiB."; the provider data source machine_type: "ram (Number) RAM size in MB" with the filter example "vcpus >= 2 && ram >= 2048" - `choose-the-size`: Set the plan or machine type yourself. The next run leaves the variable a required one the owner sets (a plan or a flavor of the catalogue, or a machine type the SKE API lists); the derived default and its DEFAULT line leave the draft, and the step that reads the variable waits for the value. Where the unit of the target's memory is not stated (the GB of a plan table or of a MongoDB Flex flavor), the person who sets the value reads the table in the unit that holds: a plan whose GB is a GiB can be smaller than the one the draft proposed. **Trade-off:** it changes the draft: the draft is generated again with it, and the steps stay held until then. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_instance.md#L36, read 2026-11-02: `plan_name` (String) The selected plan name. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/rabbitmq_instance.md#L36, read 2026-11-02: `plan_name` (String) The selected plan name. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L84, read 2026-11-02: `machine_type` (String) The machine type. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (5) - the target sizes by a flavor of the catalogue, and the source states a size in the terms of its own offer; the draft proposes the smallest flavor that covers it, which leaves out what the source does not state (the disk of a plan, the sustained load, the headroom of a pool), so the value is a proposal and the price of the draft moves with it; unit of the memory figure: PostgreSQL Flex states the memory of a flavor in Gibibyte (API v3 spec, flavor.memory), the unit of the source's size, so no unit is assumed - the target sizes by a plan of the catalogue, and the source states a size in the terms of its own offer; the draft proposes the smallest plan that covers it, which leaves out what the source does not state (the disk of a plan, the sustained load, the headroom of a pool), so the value is a proposal and the price of the draft moves with it; unit of the memory figure: the plan table gives its RAM as "GB" and does not say whether a GB is 10^9 or 2^30 bytes, so the plan is chosen to hold the source's memory when a GB is 10^9 bytes, which it then also does when a GB is 2^30 bytes (it is never smaller than the source whichever way the table is read) - the load the instance or the pool has to carry on STACKIT: memory in use, connections or messages per second, and the headroom the owner wants (the source states the size of its offer, not the load) - for a plan: whether the availability of the source (replicas, automatic failover, a cluster of brokers) is kept, and the disk the data needs (the disk is not a figure of the source) - for a pool: the requests of the workloads that run on it, and the minimum and maximum of the pool **Plan decisions** (3) - `DEC-GEN-CONVERT-SIZE-FROM-SOURCE/module.dependencies.aws_mq_broker.mq` (alias `convert:module.dependencies.aws_mq_broker.mq:dependencies_mq_plan_name:SIZE_FROM_SOURCE`) - `DEC-GEN-CONVERT-SIZE-FROM-SOURCE/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` (alias `convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:dependencies_checkout_elasticache_redis_default_plan_name:SIZE_FROM_SOURCE`) - `DEC-GEN-CONVERT-SIZE-FROM-SOURCE/module.dependencies.module.orders_rds.aws_rds_cluster.this` (alias `convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:dependencies_orders_rds_this_flavor_id:SIZE_FROM_SOURCE`) **Affected units** (3) - `module.dependencies.aws_mq_broker.mq` - `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` - `module.dependencies.module.orders_rds.aws_rds_cluster.this` ### workload placement (1 record) #### DEC-GEN-CONVERT-WORKLOAD-PLACEMENT Why: The converter could not prove what the source means by the workload placement (1 converter decision): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides. | Field | Value | |---|---| | Kind | `workload placement` | | Owner role | Network Architect | | Plan decisions | 1 | | Affected units | 1 | | Applications touched | none: no applications file was given and no suggested group holds an affected unit | | Wave | not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in foundation | | What an answer frees | The answer that frees most frees 1 step by itself; 2 of the 3 steps it holds stay held whatever is decided (the plan does not let them run). | | Options | 4, listed below | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:8423085c8f163f8f11a333347eb7eb7897eac61922c9c6cd69a52a5a7a6893f9` | **Options** (4) Options come from the knowledge base (decision-kinds.yaml; knowledge-base evidence, not in this folder), each with the sources it rests on. Choosing one in the decisions file changes no draft, no target-plan.json and no class, confidence or eligibility; its execution effect decides what the answer does to the step of the execution plan that waits for the decision: an option the draft already carries out frees it, an option that changes the draft keeps it held until the draft is regenerated with that option, and an option with no stated effect frees nothing. - `one-network-for-the-cluster-and-services`: Place the cluster and the servers in one STACKIT network, and admit the clients of the managed services by access lists naming its range. The Kubernetes cluster is deployed into one network (network.id of stackit_ske_cluster names a STACKIT Network Area network; a node pool states no network, so the tasks the source spread over several subnets share it), the servers are placed in it by their network interfaces (network_id of stackit_network_interface), and a managed database or cache is not placed in a network: its access list (acl of stackit_postgresflex_instance and stackit_mongodbflex_instance) names the range of that network. The other drafted networks of the subnets hold none of these consumers. The draft writes the cluster half of this option by default (network = { id = ... } on the drafted stackit_ske_cluster, marked DEFAULT) where the target project is not stated to be outside a Network Area, the draft asks for no such project, the cluster serves workloads of exactly one drafted network, and every other consumer of that network has a decision of its own; where one of these does not hold it writes no network.id and a person carries the cluster half out. The access lists of the managed services are a separate default of the draft and not written by this option: a person (or that default) carries the services half out, and the network's step stays held until the decision is answered where the draft binds nothing. **Trade-off:** a person carries it out: the answer frees only the manual step that does; in this run it frees no step. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242, read 2026-10-26: `id` (String) ID of the STACKIT Network Area (SNA) network into which the cluster will be deployed. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L79-L101, read 2026-10-26: Nested Schema for `node_pools` — Required: availability_zones, machine_type, maximum, minimum, name; Optional: allow_system_components, cri, labels, max_surge, max_unavailable, os_name, os_version, os_version_min, taints, volume_size, volume_type (searched the nested schema: no network attribute) - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29, read 2026-10-23: network_id (String) The network ID to which the network interface is associated. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_instance.md#L44, read 2026-10-26: `acl` (List of String) The Access Control List (ACL) for the MongoDB Flex instance. (searched the resource documentation: no network id attribute) - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_instance.md#L104, read 2026-10-22: access_scope (String) The network access scope of the instance. This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected. Possible values are: PUBLIC, SNA. - `keep-the-networks-and-place-by-tier`: Keep the drafted networks and place each consumer in the network of its tier. A network is kept per source subnet class and each consumer is placed where STACKIT can place it: a server by its network interface, a load balancer by its networks (networks.network_id of stackit_application_load_balancer), the Kubernetes cluster by network.id in one network (its node pools state no network, so one cluster cannot follow a split of its tasks over several networks), and a managed database or cache by an access list naming the range of its tier's network. The draft does not write this placement: a person carries it out, and the network's step stays held. **Trade-off:** a person carries it out: the answer frees only the manual step that does; in this run it frees no step. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242, read 2026-10-26: `id` (String) ID of the STACKIT Network Area (SNA) network into which the cluster will be deployed. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L79-L101, read 2026-10-26: Nested Schema for `node_pools` — Required: availability_zones, machine_type, maximum, minimum, name; Optional: allow_system_components, cri, labels, max_surge, max_unavailable, os_name, os_version, os_version_min, taints, volume_size, volume_type (searched the nested schema: no network attribute) - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29, read 2026-10-23: network_id (String) The network ID to which the network interface is associated. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L397-L398, read 2026-10-25: network_id (String) STACKIT network ID the Application Load Balancer and/or targets are in. role (String) The role defines how the Application Load Balancer is using the network. Possible values are: ROLE_UNSPECIFIED, ROLE_LISTENERS_AND_TARGETS, ROLE_LISTENERS, ROLE_TARGETS. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_instance.md#L44, read 2026-10-26: `acl` (List of String) The Access Control List (ACL) for the MongoDB Flex instance. (searched the resource documentation: no network id attribute) - `redesign-the-network-placement`: Redesign the network placement of the workloads. The architect designs the placement outside the draft (for example the cluster in an existing Network Area network of the target environment, or the workloads on servers in the drafted networks); the drafted network is replaced by that design. The draft carries none of it, and the network's step stays held. **Trade-off:** a person carries it out: the answer frees only the manual step that does; in this run it frees no step. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242, read 2026-10-26: `id` (String) ID of the STACKIT Network Area (SNA) network into which the cluster will be deployed. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29, read 2026-10-23: network_id (String) The network ID to which the network interface is associated. - `accept-the-consumers-outside-the-network`: Accept that the drafted network holds none of the source's consumers of its subnet. The network is applied as the draft writes it, and none of the consumers the record names is placed in it: the cluster is created without network.id as drafted (which network then holds its nodes is not stated by the sources read), a load balancer takes the network its variable is set to, and a managed database or cache admits the clients of its access list. The source's placement of these workloads in the subnet is not kept; a person accepts that difference, and whether the network's range is still needed is decided with it. **Trade-off:** the draft already carries it out, so the answer frees the steps that wait for it; in this run it frees 1 step by itself. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L67, read 2026-10-26: `network` (Attributes) Network block as defined below. (listed under Optional) - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242, read 2026-10-26: `id` (String) ID of the STACKIT Network Area (SNA) network into which the cluster will be deployed. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (4) - the source splits these workloads over subnets, and STACKIT places them differently: an SKE cluster is deployed into one network (network.id) and its node pools state no network, a managed database, cache or broker takes an access list and no network id; no one-to-one placement of the consumers in stackit_network.vpc_vpc_private follows from the source, so the network's step waits for the decision - for each source consumer the record names (an ECS service, a cluster, a load balancer, a database, cache or broker): the STACKIT network it is placed in, or the access list that admits its clients, in the layout chosen - for a Kubernetes cluster: the STACKIT Network Area network its network.id names, and that the target project can use it; the task-level subnet split of the source has no counterpart in the cluster - for a network that holds none of its consumers after the choice: whether its address range is still needed **Plan decisions** (1) - alias `convert:module.vpc.module.vpc.aws_subnet.private:network:WORKLOAD_PLACEMENT` **Affected units** (1) - `module.vpc.module.vpc.aws_subnet.private` ## Plan decisions · stackitlogs (1 record, 1 open items, 0 accepted; status open) ### retention_over_180_days (1 record) #### DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS Why: The plan of the draft lists the question "Decide how logs are kept beyond 180 days" as open (1 plan decision): a person decides it, and nothing the plan states about it is carried until it is decided. | Field | Value | |---|---| | Kind | `retention_over_180_days` | | Source | plan decisions of the draft | | Family | stackitlogs | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | technical validation passed | | Owner role | Platform Architect | | Required by phase | before the cutover | | Blocking effect | the target design stays open: a field of the draft waits for this decision | | Plan decisions | 1 | | Affected units | 1 | | Affected applications | 0 | | Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: carts, catalog, checkout, orders, ui | | Wave | wave 1 · steps in platform services | | What an answer frees | The answer that frees most frees 1 step by itself; 1 of the 2 steps it holds stay held whatever is decided (the plan does not let them run). | | Approval | not approved: no decisions file was given with this run | | Options | 2, listed below | | Recommended option | `set-retention-within-the-platform-range` | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:7098dc52d2c6183a8387b8e707e8001532ae3f4483e9dbd7a0e4f826acc8a0ff` | **Options** (2) Options come from the knowledge base (decision-kinds.yaml; knowledge-base evidence, not in this folder), each with the sources it rests on. Choosing one in the decisions file changes no draft, no target-plan.json and no class, confidence or eligibility; its execution effect decides what the answer does to the step of the execution plan that waits for the decision: an option the draft already carries out frees it, an option that changes the draft keeps it held until the draft is regenerated with that option, and an option with no stated effect frees nothing. - `set-retention-within-the-platform-range`: Keep the logs for the 180 days of the Logs instance only. **DEFAULT (change if wrong):** the draft carries this option out and the record stays open. Nobody answered it: confirm it with a review that names it, or choose another option. The Logs instance is applied as the draft writes it, with a retention of 180 days (the API accepts 1 to 180 days and the FAQ states that retention beyond 180 days is not supported). Logs older than 180 days are not kept by it and no archive is configured, so the retention the source keeps beyond 180 days is not carried. No step is added. **Trade-off:** the draft already carries it out, so the answer frees the steps that wait for it; in this run it frees no step. - SOURCE_CODE_VERIFIED, https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/logs/v1/logs.json#L164-L169, read 2026-10-12: CreateLogsInstancePayload.retentionDays: "The log retention time in days.", format int32, maximum 180, minimum 1; required with displayName - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/, read 2026-10-12: Can I extend the retention period of "Logs" beyond 180 days? No. As the Logs-Service is a fully managed service, we do not support individual retention configurations beyond 180 days. - `archive-longer-retention-elsewhere`: For the period beyond 180 days, also stream the logs to long-term storage. The Logs instance keeps at most 180 days and is applied as the draft writes it. The FAQ recommends a cold-storage approach for longer periods: stream the log data in parallel to a long-term storage such as a separate Object Storage bucket. The plan holds a step for it that a person carries out (the archive store, the stream and the retention of the archive are not generated); choosing this option takes that step. A requirement of more than 180 days inside STACKIT Logs with no external archive cannot be met by STACKIT Logs alone: it is stated by rejecting this option. **Trade-off:** a person carries it out: the answer frees only the manual step that does; in this run it frees 1 step by itself. - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/, read 2026-10-12: For long-term retention (e.g., 1 year or more), we recommend implementing a "Cold Storage" strategy. The Approach: Stream your log data to a low-cost long-term storage solution (such as a separate Object Storage bucket) in parallel to sending it to "STACKIT Logs". **Required evidence (the plan's reasons, then what the knowledge base asks for)** (2) - the source keeps its logs for ever and a STACKIT Logs instance keeps at most 180 days, so the instance drafted for it (stackit_logs_instance.logs_retention_180d) holds only the last 180 days; logs older than that exist only if a person configures an archive beside it. Choose the archive if the workload needs them; reject it if the requirement is that more than 180 days stay inside STACKIT Logs with no external archive, which STACKIT Logs alone cannot meet - the retention period, in days, the workload's logs need, and whether an archive outside STACKIT Logs is accepted for the period beyond 180 days **Plan decisions** (1) - alias `stackitlogs:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks:retention_over_180_days` **Affected units** (1) - `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks` ## Plan decisions · stackitroute (1 record, 1 open items, 0 accepted; status open) ### nat fixed egress address lost (1 record) #### DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST Why: The plan of the draft lists the question "Decide the outbound address of the servers an allow-list names" as open (1 plan decision): a person decides it, and nothing the plan states about it is carried until it is decided. | Field | Value | |---|---| | Kind | `nat fixed egress address lost` | | Source | plan decisions of the draft | | Family | stackitroute | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | technical validation passed | | Owner role | Network Architect | | Required by phase | before the pilot | | Blocking effect | the target design stays open: a field of the draft waits for this decision | | Plan decisions | 1 | | Affected units | 1 | | Affected applications | 0 | | Applications touched | none: no applications file was given and no suggested group holds an affected unit | | Wave | not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in prepare | | What an answer frees | The answer that frees most frees 1 step by itself; 7 of the 8 steps it holds stay held whatever is decided (the plan does not let them run). | | Approval | not approved: no decisions file was given with this run | | Options | 2, listed below | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:cbfcbf1e12e98cb3608485caffc5de82e33e3517a0845fc9ca14cbcf7e207d0e` | **Options** (2) Options come from the knowledge base (decision-kinds.yaml; knowledge-base evidence, not in this folder), each with the sources it rests on. Choosing one in the decisions file changes no draft, no target-plan.json and no class, confidence or eligibility; its execution effect decides what the answer does to the step of the execution plan that waits for the decision: an option the draft already carries out frees it, an option that changes the draft keeps it held until the draft is regenerated with that option, and an option with no stated effect frees nothing. - `accept-the-platform-egress-address`: Accept the address STACKIT assigns to the network for outbound traffic. Outbound traffic of servers without a public IP leaves through source NAT with the public IP STACKIT creates and assigns to the project's Virtual Networks, not with an address the owner chose. A destination allow-list that names the source's fixed NAT address does not match it. **Trade-off:** the draft already carries it out, so the answer frees the steps that wait for it; in this run it frees 1 step by itself. - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/, read 2026-10-12: Every subnet is routed to the public internet. Technically this is done by source NAT (SNAT) in combination with masquerading. When creating the first network in a public project, STACKIT automatically creates and assigns a public IP for all Virtual Networks. It supports outbound internet access but does not allow traffic initiated from the public internet to reach your resources. - `reserve-a-public-ip-per-server`: Give each server that an allow-list names a STACKIT public IP. A stackit_public_ip is reserved and associated with the network interface of each such server (network_interface_id of stackit_public_ip, or stackit_public_ip_associate). The pages read do not state which source address the outbound connections of such a server then use; confirm it on the target before relying on it. **Trade-off:** it changes the draft: the draft is generated again with it, and the steps stay held until then; in this run it frees no step. - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.116.0/docs/resources/public_ip.md#L35, read 2026-10-12: network_interface_id (String) Associates the public IP with a network interface or a virtual IP (ID). - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.116.0/docs/resources/public_ip_associate.md#L13, read 2026-10-12: Associates an existing public IP to a network interface. This is useful for situations where you have a pre-allocated public IP or unable to use the stackit_public_ip resource to create a new public IP. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (2) - a NAT gateway's fixed egress address is lost on STACKIT: the address a routed network leaves by is the network's own, shared by every routed network of the project, not fixed and not settable - the servers whose outbound address a destination allow-list names, and the allow-lists that name it **Plan decisions** (1) - alias `stackitroute:module.vpc.module.vpc.aws_route_table.private:NAT_FIXED_EGRESS_ADDRESS_LOST` **Affected units** (1) - `module.vpc.module.vpc.aws_route_table.private` ## Critical semantics · aws.cloudwatch_log_group (1 record, 1 open items, 0 accepted; status open) ### module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (1 record) #### DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-CLOUDWATCH-LOG-GROUP-ECS-TASKS Why: The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.cloudwatch_log_group | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Owner role | Platform Architect | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Affected applications | 0 | | Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: carts, catalog, checkout, orders, ui | | Wave | wave 1 · steps in platform services | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:e71bb0607c0a5ebb2ed51336e2dafb83d87e2ea428ba9c2c59f10bff5d5552d6` | **Settings** (1) - **Confirm the name of the log group** (`tc-name`, record before the settings of a unit were one record: `DEC-OPS-AWS-CLOUDWATCH-LOG-GROUP-TC-NAME`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "the name of the CloudWatch log group" of the aws.cloudwatch_log_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Carry out the manual work the plan names for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks outside the draft; the plan states no title for it. **Open critical semantics (unit and semantic)** (1) - `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks|tc-name` **Affected units** (1) - `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks` ## Critical semantics · aws.dynamodb_table (3 records, 6 open items, 0 accepted; status open) Every record under this heading states the same for these fields, and its table does not repeat them: | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.dynamodb_table | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Affected applications | 0 | | Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: carts, checkout | | Wave | wave 1 · steps in data services | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | ### module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (3 records) #### DEC-DATA-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE Why: The knowledge base cannot decide 3 critical settings of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-data-architect. | Field | Value | |---|---| | Owner role | Data Architect | | Open critical semantics (unit and semantic) | 3 | | Affected units | 1 | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:be230134eb933993e87d2acca45d6600aaef296e10ea3f5acfe1bc2868503c4c` | **Settings** (3) - **Review the key schema setting** (`key-schema`, record before the settings of a unit were one record: `DEC-DATA-AWS-DYNAMODB-TABLE-KEY-SCHEMA`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "key-schema" of the aws.dynamodb_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Carry out the manual work the plan names for module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this outside the draft; the plan states no title for it. - **Review the point in time recovery setting** (`point-in-time-recovery`, record before the settings of a unit were one record: `DEC-DATA-AWS-DYNAMODB-TABLE-POINT-IN-TIME-RECOVERY`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "point-in-time-recovery" of the aws.dynamodb_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the point in time recovery setting for module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the TTL setting** (`ttl`, record before the settings of a unit were one record: `DEC-DATA-AWS-DYNAMODB-TABLE-TTL`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "ttl" of the aws.dynamodb_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the TTL setting for module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (3) - `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|key-schema` - `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|point-in-time-recovery` - `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|ttl` **Affected units** (1) - `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this` #### DEC-OPS-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE Why: The knowledge base cannot decide 2 critical settings of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-platform-architect. | Field | Value | |---|---| | Owner role | Platform Architect | | Open critical semantics (unit and semantic) | 2 | | Affected units | 1 | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:376e1fb33723b9c06d87ddd508b5b8413291ae6a06d048c7410dbf9c03e42876` | **Settings** (2) - **Review the index projection and name setting** (`index-projection-and-name`, record before the settings of a unit were one record: `DEC-OPS-AWS-DYNAMODB-TABLE-INDEX-PROJECTION-AND-NAME`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "index-projection-and-name" of the aws.dynamodb_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the index projection and name setting for module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the name of the DynamoDB table** (`tc-dynamodb-table-name`, record before the settings of a unit were one record: `DEC-OPS-AWS-DYNAMODB-TABLE-TC-DYNAMODB-TABLE-NAME`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "the name of the DynamoDB table" of the aws.dynamodb_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Verify on the target for module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this: the check, proof or closing evidence is recorded with its result. **Open critical semantics (unit and semantic)** (2) - `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|index-projection-and-name` - `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|tc-dynamodb-table-name` **Affected units** (1) - `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this` #### DEC-SEC-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE Why: The knowledge base cannot decide 1 critical setting of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. | Field | Value | |---|---| | Owner role | Security Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:d1f3a830429052e0e3744c4e3ab5b71cad9aa7b33241a35e16b57107591f512f` | **Settings** (1) - **Review the encryption at rest setting** (`encryption-at-rest`, record before the settings of a unit were one record: `DEC-SEC-AWS-DYNAMODB-TABLE-ENCRYPTION-AT-REST`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "encryption-at-rest" of the aws.dynamodb_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the encryption at rest setting for module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (1) - `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this|encryption-at-rest` **Affected units** (1) - `module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this` ## Critical semantics · aws.ecs (25 records, 76 open items, 0 accepted; status open) Every record under this heading states the same for these fields, and its table does not repeat them: | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.ecs | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Affected applications | 0 | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | **Settings that recur under this heading** (15). A record that lists one of them names it and its next step; the setting is said here: - **Review the task definition setting** (`task-definition`, record before the settings of a unit were one record: `DEC-GEN-AWS-ECS-TASK-DEFINITION`) - Why: The knowledge base cannot decide "task-definition" of the aws.ecs contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Review the service execute command setting** (`service-execute-command`, record before the settings of a unit were one record: `DEC-IAM-AWS-ECS-SERVICE-EXECUTE-COMMAND`) - Why: The knowledge base cannot decide "service-execute-command" of the aws.ecs contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Review the service task definition setting** (`service-task-definition`, record before the settings of a unit were one record: `DEC-IAM-AWS-ECS-SERVICE-TASK-DEFINITION`) - Why: The knowledge base cannot decide "service-task-definition" of the aws.ecs contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Confirm the execution role ARN of the ECS task definition** (`td-execution-role-arn`, record before the settings of a unit were one record: `DEC-IAM-AWS-ECS-TD-EXECUTION-ROLE-ARN`) - Why: The knowledge base cannot decide "the execution role ARN of the ECS task definition" of the aws.ecs contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Confirm the task role ARN of the ECS task definition** (`td-task-role-arn`, record before the settings of a unit were one record: `DEC-IAM-AWS-ECS-TD-TASK-ROLE-ARN`) - Why: The knowledge base cannot decide "the task role ARN of the ECS task definition" of the aws.ecs contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Review the service connect values setting** (`service-connect-values`, record before the settings of a unit were one record: `DEC-NET-AWS-ECS-SERVICE-CONNECT-VALUES`) - Why: The knowledge base cannot decide "service-connect-values" of the aws.ecs contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Review the service discovery setting** (`service-discovery`, record before the settings of a unit were one record: `DEC-NET-AWS-ECS-SERVICE-DISCOVERY`) - Why: The knowledge base cannot decide "service-discovery" of the aws.ecs contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Review the service network placement setting** (`service-network-placement`, record before the settings of a unit were one record: `DEC-NET-AWS-ECS-SERVICE-NETWORK-PLACEMENT`) - Why: The knowledge base cannot decide "service-network-placement" of the aws.ecs contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Review the service public IP setting setting** (`service-public-ip-setting`, record before the settings of a unit were one record: `DEC-NET-AWS-ECS-SERVICE-PUBLIC-IP-SETTING`) - Why: The knowledge base cannot decide "service-public-ip-setting" of the aws.ecs contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Confirm the network mode of the ECS task definition** (`td-network-mode`, record before the settings of a unit were one record: `DEC-NET-AWS-ECS-TD-NETWORK-MODE`) - Why: The knowledge base cannot decide "the network mode of the ECS task definition" of the aws.ecs contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Review the service desired count setting** (`service-desired-count`, record before the settings of a unit were one record: `DEC-OPS-AWS-ECS-SERVICE-DESIRED-COUNT`) - Why: The knowledge base cannot decide "service-desired-count" of the aws.ecs contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Confirm the container definitions of the ECS task definition** (`td-container-definitions`, record before the settings of a unit were one record: `DEC-SEC-AWS-ECS-TD-CONTAINER-DEFINITIONS`) - Why: The knowledge base cannot decide "the container definitions of the ECS task definition" of the aws.ecs contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Confirm the container image registry** (`td-container-image-registry`, record before the settings of a unit were one record: `DEC-SEC-AWS-ECS-TD-CONTAINER-IMAGE-REGISTRY`) - Why: The knowledge base cannot decide "the container image registry" of the aws.ecs contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Confirm the container plaintext secret env** (`td-container-plaintext-secret-env`, record before the settings of a unit were one record: `DEC-SEC-AWS-ECS-TD-CONTAINER-PLAINTEXT-SECRET-ENV`) - Why: The knowledge base cannot decide "the container plaintext secret env" of the aws.ecs contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Confirm the container secret references** (`td-container-secret-references`, record before the settings of a unit were one record: `DEC-SEC-AWS-ECS-TD-CONTAINER-SECRET-REFERENCES`) - Why: The knowledge base cannot decide "the container secret references" of the aws.ecs contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. ### module.retail_app_ecs.module.carts_service.aws_ecs_service.this (5 records) #### DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS Why: The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.module.carts_service.aws_ecs_service.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-platform-architect. | Field | Value | |---|---| | Owner role | not stated: no rule names a role for this family | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | `carts` (PROPOSED) | | Wave | wave 3 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:5049a4a2c775c1575d3ddd82422180bceb433bf018864e226e722dd02283029d` | **Settings** (1) - **Review the task definition setting** (`task-definition`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the task definition setting for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (1) - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this|task-definition` **Affected units** (1) - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this` #### DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-identity-architect. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `carts` (PROPOSED) | | Wave | wave 3 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:7c029bf6912dd7e466ba3f83acb8125e103ae34e47e23de3a15e3579e13c7302` | **Settings** (4) - **Review the service execute command setting** (`service-execute-command`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service execute command setting for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service task definition setting** (`service-task-definition`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service task definition setting for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the execution role ARN of the ECS task definition** (`td-execution-role-arn`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the execution role ARN of the ECS task definition for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the task role ARN of the ECS task definition** (`td-task-role-arn`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the task role ARN of the ECS task definition for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-execute-command` - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-task-definition` - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-execution-role-arn` - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-task-role-arn` **Affected units** (1) - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this` #### DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS Why: The knowledge base cannot decide 5 critical settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-network-architect. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 5 | | Affected units | 1 | | Applications touched | `carts` (PROPOSED) | | Wave | wave 3 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:2884efd954f2c3166b542350df1a4b1da31abe480928a9ae49c5b5ec6e816f03` | **Settings** (5) - **Review the service connect values setting** (`service-connect-values`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service connect values setting for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service discovery setting** (`service-discovery`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service discovery setting for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service network placement setting** (`service-network-placement`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service network placement setting for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service public IP setting setting** (`service-public-ip-setting`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service public IP setting setting for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the network mode of the ECS task definition** (`td-network-mode`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the network mode of the ECS task definition for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (5) - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-connect-values` - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-discovery` - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-network-placement` - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-public-ip-setting` - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-network-mode` **Affected units** (1) - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this` #### DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS Why: The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.module.carts_service.aws_ecs_service.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-platform-architect. | Field | Value | |---|---| | Owner role | Platform Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | `carts` (PROPOSED) | | Wave | wave 3 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:ad056df0eb4026158ba41d1e9bd51c3acb82966bbafea534e35a1c48bcc88e3c` | **Settings** (1) - **Review the service desired count setting** (`service-desired-count`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service desired count setting for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (1) - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this|service-desired-count` **Affected units** (1) - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this` #### DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect. | Field | Value | |---|---| | Owner role | Security Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `carts` (PROPOSED) | | Wave | wave 3 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:8fc8c7f0b478f96951ae2ef830884975f85854c85e40dc0f90397cfd96fe7297` | **Settings** (4) - **Confirm the container definitions of the ECS task definition** (`td-container-definitions`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container definitions of the ECS task definition for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the container image registry** (`td-container-image-registry`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container image registry for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the container plaintext secret env** (`td-container-plaintext-secret-env`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container plaintext secret env for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the container secret references** (`td-container-secret-references`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container secret references for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-container-definitions` - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-container-image-registry` - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-container-plaintext-secret-env` - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this|td-container-secret-references` **Affected units** (1) - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this` ### module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (5 records) #### DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883 Why: The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-platform-architect. | Field | Value | |---|---| | Owner role | not stated: no rule names a role for this family | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | `catalog` (PROPOSED) | | Wave | wave 7 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:bd5bc5f42f2ccdd48a73d45fd65cc7d9a1889bd33e8ed34e32675b48cd9d43a6` | **Settings** (1) - **Review the task definition setting** (`task-definition`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the task definition setting for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (1) - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|task-definition` **Affected units** (1) - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this` #### DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883 Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-identity-architect. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `catalog` (PROPOSED) | | Wave | wave 7 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:269c883e5118d2289881d64bad4bc6c1a8026b09e6b86d27706930ba115e503d` | **Settings** (4) - **Review the service execute command setting** (`service-execute-command`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service execute command setting for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service task definition setting** (`service-task-definition`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service task definition setting for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the execution role ARN of the ECS task definition** (`td-execution-role-arn`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the execution role ARN of the ECS task definition for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the task role ARN of the ECS task definition** (`td-task-role-arn`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the task role ARN of the ECS task definition for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-execute-command` - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-task-definition` - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-execution-role-arn` - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-task-role-arn` **Affected units** (1) - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this` #### DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883 Why: The knowledge base cannot decide 5 critical settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-network-architect. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 5 | | Affected units | 1 | | Applications touched | `catalog` (PROPOSED) | | Wave | wave 7 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:a7b1d712f11c89a96ee56918ef329084ce43708b20a3f11098a99baba0b9f33c` | **Settings** (5) - **Review the service connect values setting** (`service-connect-values`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service connect values setting for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service discovery setting** (`service-discovery`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service discovery setting for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service network placement setting** (`service-network-placement`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service network placement setting for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service public IP setting setting** (`service-public-ip-setting`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service public IP setting setting for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the network mode of the ECS task definition** (`td-network-mode`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the network mode of the ECS task definition for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (5) - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-connect-values` - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-discovery` - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-network-placement` - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-public-ip-setting` - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-network-mode` **Affected units** (1) - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this` #### DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883 Why: The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-platform-architect. | Field | Value | |---|---| | Owner role | Platform Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | `catalog` (PROPOSED) | | Wave | wave 7 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:73e2e43b1b9a4861741108c4c531cf9c63a53c75ee5e01b4b73dff8acf27e7f2` | **Settings** (1) - **Review the service desired count setting** (`service-desired-count`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service desired count setting for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (1) - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|service-desired-count` **Affected units** (1) - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this` #### DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883 Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect. | Field | Value | |---|---| | Owner role | Security Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `catalog` (PROPOSED) | | Wave | wave 7 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:12a0c54a0723669691b414ab9cfc18d1b7c1a075bd4a331607a44ac5ce805152` | **Settings** (4) - **Confirm the container definitions of the ECS task definition** (`td-container-definitions`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container definitions of the ECS task definition for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the container image registry** (`td-container-image-registry`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container image registry for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the container plaintext secret env** (`td-container-plaintext-secret-env`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container plaintext secret env for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the container secret references** (`td-container-secret-references`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container secret references for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-container-definitions` - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-container-image-registry` - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-container-plaintext-secret-env` - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this|td-container-secret-references` **Affected units** (1) - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this` ### module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (5 records) #### DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6 Why: The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-platform-architect. | Field | Value | |---|---| | Owner role | not stated: no rule names a role for this family | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | `checkout` (PROPOSED) | | Wave | wave 8 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:623898041d449cd3e3c2d56f8809be431447e9c525cd8532005e86be1b16a734` | **Settings** (1) - **Review the task definition setting** (`task-definition`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the task definition setting for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (1) - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|task-definition` **Affected units** (1) - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` #### DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6 Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-identity-architect. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `checkout` (PROPOSED) | | Wave | wave 8 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:b6de1150e6debd14d0a9aa3604ac089dfcfeba7948cdbead286de7bd9595abde` | **Settings** (4) - **Review the service execute command setting** (`service-execute-command`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service execute command setting for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service task definition setting** (`service-task-definition`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service task definition setting for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the execution role ARN of the ECS task definition** (`td-execution-role-arn`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the execution role ARN of the ECS task definition for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the task role ARN of the ECS task definition** (`td-task-role-arn`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the task role ARN of the ECS task definition for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-execute-command` - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-task-definition` - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-execution-role-arn` - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-task-role-arn` **Affected units** (1) - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` #### DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6 Why: The knowledge base cannot decide 5 critical settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-network-architect. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 5 | | Affected units | 1 | | Applications touched | `checkout` (PROPOSED) | | Wave | wave 8 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:182803b416e449e90a1a14eb9db44d8d5c0bef7a7f4e34722f4e90a13b95e587` | **Settings** (5) - **Review the service connect values setting** (`service-connect-values`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service connect values setting for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service discovery setting** (`service-discovery`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service discovery setting for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service network placement setting** (`service-network-placement`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service network placement setting for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service public IP setting setting** (`service-public-ip-setting`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service public IP setting setting for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the network mode of the ECS task definition** (`td-network-mode`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the network mode of the ECS task definition for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (5) - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-connect-values` - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-discovery` - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-network-placement` - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-public-ip-setting` - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-network-mode` **Affected units** (1) - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` #### DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6 Why: The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-platform-architect. | Field | Value | |---|---| | Owner role | Platform Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | `checkout` (PROPOSED) | | Wave | wave 8 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:2a81745ad63beb643a056962323f1bed54efeeb2e2761acae2698f863e5ffbb2` | **Settings** (1) - **Review the service desired count setting** (`service-desired-count`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service desired count setting for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (1) - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|service-desired-count` **Affected units** (1) - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` #### DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6 Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-security-architect. | Field | Value | |---|---| | Owner role | Security Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `checkout` (PROPOSED) | | Wave | wave 8 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:e14fe5e69f14c70daaa5e1cb8fb1b01b17f0cf1b730d6634665513ae538a7be6` | **Settings** (4) - **Confirm the container definitions of the ECS task definition** (`td-container-definitions`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container definitions of the ECS task definition for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the container image registry** (`td-container-image-registry`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container image registry for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the container plaintext secret env** (`td-container-plaintext-secret-env`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container plaintext secret env for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the container secret references** (`td-container-secret-references`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container secret references for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-container-definitions` - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-container-image-registry` - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-container-plaintext-secret-env` - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this|td-container-secret-references` **Affected units** (1) - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` ### module.retail_app_ecs.module.orders_service.aws_ecs_service.this (5 records) #### DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS Why: The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.module.orders_service.aws_ecs_service.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-platform-architect. | Field | Value | |---|---| | Owner role | not stated: no rule names a role for this family | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 7 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:c0df273c3ce35360ad2de7275bf8232309dfe3548560c2d2bf71e5f5209e4108` | **Settings** (1) - **Review the task definition setting** (`task-definition`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the task definition setting for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (1) - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this|task-definition` **Affected units** (1) - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this` #### DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-identity-architect. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 7 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:9355891040e968a2302882459fd2e541f14ac72d084e886cfe7bd6401c5668d1` | **Settings** (4) - **Review the service execute command setting** (`service-execute-command`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service execute command setting for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service task definition setting** (`service-task-definition`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service task definition setting for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the execution role ARN of the ECS task definition** (`td-execution-role-arn`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the execution role ARN of the ECS task definition for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the task role ARN of the ECS task definition** (`td-task-role-arn`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the task role ARN of the ECS task definition for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-execute-command` - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-task-definition` - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-execution-role-arn` - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-task-role-arn` **Affected units** (1) - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this` #### DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS Why: The knowledge base cannot decide 5 critical settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-network-architect. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 5 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 7 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:c3fbe4584e6bfa97ed29b1ba37ed5b2284ee1bf2f21e5df2d762845bfcc9bcce` | **Settings** (5) - **Review the service connect values setting** (`service-connect-values`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service connect values setting for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service discovery setting** (`service-discovery`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service discovery setting for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service network placement setting** (`service-network-placement`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service network placement setting for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service public IP setting setting** (`service-public-ip-setting`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service public IP setting setting for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the network mode of the ECS task definition** (`td-network-mode`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the network mode of the ECS task definition for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (5) - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-connect-values` - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-discovery` - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-network-placement` - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-public-ip-setting` - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-network-mode` **Affected units** (1) - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this` #### DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS Why: The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.module.orders_service.aws_ecs_service.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-platform-architect. | Field | Value | |---|---| | Owner role | Platform Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 7 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:a99af72e26244afeba9183b468016c2f97d481f9ef9e344f8b0cd66bc4f96e85` | **Settings** (1) - **Review the service desired count setting** (`service-desired-count`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service desired count setting for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (1) - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this|service-desired-count` **Affected units** (1) - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this` #### DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect. | Field | Value | |---|---| | Owner role | Security Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 7 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:be34e739bc39a8d7f9a75ec54e4a06207f7b84000f5f784e735bcc8fac34a2be` | **Settings** (4) - **Confirm the container definitions of the ECS task definition** (`td-container-definitions`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container definitions of the ECS task definition for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the container image registry** (`td-container-image-registry`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container image registry for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the container plaintext secret env** (`td-container-plaintext-secret-env`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container plaintext secret env for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the container secret references** (`td-container-secret-references`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container secret references for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-container-definitions` - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-container-image-registry` - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-container-plaintext-secret-env` - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this|td-container-secret-references` **Affected units** (1) - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this` ### module.retail_app_ecs.module.ui_service.aws_ecs_service.this (5 records) #### DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS Why: The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.module.ui_service.aws_ecs_service.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-platform-architect. | Field | Value | |---|---| | Owner role | not stated: no rule names a role for this family | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | `ui` (PROPOSED) | | Wave | wave 9 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:cd84cdba0aa722b0700f256589172631f462ab3a79939d8703d4dcf136e51830` | **Settings** (1) - **Review the task definition setting** (`task-definition`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the task definition setting for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (1) - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this|task-definition` **Affected units** (1) - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this` #### DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-identity-architect. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `ui` (PROPOSED) | | Wave | wave 9 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:13b648f793c6330d876e75b4a9e7de9a954b1465c6fd5e915538b738c05650ba` | **Settings** (4) - **Review the service execute command setting** (`service-execute-command`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service execute command setting for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service task definition setting** (`service-task-definition`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service task definition setting for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the execution role ARN of the ECS task definition** (`td-execution-role-arn`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the execution role ARN of the ECS task definition for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the task role ARN of the ECS task definition** (`td-task-role-arn`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the task role ARN of the ECS task definition for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-execute-command` - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-task-definition` - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-execution-role-arn` - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-task-role-arn` **Affected units** (1) - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this` #### DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS Why: The knowledge base cannot decide 6 critical settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 6 | | Affected units | 1 | | Applications touched | `ui` (PROPOSED) | | Wave | wave 9 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:a803971360a7c14f2d1f59ef457345625b6b24b4ab02a4c951935921fa6b197c` | **Settings** (6) - **Review the service connect values setting** (`service-connect-values`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service connect values setting for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service discovery setting** (`service-discovery`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service discovery setting for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service load balancer target setting** (`service-load-balancer-target`, record before the settings of a unit were one record: `DEC-NET-AWS-ECS-SERVICE-LOAD-BALANCER-TARGET`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "service-load-balancer-target" of the aws.ecs contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the service load balancer target setting for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service network placement setting** (`service-network-placement`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service network placement setting for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the service public IP setting setting** (`service-public-ip-setting`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service public IP setting setting for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the network mode of the ECS task definition** (`td-network-mode`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the network mode of the ECS task definition for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (6) - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-connect-values` - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-discovery` - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-load-balancer-target` - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-network-placement` - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-public-ip-setting` - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-network-mode` **Affected units** (1) - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this` #### DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS Why: The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.module.ui_service.aws_ecs_service.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-platform-architect. | Field | Value | |---|---| | Owner role | Platform Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | `ui` (PROPOSED) | | Wave | wave 9 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:892d8be364574bea145cb905c22d892bdcf013b62b24306a5e72cfd27f92bb59` | **Settings** (1) - **Review the service desired count setting** (`service-desired-count`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the service desired count setting for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (1) - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this|service-desired-count` **Affected units** (1) - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this` #### DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-security-architect. | Field | Value | |---|---| | Owner role | Security Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `ui` (PROPOSED) | | Wave | wave 9 · steps in platform services | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:e4bca6f80507db70550fa30296dcb1663d180045b12ab84aef82f90af4d4591f` | **Settings** (4) - **Confirm the container definitions of the ECS task definition** (`td-container-definitions`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container definitions of the ECS task definition for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the container image registry** (`td-container-image-registry`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container image registry for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the container plaintext secret env** (`td-container-plaintext-secret-env`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container plaintext secret env for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the container secret references** (`td-container-secret-references`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Confirm the container secret references for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-container-definitions` - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-container-image-registry` - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-container-plaintext-secret-env` - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this|td-container-secret-references` **Affected units** (1) - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this` ## Critical semantics · aws.eip (1 record, 1 open items, 0 accepted; status open) ### module.vpc.module.vpc.aws_eip.nat (1 record) #### DEC-NET-MODULE-VPC-MODULE-VPC-AWS-EIP-NAT Why: The knowledge base cannot decide 1 critical setting of module.vpc.module.vpc.aws_eip.nat: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.eip | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Owner role | Network Architect | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Affected applications | 0 | | Applications touched | none: no applications file was given and no suggested group holds an affected unit | | Wave | wave 1 · steps in foundation | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:8d53b9492e347facc4402eb7bb6e29a11778a63c708b92d5e683cc85fb10dcd9` | **Settings** (1) - **Review the public address setting** (`public-address`, record before the settings of a unit were one record: `DEC-NET-AWS-EIP-PUBLIC-ADDRESS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "public-address" of the aws.eip contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Carry out the manual work the plan names for module.vpc.module.vpc.aws_eip.nat outside the draft; the plan states no title for it. **Open critical semantics (unit and semantic)** (1) - `module.vpc.module.vpc.aws_eip.nat|public-address` **Affected units** (1) - `module.vpc.module.vpc.aws_eip.nat` ## Critical semantics · aws.elasticache (4 records, 9 open items, 0 accepted; status open) Every record under this heading states the same for these fields, and its table does not repeat them: | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.elasticache | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Affected applications | 0 | | Applications touched | `checkout` (PROPOSED) | | Wave | wave 4 · steps in data services | | Approval | not approved: no decisions file was given with this run | | Recommended option | none | ### module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (4 records) #### DEC-DATA-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374 Why: The knowledge base cannot decide 2 critical settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-data-architect. | Field | Value | |---|---| | Owner role | Data Architect | | Open critical semantics (unit and semantic) | 2 | | Affected units | 1 | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:a81099a7a19d0a70e93099ba046b0f6ffe0b067d5d7d330a726223a11b4a8a71` | **Settings** (2) - **Review the seed snapshot setting** (`seed-snapshot`, record before the settings of a unit were one record: `DEC-DATA-AWS-ELASTICACHE-SEED-SNAPSHOT`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "seed-snapshot" of the aws.elasticache contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the seed snapshot setting for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the snapshots off setting** (`snapshots-off`, record before the settings of a unit were one record: `DEC-DATA-AWS-ELASTICACHE-SNAPSHOTS-OFF`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "snapshots-off" of the aws.elasticache contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the snapshots off setting for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (2) - `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|seed-snapshot` - `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|snapshots-off` **Affected units** (1) - `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` #### DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374 Why: The knowledge base cannot decide 1 critical setting of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:6a0885338cdc784fa0469bff7f3e328048bdf0779f8fe6695463e4f84db89ece` | **Settings** (1) - **Review the network placement setting** (`network-placement`, record before the settings of a unit were one record: `DEC-NET-AWS-ELASTICACHE-NETWORK-PLACEMENT`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "network-placement" of the aws.elasticache contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Carry out the manual work the plan names for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default outside the draft; the plan states no title for it. **Open critical semantics (unit and semantic)** (1) - `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|network-placement` **Affected units** (1) - `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` #### DEC-OPS-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374 Why: The knowledge base cannot decide 4 critical settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect. | Field | Value | |---|---| | Owner role | Platform Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:22903c56db5911aeb017374334c4c459471b44cc52549e1be5fc3e282b7f0382` | **Settings** (4) - **Review the failover off setting** (`failover-off`, record before the settings of a unit were one record: `DEC-OPS-AWS-ELASTICACHE-FAILOVER-OFF`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "failover-off" of the aws.elasticache contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the failover off setting for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the parameter group setting** (`parameter-group`, record before the settings of a unit were one record: `DEC-OPS-AWS-ELASTICACHE-PARAMETER-GROUP`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "parameter-group" of the aws.elasticache contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Carry out the manual work the plan names for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default outside the draft; the plan states no title for it. - **Review the parameter group default setting** (`parameter-group-default`, record before the settings of a unit were one record: `DEC-OPS-AWS-ELASTICACHE-PARAMETER-GROUP-DEFAULT`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "parameter-group-default" of the aws.elasticache contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Verify on the target for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: the check, proof or closing evidence is recorded with its result. - **Confirm the replication group ID of the ElastiCache replication group** (`tc-elasticache-replication-group-replication-group-id`, record before the settings of a unit were one record: `DEC-OPS-AWS-ELASTICACHE-TC-ELASTICACHE-REPLICATION-GROUP-REPLIC-D383F7A4`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "the replication group ID of the ElastiCache replication group" of the aws.elasticache contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Verify on the target for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: the check, proof or closing evidence is recorded with its result. **Open critical semantics (unit and semantic)** (4) - `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|failover-off` - `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|parameter-group` - `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|parameter-group-default` - `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|tc-elasticache-replication-group-replication-group-id` **Affected units** (1) - `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` #### DEC-SEC-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374 Why: The knowledge base cannot decide 2 critical settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-security-architect. | Field | Value | |---|---| | Owner role | Security Architect | | Open critical semantics (unit and semantic) | 2 | | Affected units | 1 | | Options | the options are those of the settings: 1 setting of them list options, below | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:7a84420d04b71d9952e3521b09fbde28030d59bd2678d039f0ea48f4d8c6eec5` | **Settings** (2) - **Review the at rest encryption off setting** (`at-rest-encryption-off`, record before the settings of a unit were one record: `DEC-SEC-AWS-ELASTICACHE-AT-REST-ENCRYPTION-OFF`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "at-rest-encryption-off" of the aws.elasticache contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the at rest encryption off setting for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the transit encryption enabled setting of the ElastiCache replication group** (`tcp-elasticache-replication-group-transit-encryption-enabled`, record before the settings of a unit were one record: `DEC-SEC-AWS-ELASTICACHE-TCP-ELASTICACHE-REPLICATION-GROUP-TRANS-B5C85484`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "the transit encryption enabled setting of the ElastiCache replication group" of the aws.elasticache contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Verify on the target for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: the check, proof or closing evidence is recorded with its result. - Option `clients-connect-with-tls`: Switch every client to TLS against the Key Value Store. The clients connect to the instance with TLS (the migration tutorial uses the --tls option, and a public SwissSign certificate that modern systems trust, or the SwissSign root and intermediate certificates passed to the client). Whether the instance also accepts a connection without TLS is not stated in the pages read, so the customer checks it on the instance and does not rely on the platform to refuse a plain connection. A review records the choice and closes no critical setting by itself. **Trade-off:** its effect on the steps is not stated: an answer frees nothing. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (2) - an observation on a STACKIT instance (or STACKIT's statement) of whether a connection without TLS is accepted, since the pages read do not state it - the clients of the cache and whether each can connect with TLS (and verify the certificate) **Open critical semantics (unit and semantic)** (2) - `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|at-rest-encryption-off` - `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|tcp-elasticache-replication-group-transit-encryption-enabled` **Affected units** (1) - `module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` ## Critical semantics · aws.iam_role (10 records, 40 open items, 0 accepted; status open) Every record under this heading states the same for these fields, and its table does not repeat them: | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.iam_role | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Affected applications | 0 | | Approval | not approved: no decisions file was given with this run | | Options | the options are those of the settings: 1 setting of them list options, below | | Recommended option | none | **Settings that recur under this heading** (5). A record that lists one of them names it and its next step; the setting is said here: - **Review the IAM managed ECS setting** (`iam-managed-ecs`, record before the settings of a unit were one record: `DEC-IAM-AWS-IAM-ROLE-IAM-MANAGED-ECS`) - Why: The knowledge base cannot decide "iam-managed-ecs" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Review the IAM trust service workload setting** (`iam-trust-service-workload`, record before the settings of a unit were one record: `DEC-IAM-AWS-IAM-ROLE-IAM-TRUST-SERVICE-WORKLOAD`) - Why: The knowledge base cannot decide "iam-trust-service-workload" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Translate the IAM permissions into STACKIT roles** (`permissions`, record before the settings of a unit were one record: `DEC-IAM-AWS-IAM-ROLE-PERMISSIONS`) - Why: The knowledge base cannot decide "permissions" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Option `bind-minimum-stackit-roles`: Bind the minimum STACKIT roles the workload needs to the account. A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing. **Trade-off:** its effect on the steps is not stated: an answer frees nothing. - **Decide who may assume each IAM role** (`trust`, record before the settings of a unit were one record: `DEC-IAM-AWS-IAM-ROLE-TRUST`) - Why: The knowledge base cannot decide "trust" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Review the IAM managed customer policy setting** (`iam-managed-customer-policy`, record before the settings of a unit were one record: `DEC-IAM-AWS-IAM-ROLE-IAM-MANAGED-CUSTOMER-POLICY`) - Why: The knowledge base cannot decide "iam-managed-customer-policy" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. ### module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role (1 record) #### DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885 Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `carts` (PROPOSED) | | Wave | wave 1 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:854ada05e50ac04e13e60fc48160978911c675e9023d17869e5df35f06130e06` | **Settings** (4) - **Review the IAM managed ECS setting** (`iam-managed-ecs`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the IAM managed ECS setting for module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the IAM trust service workload setting** (`iam-trust-service-workload`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role: the check, proof or closing evidence is recorded with its result. - **Translate the IAM permissions into STACKIT roles** (`permissions`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it. - **Decide who may assume each IAM role** (`trust`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (2) - the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it - who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies) **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role|iam-managed-ecs` - `module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role|iam-trust-service-workload` - `module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role|permissions` - `module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role|trust` **Affected units** (1) - `module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role` ### module.retail_app_ecs.module.carts_service.aws_iam_role.task_role (1 record) #### DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `carts` (PROPOSED) | | Wave | wave 2 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:51ceb0018ab2bfda815b7e25eead649fca3447af44bcb92f28bf7b0af815f4a4` | **Settings** (4) - **Review the IAM managed customer policy setting** (`iam-managed-customer-policy`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.carts_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result. - **Review the IAM trust service workload setting** (`iam-trust-service-workload`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.carts_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result. - **Translate the IAM permissions into STACKIT roles** (`permissions`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.carts_service.aws_iam_role.task_role outside the draft; the plan states no title for it. - **Decide who may assume each IAM role** (`trust`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.carts_service.aws_iam_role.task_role outside the draft; the plan states no title for it. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (2) - the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it - who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies) **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|iam-managed-customer-policy` - `module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|iam-trust-service-workload` - `module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|permissions` - `module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|trust` **Affected units** (1) - `module.retail_app_ecs.module.carts_service.aws_iam_role.task_role` ### module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role (1 record) #### DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913 Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `catalog` (PROPOSED) | | Wave | wave 6 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:473be156256464a573dc12f091fa5a8c4239899c98d3c87587560d5613b7f301` | **Settings** (4) - **Review the IAM managed ECS setting** (`iam-managed-ecs`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the IAM managed ECS setting for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the IAM trust service workload setting** (`iam-trust-service-workload`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role: the check, proof or closing evidence is recorded with its result. - **Translate the IAM permissions into STACKIT roles** (`permissions`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it. - **Decide who may assume each IAM role** (`trust`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (2) - the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it - who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies) **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role|iam-managed-ecs` - `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role|iam-trust-service-workload` - `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role|permissions` - `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role|trust` **Affected units** (1) - `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role` ### module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role (1 record) #### DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1 Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `catalog` (PROPOSED) | | Wave | wave 2 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:4c1cdaf163c1329c050b9bb8c155cd2416b67516dfdcc85c9ebc37487c1c62ec` | **Settings** (4) - **Review the IAM managed customer policy setting** (`iam-managed-customer-policy`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result. - **Review the IAM trust service workload setting** (`iam-trust-service-workload`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result. - **Translate the IAM permissions into STACKIT roles** (`permissions`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role outside the draft; the plan states no title for it. - **Decide who may assume each IAM role** (`trust`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role outside the draft; the plan states no title for it. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (2) - the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it - who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies) **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|iam-managed-customer-policy` - `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|iam-trust-service-workload` - `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|permissions` - `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|trust` **Affected units** (1) - `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role` ### module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role (1 record) #### DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673 Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `checkout` (PROPOSED) | | Wave | wave 1 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:b7d645453be730367ca644e3bab971d447c08ed019d765ed139181f4eae4d09c` | **Settings** (4) - **Review the IAM managed ECS setting** (`iam-managed-ecs`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the IAM managed ECS setting for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the IAM trust service workload setting** (`iam-trust-service-workload`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role: the check, proof or closing evidence is recorded with its result. - **Translate the IAM permissions into STACKIT roles** (`permissions`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it. - **Decide who may assume each IAM role** (`trust`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (2) - the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it - who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies) **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role|iam-managed-ecs` - `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role|iam-trust-service-workload` - `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role|permissions` - `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role|trust` **Affected units** (1) - `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role` ### module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role (1 record) #### DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6 Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `checkout` (PROPOSED) | | Wave | wave 2 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:4cc70f00b75b15f677d467aad39fca316ea2386384bb118334f60d1b56671a18` | **Settings** (4) - **Review the IAM managed customer policy setting** (`iam-managed-customer-policy`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result. - **Review the IAM trust service workload setting** (`iam-trust-service-workload`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result. - **Translate the IAM permissions into STACKIT roles** (`permissions`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role outside the draft; the plan states no title for it. - **Decide who may assume each IAM role** (`trust`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role outside the draft; the plan states no title for it. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (2) - the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it - who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies) **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|iam-managed-customer-policy` - `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|iam-trust-service-workload` - `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|permissions` - `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|trust` **Affected units** (1) - `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role` ### module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role (1 record) #### DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202 Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 6 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:5cb92f5482d71bb1a60742351a8f0e11a6f28348d2ec19149d8368eb6def2cf7` | **Settings** (4) - **Review the IAM managed ECS setting** (`iam-managed-ecs`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the IAM managed ECS setting for module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the IAM trust service workload setting** (`iam-trust-service-workload`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role: the check, proof or closing evidence is recorded with its result. - **Translate the IAM permissions into STACKIT roles** (`permissions`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it. - **Decide who may assume each IAM role** (`trust`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (2) - the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it - who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies) **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role|iam-managed-ecs` - `module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role|iam-trust-service-workload` - `module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role|permissions` - `module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role|trust` **Affected units** (1) - `module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role` ### module.retail_app_ecs.module.orders_service.aws_iam_role.task_role (1 record) #### DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65 Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 2 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:2f0bb0ed7fec154e45a2cb12fe4064f9f20b82d2c47f71a7c542e4a2c02b85d2` | **Settings** (4) - **Review the IAM managed customer policy setting** (`iam-managed-customer-policy`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.orders_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result. - **Review the IAM trust service workload setting** (`iam-trust-service-workload`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.orders_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result. - **Translate the IAM permissions into STACKIT roles** (`permissions`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.orders_service.aws_iam_role.task_role outside the draft; the plan states no title for it. - **Decide who may assume each IAM role** (`trust`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.orders_service.aws_iam_role.task_role outside the draft; the plan states no title for it. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (2) - the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it - who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies) **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|iam-managed-customer-policy` - `module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|iam-trust-service-workload` - `module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|permissions` - `module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|trust` **Affected units** (1) - `module.retail_app_ecs.module.orders_service.aws_iam_role.task_role` ### module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role (1 record) #### DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0 Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `ui` (PROPOSED) | | Wave | wave 1 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:0d3abc1d1e4e02ab819f5eb020fea10c4d78955084f9cfbda065762de79660b4` | **Settings** (4) - **Review the IAM managed ECS setting** (`iam-managed-ecs`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the IAM managed ECS setting for module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the IAM trust service workload setting** (`iam-trust-service-workload`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role: the check, proof or closing evidence is recorded with its result. - **Translate the IAM permissions into STACKIT roles** (`permissions`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it. - **Decide who may assume each IAM role** (`trust`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role outside the draft; the plan states no title for it. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (2) - the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it - who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies) **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role|iam-managed-ecs` - `module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role|iam-trust-service-workload` - `module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role|permissions` - `module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role|trust` **Affected units** (1) - `module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role` ### module.retail_app_ecs.module.ui_service.aws_iam_role.task_role (1 record) #### DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `ui` (PROPOSED) | | Wave | wave 2 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:c2be12d3d2e2fb732e8477e43439fd19dffa3bc19f7641e8a62de8194da707fb` | **Settings** (4) - **Review the IAM managed customer policy setting** (`iam-managed-customer-policy`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.ui_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result. - **Review the IAM trust service workload setting** (`iam-trust-service-workload`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.ui_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result. - **Translate the IAM permissions into STACKIT roles** (`permissions`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.ui_service.aws_iam_role.task_role outside the draft; the plan states no title for it. - **Decide who may assume each IAM role** (`trust`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.ui_service.aws_iam_role.task_role outside the draft; the plan states no title for it. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (2) - the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it - who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies) **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|iam-managed-customer-policy` - `module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|iam-trust-service-workload` - `module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|permissions` - `module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|trust` **Affected units** (1) - `module.retail_app_ecs.module.ui_service.aws_iam_role.task_role` ## Critical semantics · aws.internet_gateway (1 record, 1 open items, 0 accepted; status open) ### module.vpc.module.vpc.aws_internet_gateway.this (1 record) #### DEC-NET-MODULE-VPC-MODULE-VPC-AWS-INTERNET-GATEWAY-THIS Why: The knowledge base cannot decide 1 critical setting of module.vpc.module.vpc.aws_internet_gateway.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them. | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.internet_gateway | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Owner role | Network Architect | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Affected applications | 0 | | Applications touched | none: no applications file was given and no suggested group holds an affected unit | | Wave | not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in foundation | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:47c616336e5e1ad5768b91bfcb1100491e0fcda692c9b1fee7c3c8ca251f277e` | **Settings** (1) - **Confirm that the project is the boundary of one network** (`network-topology-boundary`, record before the settings of a unit were one record: `DEC-NET-AWS-INTERNET-GATEWAY-NETWORK-TOPOLOGY-BOUNDARY`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "network-topology-boundary" of the aws.internet_gateway contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Verify on the target for module.vpc.module.vpc.aws_internet_gateway.this: the check, proof or closing evidence is recorded with its result. **Open critical semantics (unit and semantic)** (1) - `module.vpc.module.vpc.aws_internet_gateway.this|network-topology-boundary` **Instances of `module.vpc.module.vpc.aws_internet_gateway.this` for `network-topology-boundary`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Affected units** (1) - `module.vpc.module.vpc.aws_internet_gateway.this` ## Critical semantics · aws.kms_key (1 record, 1 open items, 0 accepted; status open) ### module.retail_app_ecs.aws_kms_key.cmk (1 record) #### DEC-IAM-MODULE-RETAIL-APP-ECS-AWS-KMS-KEY-CMK Why: The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.aws_kms_key.cmk: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.kms_key | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Owner role | Identity Architect | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Affected applications | 0 | | Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; module.retail_app_ecs.aws_kms_key.cmk is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders | | Wave | wave 1 · steps in security | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:f89900f92525e7c55732bc4918958a09715b21610264e9c769a83f22f3d3d990` | **Settings** (1) - **Review the deletion window setting** (`deletion-window`, record before the settings of a unit were one record: `DEC-DATA-AWS-KMS-KEY-DELETION-WINDOW`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "deletion-window" of the aws.kms_key contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the deletion window setting for module.retail_app_ecs.aws_kms_key.cmk, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (1) - `module.retail_app_ecs.aws_kms_key.cmk|deletion-window` **Affected units** (1) - `module.retail_app_ecs.aws_kms_key.cmk` ## Critical semantics · aws.lb (2 records, 8 open items, 0 accepted; status open) ### module.retail_app_ecs.module.alb.aws_lb.this (2 records) #### DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS Why: The knowledge base cannot decide 5 critical settings of module.retail_app_ecs.module.alb.aws_lb.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect. | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.lb | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Owner role | Network Architect | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Open critical semantics (unit and semantic) | 5 | | Affected units | 1 | | Affected applications | 0 | | Applications touched | `ui` (PROPOSED) | | Wave | wave 3 · steps in platform services | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:f757f9ce3f4966d7d8803d03f11e2b3a0e09c8f5cfa0e4a9c5081c4883698607` | **Settings** (5) - **Decide the ALB client access** (`client-restriction`, record before the settings of a unit were one record: `DEC-NET-AWS-LB-CLIENT-RESTRICTION`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "client-restriction" of the aws.lb contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Decide the ALB client access for module.retail_app_ecs.module.alb.aws_lb.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the LB routing and addressing setting** (`lb-routing-and-addressing`, record before the settings of a unit were one record: `DEC-NET-AWS-LB-LB-ROUTING-AND-ADDRESSING`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "lb-routing-and-addressing" of the aws.lb contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the LB routing and addressing setting for module.retail_app_ecs.module.alb.aws_lb.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the LB subnets setting** (`lb-subnets`, record before the settings of a unit were one record: `DEC-NET-AWS-LB-LB-SUBNETS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "lb-subnets" of the aws.lb contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Verify on the target for module.retail_app_ecs.module.alb.aws_lb.this: the check, proof or closing evidence is recorded with its result. - **Decide who may reach the service over the network** (`network-exposure`, record before the settings of a unit were one record: `DEC-NET-AWS-LB-NETWORK-EXPOSURE`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "network-exposure" of the aws.lb contract for 1 unit (carried into the draft): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Carry out the manual work the plan names for module.retail_app_ecs.module.alb.aws_lb.this outside the draft; the plan states no title for it. - **Review the request handling setting** (`request-handling`, record before the settings of a unit were one record: `DEC-NET-AWS-LB-REQUEST-HANDLING`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "request-handling" of the aws.lb contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the request handling setting for module.retail_app_ecs.module.alb.aws_lb.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (5) - `module.retail_app_ecs.module.alb.aws_lb.this|client-restriction` - `module.retail_app_ecs.module.alb.aws_lb.this|lb-routing-and-addressing` - `module.retail_app_ecs.module.alb.aws_lb.this|lb-subnets` - `module.retail_app_ecs.module.alb.aws_lb.this|network-exposure` - `module.retail_app_ecs.module.alb.aws_lb.this|request-handling` **Affected units** (1) - `module.retail_app_ecs.module.alb.aws_lb.this` #### DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS Why: The knowledge base cannot decide 3 critical settings of module.retail_app_ecs.module.alb.aws_lb.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-platform-architect. | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.lb | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Owner role | Platform Architect | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Open critical semantics (unit and semantic) | 3 | | Affected units | 1 | | Affected applications | 0 | | Applications touched | `ui` (PROPOSED) | | Wave | wave 3 · steps in platform services | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:1f886639d618968c583259189057db4e9560ece36778f6e9a6944d4309935aca` | **Settings** (3) - **Review the LB connection timeouts setting** (`lb-connection-timeouts`, record before the settings of a unit were one record: `DEC-OPS-AWS-LB-LB-CONNECTION-TIMEOUTS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "lb-connection-timeouts" of the aws.lb contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the LB connection timeouts setting for module.retail_app_ecs.module.alb.aws_lb.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the request header options setting** (`request-header-options`, record before the settings of a unit were one record: `DEC-OPS-AWS-LB-REQUEST-HEADER-OPTIONS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "request-header-options" of the aws.lb contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the request header options setting for module.retail_app_ecs.module.alb.aws_lb.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the name of the load balancer** (`tc-lb-name`, record before the settings of a unit were one record: `DEC-OPS-AWS-LB-TC-LB-NAME`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "the name of the LB" of the aws.lb contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: The draft does not carry the name of the LB for module.retail_app_ecs.module.alb.aws_lb.this: set the load balancer's name in the draft by hand, or accept the name the draft writes. **Open critical semantics (unit and semantic)** (3) - `module.retail_app_ecs.module.alb.aws_lb.this|lb-connection-timeouts` - `module.retail_app_ecs.module.alb.aws_lb.this|request-header-options` - `module.retail_app_ecs.module.alb.aws_lb.this|tc-lb-name` **Affected units** (1) - `module.retail_app_ecs.module.alb.aws_lb.this` ## Critical semantics · aws.mq_broker (4 records, 7 open items, 0 accepted; status open) Every record under this heading states the same for these fields, and its table does not repeat them: | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.mq_broker | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Affected applications | 0 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 4 · steps in platform services | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | ### module.dependencies.aws_mq_broker.mq (4 records) #### DEC-IAM-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ Why: The knowledge base cannot decide 2 critical settings of module.dependencies.aws_mq_broker.mq: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-identity-architect. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 2 | | Affected units | 1 | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:1d010c1b6ab6c30f34ff7ae81cdd495a8a439b7de14ec99385aea80975a5725b` | **Settings** (2) - **Decide the users of the message broker** (`broker-users`, record before the settings of a unit were one record: `DEC-IAM-AWS-MQ-BROKER-BROKER-USERS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "broker-users" of the aws.mq_broker contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it. - **Confirm the user name** (`tc-user--username`, record before the settings of a unit were one record: `DEC-IAM-AWS-MQ-BROKER-TC-USER-USERNAME`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "the username of the user entry of the MQ broker" of the aws.mq_broker contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Verify on the target for module.dependencies.aws_mq_broker.mq: the check, proof or closing evidence is recorded with its result. **Open critical semantics (unit and semantic)** (2) - `module.dependencies.aws_mq_broker.mq|broker-users` - `module.dependencies.aws_mq_broker.mq|tc-user--username` **Affected units** (1) - `module.dependencies.aws_mq_broker.mq` #### DEC-NET-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ Why: The knowledge base cannot decide 1 critical setting of module.dependencies.aws_mq_broker.mq: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:0677d3c44629dc255384d38daf4d1be95731a7b0f973c9589d4bbae60eb3321a` | **Settings** (1) - **Decide the network of the message broker** (`broker-network`, record before the settings of a unit were one record: `DEC-NET-AWS-MQ-BROKER-BROKER-NETWORK`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "broker-network" of the aws.mq_broker contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it. **Open critical semantics (unit and semantic)** (1) - `module.dependencies.aws_mq_broker.mq|broker-network` **Affected units** (1) - `module.dependencies.aws_mq_broker.mq` #### DEC-OPS-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ Why: The knowledge base cannot decide 3 critical settings of module.dependencies.aws_mq_broker.mq: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect. | Field | Value | |---|---| | Owner role | Platform Architect | | Open critical semantics (unit and semantic) | 3 | | Affected units | 1 | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:ef3bdbf036354a9489578e8cc7954091c560180b4f5f81788a824d645c25a480` | **Settings** (3) - **Choose the database engine version** (`engine-version`, record before the settings of a unit were one record: `DEC-OPS-AWS-MQ-BROKER-ENGINE-VERSION`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "engine-version" of the aws.mq_broker contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it. - **Confirm the name of the message broker** (`tc-mq-broker-broker-name`, record before the settings of a unit were one record: `DEC-OPS-AWS-MQ-BROKER-TC-MQ-BROKER-BROKER-NAME`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "the broker name of the MQ broker" of the aws.mq_broker contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Verify on the target for module.dependencies.aws_mq_broker.mq: the check, proof or closing evidence is recorded with its result. - **Choose the deployment mode of the broker** (`tcp-deployment-mode`, record before the settings of a unit were one record: `DEC-OPS-AWS-MQ-BROKER-TCP-DEPLOYMENT-MODE`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "the deployment mode of the MQ broker" of the aws.mq_broker contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it. **Open critical semantics (unit and semantic)** (3) - `module.dependencies.aws_mq_broker.mq|engine-version` - `module.dependencies.aws_mq_broker.mq|tc-mq-broker-broker-name` - `module.dependencies.aws_mq_broker.mq|tcp-deployment-mode` **Affected units** (1) - `module.dependencies.aws_mq_broker.mq` #### DEC-SEC-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ Why: The knowledge base cannot decide 1 critical setting of module.dependencies.aws_mq_broker.mq: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-security-architect. | Field | Value | |---|---| | Owner role | Security Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:4e74b75b281d7cca7f66b57294584f30ce28513bc601ae4284f9e27f1e62c0fb` | **Settings** (1) - **Decide how the user password is supplied** (`tc-user--password`, record before the settings of a unit were one record: `DEC-SEC-AWS-MQ-BROKER-TC-USER-PASSWORD`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "the password of the user entry of the MQ broker" of the aws.mq_broker contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it. **Open critical semantics (unit and semantic)** (1) - `module.dependencies.aws_mq_broker.mq|tc-user--password` **Affected units** (1) - `module.dependencies.aws_mq_broker.mq` ## Critical semantics · aws.nat_gateway (1 record, 3 open items, 0 accepted; status open) ### module.vpc.module.vpc.aws_nat_gateway.this (1 record) #### DEC-NET-MODULE-VPC-MODULE-VPC-AWS-NAT-GATEWAY-THIS Why: The knowledge base cannot decide 3 critical settings of module.vpc.module.vpc.aws_nat_gateway.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.vpc.module.vpc.aws_nat_gateway.this/open-settings. | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.nat_gateway | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Owner role | Network Architect | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Open critical semantics (unit and semantic) | 3 | | Affected units | 1 | | Affected applications | 0 | | Applications touched | none: no applications file was given and no suggested group holds an affected unit | | Wave | wave 2 · steps in foundation | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:3e80a05723d110a3e1c0d44751fa6e6caf815a7d234eb525820b1d1c73adc582` | **Settings** (3) - **Decide the fixed outbound IP address** (`fixed-egress-ip`, record before the settings of a unit were one record: `DEC-NET-AWS-NAT-GATEWAY-FIXED-EGRESS-IP`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "fixed-egress-ip" of the aws.nat_gateway contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Carry out the manual work the plan names for module.vpc.module.vpc.aws_nat_gateway.this outside the draft; the plan states no title for it. - **Review the NAT placement setting** (`nat-placement`, record before the settings of a unit were one record: `DEC-NET-AWS-NAT-GATEWAY-NAT-PLACEMENT`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "nat-placement" of the aws.nat_gateway contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Carry out the manual work the plan names for module.vpc.module.vpc.aws_nat_gateway.this outside the draft; the plan states no title for it. - **Confirm that the project is the boundary of one network** (`network-topology-boundary`, record before the settings of a unit were one record: `DEC-NET-AWS-NAT-GATEWAY-NETWORK-TOPOLOGY-BOUNDARY`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "network-topology-boundary" of the aws.nat_gateway contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Verify on the target for module.vpc.module.vpc.aws_nat_gateway.this: the check, proof or closing evidence is recorded with its result. **Open critical semantics (unit and semantic)** (3) - `module.vpc.module.vpc.aws_nat_gateway.this|fixed-egress-ip` - `module.vpc.module.vpc.aws_nat_gateway.this|nat-placement` - `module.vpc.module.vpc.aws_nat_gateway.this|network-topology-boundary` **Affected units** (1) - `module.vpc.module.vpc.aws_nat_gateway.this` ## Critical semantics · aws.opensearch (4 records, 14 open items, 0 accepted; status open) Every record under this heading states the same for these fields, and its table does not repeat them: | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.opensearch | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Affected applications | 0 | | Applications touched | `catalog` (PROPOSED) | | Wave | wave 4 · steps in data services | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | ### module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (4 records) #### DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E Why: The knowledge base cannot decide 7 critical settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 7 | | Affected units | 1 | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:a9e0ee79957045c23a463b07a97b52afc357b86ed2311d9024f40b66f15e8e40` | **Settings** (7) - **Review the access and encryption settings setting** (`access-and-encryption-settings`, record before the settings of a unit were one record: `DEC-IAM-AWS-OPENSEARCH-ACCESS-AND-ENCRYPTION-SETTINGS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "access-and-encryption-settings" of the aws.opensearch contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the access and encryption settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the credentials and keys settings setting** (`credentials-and-keys-settings`, record before the settings of a unit were one record: `DEC-IAM-AWS-OPENSEARCH-CREDENTIALS-AND-KEYS-SETTINGS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "credentials-and-keys-settings" of the aws.opensearch contract for 1 unit (not available on STACKIT): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the credentials and keys settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the domain credentials and keys setting** (`domain-credentials-and-keys`, record before the settings of a unit were one record: `DEC-IAM-AWS-OPENSEARCH-DOMAIN-CREDENTIALS-AND-KEYS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "domain-credentials-and-keys" of the aws.opensearch contract for 1 unit (not available on STACKIT): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the domain credentials and keys setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the domain settings setting** (`domain-settings`, record before the settings of a unit were one record: `DEC-IAM-AWS-OPENSEARCH-DOMAIN-SETTINGS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "domain-settings" of the aws.opensearch contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the domain settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the fine grained access setting** (`fine-grained-access`, record before the settings of a unit were one record: `DEC-IAM-AWS-OPENSEARCH-FINE-GRAINED-ACCESS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "fine-grained-access" of the aws.opensearch contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the fine grained access setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the effect of a neighbouring OpenSearch domain policy** (`nbr-aws-opensearch-domain-policy`, record before the settings of a unit were one record: `DEC-IAM-AWS-OPENSEARCH-NBR-AWS-OPENSEARCH-DOMAIN-POLICY`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "the effect of a neighbouring OpenSearch domain policy" of the aws.opensearch contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Confirm the effect of a neighbouring OpenSearch domain policy for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the OpenSearch domain policy resource setting** (`opensearch-domain-policy-resource`, record before the settings of a unit were one record: `DEC-IAM-AWS-OPENSEARCH-OPENSEARCH-DOMAIN-POLICY-RESOURCE`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "opensearch-domain-policy-resource" of the aws.opensearch contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the OpenSearch domain policy resource setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (7) - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|access-and-encryption-settings` - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|credentials-and-keys-settings` - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|domain-credentials-and-keys` - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|domain-settings` - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|fine-grained-access` - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|nbr-aws-opensearch-domain-policy` - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|opensearch-domain-policy-resource` **Affected units** (1) - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` #### DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E Why: The knowledge base cannot decide 2 critical settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-network-architect. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 2 | | Affected units | 1 | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:efd09ed3163fcd2d1f8f02ae26a7794ec875cfcd3748cbee1def5e930d468b24` | **Settings** (2) - **Review the network settings setting** (`network-settings`, record before the settings of a unit were one record: `DEC-NET-AWS-OPENSEARCH-NETWORK-SETTINGS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "network-settings" of the aws.opensearch contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the network settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the private endpoint setting** (`private-endpoint`, record before the settings of a unit were one record: `DEC-NET-AWS-OPENSEARCH-PRIVATE-ENDPOINT`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "private-endpoint" of the aws.opensearch contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the private endpoint setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (2) - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|network-settings` - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|private-endpoint` **Affected units** (1) - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` #### DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E Why: The knowledge base cannot decide 4 critical settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect. | Field | Value | |---|---| | Owner role | Platform Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:6624c3ac7454bc6f7584654b5457e914db689e9b03564a6ef798e8fd91f4c794` | **Settings** (4) - **Review the cluster layout settings setting** (`cluster-layout-settings`, record before the settings of a unit were one record: `DEC-OPS-AWS-OPENSEARCH-CLUSTER-LAYOUT-SETTINGS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "cluster-layout-settings" of the aws.opensearch contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the cluster layout settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Choose the database engine version** (`engine-version`, record before the settings of a unit were one record: `DEC-OPS-AWS-OPENSEARCH-ENGINE-VERSION`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "engine-version" of the aws.opensearch contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Choose the database engine version for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the storage settings setting** (`storage-settings`, record before the settings of a unit were one record: `DEC-OPS-AWS-OPENSEARCH-STORAGE-SETTINGS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "storage-settings" of the aws.opensearch contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the storage settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the domain name of the OpenSearch domain** (`tc-opensearch-domain-domain-name`, record before the settings of a unit were one record: `DEC-OPS-AWS-OPENSEARCH-TC-OPENSEARCH-DOMAIN-DOMAIN-NAME`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "the domain name of the OpenSearch domain" of the aws.opensearch contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Confirm the domain name of the OpenSearch domain for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (4) - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|cluster-layout-settings` - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|engine-version` - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|storage-settings` - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|tc-opensearch-domain-domain-name` **Affected units** (1) - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` #### DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E Why: The knowledge base cannot decide 1 critical setting of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. | Field | Value | |---|---| | Owner role | Security Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:caf9581bf513722f70799201583927c9f7d2aad376462690c78884ffb3e7913a` | **Settings** (1) - **Review the encryption at rest setting** (`encryption-at-rest`, record before the settings of a unit were one record: `DEC-SEC-AWS-OPENSEARCH-ENCRYPTION-AT-REST`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "encryption-at-rest" of the aws.opensearch contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the encryption at rest setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (1) - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this|encryption-at-rest` **Affected units** (1) - `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` ## Critical semantics · aws.rds_cluster (10 records, 24 open items, 0 accepted; status open) Every record under this heading states the same for these fields, and its table does not repeat them: | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.rds_cluster | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Affected applications | 0 | | Approval | not approved: no decisions file was given with this run | | Recommended option | none | ### module.dependencies.module.catalog_rds.aws_rds_cluster.this (5 records) #### DEC-DATA-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS Why: The knowledge base cannot decide 2 critical settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-data-architect. | Field | Value | |---|---| | Owner role | Data Architect | | Open critical semantics (unit and semantic) | 2 | | Affected units | 1 | | Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; module.dependencies.module.catalog_rds.aws_rds_cluster.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders | | Wave | wave 4 · steps in data services | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:3ac0ea2fe4b2c89a0ba32b318fb09555b19d7908dee3884848002f6aaab52ca2` | **Settings** (2) - **Review the backup retention setting** (`backup-retention`, record before the settings of a unit were one record: `DEC-DATA-AWS-RDS-CLUSTER-BACKUP-RETENTION`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "backup-retention" of the aws.rds_cluster contract for 1 unit (carried into the draft): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the backup retention setting for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the final snapshot setting** (`final-snapshot`, record before the settings of a unit were one record: `DEC-DATA-AWS-RDS-CLUSTER-FINAL-SNAPSHOT`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "final-snapshot" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the final snapshot setting for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (2) - `module.dependencies.module.catalog_rds.aws_rds_cluster.this|backup-retention` - `module.dependencies.module.catalog_rds.aws_rds_cluster.this|final-snapshot` **Affected units** (1) - `module.dependencies.module.catalog_rds.aws_rds_cluster.this` #### DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS Why: The knowledge base cannot decide 1 critical setting of module.dependencies.module.catalog_rds.aws_rds_cluster.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; module.dependencies.module.catalog_rds.aws_rds_cluster.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders | | Wave | wave 4 · steps in data services | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:30cbded70d6861ce65a80938e1025f6e3f6b4b28ba08fb7268b5246df0f1c22b` | **Settings** (1) - **Review the admin username not carried setting** (`admin-username-not-carried`, record before the settings of a unit were one record: `DEC-IAM-AWS-RDS-CLUSTER-ADMIN-USERNAME-NOT-CARRIED`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "admin-username-not-carried" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the admin username not carried setting for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (1) - `module.dependencies.module.catalog_rds.aws_rds_cluster.this|admin-username-not-carried` **Affected units** (1) - `module.dependencies.module.catalog_rds.aws_rds_cluster.this` #### DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS Why: The knowledge base cannot decide 3 critical settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-network-architect. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 3 | | Affected units | 1 | | Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; module.dependencies.module.catalog_rds.aws_rds_cluster.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders | | Wave | wave 4 · steps in data services | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:08ef1795fb2ca2f1693f6c9f9ca0f87f030551d26b59f47d9f5e242c34a5a85d` | **Settings** (3) - **Decide how clients reach the database (the endpoint STACKIT assigns and its access list)** (`db-network-placement`, record before the settings of a unit were one record: `DEC-NET-AWS-RDS-CLUSTER-DB-NETWORK-PLACEMENT`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "db-network-placement" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Decide how clients reach the database (the endpoint STACKIT assigns and its access list) for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the member settings setting** (`member-settings`, record before the settings of a unit were one record: `DEC-NET-AWS-RDS-CLUSTER-MEMBER-SETTINGS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "member-settings" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the member settings setting for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the security groups setting** (`security-groups`, record before the settings of a unit were one record: `DEC-NET-AWS-RDS-CLUSTER-SECURITY-GROUPS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "security-groups" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the security groups setting for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (3) - `module.dependencies.module.catalog_rds.aws_rds_cluster.this|db-network-placement` - `module.dependencies.module.catalog_rds.aws_rds_cluster.this|member-settings` - `module.dependencies.module.catalog_rds.aws_rds_cluster.this|security-groups` **Affected units** (1) - `module.dependencies.module.catalog_rds.aws_rds_cluster.this` #### DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS Why: The knowledge base cannot decide 5 critical settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect. | Field | Value | |---|---| | Owner role | Platform Architect | | Open critical semantics (unit and semantic) | 5 | | Affected units | 1 | | Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; module.dependencies.module.catalog_rds.aws_rds_cluster.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders | | Wave | wave 4 · steps in data services | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:04c13bb75bcc4b3f06e8a9be6649f1aa33f1783b80e228945967077a7b7f440d` | **Settings** (5) - **Choose the database engine** (`engine`, record before the settings of a unit were one record: `DEC-OPS-AWS-RDS-CLUSTER-ENGINE`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "engine" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Choose the database engine for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Choose the database engine version** (`engine-version`, record before the settings of a unit were one record: `DEC-OPS-AWS-RDS-CLUSTER-ENGINE-VERSION`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "engine-version" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Choose the database engine version for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the member engine setting** (`member-engine`, record before the settings of a unit were one record: `DEC-OPS-AWS-RDS-CLUSTER-MEMBER-ENGINE`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "member-engine" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the member engine setting for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the database name of the RDS cluster** (`tc-database-name`, record before the settings of a unit were one record: `DEC-OPS-AWS-RDS-CLUSTER-TC-DATABASE-NAME`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "the database name of the RDS cluster" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Confirm the database name of the RDS cluster for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the identifier of the RDS cluster instance** (`tcf-rds-cluster-instance--identifier`, record before the settings of a unit were one record: `DEC-OPS-AWS-RDS-CLUSTER-TCF-RDS-CLUSTER-INSTANCE-IDENTIFIER`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "the identifier of the RDS cluster instance" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Confirm the identifier of the RDS cluster instance for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (5) - `module.dependencies.module.catalog_rds.aws_rds_cluster.this|engine` - `module.dependencies.module.catalog_rds.aws_rds_cluster.this|engine-version` - `module.dependencies.module.catalog_rds.aws_rds_cluster.this|member-engine` - `module.dependencies.module.catalog_rds.aws_rds_cluster.this|tc-database-name` - `module.dependencies.module.catalog_rds.aws_rds_cluster.this|tcf-rds-cluster-instance--identifier` **Affected units** (1) - `module.dependencies.module.catalog_rds.aws_rds_cluster.this` #### DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS Why: The knowledge base cannot decide 3 critical settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect. | Field | Value | |---|---| | Owner role | Security Architect | | Open critical semantics (unit and semantic) | 3 | | Affected units | 1 | | Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; module.dependencies.module.catalog_rds.aws_rds_cluster.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders | | Wave | wave 4 · steps in data services | | Options | the options are those of the settings: 1 setting of them list options, below | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:83e2e9a6dde82e51cd66d9801c1c5f0f3264133cdd53c48904171583c84daf89` | **Settings** (3) - **Decide how the administrator password is supplied** (`admin-password`, record before the settings of a unit were one record: `DEC-SEC-AWS-RDS-CLUSTER-ADMIN-PASSWORD`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "admin-password" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Decide how the administrator password is supplied for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - Recommended option: `use-the-password-stackit-generates` - Option `use-the-password-stackit-generates`: Use the password STACKIT generates for the database user. The draft writes the database user (stackit_postgresflex_user, stackit_sqlserverflex_user, stackit_mariadb_credential or stackit_mongodbflex_user) and STACKIT generates its password at the apply. The draft exposes it as the sensitive output _admin_password (a reference to the resource, never a value, and no password in any file of the package); the state holds it in plain text, so the state is a secret. The source password and its Secrets Manager management are not copied and the clients get new credentials: after the apply a person reads the output, puts it into the connection settings of every client (a cutover action) and keeps it in the secret store the customer uses. This is the default the draft writes. A review records the choice; the new credentials reaching the clients stays the manual work of the record. **Trade-off:** its effect on the steps is not stated: an answer frees nothing. - Option `store-the-generated-password-in-secrets-manager`: Store the generated password in STACKIT Secrets Manager. The password is still generated by STACKIT and exposed by the draft as the sensitive output _admin_password; in addition a person writes it into a secret of a STACKIT Secrets Manager instance after the apply and lets the clients read it there. The draft creates no secret: the provider documentation lists stackit_secretsmanager_instance, stackit_secretsmanager_user and two role bindings and no secret resource (searched), so writing the secret is work outside the Terraform draft; the pages read do not describe the write steps (not stated). The source's rotation schedule is not carried either way. **Trade-off:** its effect on the steps is not stated: an answer frees nothing. - **Review the parameter and option groups setting** (`parameter-and-option-groups`, record before the settings of a unit were one record: `DEC-SEC-AWS-RDS-CLUSTER-PARAMETER-AND-OPTION-GROUPS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "parameter-and-option-groups" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the parameter and option groups setting for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the storage encryption setting** (`storage-encryption`, record before the settings of a unit were one record: `DEC-SEC-AWS-RDS-CLUSTER-STORAGE-ENCRYPTION`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "storage-encryption" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the storage encryption setting for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Required evidence (the plan's reasons, then what the knowledge base asks for)** (2) - for storing the password in STACKIT Secrets Manager: the Secrets Manager instance and the way the secret is written there - who hands the new credentials to the clients (every connection setting that holds the source password), and where the clients read them from after the cutover **Open critical semantics (unit and semantic)** (3) - `module.dependencies.module.catalog_rds.aws_rds_cluster.this|admin-password` - `module.dependencies.module.catalog_rds.aws_rds_cluster.this|parameter-and-option-groups` - `module.dependencies.module.catalog_rds.aws_rds_cluster.this|storage-encryption` **Affected units** (1) - `module.dependencies.module.catalog_rds.aws_rds_cluster.this` ### module.dependencies.module.orders_rds.aws_rds_cluster.this (5 records) #### DEC-DATA-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS Why: The knowledge base cannot decide 1 critical setting of module.dependencies.module.orders_rds.aws_rds_cluster.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. | Field | Value | |---|---| | Owner role | Data Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 4 · steps in data services | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:c9776a97d7c44508822e47ba0976fac039372b9a459319ac8420e0010f5391f0` | **Settings** (1) - **Review the final snapshot setting** (`final-snapshot`, record before the settings of a unit were one record: `DEC-DATA-AWS-RDS-CLUSTER-FINAL-SNAPSHOT`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "final-snapshot" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the final snapshot setting for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (1) - `module.dependencies.module.orders_rds.aws_rds_cluster.this|final-snapshot` **Affected units** (1) - `module.dependencies.module.orders_rds.aws_rds_cluster.this` #### DEC-IAM-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS Why: The knowledge base cannot decide 1 critical setting of module.dependencies.module.orders_rds.aws_rds_cluster.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. | Field | Value | |---|---| | Owner role | Identity Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 4 · steps in data services | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:56a8b21cfab709656b73f9d44bc0f7560aad7fc1566c66d5cd5addcb8bd1753c` | **Settings** (1) - **Review the admin username not carried setting** (`admin-username-not-carried`, record before the settings of a unit were one record: `DEC-IAM-AWS-RDS-CLUSTER-ADMIN-USERNAME-NOT-CARRIED`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "admin-username-not-carried" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the admin username not carried setting for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (1) - `module.dependencies.module.orders_rds.aws_rds_cluster.this|admin-username-not-carried` **Affected units** (1) - `module.dependencies.module.orders_rds.aws_rds_cluster.this` #### DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS Why: The knowledge base cannot decide 3 critical settings of module.dependencies.module.orders_rds.aws_rds_cluster.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-network-architect. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 3 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 4 · steps in data services | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:b3c81382b03c6c736acc4d26ff3e92a4345e4df4789e0623bd0f59c9b345b926` | **Settings** (3) - **Decide how clients reach the database (the endpoint STACKIT assigns and its access list)** (`db-network-placement`, record before the settings of a unit were one record: `DEC-NET-AWS-RDS-CLUSTER-DB-NETWORK-PLACEMENT`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "db-network-placement" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Decide how clients reach the database (the endpoint STACKIT assigns and its access list) for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the member settings setting** (`member-settings`, record before the settings of a unit were one record: `DEC-NET-AWS-RDS-CLUSTER-MEMBER-SETTINGS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "member-settings" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the member settings setting for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the security groups setting** (`security-groups`, record before the settings of a unit were one record: `DEC-NET-AWS-RDS-CLUSTER-SECURITY-GROUPS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "security-groups" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the security groups setting for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (3) - `module.dependencies.module.orders_rds.aws_rds_cluster.this|db-network-placement` - `module.dependencies.module.orders_rds.aws_rds_cluster.this|member-settings` - `module.dependencies.module.orders_rds.aws_rds_cluster.this|security-groups` **Affected units** (1) - `module.dependencies.module.orders_rds.aws_rds_cluster.this` #### DEC-OPS-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS Why: The knowledge base cannot decide 2 critical settings of module.dependencies.module.orders_rds.aws_rds_cluster.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is carried by the draft already: a person only confirms it. | Field | Value | |---|---| | Owner role | Platform Architect | | Open critical semantics (unit and semantic) | 2 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 4 · steps in data services, platform services | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:5fbeb2619f0e2cfb47bde72a31bb3e3a1f5543ba5914660763055c373724e0c8` | **Settings** (2) - **Confirm the database name of the RDS cluster** (`tc-database-name`, record before the settings of a unit were one record: `DEC-OPS-AWS-RDS-CLUSTER-TC-DATABASE-NAME`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "the database name of the RDS cluster" of the aws.rds_cluster contract for 1 unit (left for a person to decide): the draft already carries it, so a person only confirms it. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The row of each member in assurance/critical-semantics.json (carried_by) names the step and the file that carry it. - Next: Confirm in terraform/data.tf that the draft carries the database name of the RDS cluster for module.dependencies.module.orders_rds.aws_rds_cluster.this as the source relies on it; nothing needs deciding. - **Confirm the identifier of the RDS cluster instance** (`tcf-rds-cluster-instance--identifier`, record before the settings of a unit were one record: `DEC-OPS-AWS-RDS-CLUSTER-TCF-RDS-CLUSTER-INSTANCE-IDENTIFIER`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "the identifier of the RDS cluster instance" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Confirm the identifier of the RDS cluster instance for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (2) - `module.dependencies.module.orders_rds.aws_rds_cluster.this|tc-database-name` - `module.dependencies.module.orders_rds.aws_rds_cluster.this|tcf-rds-cluster-instance--identifier` **Affected units** (1) - `module.dependencies.module.orders_rds.aws_rds_cluster.this` #### DEC-SEC-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS Why: The knowledge base cannot decide 3 critical settings of module.dependencies.module.orders_rds.aws_rds_cluster.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect. | Field | Value | |---|---| | Owner role | Security Architect | | Open critical semantics (unit and semantic) | 3 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 4 · steps in data services | | Options | the options are those of the settings: 1 setting of them list options, below | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:ab8f2937699001b60dad6a667cbc1e25d1e136bd735d58b05008f2a9eb3b0d60` | **Settings** (3) - **Decide how the administrator password is supplied** (`admin-password`, record before the settings of a unit were one record: `DEC-SEC-AWS-RDS-CLUSTER-ADMIN-PASSWORD`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "admin-password" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Decide how the administrator password is supplied for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - Recommended option: `use-the-password-stackit-generates` - Option `use-the-password-stackit-generates`: Use the password STACKIT generates for the database user. The draft writes the database user (stackit_postgresflex_user, stackit_sqlserverflex_user, stackit_mariadb_credential or stackit_mongodbflex_user) and STACKIT generates its password at the apply. The draft exposes it as the sensitive output _admin_password (a reference to the resource, never a value, and no password in any file of the package); the state holds it in plain text, so the state is a secret. The source password and its Secrets Manager management are not copied and the clients get new credentials: after the apply a person reads the output, puts it into the connection settings of every client (a cutover action) and keeps it in the secret store the customer uses. This is the default the draft writes. A review records the choice; the new credentials reaching the clients stays the manual work of the record. **Trade-off:** its effect on the steps is not stated: an answer frees nothing. - Option `store-the-generated-password-in-secrets-manager`: Store the generated password in STACKIT Secrets Manager. The password is still generated by STACKIT and exposed by the draft as the sensitive output _admin_password; in addition a person writes it into a secret of a STACKIT Secrets Manager instance after the apply and lets the clients read it there. The draft creates no secret: the provider documentation lists stackit_secretsmanager_instance, stackit_secretsmanager_user and two role bindings and no secret resource (searched), so writing the secret is work outside the Terraform draft; the pages read do not describe the write steps (not stated). The source's rotation schedule is not carried either way. **Trade-off:** its effect on the steps is not stated: an answer frees nothing. - **Review the parameter and option groups setting** (`parameter-and-option-groups`, record before the settings of a unit were one record: `DEC-SEC-AWS-RDS-CLUSTER-PARAMETER-AND-OPTION-GROUPS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "parameter-and-option-groups" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the parameter and option groups setting for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the storage encryption setting** (`storage-encryption`, record before the settings of a unit were one record: `DEC-SEC-AWS-RDS-CLUSTER-STORAGE-ENCRYPTION`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "storage-encryption" of the aws.rds_cluster contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the storage encryption setting for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Required evidence (the plan's reasons, then what the knowledge base asks for)** (2) - for storing the password in STACKIT Secrets Manager: the Secrets Manager instance and the way the secret is written there - who hands the new credentials to the clients (every connection setting that holds the source password), and where the clients read them from after the cutover **Open critical semantics (unit and semantic)** (3) - `module.dependencies.module.orders_rds.aws_rds_cluster.this|admin-password` - `module.dependencies.module.orders_rds.aws_rds_cluster.this|parameter-and-option-groups` - `module.dependencies.module.orders_rds.aws_rds_cluster.this|storage-encryption` **Affected units** (1) - `module.dependencies.module.orders_rds.aws_rds_cluster.this` ## Critical semantics · aws.route_table (2 records, 13 open items, 0 accepted; status open) ### module.vpc.module.vpc.aws_route_table.private (1 record) #### DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE Why: The knowledge base cannot decide 8 critical settings of module.vpc.module.vpc.aws_route_table.private: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 8 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them. The review step of the execution plan for these settings is MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings. | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.route_table | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Owner role | Network Architect | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Open critical semantics (unit and semantic) | 8 | | Affected units | 1 | | Affected applications | 0 | | Applications touched | none: no applications file was given and no suggested group holds an affected unit | | Wave | not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in foundation | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:1561d4bf75d1713671e851b18f2c392b9346c65555cab9b2398ea2763bc5b3d6` | **Settings** (8) - **Decide the outbound (egress) rules of the security group** (`egress-restriction`, record before the settings of a unit were one record: `DEC-NET-AWS-ROUTE-TABLE-EGRESS-RESTRICTION`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "egress-restriction" of the aws.route_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Verify on the target for module.vpc.module.vpc.aws_route_table.private: the check, proof or closing evidence is recorded with its result. - **Review the NAT fixed egress address setting** (`nat-fixed-egress-address`, record before the settings of a unit were one record: `DEC-NET-AWS-ROUTE-TABLE-NAT-FIXED-EGRESS-ADDRESS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "nat-fixed-egress-address" of the aws.route_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Review the NAT fixed egress address setting for module.vpc.module.vpc.aws_route_table.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm that the project is the boundary of one network** (`network-topology-boundary`, record before the settings of a unit were one record: `DEC-NET-AWS-ROUTE-TABLE-NETWORK-TOPOLOGY-BOUNDARY`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "network-topology-boundary" of the aws.route_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Verify on the target for module.vpc.module.vpc.aws_route_table.private: the check, proof or closing evidence is recorded with its result. - **Confirm the destinations of the routes** (`route-destinations`, record before the settings of a unit were one record: `DEC-NET-AWS-ROUTE-TABLE-ROUTE-DESTINATIONS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "route-destinations" of the aws.route_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Confirm the destinations of the routes for module.vpc.module.vpc.aws_route_table.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the targets of the routes** (`route-targets`, record before the settings of a unit were one record: `DEC-NET-AWS-ROUTE-TABLE-ROUTE-TARGETS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "route-targets" of the aws.route_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Confirm the targets of the routes for module.vpc.module.vpc.aws_route_table.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Re-create the routes with STACKIT next hops** (`routes`, record before the settings of a unit were one record: `DEC-NET-AWS-ROUTE-TABLE-ROUTES`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "routes" of the aws.route_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Re-create the routes with STACKIT next hops for module.vpc.module.vpc.aws_route_table.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm what each route table is associated with** (`subnet-association-target`, record before the settings of a unit were one record: `DEC-NET-AWS-ROUTE-TABLE-SUBNET-ASSOCIATION-TARGET`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "subnet-association-target" of the aws.route_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Carry out the manual work the plan names for module.vpc.module.vpc.aws_route_table.private outside the draft; the plan states no title for it. - **Confirm the network of the route table** (`tcr-route-table-vpc-id`, record before the settings of a unit were one record: `DEC-NET-AWS-ROUTE-TABLE-TCR-ROUTE-TABLE-VPC-ID`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "the VPC ID of the route table" of the aws.route_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Confirm the network of the route table for module.vpc.module.vpc.aws_route_table.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (8) - `module.vpc.module.vpc.aws_route_table.private|egress-restriction` - `module.vpc.module.vpc.aws_route_table.private|nat-fixed-egress-address` - `module.vpc.module.vpc.aws_route_table.private|network-topology-boundary` - `module.vpc.module.vpc.aws_route_table.private|route-destinations` - `module.vpc.module.vpc.aws_route_table.private|route-targets` - `module.vpc.module.vpc.aws_route_table.private|routes` - `module.vpc.module.vpc.aws_route_table.private|subnet-association-target` - `module.vpc.module.vpc.aws_route_table.private|tcr-route-table-vpc-id` **Instances of `module.vpc.module.vpc.aws_route_table.private` for `egress-restriction`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Instances of `module.vpc.module.vpc.aws_route_table.private` for `nat-fixed-egress-address`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Instances of `module.vpc.module.vpc.aws_route_table.private` for `network-topology-boundary`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Instances of `module.vpc.module.vpc.aws_route_table.private` for `route-destinations`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Instances of `module.vpc.module.vpc.aws_route_table.private` for `route-targets`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Instances of `module.vpc.module.vpc.aws_route_table.private` for `routes`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Instances of `module.vpc.module.vpc.aws_route_table.private` for `subnet-association-target`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Instances of `module.vpc.module.vpc.aws_route_table.private` for `tcr-route-table-vpc-id`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Affected units** (1) - `module.vpc.module.vpc.aws_route_table.private` ### module.vpc.module.vpc.aws_route_table.public (1 record) #### DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC Why: The knowledge base cannot decide 5 critical settings of module.vpc.module.vpc.aws_route_table.public: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 5 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them. The review step of the execution plan for these settings is MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings. | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.route_table | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Owner role | Network Architect | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Open critical semantics (unit and semantic) | 5 | | Affected units | 1 | | Affected applications | 0 | | Applications touched | none: no applications file was given and no suggested group holds an affected unit | | Wave | not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in foundation | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:4381bcffbb8aba26ae5ac648a21eb6de290d0ac6a31e8dcfe9735ff5bb04a8aa` | **Settings** (5) - **Confirm that the project is the boundary of one network** (`network-topology-boundary`, record before the settings of a unit were one record: `DEC-NET-AWS-ROUTE-TABLE-NETWORK-TOPOLOGY-BOUNDARY`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "network-topology-boundary" of the aws.route_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Verify on the target for module.vpc.module.vpc.aws_route_table.public: the check, proof or closing evidence is recorded with its result. - **Confirm the destinations of the routes** (`route-destinations`, record before the settings of a unit were one record: `DEC-NET-AWS-ROUTE-TABLE-ROUTE-DESTINATIONS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "route-destinations" of the aws.route_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Confirm the destinations of the routes for module.vpc.module.vpc.aws_route_table.public, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the targets of the routes** (`route-targets`, record before the settings of a unit were one record: `DEC-NET-AWS-ROUTE-TABLE-ROUTE-TARGETS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "route-targets" of the aws.route_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Confirm the targets of the routes for module.vpc.module.vpc.aws_route_table.public, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Re-create the routes with STACKIT next hops** (`routes`, record before the settings of a unit were one record: `DEC-NET-AWS-ROUTE-TABLE-ROUTES`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "routes" of the aws.route_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Re-create the routes with STACKIT next hops for module.vpc.module.vpc.aws_route_table.public, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the network of the route table** (`tcr-route-table-vpc-id`, record before the settings of a unit were one record: `DEC-NET-AWS-ROUTE-TABLE-TCR-ROUTE-TABLE-VPC-ID`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "the VPC ID of the route table" of the aws.route_table contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Confirm the network of the route table for module.vpc.module.vpc.aws_route_table.public, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (5) - `module.vpc.module.vpc.aws_route_table.public|network-topology-boundary` - `module.vpc.module.vpc.aws_route_table.public|route-destinations` - `module.vpc.module.vpc.aws_route_table.public|route-targets` - `module.vpc.module.vpc.aws_route_table.public|routes` - `module.vpc.module.vpc.aws_route_table.public|tcr-route-table-vpc-id` **Instances of `module.vpc.module.vpc.aws_route_table.public` for `network-topology-boundary`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Instances of `module.vpc.module.vpc.aws_route_table.public` for `route-destinations`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Instances of `module.vpc.module.vpc.aws_route_table.public` for `route-targets`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Instances of `module.vpc.module.vpc.aws_route_table.public` for `routes`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Instances of `module.vpc.module.vpc.aws_route_table.public` for `tcr-route-table-vpc-id`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Affected units** (1) - `module.vpc.module.vpc.aws_route_table.public` ## Critical semantics · aws.secretsmanager_secret (8 records, 10 open items, 0 accepted; status open) Every record under this heading states the same for these fields, and its table does not repeat them: | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.secretsmanager_secret | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Affected applications | 0 | | Approval | not approved: no decisions file was given with this run | | Recommended option | none | **Settings that recur under this heading** (2). A record that lists one of them names it and its next step; the setting is said here: - **Confirm the name of the Secrets Manager secret** (`tc-secretsmanager-secret-name`, record before the settings of a unit were one record: `DEC-OPS-AWS-SECRETSMANAGER-SECRET-TC-SECRETSMANAGER-SECRET-NAME`) - Why: The knowledge base cannot decide "the name of the Secrets Manager secret" of the aws.secretsmanager_secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Review the secret value setting** (`secret-value`, record before the settings of a unit were one record: `DEC-SEC-AWS-SECRETSMANAGER-SECRET-SECRET-VALUE`) - Why: The knowledge base cannot decide "secret-value" of the aws.secretsmanager_secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. ### module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (2 records) #### DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB Why: The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. | Field | Value | |---|---| | Owner role | Platform Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; module.retail_app_ecs.aws_secretsmanager_secret.catalog_db is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders | | Wave | wave 5 · steps in security | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:195cb41bddbb96ebcec7e0f37d5f2f429896503f4ae7885eefe450c77faddf70` | **Settings** (1) - **Confirm the name of the Secrets Manager secret** (`tc-secretsmanager-secret-name`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db: the check, proof or closing evidence is recorded with its result. **Open critical semantics (unit and semantic)** (1) - `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db|tc-secretsmanager-secret-name` **Affected units** (1) - `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db` #### DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB Why: The knowledge base cannot decide 2 critical settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db/open-settings-security-architect. | Field | Value | |---|---| | Owner role | Security Architect | | Open critical semantics (unit and semantic) | 2 | | Affected units | 1 | | Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; module.retail_app_ecs.aws_secretsmanager_secret.catalog_db is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders | | Wave | wave 5 · steps in security | | Options | the options are those of the settings: 1 setting of them list options, below | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:3648ebb527da2bc96efc5425a387853eeeef8b1af4da2208b4326214e2fe9417` | **Settings** (2) - **Confirm the customer-managed encryption key** (`customer-managed-key`, record before the settings of a unit were one record: `DEC-SEC-AWS-SECRETSMANAGER-SECRET-CUSTOMER-MANAGED-KEY`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "customer-managed-key" of the aws.secretsmanager_secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Verify on the target for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db: the check, proof or closing evidence is recorded with its result. - Option `kms-key-on-the-secrets-manager-instance`: Encrypt the Secrets Manager instance with a key of the STACKIT KMS. The instance gets a kms_key (key ring, key, key version and the service account that performs the key operations, which holds at least the Secrets Manager Reader role) and all its secret values are encrypted with that key; a key version change re-encrypts the stored secrets. The key belongs to the instance: secrets that used different AWS keys and must stay under different keys belong in different instances. The configuration is available by API and the provider; the portal does not offer it. A review records the choice and closes no critical setting by itself. **Trade-off:** its effect on the steps is not stated: an answer frees nothing. - Option `accept-an-instance-without-a-customer-key`: Use the Secrets Manager instance without a customer key. The instance has no kms_key and the secret values are not under a key the customer controls. The pages read describe encryption with a KMS key as optional and do not state how the values are encrypted at rest without one, so this choice accepts an unstated platform default and not a proven equivalent. The review records who accepts it and the requirement the customer key served. A review records the choice and closes no critical setting by itself. **Trade-off:** its effect on the steps is not stated: an answer frees nothing. - **Review the secret value setting** (`secret-value`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db outside the draft; the plan states no title for it. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (3) - for the platform default: STACKIT's written statement of how the values are encrypted at rest when the instance has no KMS key, since the pages read do not state it - the STACKIT KMS key (key ring, key, key version) and the service account that performs the key operations for the instance, with a role of the Secrets Manager - which AWS keys the secrets used (one key for all, or one per secret), and which secrets must stay under separate keys **Open critical semantics (unit and semantic)** (2) - `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db|customer-managed-key` - `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db|secret-value` **Affected units** (1) - `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db` ### module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (2 records) #### DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E Why: The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. | Field | Value | |---|---| | Owner role | Platform Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders | | Wave | wave 2 · steps in security | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:2073dd961a032b84b2d9831d3f75f110a2575f042a5ea8c79798030c3da3245d` | **Settings** (1) - **Confirm the name of the Secrets Manager secret** (`tc-secretsmanager-secret-name`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch: the check, proof or closing evidence is recorded with its result. **Open critical semantics (unit and semantic)** (1) - `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch|tc-secretsmanager-secret-name` **Affected units** (1) - `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch` #### DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E Why: The knowledge base cannot decide 2 critical settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch/open-settings-security-architect. | Field | Value | |---|---| | Owner role | Security Architect | | Open critical semantics (unit and semantic) | 2 | | Affected units | 1 | | Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders | | Wave | wave 2 · steps in security | | Options | the options are those of the settings: 1 setting of them list options, below | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:ae17628c8cbe0ab8697ae4bb2880130aeee40989541c8f0376736190f705f513` | **Settings** (2) - **Confirm the customer-managed encryption key** (`customer-managed-key`, record before the settings of a unit were one record: `DEC-SEC-AWS-SECRETSMANAGER-SECRET-CUSTOMER-MANAGED-KEY`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "customer-managed-key" of the aws.secretsmanager_secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Verify on the target for module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch: the check, proof or closing evidence is recorded with its result. - Option `kms-key-on-the-secrets-manager-instance`: Encrypt the Secrets Manager instance with a key of the STACKIT KMS. The instance gets a kms_key (key ring, key, key version and the service account that performs the key operations, which holds at least the Secrets Manager Reader role) and all its secret values are encrypted with that key; a key version change re-encrypts the stored secrets. The key belongs to the instance: secrets that used different AWS keys and must stay under different keys belong in different instances. The configuration is available by API and the provider; the portal does not offer it. A review records the choice and closes no critical setting by itself. **Trade-off:** its effect on the steps is not stated: an answer frees nothing. - Option `accept-an-instance-without-a-customer-key`: Use the Secrets Manager instance without a customer key. The instance has no kms_key and the secret values are not under a key the customer controls. The pages read describe encryption with a KMS key as optional and do not state how the values are encrypted at rest without one, so this choice accepts an unstated platform default and not a proven equivalent. The review records who accepts it and the requirement the customer key served. A review records the choice and closes no critical setting by itself. **Trade-off:** its effect on the steps is not stated: an answer frees nothing. - **Review the secret value setting** (`secret-value`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch outside the draft; the plan states no title for it. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (3) - for the platform default: STACKIT's written statement of how the values are encrypted at rest when the instance has no KMS key, since the pages read do not state it - the STACKIT KMS key (key ring, key, key version) and the service account that performs the key operations for the instance, with a role of the Secrets Manager - which AWS keys the secrets used (one key for all, or one per secret), and which secrets must stay under separate keys **Open critical semantics (unit and semantic)** (2) - `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch|customer-managed-key` - `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch|secret-value` **Affected units** (1) - `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch` ### module.retail_app_ecs.aws_secretsmanager_secret.mq (2 records) #### DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ Why: The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.aws_secretsmanager_secret.mq: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. | Field | Value | |---|---| | Owner role | Platform Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 5 · steps in security | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:5fe5a2647141b1c84f8d6ebec8419e93f5cdd3bf7608a08434c32b8983acd76f` | **Settings** (1) - **Confirm the name of the Secrets Manager secret** (`tc-secretsmanager-secret-name`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.aws_secretsmanager_secret.mq: the check, proof or closing evidence is recorded with its result. **Open critical semantics (unit and semantic)** (1) - `module.retail_app_ecs.aws_secretsmanager_secret.mq|tc-secretsmanager-secret-name` **Affected units** (1) - `module.retail_app_ecs.aws_secretsmanager_secret.mq` #### DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ Why: The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.aws_secretsmanager_secret.mq: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. | Field | Value | |---|---| | Owner role | Security Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 5 · steps in security | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:3ae1d83437aa0047401e57a727c9c83c53c975e37cb2489aa208cb01e090a9e2` | **Settings** (1) - **Review the secret value setting** (`secret-value`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.aws_secretsmanager_secret.mq outside the draft; the plan states no title for it. **Open critical semantics (unit and semantic)** (1) - `module.retail_app_ecs.aws_secretsmanager_secret.mq|secret-value` **Affected units** (1) - `module.retail_app_ecs.aws_secretsmanager_secret.mq` ### module.retail_app_ecs.aws_secretsmanager_secret.orders_db (2 records) #### DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB Why: The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.aws_secretsmanager_secret.orders_db: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. | Field | Value | |---|---| | Owner role | Platform Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 5 · steps in security | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:0e7d0853832152461beef7d325cf888b63bc96f93367ca9eaa967f2a0d8d046d` | **Settings** (1) - **Confirm the name of the Secrets Manager secret** (`tc-secretsmanager-secret-name`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.aws_secretsmanager_secret.orders_db: the check, proof or closing evidence is recorded with its result. **Open critical semantics (unit and semantic)** (1) - `module.retail_app_ecs.aws_secretsmanager_secret.orders_db|tc-secretsmanager-secret-name` **Affected units** (1) - `module.retail_app_ecs.aws_secretsmanager_secret.orders_db` #### DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB Why: The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.aws_secretsmanager_secret.orders_db: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. | Field | Value | |---|---| | Owner role | Security Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 5 · steps in security | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:d75d1a13db1394da7b51b43ba4b0a2e89b879d6a844416890877de4f2206469c` | **Settings** (1) - **Review the secret value setting** (`secret-value`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Carry out the manual work the plan names for module.retail_app_ecs.aws_secretsmanager_secret.orders_db outside the draft; the plan states no title for it. **Open critical semantics (unit and semantic)** (1) - `module.retail_app_ecs.aws_secretsmanager_secret.orders_db|secret-value` **Affected units** (1) - `module.retail_app_ecs.aws_secretsmanager_secret.orders_db` ## Critical semantics · aws.security_group (12 records, 76 open items, 0 accepted; status open) Every record under this heading states the same for these fields, and its table does not repeat them: | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.security_group | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Affected applications | 0 | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | **Settings that recur under this heading** (10). A record that lists one of them names it and its next step; the setting is said here: - **Decide the outbound (egress) rules of the security group** (`egress-restriction`, record before the settings of a unit were one record: `DEC-NET-AWS-SECURITY-GROUP-EGRESS-RESTRICTION`) - Why: The knowledge base cannot decide "egress-restriction" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Confirm that the project is the boundary of one network** (`network-topology-boundary`, record before the settings of a unit were one record: `DEC-NET-AWS-SECURITY-GROUP-NETWORK-TOPOLOGY-BOUNDARY`) - Why: The knowledge base cannot decide "network-topology-boundary" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Decide which networks the security group may be attached to (a STACKIT group has no network scope)** (`security-group-vpc-membership`, record before the settings of a unit were one record: `DEC-NET-AWS-SECURITY-GROUP-SECURITY-GROUP-VPC-MEMBERSHIP`) - Why: The knowledge base cannot decide "security-group-vpc-membership" of the aws.security_group contract for 1 unit (not available on STACKIT): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Review the stateful setting** (`stateful`, record before the settings of a unit were one record: `DEC-NET-AWS-SECURITY-GROUP-STATEFUL`) - Why: The knowledge base cannot decide "stateful" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Confirm the ports of the rules of the security group** (`rule-ports`, record before the settings of a unit were one record: `DEC-NET-AWS-SECURITY-GROUP-RULE-PORTS`) - Why: The knowledge base cannot decide "rule-ports" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Review the standalone rule values setting** (`standalone-rule-values`, record before the settings of a unit were one record: `DEC-NET-AWS-SECURITY-GROUP-STANDALONE-RULE-VALUES`) - Why: The knowledge base cannot decide "standalone-rule-values" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Decide how the target enforces the protocol of the outbound rules of the security group** (`egress-rule-protocol`, record before the settings of a unit were one record: `DEC-NET-AWS-SECURITY-GROUP-EGRESS-RULE-PROTOCOL`) - Why: The knowledge base cannot decide "egress-rule-protocol" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Decide how the target enforces the destinations the outbound rules of the security group allow** (`egress-sources`, record before the settings of a unit were one record: `DEC-NET-AWS-SECURITY-GROUP-EGRESS-SOURCES`) - Why: The knowledge base cannot decide "egress-sources" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Confirm the sources the inbound rules of the security group allow** (`ingress-sources`, record before the settings of a unit were one record: `DEC-NET-AWS-SECURITY-GROUP-INGRESS-SOURCES`) - Why: The knowledge base cannot decide "ingress-sources" of the aws.security_group contract for 1 unit (carried into the draft): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - **Confirm the ports of the rules of the security group** (`rule-ports`, record before the settings of a unit were one record: `DEC-NET-AWS-SECURITY-GROUP-RULE-PORTS`) - Why: The knowledge base cannot decide "rule-ports" of the aws.security_group contract for 1 unit (carried into the draft): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. ### module.dependencies.aws_security_group.catalog_opensearch_sg (1 record) #### DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG Why: The knowledge base cannot decide 6 critical settings of module.dependencies.aws_security_group.catalog_opensearch_sg: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 6 | | Affected units | 1 | | Applications touched | `catalog` (PROPOSED) | | Wave | wave 3 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:20e99159b8d629dc059056933c714a05c8d0553031578feda2e55da35374d1f9` | **Settings** (6) - **Decide the outbound (egress) rules of the security group** (`egress-restriction`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.dependencies.aws_security_group.catalog_opensearch_sg: the check, proof or closing evidence is recorded with its result. - **Confirm that the project is the boundary of one network** (`network-topology-boundary`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.dependencies.aws_security_group.catalog_opensearch_sg: the check, proof or closing evidence is recorded with its result. - **Decide which networks the security group may be attached to (a STACKIT group has no network scope)** (`security-group-vpc-membership`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.aws_security_group.catalog_opensearch_sg, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the standalone rule not generated setting** (`standalone-rule-not-generated`, record before the settings of a unit were one record: `DEC-NET-AWS-SECURITY-GROUP-STANDALONE-RULE-NOT-GENERATED`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "standalone-rule-not-generated" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the standalone rule not generated setting for module.dependencies.aws_security_group.catalog_opensearch_sg, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the standalone rule remote not resolved setting** (`standalone-rule-remote-not-resolved`, record before the settings of a unit were one record: `DEC-NET-AWS-SECURITY-GROUP-STANDALONE-RULE-REMOTE-NOT-RESOLVED`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "standalone-rule-remote-not-resolved" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the standalone rule remote not resolved setting for module.dependencies.aws_security_group.catalog_opensearch_sg, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the stateful setting** (`stateful`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the stateful setting for module.dependencies.aws_security_group.catalog_opensearch_sg, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (6) - `module.dependencies.aws_security_group.catalog_opensearch_sg|egress-restriction` - `module.dependencies.aws_security_group.catalog_opensearch_sg|network-topology-boundary` - `module.dependencies.aws_security_group.catalog_opensearch_sg|security-group-vpc-membership` - `module.dependencies.aws_security_group.catalog_opensearch_sg|standalone-rule-not-generated` - `module.dependencies.aws_security_group.catalog_opensearch_sg|standalone-rule-remote-not-resolved` - `module.dependencies.aws_security_group.catalog_opensearch_sg|stateful` **Affected units** (1) - `module.dependencies.aws_security_group.catalog_opensearch_sg` ### module.dependencies.aws_security_group.mq (1 record) #### DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ Why: The knowledge base cannot decide 5 critical settings of module.dependencies.aws_security_group.mq: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.aws_security_group.mq/open-settings. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 5 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 3 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:8c5aaa45532d67ee2d6bcb3a9534148642f01d37c523570686e3fd349d2dee8b` | **Settings** (5) - **Decide the outbound (egress) rules of the security group** (`egress-restriction`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.dependencies.aws_security_group.mq: the check, proof or closing evidence is recorded with its result. - **Confirm that the project is the boundary of one network** (`network-topology-boundary`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.dependencies.aws_security_group.mq: the check, proof or closing evidence is recorded with its result. - **Decide which networks the security group may be attached to (a STACKIT group has no network scope)** (`security-group-vpc-membership`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.aws_security_group.mq, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the standalone rule not generated setting** (`standalone-rule-not-generated`, record before the settings of a unit were one record: `DEC-NET-AWS-SECURITY-GROUP-STANDALONE-RULE-NOT-GENERATED`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "standalone-rule-not-generated" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the standalone rule not generated setting for module.dependencies.aws_security_group.mq, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the stateful setting** (`stateful`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the stateful setting for module.dependencies.aws_security_group.mq, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (5) - `module.dependencies.aws_security_group.mq|egress-restriction` - `module.dependencies.aws_security_group.mq|network-topology-boundary` - `module.dependencies.aws_security_group.mq|security-group-vpc-membership` - `module.dependencies.aws_security_group.mq|standalone-rule-not-generated` - `module.dependencies.aws_security_group.mq|stateful` **Affected units** (1) - `module.dependencies.aws_security_group.mq` ### module.dependencies.module.catalog_rds.aws_security_group.this (1 record) #### DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS Why: The knowledge base cannot decide 6 critical settings of module.dependencies.module.catalog_rds.aws_security_group.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_rds.aws_security_group.this/open-settings. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 6 | | Affected units | 1 | | Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; module.dependencies.module.catalog_rds.aws_security_group.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders | | Wave | wave 3 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:ecc068fbe9a8c1df8ea476fa3e0bcf0744ec368b08040242f186cb86c54b706c` | **Settings** (6) - **Decide the outbound (egress) rules of the security group** (`egress-restriction`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.dependencies.module.catalog_rds.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Confirm that the project is the boundary of one network** (`network-topology-boundary`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.dependencies.module.catalog_rds.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Confirm the ports of the rules of the security group** (`rule-ports`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.dependencies.module.catalog_rds.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Decide which networks the security group may be attached to (a STACKIT group has no network scope)** (`security-group-vpc-membership`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.module.catalog_rds.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the standalone rule values setting** (`standalone-rule-values`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the standalone rule values setting for module.dependencies.module.catalog_rds.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the stateful setting** (`stateful`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the stateful setting for module.dependencies.module.catalog_rds.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (6) - `module.dependencies.module.catalog_rds.aws_security_group.this|egress-restriction` - `module.dependencies.module.catalog_rds.aws_security_group.this|network-topology-boundary` - `module.dependencies.module.catalog_rds.aws_security_group.this|rule-ports` - `module.dependencies.module.catalog_rds.aws_security_group.this|security-group-vpc-membership` - `module.dependencies.module.catalog_rds.aws_security_group.this|standalone-rule-values` - `module.dependencies.module.catalog_rds.aws_security_group.this|stateful` **Affected units** (1) - `module.dependencies.module.catalog_rds.aws_security_group.this` ### module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd (1 record) #### DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0 Why: The knowledge base cannot decide 7 critical settings of module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 7 | | Affected units | 1 | | Applications touched | `checkout` (PROPOSED) | | Wave | wave 3 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:e2caf76ce6b00a72a5bb989dce3f951588e583a80dba6f2f2d83fa3a24d39303` | **Settings** (7) - **Confirm that the project is the boundary of one network** (`network-topology-boundary`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd: the check, proof or closing evidence is recorded with its result. - **Confirm the ports of the rules of the security group** (`rule-ports`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd: the check, proof or closing evidence is recorded with its result. - **Decide which networks the security group may be attached to (a STACKIT group has no network scope)** (`security-group-vpc-membership`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the standalone rule empty sources setting** (`standalone-rule-empty-sources`, record before the settings of a unit were one record: `DEC-NET-AWS-SECURITY-GROUP-STANDALONE-RULE-EMPTY-SOURCES`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "standalone-rule-empty-sources" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the standalone rule empty sources setting for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the standalone rule other sources setting** (`standalone-rule-other-sources`, record before the settings of a unit were one record: `DEC-NET-AWS-SECURITY-GROUP-STANDALONE-RULE-OTHER-SOURCES`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "standalone-rule-other-sources" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the standalone rule other sources setting for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the standalone rule values setting** (`standalone-rule-values`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the standalone rule values setting for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the stateful setting** (`stateful`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the stateful setting for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (7) - `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|network-topology-boundary` - `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|rule-ports` - `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|security-group-vpc-membership` - `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|standalone-rule-empty-sources` - `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|standalone-rule-other-sources` - `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|standalone-rule-values` - `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|stateful` **Affected units** (1) - `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd` ### module.dependencies.module.orders_rds.aws_security_group.this (1 record) #### DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS Why: The knowledge base cannot decide 6 critical settings of module.dependencies.module.orders_rds.aws_security_group.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.orders_rds.aws_security_group.this/open-settings. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 6 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 3 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:c70ab8626c768f56f794aa0d2ead7d41c74347f2a6dcf8782ed4bd599a108b12` | **Settings** (6) - **Decide the outbound (egress) rules of the security group** (`egress-restriction`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.dependencies.module.orders_rds.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Confirm that the project is the boundary of one network** (`network-topology-boundary`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.dependencies.module.orders_rds.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Confirm the ports of the rules of the security group** (`rule-ports`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.dependencies.module.orders_rds.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Decide which networks the security group may be attached to (a STACKIT group has no network scope)** (`security-group-vpc-membership`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.module.orders_rds.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the standalone rule values setting** (`standalone-rule-values`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the standalone rule values setting for module.dependencies.module.orders_rds.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the stateful setting** (`stateful`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the stateful setting for module.dependencies.module.orders_rds.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (6) - `module.dependencies.module.orders_rds.aws_security_group.this|egress-restriction` - `module.dependencies.module.orders_rds.aws_security_group.this|network-topology-boundary` - `module.dependencies.module.orders_rds.aws_security_group.this|rule-ports` - `module.dependencies.module.orders_rds.aws_security_group.this|security-group-vpc-membership` - `module.dependencies.module.orders_rds.aws_security_group.this|standalone-rule-values` - `module.dependencies.module.orders_rds.aws_security_group.this|stateful` **Affected units** (1) - `module.dependencies.module.orders_rds.aws_security_group.this` ### module.retail_app_ecs.module.alb.aws_security_group.this (1 record) #### DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS Why: The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.alb.aws_security_group.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.alb.aws_security_group.this/open-settings. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Applications touched | `ui` (PROPOSED) | | Wave | wave 2 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:8e08c65f886c3621d3760f297a9f0f9270020b298c499881ee4e87eabdfb2c10` | **Settings** (4) - **Decide the outbound (egress) rules of the security group** (`egress-restriction`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.alb.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Confirm that the project is the boundary of one network** (`network-topology-boundary`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.alb.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Decide which networks the security group may be attached to (a STACKIT group has no network scope)** (`security-group-vpc-membership`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.retail_app_ecs.module.alb.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the stateful setting** (`stateful`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the stateful setting for module.retail_app_ecs.module.alb.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (4) - `module.retail_app_ecs.module.alb.aws_security_group.this|egress-restriction` - `module.retail_app_ecs.module.alb.aws_security_group.this|network-topology-boundary` - `module.retail_app_ecs.module.alb.aws_security_group.this|security-group-vpc-membership` - `module.retail_app_ecs.module.alb.aws_security_group.this|stateful` **Affected units** (1) - `module.retail_app_ecs.module.alb.aws_security_group.this` ### module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix (1 record) #### DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862 Why: The knowledge base cannot decide 7 critical settings of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 7 | | Affected units | 1 | | Applications touched | `ui` (PROPOSED) | | Wave | wave 2 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:5eb9ea3019259ced92a0d178966ff7f78a63ab44e0f204fdcc70e4e9dbbbdef2` | **Settings** (7) - **Confirm that the project is the boundary of one network** (`network-topology-boundary`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix: the check, proof or closing evidence is recorded with its result. - **Confirm the ports of the rules of the security group** (`rule-ports`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix: the check, proof or closing evidence is recorded with its result. - **Decide which networks the security group may be attached to (a STACKIT group has no network scope)** (`security-group-vpc-membership`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the standalone rule empty sources setting** (`standalone-rule-empty-sources`, record before the settings of a unit were one record: `DEC-NET-AWS-SECURITY-GROUP-STANDALONE-RULE-EMPTY-SOURCES`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "standalone-rule-empty-sources" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the standalone rule empty sources setting for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the standalone rule other sources setting** (`standalone-rule-other-sources`, record before the settings of a unit were one record: `DEC-NET-AWS-SECURITY-GROUP-STANDALONE-RULE-OTHER-SOURCES`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "standalone-rule-other-sources" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Review the standalone rule other sources setting for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the standalone rule values setting** (`standalone-rule-values`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the standalone rule values setting for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the stateful setting** (`stateful`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the stateful setting for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (7) - `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|network-topology-boundary` - `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|rule-ports` - `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|security-group-vpc-membership` - `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|standalone-rule-empty-sources` - `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|standalone-rule-other-sources` - `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|standalone-rule-values` - `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|stateful` **Affected units** (1) - `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix` ### module.retail_app_ecs.module.carts_service.aws_security_group.this (1 record) #### DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF Why: The knowledge base cannot decide 7 critical settings of module.retail_app_ecs.module.carts_service.aws_security_group.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.carts_service.aws_security_group.this/open-settings. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 7 | | Affected units | 1 | | Applications touched | `carts` (PROPOSED) | | Wave | wave 2 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:d2ce6c8560f61656e20bb6b51a011c7b79ca81012b6e7dda9e01fb0de53751f3` | **Settings** (7) - **Decide how the target enforces the protocol of the outbound rules of the security group** (`egress-rule-protocol`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide how the target enforces the protocol of the outbound rules of the security group for module.retail_app_ecs.module.carts_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Decide how the target enforces the destinations the outbound rules of the security group allow** (`egress-sources`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide how the target enforces the destinations the outbound rules of the security group allow for module.retail_app_ecs.module.carts_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the sources the inbound rules of the security group allow** (`ingress-sources`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.carts_service.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Confirm that the project is the boundary of one network** (`network-topology-boundary`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.carts_service.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Confirm the ports of the rules of the security group** (`rule-ports`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.carts_service.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Decide which networks the security group may be attached to (a STACKIT group has no network scope)** (`security-group-vpc-membership`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.retail_app_ecs.module.carts_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the stateful setting** (`stateful`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the stateful setting for module.retail_app_ecs.module.carts_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (7) - `module.retail_app_ecs.module.carts_service.aws_security_group.this|egress-rule-protocol` - `module.retail_app_ecs.module.carts_service.aws_security_group.this|egress-sources` - `module.retail_app_ecs.module.carts_service.aws_security_group.this|ingress-sources` - `module.retail_app_ecs.module.carts_service.aws_security_group.this|network-topology-boundary` - `module.retail_app_ecs.module.carts_service.aws_security_group.this|rule-ports` - `module.retail_app_ecs.module.carts_service.aws_security_group.this|security-group-vpc-membership` - `module.retail_app_ecs.module.carts_service.aws_security_group.this|stateful` **Affected units** (1) - `module.retail_app_ecs.module.carts_service.aws_security_group.this` ### module.retail_app_ecs.module.catalog_service.aws_security_group.this (1 record) #### DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F Why: The knowledge base cannot decide 7 critical settings of module.retail_app_ecs.module.catalog_service.aws_security_group.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_security_group.this/open-settings. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 7 | | Affected units | 1 | | Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; module.retail_app_ecs.module.catalog_service.aws_security_group.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders | | Wave | wave 2 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:533d0003c31ab197546f7c4f8d22e3c3bf725e8b7395b5d3ea21b3278fdb62b3` | **Settings** (7) - **Decide how the target enforces the protocol of the outbound rules of the security group** (`egress-rule-protocol`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide how the target enforces the protocol of the outbound rules of the security group for module.retail_app_ecs.module.catalog_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Decide how the target enforces the destinations the outbound rules of the security group allow** (`egress-sources`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide how the target enforces the destinations the outbound rules of the security group allow for module.retail_app_ecs.module.catalog_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the sources the inbound rules of the security group allow** (`ingress-sources`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.catalog_service.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Confirm that the project is the boundary of one network** (`network-topology-boundary`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.catalog_service.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Confirm the ports of the rules of the security group** (`rule-ports`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.catalog_service.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Decide which networks the security group may be attached to (a STACKIT group has no network scope)** (`security-group-vpc-membership`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.retail_app_ecs.module.catalog_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the stateful setting** (`stateful`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the stateful setting for module.retail_app_ecs.module.catalog_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (7) - `module.retail_app_ecs.module.catalog_service.aws_security_group.this|egress-rule-protocol` - `module.retail_app_ecs.module.catalog_service.aws_security_group.this|egress-sources` - `module.retail_app_ecs.module.catalog_service.aws_security_group.this|ingress-sources` - `module.retail_app_ecs.module.catalog_service.aws_security_group.this|network-topology-boundary` - `module.retail_app_ecs.module.catalog_service.aws_security_group.this|rule-ports` - `module.retail_app_ecs.module.catalog_service.aws_security_group.this|security-group-vpc-membership` - `module.retail_app_ecs.module.catalog_service.aws_security_group.this|stateful` **Affected units** (1) - `module.retail_app_ecs.module.catalog_service.aws_security_group.this` ### module.retail_app_ecs.module.checkout_service.aws_security_group.this (1 record) #### DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F Why: The knowledge base cannot decide 7 critical settings of module.retail_app_ecs.module.checkout_service.aws_security_group.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_security_group.this/open-settings. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 7 | | Affected units | 1 | | Applications touched | `checkout` (PROPOSED) | | Wave | wave 2 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:9d37a2eef4e29a3cb7c4a4bac8afc4bf54d07043772e5a624d09c77aa3ddb8ae` | **Settings** (7) - **Decide how the target enforces the protocol of the outbound rules of the security group** (`egress-rule-protocol`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide how the target enforces the protocol of the outbound rules of the security group for module.retail_app_ecs.module.checkout_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Decide how the target enforces the destinations the outbound rules of the security group allow** (`egress-sources`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide how the target enforces the destinations the outbound rules of the security group allow for module.retail_app_ecs.module.checkout_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the sources the inbound rules of the security group allow** (`ingress-sources`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.checkout_service.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Confirm that the project is the boundary of one network** (`network-topology-boundary`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.checkout_service.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Confirm the ports of the rules of the security group** (`rule-ports`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.checkout_service.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Decide which networks the security group may be attached to (a STACKIT group has no network scope)** (`security-group-vpc-membership`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.retail_app_ecs.module.checkout_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the stateful setting** (`stateful`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the stateful setting for module.retail_app_ecs.module.checkout_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (7) - `module.retail_app_ecs.module.checkout_service.aws_security_group.this|egress-rule-protocol` - `module.retail_app_ecs.module.checkout_service.aws_security_group.this|egress-sources` - `module.retail_app_ecs.module.checkout_service.aws_security_group.this|ingress-sources` - `module.retail_app_ecs.module.checkout_service.aws_security_group.this|network-topology-boundary` - `module.retail_app_ecs.module.checkout_service.aws_security_group.this|rule-ports` - `module.retail_app_ecs.module.checkout_service.aws_security_group.this|security-group-vpc-membership` - `module.retail_app_ecs.module.checkout_service.aws_security_group.this|stateful` **Affected units** (1) - `module.retail_app_ecs.module.checkout_service.aws_security_group.this` ### module.retail_app_ecs.module.orders_service.aws_security_group.this (1 record) #### DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3 Why: The knowledge base cannot decide 7 critical settings of module.retail_app_ecs.module.orders_service.aws_security_group.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.orders_service.aws_security_group.this/open-settings. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 7 | | Affected units | 1 | | Applications touched | `orders` (PROPOSED) | | Wave | wave 2 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:6761ee5382c2046f852e12938f4868f00aa72c16f7060930ffb775b9e048cb7e` | **Settings** (7) - **Decide how the target enforces the protocol of the outbound rules of the security group** (`egress-rule-protocol`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide how the target enforces the protocol of the outbound rules of the security group for module.retail_app_ecs.module.orders_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Decide how the target enforces the destinations the outbound rules of the security group allow** (`egress-sources`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide how the target enforces the destinations the outbound rules of the security group allow for module.retail_app_ecs.module.orders_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the sources the inbound rules of the security group allow** (`ingress-sources`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.orders_service.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Confirm that the project is the boundary of one network** (`network-topology-boundary`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.orders_service.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Confirm the ports of the rules of the security group** (`rule-ports`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.orders_service.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Decide which networks the security group may be attached to (a STACKIT group has no network scope)** (`security-group-vpc-membership`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.retail_app_ecs.module.orders_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the stateful setting** (`stateful`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the stateful setting for module.retail_app_ecs.module.orders_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (7) - `module.retail_app_ecs.module.orders_service.aws_security_group.this|egress-rule-protocol` - `module.retail_app_ecs.module.orders_service.aws_security_group.this|egress-sources` - `module.retail_app_ecs.module.orders_service.aws_security_group.this|ingress-sources` - `module.retail_app_ecs.module.orders_service.aws_security_group.this|network-topology-boundary` - `module.retail_app_ecs.module.orders_service.aws_security_group.this|rule-ports` - `module.retail_app_ecs.module.orders_service.aws_security_group.this|security-group-vpc-membership` - `module.retail_app_ecs.module.orders_service.aws_security_group.this|stateful` **Affected units** (1) - `module.retail_app_ecs.module.orders_service.aws_security_group.this` ### module.retail_app_ecs.module.ui_service.aws_security_group.this (1 record) #### DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS Why: The knowledge base cannot decide 7 critical settings of module.retail_app_ecs.module.ui_service.aws_security_group.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.ui_service.aws_security_group.this/open-settings. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 7 | | Affected units | 1 | | Applications touched | `ui` (PROPOSED) | | Wave | wave 2 · steps in security | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:d3db27e38c1fef4dfc310642c956f0cd27d824826e599bedf54475accbc6fe8c` | **Settings** (7) - **Decide how the target enforces the protocol of the outbound rules of the security group** (`egress-rule-protocol`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide how the target enforces the protocol of the outbound rules of the security group for module.retail_app_ecs.module.ui_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Decide how the target enforces the destinations the outbound rules of the security group allow** (`egress-sources`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide how the target enforces the destinations the outbound rules of the security group allow for module.retail_app_ecs.module.ui_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm the sources the inbound rules of the security group allow** (`ingress-sources`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.ui_service.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Confirm that the project is the boundary of one network** (`network-topology-boundary`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.ui_service.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Confirm the ports of the rules of the security group** (`rule-ports`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Verify on the target for module.retail_app_ecs.module.ui_service.aws_security_group.this: the check, proof or closing evidence is recorded with its result. - **Decide which networks the security group may be attached to (a STACKIT group has no network scope)** (`security-group-vpc-membership`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.retail_app_ecs.module.ui_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Review the stateful setting** (`stateful`): Open: no decision of the record has been taken (the setting is said under the heading of the group) - Next: Review the stateful setting for module.retail_app_ecs.module.ui_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). **Open critical semantics (unit and semantic)** (7) - `module.retail_app_ecs.module.ui_service.aws_security_group.this|egress-rule-protocol` - `module.retail_app_ecs.module.ui_service.aws_security_group.this|egress-sources` - `module.retail_app_ecs.module.ui_service.aws_security_group.this|ingress-sources` - `module.retail_app_ecs.module.ui_service.aws_security_group.this|network-topology-boundary` - `module.retail_app_ecs.module.ui_service.aws_security_group.this|rule-ports` - `module.retail_app_ecs.module.ui_service.aws_security_group.this|security-group-vpc-membership` - `module.retail_app_ecs.module.ui_service.aws_security_group.this|stateful` **Affected units** (1) - `module.retail_app_ecs.module.ui_service.aws_security_group.this` ## Critical semantics · aws.subnet (4 records, 11 open items, 0 accepted; status open) Every record under this heading states the same for these fields, and its table does not repeat them: | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.subnet | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Affected applications | 0 | | Applications touched | none: no applications file was given and no suggested group holds an affected unit | | Wave | not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in foundation | | Approval | not approved: no decisions file was given with this run | | Recommended option | none | ### module.vpc.module.vpc.aws_subnet.private (2 records) #### DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE Why: The knowledge base cannot decide 4 critical settings of module.vpc.module.vpc.aws_subnet.private: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 4 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them. The review step of the execution plan for these settings is MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 4 | | Affected units | 1 | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:b1a497b9caa9da516a8ceb6a9547cf01be0e17d4e1b868091441dfc57a5ebc5c` | **Settings** (4) - **Confirm that the project is the boundary of one network** (`network-topology-boundary`, record before the settings of a unit were one record: `DEC-NET-AWS-SUBNET-NETWORK-TOPOLOGY-BOUNDARY`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "network-topology-boundary" of the aws.subnet contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Verify on the target for module.vpc.module.vpc.aws_subnet.private: the check, proof or closing evidence is recorded with its result. - **Review the prefix setting** (`prefix`, record before the settings of a unit were one record: `DEC-NET-AWS-SUBNET-PREFIX`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "prefix" of the aws.subnet contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Review the prefix setting for module.vpc.module.vpc.aws_subnet.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Decide how private servers reach the internet (outbound IPv4)** (`private-egress-ipv4`, record before the settings of a unit were one record: `DEC-NET-AWS-SUBNET-PRIVATE-EGRESS-IPV4`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "private-egress-ipv4" of the aws.subnet contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Decide how private servers reach the internet (outbound IPv4) for module.vpc.module.vpc.aws_subnet.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm which network each subnet belongs to** (`subnet-vpc-membership`, record before the settings of a unit were one record: `DEC-NET-AWS-SUBNET-SUBNET-VPC-MEMBERSHIP`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "subnet-vpc-membership" of the aws.subnet contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Verify on the target for module.vpc.module.vpc.aws_subnet.private: the check, proof or closing evidence is recorded with its result. **Open critical semantics (unit and semantic)** (4) - `module.vpc.module.vpc.aws_subnet.private|network-topology-boundary` - `module.vpc.module.vpc.aws_subnet.private|prefix` - `module.vpc.module.vpc.aws_subnet.private|private-egress-ipv4` - `module.vpc.module.vpc.aws_subnet.private|subnet-vpc-membership` **Instances of `module.vpc.module.vpc.aws_subnet.private` for `network-topology-boundary`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Instances of `module.vpc.module.vpc.aws_subnet.private` for `prefix`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Instances of `module.vpc.module.vpc.aws_subnet.private` for `private-egress-ipv4`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Instances of `module.vpc.module.vpc.aws_subnet.private` for `subnet-vpc-membership`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Affected units** (1) - `module.vpc.module.vpc.aws_subnet.private` #### DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE Why: The knowledge base cannot decide 1 critical setting of module.vpc.module.vpc.aws_subnet.private: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them. | Field | Value | |---|---| | Owner role | Platform Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Options | the options are those of the settings: 1 setting of them list options, below | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:5f69f9a245d1ee7220cd5f7ae8dd7d6c63754281e22d38e57ece0dd324c9f7ca` | **Settings** (1) - **Confirm the availability zone of the subnet** (`availability-zone`, record before the settings of a unit were one record: `DEC-OPS-AWS-SUBNET-AVAILABILITY-ZONE`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "availability-zone" of the aws.subnet contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Confirm the availability zone of the subnet for module.vpc.module.vpc.aws_subnet.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - Option `accept-the-availability-zone-difference`: Accept the availability-zone difference of the placement the draft writes for the servers of the subnet. The servers the subnet places stay, each with its volumes, in the one Single-AZ zone the regenerated draft writes for them; the STACKIT network of the subnet is regional. A Single-AZ server is not restarted in another zone when its zone fails and its volumes are not mirrored to another zone, so a zone outage takes down what sits in that zone. The Metro zone is no spread either: it restarts a single instance in another zone and may place all instances in one zone. The review accepts that difference with the source zone layout, the target placement of each server, the failure-domain difference, the recovery expectation (RTO and RPO) and the verification it requires; the check then closes as an accepted design change bound to the draft that writes those placements, and frees nothing else. **Trade-off:** the draft already carries it out, so the answer frees the steps that wait for it. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (4) - the failure-domain difference, named: a Single-AZ server is not restarted in another zone, and its volumes are not mirrored to another zone - the recovery expectation (RTO and RPO) the accepted placement has to meet, and the verification that shows it does - the source zone layout: which AWS zone each subnet is in and which servers it places there - the target placement of the servers of each subnet, as the regenerated draft writes it (target.placement.availability_zone answered); a STACKIT network is regional and has no zone **Open critical semantics (unit and semantic)** (1) - `module.vpc.module.vpc.aws_subnet.private|availability-zone` **Instances of `module.vpc.module.vpc.aws_subnet.private` for `availability-zone`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Affected units** (1) - `module.vpc.module.vpc.aws_subnet.private` ### module.vpc.module.vpc.aws_subnet.public (2 records) #### DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC Why: The knowledge base cannot decide 5 critical settings of module.vpc.module.vpc.aws_subnet.public: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 5 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them. The review step of the execution plan for these settings is MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect. | Field | Value | |---|---| | Owner role | Network Architect | | Open critical semantics (unit and semantic) | 5 | | Affected units | 1 | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:755f2761ac8b2e8f203b7be58efc5948a0633f72c4f5eadcad7fafd1ed820427` | **Settings** (5) - **Confirm which route table each subnet really uses** (`effective-route-table`, record before the settings of a unit were one record: `DEC-NET-AWS-SUBNET-EFFECTIVE-ROUTE-TABLE`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "effective-route-table" of the aws.subnet contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Carry out the manual work the plan names for module.vpc.module.vpc.aws_subnet.public outside the draft; the plan states no title for it. - **Confirm that the project is the boundary of one network** (`network-topology-boundary`, record before the settings of a unit were one record: `DEC-NET-AWS-SUBNET-NETWORK-TOPOLOGY-BOUNDARY`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "network-topology-boundary" of the aws.subnet contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Verify on the target for module.vpc.module.vpc.aws_subnet.public: the check, proof or closing evidence is recorded with its result. - **Review the prefix setting** (`prefix`, record before the settings of a unit were one record: `DEC-NET-AWS-SUBNET-PREFIX`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "prefix" of the aws.subnet contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Review the prefix setting for module.vpc.module.vpc.aws_subnet.public, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Decide how private servers reach the internet (outbound IPv4)** (`private-egress-ipv4`, record before the settings of a unit were one record: `DEC-NET-AWS-SUBNET-PRIVATE-EGRESS-IPV4`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "private-egress-ipv4" of the aws.subnet contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Decide how private servers reach the internet (outbound IPv4) for module.vpc.module.vpc.aws_subnet.public, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - **Confirm which network each subnet belongs to** (`subnet-vpc-membership`, record before the settings of a unit were one record: `DEC-NET-AWS-SUBNET-SUBNET-VPC-MEMBERSHIP`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "subnet-vpc-membership" of the aws.subnet contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Verify on the target for module.vpc.module.vpc.aws_subnet.public: the check, proof or closing evidence is recorded with its result. **Open critical semantics (unit and semantic)** (5) - `module.vpc.module.vpc.aws_subnet.public|effective-route-table` - `module.vpc.module.vpc.aws_subnet.public|network-topology-boundary` - `module.vpc.module.vpc.aws_subnet.public|prefix` - `module.vpc.module.vpc.aws_subnet.public|private-egress-ipv4` - `module.vpc.module.vpc.aws_subnet.public|subnet-vpc-membership` **Instances of `module.vpc.module.vpc.aws_subnet.public` for `effective-route-table`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Instances of `module.vpc.module.vpc.aws_subnet.public` for `network-topology-boundary`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Instances of `module.vpc.module.vpc.aws_subnet.public` for `prefix`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Instances of `module.vpc.module.vpc.aws_subnet.public` for `private-egress-ipv4`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Instances of `module.vpc.module.vpc.aws_subnet.public` for `subnet-vpc-membership`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Affected units** (1) - `module.vpc.module.vpc.aws_subnet.public` #### DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC Why: The knowledge base cannot decide 1 critical setting of module.vpc.module.vpc.aws_subnet.public: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them. | Field | Value | |---|---| | Owner role | Platform Architect | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Options | the options are those of the settings: 1 setting of them list options, below | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:011643d2054f5f8478b444cf7895470f87a6d43d3f75c6ef3ff169fcdffdbdc3` | **Settings** (1) - **Confirm the availability zone of the subnet** (`availability-zone`, record before the settings of a unit were one record: `DEC-OPS-AWS-SUBNET-AVAILABILITY-ZONE`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "availability-zone" of the aws.subnet contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input. - Next: Confirm the availability zone of the subnet for module.vpc.module.vpc.aws_subnet.public, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml). - Option `accept-the-availability-zone-difference`: Accept the availability-zone difference of the placement the draft writes for the servers of the subnet. The servers the subnet places stay, each with its volumes, in the one Single-AZ zone the regenerated draft writes for them; the STACKIT network of the subnet is regional. A Single-AZ server is not restarted in another zone when its zone fails and its volumes are not mirrored to another zone, so a zone outage takes down what sits in that zone. The Metro zone is no spread either: it restarts a single instance in another zone and may place all instances in one zone. The review accepts that difference with the source zone layout, the target placement of each server, the failure-domain difference, the recovery expectation (RTO and RPO) and the verification it requires; the check then closes as an accepted design change bound to the draft that writes those placements, and frees nothing else. **Trade-off:** the draft already carries it out, so the answer frees the steps that wait for it. **Required evidence (the plan's reasons, then what the knowledge base asks for)** (4) - the failure-domain difference, named: a Single-AZ server is not restarted in another zone, and its volumes are not mirrored to another zone - the recovery expectation (RTO and RPO) the accepted placement has to meet, and the verification that shows it does - the source zone layout: which AWS zone each subnet is in and which servers it places there - the target placement of the servers of each subnet, as the regenerated draft writes it (target.placement.availability_zone answered); a STACKIT network is regional and has no zone **Open critical semantics (unit and semantic)** (1) - `module.vpc.module.vpc.aws_subnet.public|availability-zone` **Instances of `module.vpc.module.vpc.aws_subnet.public` for `availability-zone`**: not read instance by instance (unknown_count: the number of instances is not known statically) **Affected units** (1) - `module.vpc.module.vpc.aws_subnet.public` ## Critical semantics · aws.vpc (2 records, 6 open items, 0 accepted; status open) ### module.vpc.module.vpc.aws_vpc.this (2 records) #### DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS Why: The knowledge base cannot decide 5 critical settings of module.vpc.module.vpc.aws_vpc.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect. | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.vpc | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Owner role | Network Architect | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Open critical semantics (unit and semantic) | 5 | | Affected units | 1 | | Affected applications | 0 | | Applications touched | none: no applications file was given and no suggested group holds an affected unit | | Wave | wave 1 · steps in foundation | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:4865af5a8e50259aa89eda3cb3004ce9ea97b5c15f0b1eca3b8d2b5c3f3514dd` | **Settings** (5) - **Review the default nacl rules setting** (`default-nacl-rules`, record before the settings of a unit were one record: `DEC-NET-AWS-VPC-DEFAULT-NACL-RULES`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "default-nacl-rules" of the aws.vpc contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Carry out the manual work the plan names for module.vpc.module.vpc.aws_vpc.this outside the draft; the plan states no title for it. - **Review the default route table setting** (`default-route-table`, record before the settings of a unit were one record: `DEC-NET-AWS-VPC-DEFAULT-ROUTE-TABLE`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "default-route-table" of the aws.vpc contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Verify on the target for module.vpc.module.vpc.aws_vpc.this: the check, proof or closing evidence is recorded with its result. - **Review the default security group omitted direction setting** (`default-security-group-omitted-direction`, record before the settings of a unit were one record: `DEC-NET-AWS-VPC-DEFAULT-SECURITY-GROUP-OMITTED-DIRECTION`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "default-security-group-omitted-direction" of the aws.vpc contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Verify on the target for module.vpc.module.vpc.aws_vpc.this: the check, proof or closing evidence is recorded with its result. - **Review the main table set setting** (`main-table-set`, record before the settings of a unit were one record: `DEC-NET-AWS-VPC-MAIN-TABLE-SET`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "main-table-set" of the aws.vpc contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Verify on the target for module.vpc.module.vpc.aws_vpc.this: the check, proof or closing evidence is recorded with its result. - **Confirm that the project is the boundary of one network** (`network-topology-boundary`, record before the settings of a unit were one record: `DEC-NET-AWS-VPC-NETWORK-TOPOLOGY-BOUNDARY`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "network-topology-boundary" of the aws.vpc contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Verify on the target for module.vpc.module.vpc.aws_vpc.this: the check, proof or closing evidence is recorded with its result. **Open critical semantics (unit and semantic)** (5) - `module.vpc.module.vpc.aws_vpc.this|default-nacl-rules` - `module.vpc.module.vpc.aws_vpc.this|default-route-table` - `module.vpc.module.vpc.aws_vpc.this|default-security-group-omitted-direction` - `module.vpc.module.vpc.aws_vpc.this|main-table-set` - `module.vpc.module.vpc.aws_vpc.this|network-topology-boundary` **Affected units** (1) - `module.vpc.module.vpc.aws_vpc.this` #### DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS Why: The knowledge base cannot decide 1 critical setting of module.vpc.module.vpc.aws_vpc.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. | Field | Value | |---|---| | Kind | `the critical settings of a unit` | | Source | open critical semantic | | Family | aws.vpc | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Owner role | Platform Architect | | Required by phase | not stated: the plan names no phase for this decision | | Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading | | Open critical semantics (unit and semantic) | 1 | | Affected units | 1 | | Affected applications | 0 | | Applications touched | none: no applications file was given and no suggested group holds an affected unit | | Wave | wave 1 · steps in foundation | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:922a8c15b2b7499818c932ef55606b1e59f94f004ed39d782da13bce247b427c` | **Settings** (1) - **Confirm how names resolve for the servers of the migrated networks** (`dns-settings`, record before the settings of a unit were one record: `DEC-OPS-AWS-VPC-DNS-SETTINGS`): Open: no decision of the record has been taken - Why: The knowledge base cannot decide "dns-settings" of the aws.vpc contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. - Next: Verify on the target for module.vpc.module.vpc.aws_vpc.this: the check, proof or closing evidence is recorded with its result. **Open critical semantics (unit and semantic)** (1) - `module.vpc.module.vpc.aws_vpc.this|dns-settings` **Affected units** (1) - `module.vpc.module.vpc.aws_vpc.this` ## Manual actions · stackitlogs (3 records, 3 open items, 0 accepted; status open) Every record under this heading states the same for these fields, and its table does not repeat them: | Field | Value | |---|---| | Source | manual actions of the plan | | Family | stackitlogs | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | technical validation passed | | Required by phase | before the cutover | | Blocking effect | a person does this step outside the draft: StackToIT neither does it nor verifies it | | Affected applications | 0 | | Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: carts, catalog, checkout, orders, ui | | Wave | wave 1 · steps in platform services | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | ### archive flow (1 record) #### DEC-OPS-STACKITLOGS-ACTION-ARCHIVE-FLOW Why: The plan of the draft lists the stackitlogs manual action kind "archive flow" (1 action): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan. | Field | Value | |---|---| | Kind | `archive flow` | | Owner role | Platform Architect | | Manual actions | 1 | | Affected units | 1 | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:bb64988972ed356df4aa14fc8e54b8401f2f06a46c9738974e9ce41147d7a9f6` | **Manual actions** (1) - alias `stackitlogs:archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks` **Affected units** (1) - `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks` ### label convention (1 record) #### DEC-OPS-STACKITLOGS-ACTION-LABEL-CONVENTION Why: The plan of the draft lists the stackitlogs manual action kind "label convention" (1 action): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan. | Field | Value | |---|---| | Kind | `label convention` | | Owner role | Platform Architect | | Manual actions | 1 | | Affected units | 1 | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:b58c0c06f680feba6220276e5fbad92f2c72b3b306439aa1b3976d3534797a14` | **Manual actions** (1) - alias `stackitlogs:label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks` **Affected units** (1) - `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks` ### target precondition (1 record) #### DEC-OPS-STACKITLOGS-ACTION-TARGET-PRECONDITION Why: The plan of the draft lists the stackitlogs manual action kind "target precondition" (1 action): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan. | Field | Value | |---|---| | Kind | `target precondition` | | Owner role | Platform Architect | | Manual actions | 1 | | Affected units | 1 | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:869fcb456492cde1234d12ef703bdb950ac8fd8e22799b1525a5563d29e506d0` | **Manual actions** (1) - alias `stackitlogs:token:stackit_logs_instance.logs_retention_180d` **Affected units** (1) - `module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks` ## Manual actions · stackitsg (2 records, 4 open items, 0 accepted; status open) ### incomplete (1 record) #### DEC-SEC-STACKITSG-ACTION-INCOMPLETE Why: The plan of the draft lists the stackitsg manual action kind "incomplete" (2 actions): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan. | Field | Value | |---|---| | Kind | `incomplete` | | Source | manual actions of the plan | | Family | stackitsg | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | technical validation passed | | Owner role | Security Architect | | Required by phase | before the pilot | | Blocking effect | a person does this step outside the draft: StackToIT neither does it nor verifies it | | Manual actions | 2 | | Affected units | 1 | | Affected applications | 0 | | Applications touched | `ui` (PROPOSED) | | Wave | wave 2 · steps in security | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:246f8bd919be5928fd53549dda1b5936212a68d1c144c86e55d5ed6b3e165741` | **Manual actions** (2) - alias `awssg:incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules` - alias `awssg:incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules` **Affected units** (1) - `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix` ### unplaced (1 record) #### DEC-SEC-STACKITSG-ACTION-UNPLACED Why: The plan of the draft lists the stackitsg manual action kind "unplaced" (2 actions): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan. | Field | Value | |---|---| | Kind | `unplaced` | | Source | manual actions of the plan | | Family | stackitsg | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | technical validation passed | | Owner role | Security Architect | | Required by phase | before the pilot | | Blocking effect | a person does this step outside the draft: StackToIT neither does it nor verifies it | | Manual actions | 2 | | Affected units | 1 | | Affected applications | 0 | | Applications touched | `ui` (PROPOSED) | | Wave | wave 2 · steps in prepare | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:c30c890a1799d91f5c3dd6213a6e7ae3d8c381d635b1bb48ea9a45e4efebf255` | **Manual actions** (2) - alias `awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0]` - alias `awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0]` **Affected units** (1) - `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix` ## Plan statements · stackitroute (1 record, 2 open items, 0 accepted; status open) ### not drafted (1 record) #### DEC-NET-STACKITROUTE-STATEMENT-NOT-DRAFTED Why: The stackitroute plan of the draft writes no resource for 2 units and states why (no resource is written for the unit and the plan names a step beside it): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan. | Field | Value | |---|---| | Kind | `not drafted` | | Source | open statements of the plan about units it writes no resource for | | Family | stackitroute | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Owner role | Network Architect | | Required by phase | before the pilot | | Blocking effect | the plan writes no resource for the units listed and states what a person decides or does instead: StackToIT neither does it nor verifies it | | Plan statements | 2 | | Affected units | 2 | | Affected applications | 0 | | Applications touched | none: no applications file was given and no suggested group holds an affected unit | | Wave | not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in prepare | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:650b81a7db5184350b172778d82ba46d11cd6e33c14f6a6e897d1c2e161a6fdb` | **Plan statements** (2) - alias `stackitroute:statement:module.vpc.module.vpc.aws_route_table.private` - alias `stackitroute:statement:module.vpc.module.vpc.aws_route_table.public` **Affected units** (2) - `module.vpc.module.vpc.aws_route_table.private` - `module.vpc.module.vpc.aws_route_table.public` ## Plan statements · stackitsa (1 record, 5 open items, 0 accepted; status open) ### manual review (1 record) #### DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW Why: The stackitsa plan of the draft writes no resource for 5 units and states why (the plan states the cause for each unit: module.retail_app_ecs.module.carts_service.aws_ecs_service.this: module.retail_app_ecs.module.carts_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person); module.retail_app_ecs.module.catalog_service.aws_ecs_service.this: module.retail_app_ecs.module.catalog_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person); module.retail_app_ecs.module.checkout_service.aws_ecs_service.this: module.retail_app_ecs.module.checkout_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person); and 2 more): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan. | Field | Value | |---|---| | Kind | `manual review` | | Source | open statements of the plan about units it writes no resource for | | Family | stackitsa | | Status | Open: no decision of the record has been taken | | Review state | unreviewed | | Design state | open | | Validation state | not validated | | Owner role | Identity Architect | | Required by phase | before the pilot | | Blocking effect | the plan writes no resource for the units listed and states what a person decides or does instead: StackToIT neither does it nor verifies it | | Plan statements | 5 | | Affected units | 5 | | Affected applications | 0 | | Applications touched | `carts` (PROPOSED), `catalog` (PROPOSED), `checkout` (PROPOSED), `orders` (PROPOSED), `ui` (PROPOSED) | | Wave | waves 3 to 9 · steps in prepare | | Approval | not approved: no decisions file was given with this run | | Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented | | Recommended option | none | | Review binding | bound to this run's source digest (see decisions.json) · KB 0.384.0 · members `sha256:8ae94bd60884e4f89887095201ccae2cb675b6de0ca40c6d52a7a14653c82f28` | **Plan statements** (5) - alias `stackitsa:statement:module.retail_app_ecs.module.carts_service.aws_ecs_service.this` - alias `stackitsa:statement:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this` - alias `stackitsa:statement:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` - alias `stackitsa:statement:module.retail_app_ecs.module.orders_service.aws_ecs_service.this` - alias `stackitsa:statement:module.retail_app_ecs.module.ui_service.aws_ecs_service.this` **Affected units** (5) - `module.retail_app_ecs.module.carts_service.aws_ecs_service.this` - `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this` - `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` - `module.retail_app_ecs.module.orders_service.aws_ecs_service.this` - `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`