# Landing zone requirements — default

> PROPOSAL — generated by StackToIT Assess. Architect review required before any decision.

Run `f6267c3f-2848-4aa5-89df-5fee8b15b3b9` · source digest `sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70`

What the STACKIT organization and project have to provide before the first apply, read from the blocks of the draft, the target plans (target-plan.json), the execution plan (execution-plan.json) and the assessment. A line that says unknown is not a gap of this document: it is a value the run does not state.

## 1. Organization

- A STACKIT organization that the people who carry out the migration belong to, with a project in it that holds everything the draft creates. The plans state no organization name or id; none is assumed.
- The draft takes the project from the variable `project_id`: STACKIT project ID the migrated resources are created in. It has no default: a person supplies it.

## 2. Project

- The project exists

Values a person supplies before the apply:

- `alb_interval_jitter`: Jitter added to the STACKIT ALB health-check interval, e.g. "1s". Required by stackit_application_load_balancer; the source load balancer has no such setting and STACKIT documents no default
- `dependencies_catalog_opensearch_this_plan_name`: STACKIT opensearch plan for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (source sizing unknown)
- `dependencies_catalog_opensearch_this_version`: STACKIT opensearch version for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this. STACKIT OpenSearch in eu01 offers 2 (catalogue 2026-10-18); the source runs 3.3. (the full description is in terraform/variables.tf)
- `dependencies_catalog_rds_this_plan_name`: STACKIT MariaDB plan for module.dependencies.module.catalog_rds.aws_rds_cluster.this (source class db.t3.medium). (the full description is in terraform/variables.tf)
- `dependencies_checkout_elasticache_redis_default_allowed_cidrs`: CIDRs allowed to reach the STACKIT valkey instance for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (parameters.sgw_acl). (the full description is in terraform/variables.tf)
- `dependencies_checkout_elasticache_redis_default_version`: STACKIT valkey version for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default. STACKIT Valkey in eu01 offers 8 (catalogue 2026-10-18); the source runs 4.0.10. (the full description is in terraform/variables.tf)
- `dependencies_mq_version`: STACKIT RabbitMQ version for module.dependencies.aws_mq_broker.mq. STACKIT RabbitMQ in eu01 offers 4.1 (catalogue 2026-10-18); the source runs 3.13. (the full description is in terraform/variables.tf)
- `dependencies_orders_rds_this_storage_size`: PostgreSQL Flex storage size in GB for module.dependencies.module.orders_rds.aws_rds_cluster.this: the source states no allocated_storage (Aurora storage grows automatically) — set the size STACKIT should provision. (the full description is in terraform/variables.tf)
- `dynamodb_tables_allowed_cidrs`: CIDRs allowed to reach the MongoDB Flex instance replacing the DynamoDB tables. DynamoDB had no network ACL (an IAM-authenticated regional endpoint); list the STACKIT network prefixes or egress addresses of the clients
- `dynamodb_tables_cpu`: vCPUs of the MongoDB Flex instance replacing the DynamoDB tables (DynamoDB scales in capacity units; size from the observed load). (the full description is in terraform/variables.tf)
- `dynamodb_tables_pitr_hours`: Point-in-time recovery window in hours; check the maximum MongoDB Flex accepts (DynamoDB PITR restores to any second of up to 35 days)
- `dynamodb_tables_ram`: RAM of the MongoDB Flex instance replacing the DynamoDB tables (size from the working set; the unit is not stated by the API: GB or GiB). (the full description is in terraform/variables.tf)
- `dynamodb_tables_storage_gb`: Storage in GB of the MongoDB Flex instance (sum of the tables' current sizes plus index overhead and growth)
- `kms_access_scope`: Network access scope of the migrated STACKIT KMS keys and wrapping keys: PUBLIC (the key is reachable on the public STACKIT KMS endpoint) or SNA (reachable over the STACKIT network area only; pinned provider stackit_kms_key.access_scope … (the full description is in terraform/variables.tf)
- `kms_protection`: STACKIT KMS key protection level (see the stackit_kms_key documentation)
- `mongodbflex_storage_class`: MongoDB Flex storage performance class
- `postgresflex_storage_class`: PostgreSQL Flex storage performance class
- `project_id`: STACKIT project ID the migrated resources are created in
- `retail_app_ecs_alb_this_health_ok_status`: HTTP status codes the health check of pool retail-app-ecs-alb-main of module.retail_app_ecs.module.alb.aws_lb.this accepts (module.retail_app_ecs.module.alb.aws_lb_target_group.main does not set a matcher or it is not visible statically … (the full description is in terraform/variables.tf)
- `retail_app_ecs_alb_this_network_id_target`: Which instance of stackit_network.vpc_vpc_public the network_id of module.retail_app_ecs.module.alb.aws_lb.this means: the index of one candidate, stackit_network.vpc_vpc_public[0] to the last instance (the number of instances is not known … (the full description is in terraform/variables.tf)
- `retail_app_ecs_alb_this_target_ips`: Private IPs of the nodes of the SKE cluster behind pool retail-app-ecs-alb-main of module.retail_app_ecs.module.alb.aws_lb.this: the NodePort Service ui-nodeport of the workload ui (ECS service … (the full description is in terraform/variables.tf)
- `retail_app_ecs_carts_service_task_execution_role_project_roles`: STACKIT project roles for service account retail_app_ecs_carts_service_task_execution_role replacing the AWS policies of module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role (AWS managed/external policies … (the full description is in terraform/variables.tf)
- `retail_app_ecs_carts_service_task_role_project_roles`: STACKIT project roles for service account retail_app_ecs_carts_service_task_role replacing the AWS policies of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role (the source allows dynamodb:*, logs:CreateLogGroup … (the full description is in terraform/variables.tf)
- `retail_app_ecs_catalog_service_task_execution_role_project_roles`: STACKIT project roles for service account retail_app_ecs_catalog_service_task_execution_role replacing the AWS policies of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role (the source allows kms:Decrypt* … (the full description is in terraform/variables.tf)
- `retail_app_ecs_catalog_service_task_role_project_roles`: STACKIT project roles for service account retail_app_ecs_catalog_service_task_role replacing the AWS policies of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role (the source allows logs:CreateLogGroup … (the full description is in terraform/variables.tf)
- `retail_app_ecs_checkout_service_task_execution_role_project_roles`: STACKIT project roles for service account retail_app_ecs_checkout_service_task_execution_role replacing the AWS policies of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role (AWS managed/external policies … (the full description is in terraform/variables.tf)
- `retail_app_ecs_checkout_service_task_role_project_roles`: STACKIT project roles for service account retail_app_ecs_checkout_service_task_role replacing the AWS policies of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role (the source allows dynamodb:*, logs:CreateLogGroup … (the full description is in terraform/variables.tf)
- `retail_app_ecs_cluster_machine_type`: STACKIT machine type replacing the node pool of the ECS cluster module.retail_app_ecs.aws_ecs_cluster.cluster. See https://docs.stackit.cloud/products/compute-engine/server/basics/machine-types/
- `retail_app_ecs_cluster_nodes_max`: Maximum nodes of the node pool replacing the capacity of the ECS cluster module.retail_app_ecs.aws_ecs_cluster.cluster. The services of the cluster ask for 5 vCPU / 10 GiB at the ceilings (the cluster block lists them). (the full description is in terraform/variables.tf)
- `retail_app_ecs_cluster_nodes_min`: Minimum nodes of the node pool replacing the capacity of the ECS cluster module.retail_app_ecs.aws_ecs_cluster.cluster (size it from the CPU and memory the services' manifests request). (the full description is in terraform/variables.tf)
- `retail_app_ecs_orders_service_task_execution_role_project_roles`: STACKIT project roles for service account retail_app_ecs_orders_service_task_execution_role replacing the AWS policies of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role (the source allows kms:Decrypt* … (the full description is in terraform/variables.tf)
- `retail_app_ecs_orders_service_task_role_project_roles`: STACKIT project roles for service account retail_app_ecs_orders_service_task_role replacing the AWS policies of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role (the source allows logs:CreateLogGroup … (the full description is in terraform/variables.tf)
- `retail_app_ecs_ui_service_task_execution_role_project_roles`: STACKIT project roles for service account retail_app_ecs_ui_service_task_execution_role replacing the AWS policies of module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role (AWS managed/external policies … (the full description is in terraform/variables.tf)
- `retail_app_ecs_ui_service_task_role_project_roles`: STACKIT project roles for service account retail_app_ecs_ui_service_task_role replacing the AWS policies of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role (the source allows logs:CreateLogGroup, logs:CreateLogStream … (the full description is in terraform/variables.tf)
- `sg_retail_app_ecs_carts_service_this_name`: the name of module.retail_app_ecs.module.carts_service.aws_security_group.this comes from a root variable that a tfvars or -var can override: its default is not a fact of the source (1 to 63 characters, alphanumeric runs joined by one separator)
- `sg_retail_app_ecs_catalog_service_this_name`: the name of module.retail_app_ecs.module.catalog_service.aws_security_group.this comes from a root variable that a tfvars or -var can override: its default is not a fact of the source (1 to 63 characters, alphanumeric runs joined by one separator)
- `sg_retail_app_ecs_checkout_service_this_name`: the name of module.retail_app_ecs.module.checkout_service.aws_security_group.this comes from a root variable that a tfvars or -var can override: its default is not a fact of the source (1 to 63 characters, alphanumeric runs joined by one separator)
- `sg_retail_app_ecs_orders_service_this_name`: the name of module.retail_app_ecs.module.orders_service.aws_security_group.this comes from a root variable that a tfvars or -var can override: its default is not a fact of the source (1 to 63 characters, alphanumeric runs joined by one separator)
- `sg_retail_app_ecs_ui_service_this_name`: the name of module.retail_app_ecs.module.ui_service.aws_security_group.this comes from a root variable that a tfvars or -var can override: its default is not a fact of the source (1 to 63 characters, alphanumeric runs joined by one separator)
- `vpc_vpc_private_count`: Number of stackit_network instances replacing module.vpc.module.vpc.aws_subnet.private (its count/for_each is not known statically)
- `vpc_vpc_private_ipv4_prefixes`: IPv4 prefixes (CIDR) for the networks replacing module.vpc.module.vpc.aws_subnet.private, one per instance (their number is var.vpc_vpc_private_count); reuse the source CIDRs unless the address plan changes. (the full description is in terraform/variables.tf)
- `vpc_vpc_public_count`: Number of stackit_network instances replacing module.vpc.module.vpc.aws_subnet.public (its count/for_each is not known statically)
- `vpc_vpc_public_ipv4_prefixes`: IPv4 prefixes (CIDR) for the networks replacing module.vpc.module.vpc.aws_subnet.public, one per instance (their number is var.vpc_vpc_public_count); reuse the source CIDRs unless the address plan changes. (the full description is in terraform/variables.tf)

Defaults that are the scan's reading of the source, not proven:

- `sg_retail_app_ecs_alb_sg_this_name_prefix_labels`: the labels of stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix, from the tags of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix: the source reads a variable for its tags (or its provider's default_tags), so the values here are the scan's reading of the variable's default, not proven: set the labels you want; the draft gives it a default (a value too long to quote here)
- `sg_retail_app_ecs_alb_this_labels`: the labels of stackit_security_group.retail_app_ecs_alb_this, from the tags of module.retail_app_ecs.module.alb.aws_security_group.this: the source reads a variable for its tags (or its provider's default_tags), so the values here are the scan's reading of the variable's default, not proven: set the labels you want; the draft gives it a default (a value too long to quote here)

## 3. Network area and region

- Region: `var.region`, default `eu01` in the draft; no input of the run overrides it. Check that the services below are available in it.
- Network area: the draft writes none; the assessment maps 1 source unit to `stackit_network_area`, which this draft does not write (sections 8 and 9).
- Networks: 2 network blocks created by the draft and 0 network blocks that read a network that exists on the target. One block with a count or a for_each makes one network for each element: the number is in the list below, or not expanded.
  - `stackit_network.vpc_vpc_private` in `terraform/network.tf`: `count = var.vpc_vpc_private_count` (multiplicity not expanded; the variable `vpc_vpc_private_count` has no default: a person supplies the number)
  - `stackit_network.vpc_vpc_public` in `terraform/network.tf`: `count = var.vpc_vpc_public_count` (multiplicity not expanded; the variable `vpc_vpc_public_count` has no default: a person supplies the number)

## 4. Address ranges

Every network prefix and route destination the plans and the draft state. A prefix that is still open is marked to decide, with the variable or the decision that settles it. A prefix the draft takes from a variable is not written out: the row says where the draft states it and which variable carries it.

| Resource | Attribute | Prefix |
|---|---|---|
| `stackit_network.vpc_vpc_private` | `ipv4_prefix` | Stated in `terraform/network.tf` as `var.vpc_vpc_private_ipv4_prefixes[count.index]`; the variable `vpc_vpc_private_ipv4_prefixes` has no default: a person supplies the range |
| `stackit_network.vpc_vpc_public` | `ipv4_prefix` | Stated in `terraform/network.tf` as `var.vpc_vpc_public_ipv4_prefixes[count.index]`; the variable `vpc_vpc_public_ipv4_prefixes` has no default: a person supplies the range |

Ranges the security group rules name (the addresses a rule lets in or out, not networks of the target):

- `0.0.0.0/0` (5 rules)

## 5. Routing

- Before any log source writes to stackit_logs_instance.logs_retention_180d: create a write access token for the instance (stackit_logs_access_token with the permission write), set the access control list of the instance, and point the shipper at the instance's ingest_url (Loki API) or ingest_otlp_url (OpenTelemetry) (needed before the cutover)
- Create the target project outside a Network Area: module.vpc.module.vpc.aws_route_table.private is replaced by STACKIT's default routing, which was observed to give a routed network the same reachability only in a project outside a Network Area (needed before the pilot)
- Create the target project outside a Network Area: module.vpc.module.vpc.aws_route_table.public is replaced by STACKIT's default routing, which was observed to give a routed network the same reachability only in a project outside a Network Area (needed before the pilot)

## 6. DNS

No plan writes a DNS zone or a record.

## 7. Identity

- Authorization `stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role`
- Authorization `stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role`
- Authorization `stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role`
- Authorization `stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role`
- Authorization `stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role`
- Authorization `stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role`
- Authorization `stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role`
- Authorization `stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role`
- Authorization `stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role`
- Authorization `stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role`
- Service account `stackit_service_account.retail_app_ecs_carts_service_task_execution_role`: no plan states its name
- Service account `stackit_service_account.retail_app_ecs_carts_service_task_role`: no plan states its name
- Service account `stackit_service_account.retail_app_ecs_catalog_service_task_execution_role`: no plan states its name
- Service account `stackit_service_account.retail_app_ecs_catalog_service_task_role`: no plan states its name
- Service account `stackit_service_account.retail_app_ecs_checkout_service_task_execution_role`: no plan states its name
- Service account `stackit_service_account.retail_app_ecs_checkout_service_task_role`: no plan states its name
- Service account `stackit_service_account.retail_app_ecs_orders_service_task_execution_role`: no plan states its name
- Service account `stackit_service_account.retail_app_ecs_orders_service_task_role`: no plan states its name
- Service account `stackit_service_account.retail_app_ecs_ui_service_task_execution_role`: no plan states its name
- Service account `stackit_service_account.retail_app_ecs_ui_service_task_role`: no plan states its name
- A person decides or does: Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach (needed before the pilot)
- A person decides or does: Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it (needed before the pilot)
- A person decides or does: Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach (needed before the pilot)
- A person decides or does: Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it (needed before the pilot)
- A person decides or does: Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach (needed before the pilot)
- A person decides or does: Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it (needed before the pilot)
- A person decides or does: Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach (needed before the pilot)
- A person decides or does: Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it (needed before the pilot)
- A person decides or does: Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach (needed before the pilot)
- A person decides or does: Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it (needed before the pilot)

## 8. Service enablement

Each service below has a block in the draft and has to be usable in the project and in the region of section 3. StackToIT does not read which services the project has.

| Service | Resource types | Blocks in the draft | Source units mapped | Note |
|---|---|---|---|---|
| IaaS | `stackit_network`, `stackit_security_group`, `stackit_security_group_rule` | 14 | 8 | — |
| Identity and access | `stackit_authorization_project_role_assignment`, `stackit_service_account` | 20 | 10 | — |
| Key Management (KMS) | `stackit_kms_key`, `stackit_kms_keyring` | 2 | 1 | — |
| Kubernetes Engine (SKE) | `stackit_ske_cluster` | 1 | 6 | — |
| Load Balancing | `stackit_application_load_balancer` | 1 | 1 | — |
| Logs | `stackit_logs_instance` | 1 | 1 | — |
| MariaDB | `stackit_mariadb_credential`, `stackit_mariadb_instance` | 2 | 1 | — |
| MongoDB Flex | `stackit_mongodbflex_instance` | 1 | 1 | — |
| OpenSearch | `stackit_opensearch_credential`, `stackit_opensearch_instance` | 2 | 1 | — |
| PostgreSQL Flex | `stackit_postgresflex_database`, `stackit_postgresflex_instance`, `stackit_postgresflex_user` | 3 | 1 | — |
| RabbitMQ | `stackit_rabbitmq_credential`, `stackit_rabbitmq_instance` | 2 | 1 | — |
| Secrets Manager | `stackit_secretsmanager_instance`, `stackit_secretsmanager_user` | 2 | 4 | — |
| Valkey | `stackit_valkey_credential`, `stackit_valkey_instance` | 2 | 1 | — |

Not created by this draft: the assessment maps source units to these resource types and no block of the draft writes one, so this draft creates nothing in them and nothing has to be enabled for it.

| Service | Resource types | Source units mapped |
|---|---|---|
| IaaS | `stackit_network_area` | 1 |
| Identity and access | `stackit_service_account_key` | 10 |
| Load Balancing | `stackit_alb_certificate` | 1 |
| Logs | `stackit_logs_access_token` | 1 |

## 9. Quotas

What the draft creates, counted by type. A block with count or for_each creates one object for each element, so the objects can be more than the blocks: where the draft states the number it is given, else the line says the multiplicity is not expanded. A block the draft writes only as a comment creates nothing and is not counted. StackToIT states no quota and reads none from the project.

- Check the project quota for 1 `stackit_application_load_balancer` block
- Check the project quota for 10 `stackit_authorization_project_role_assignment` blocks (multiplicity not expanded: `stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role`: `for_each = toset(var.retail_app_ecs_carts_service_task_execution_role_project_roles)`, `stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role`: `for_each = toset(var.retail_app_ecs_carts_service_task_role_project_roles)`, `stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role`: `for_each = toset(var.retail_app_ecs_catalog_service_task_execution_role_project_roles)`, `stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role`: `for_each = toset(var.retail_app_ecs_catalog_service_task_role_project_roles)`, `stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role`: `for_each = toset(var.retail_app_ecs_checkout_service_task_execution_role_project_roles)`, `stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role`: `for_each = toset(var.retail_app_ecs_checkout_service_task_role_project_roles)`, `stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role`: `for_each = toset(var.retail_app_ecs_orders_service_task_execution_role_project_roles)`, `stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role`: `for_each = toset(var.retail_app_ecs_orders_service_task_role_project_roles)`, `stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role`: `for_each = toset(var.retail_app_ecs_ui_service_task_execution_role_project_roles)`, `stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role`: `for_each = toset(var.retail_app_ecs_ui_service_task_role_project_roles)`)
- Check the project quota for 1 `stackit_kms_key` block
- Check the project quota for 1 `stackit_kms_keyring` block
- Check the project quota for 1 `stackit_logs_instance` block
- Check the project quota for 1 `stackit_mariadb_credential` block
- Check the project quota for 1 `stackit_mariadb_instance` block
- Check the project quota for 1 `stackit_mongodbflex_instance` block
- Check the project quota for 2 `stackit_network` blocks (multiplicity not expanded: `stackit_network.vpc_vpc_private`: `count = var.vpc_vpc_private_count`, `stackit_network.vpc_vpc_public`: `count = var.vpc_vpc_public_count`)
- Check the project quota for 1 `stackit_opensearch_credential` block
- Check the project quota for 1 `stackit_opensearch_instance` block
- Check the project quota for 1 `stackit_postgresflex_database` block
- Check the project quota for 1 `stackit_postgresflex_instance` block
- Check the project quota for 1 `stackit_postgresflex_user` block
- Check the project quota for 1 `stackit_rabbitmq_credential` block
- Check the project quota for 1 `stackit_rabbitmq_instance` block
- Check the project quota for 1 `stackit_secretsmanager_instance` block
- Check the project quota for 1 `stackit_secretsmanager_user` block
- Check the project quota for 7 `stackit_security_group` blocks
- Check the project quota for 5 `stackit_security_group_rule` blocks
- Check the project quota for 10 `stackit_service_account` blocks
- Check the project quota for 1 `stackit_ske_cluster` block
- Check the project quota for 1 `stackit_valkey_credential` block
- Check the project quota for 1 `stackit_valkey_instance` block

Source units are mapped to these types and no block of the draft creates one, so they are not counted above. Check their quota when the units are drafted.

| Type | Source units mapped |
|---|---|
| `stackit_alb_certificate` | 1 |
| `stackit_logs_access_token` | 1 |
| `stackit_network_area` | 1 |
| `stackit_service_account_key` | 10 |

## 10. Required API access

The draft and the steps of the plan call the STACKIT APIs of the services in section 8, in the region of section 3, from the machine that runs them. That machine needs network access to those APIs.

- Terraform provider `stackit`, version `0.121.0`.
- STACKIT API step `API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db`: secrets-manager-vault, WriteSecret. Authorisation: the username and password of a Secrets Manager user of the instance with write access (the stackit_secretsmanager_user the draft creates, write_enabled = true), which the script exchanges for a token (login) and sends as X-Vault-Token.
- STACKIT API step `API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch`: secrets-manager-vault, WriteSecret. Authorisation: the username and password of a Secrets Manager user of the instance with write access (the stackit_secretsmanager_user the draft creates, write_enabled = true), which the script exchanges for a token (login) and sends as X-Vault-Token.
- STACKIT API step `API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq`: secrets-manager-vault, WriteSecret. Authorisation: the username and password of a Secrets Manager user of the instance with write access (the stackit_secretsmanager_user the draft creates, write_enabled = true), which the script exchanges for a token (login) and sends as X-Vault-Token.
- STACKIT API step `API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db`: secrets-manager-vault, WriteSecret. Authorisation: the username and password of a Secrets Manager user of the instance with write access (the stackit_secretsmanager_user the draft creates, write_enabled = true), which the script exchanges for a token (login) and sends as X-Vault-Token.

## 11. Required Terraform permissions

Terraform acts on the project as one STACKIT identity whose credentials are given to the provider outside the draft; the draft holds none. The identity needs, for each service the plans use:

- IaaS: the role that may create IaaS resources in the project
- Identity and access: the role that may create Identity and access resources in the project
- Key Management (KMS): the role that may create Key Management (KMS) resources in the project
- Kubernetes Engine (SKE): the role that may create Kubernetes Engine (SKE) resources in the project
- Load Balancing: the role that may create Load Balancing resources in the project
- Logs: the role that may create Logs resources in the project
- MariaDB: the role that may create MariaDB resources in the project
- MongoDB Flex: the role that may create MongoDB Flex resources in the project
- OpenSearch: the role that may create OpenSearch resources in the project
- PostgreSQL Flex: the role that may create PostgreSQL Flex resources in the project
- RabbitMQ: the role that may create RabbitMQ resources in the project
- Secrets Manager: the role that may create Secrets Manager resources in the project
- Valkey: the role that may create Valkey resources in the project

StackToIT names no role: which role grants this is the project's to look up.

## 12. External dependencies

- Not migrated: the VPC membership (the critical setting `security-group-vpc-membership`) of 12 AWS security groups: `module.retail_app_ecs.module.alb.aws_security_group.this`, `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`, `module.retail_app_ecs.module.carts_service.aws_security_group.this`, `module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `module.retail_app_ecs.module.orders_service.aws_security_group.this`, `module.retail_app_ecs.module.ui_service.aws_security_group.this`, `module.dependencies.aws_security_group.catalog_opensearch_sg`, `module.dependencies.aws_security_group.mq`, `module.dependencies.module.catalog_rds.aws_security_group.this`, `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd`, `module.dependencies.module.orders_rds.aws_security_group.this`; 7 of the drafted STACKIT security groups are orphaned (no block of the draft attaches the group, so its rules restrict nothing on STACKIT as drafted): `stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix`, `stackit_security_group.retail_app_ecs_alb_this`, `stackit_security_group.retail_app_ecs_carts_service_this`, `stackit_security_group.retail_app_ecs_catalog_service_this`, `stackit_security_group.retail_app_ecs_checkout_service_this`, `stackit_security_group.retail_app_ecs_orders_service_this`, `stackit_security_group.retail_app_ecs_ui_service_this` — A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.; This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project; reason: the target's scope model differs from the source's, so the source's boundary has no one-to-one counterpart (`TARGET_SCOPE_MODEL_DIFFERS`); missing on STACKIT: network-scoped security group: a STACKIT security group belongs to the project, not to a network, so the VPC boundary of the source groups is one design parity gap of the target for the whole estate, with alternatives; the draft still writes each group and its rules; direction: close it once for the estate by one of these alternatives: confirm that the estate has one VPC (the project the draft creates is then that VPC's boundary, and the setting closes); give each source VPC a STACKIT project of its own, joined through a Network Area where their networks must reach each other; or keep one project and attach each group only to the interfaces of the networks that replace its VPC, with no rule's remote_security_group_id naming a group whose members sit in a network the source VPC kept apart. A difference that is accepted instead (the groups stay project-wide) is recorded as an accepted design difference, with who accepted it and why, never as equivalent
- Not migrated: the critical setting `credentials-and-keys-settings` of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` — The mapping rule for this kind of unit found a setting the target has no counterpart for. The IAM master user, the master user name and password, the customer KMS key and the custom endpoint certificate, read where they are set whatever their value. STACKIT generates the OpenSearch credential (stackit_opensearch_credential username and password are computed), offers no customer KMS key for the instance and no custom endpoint certificate (pinned provider) - UNSUPPORTED; a password is never carried; reason: the target has no counterpart that carries this setting of the source (`TARGET_SETTING_UNSUPPORTED`); missing on STACKIT: counterpart that carries the setting `credentials-and-keys-settings` of aws_opensearch_domain (the knowledge base marks it UNSUPPORTED)
- Not migrated: the critical setting `domain-credentials-and-keys` of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` — The mapping rule for this kind of unit found a setting the target has no counterpart for. STACKIT generates the OpenSearch credential (stackit_opensearch_credential username and password are computed), offers no customer KMS key for the instance and no custom endpoint certificate (pinned provider) — UNSUPPORTED; reason: the target has no counterpart that carries this setting of the source (`TARGET_SETTING_UNSUPPORTED`); missing on STACKIT: counterpart that carries the setting `domain-credentials-and-keys` of aws_opensearch_domain (the knowledge base marks it UNSUPPORTED)
- Before the pilot, pin remote modules to an immutable Git ref or a registry version: a module source that can move can change the estate this migration was planned for between two runs. Unpinned module sources found:
  - `module.retail_app_ecs.module.alb` from `terraform-aws-modules/alb/aws`
  - `module.retail_app_ecs.module.alb_sg` from `terraform-aws-modules/security-group/aws`

## 13. Customer decisions

The decisions a step of the plan waits for. Each one is answered by the customer; the roadmap shows the steps behind it.

| Decision | Question | Why it matters | AWS resource | Needed | Blocks |
|---|---|---|---|---|---|
| `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION` | Decide which instance of stackit_network.vpc_vpc_public the networks of stackit_application_load_balancer.retail_app_ecs_alb_this means: set var.retail_app_ecs_alb_this_network_id_target to its index | the reference reaches stackit_network.vpc_vpc_public, a repeated resource (count or for_each), and nothing in the source proves which instance it means; no instance is assumed and the variable has no default | module.retail_app_ecs.module.alb.aws_lb.this | before the pilot; answer with one of its options: "Set the selector variable to the index of the instance the source means" or "Reference another resource than the candidates" | 66 steps |
| `DEC-GEN-CONVERT-API-OPT-IN` | Allow calls of the Secrets Manager Vault-compatible API, whose maturity is not established, for this migration (the API may change or vanish)? Accept: the calls of the Secrets Manager Vault-compatible API (WriteSecret) are carried out for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db. Refuse: no call is made, a refusal selects no other path (the draft holds no other carrier of what the calls set), and what they set stays open for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db. | the Secrets Manager Vault-compatible API is of a maturity that is not established (its documentation states no release status and its product documentation does not establish it as generally available): the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db wait for this decision; the draft's own blocks do not | — | before the pilot; answer with one of its options: "Allow the calls of the API for this migration" | 74 steps |
| `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` | Choose how the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this moves from aws_opensearch_domain to STACKIT OpenSearch (stackit_opensearch_instance.dependencies_catalog_opensearch_this): the method, the downtime it needs and the check that the copy is complete | StackToIT moves no data and writes no runbook for aws_opensearch_domain to STACKIT OpenSearch; the data-movement register lists module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the mechanism UNKNOWN, and the source states neither the size of the data nor the downtime the business tolerates nor the consistency the application needs | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | before the pilot; answer with one of its options: "Export the data from the source and import it with the clients of the target engine" or "Replicate the data with the replication of the source engine until the cutover" or "Move the data with a migration tool or a replication of the owner's own" | 82 steps |
| `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.catalog_rds.aws_rds_cluster.this` | Choose how the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this moves from aws_rds_cluster to STACKIT MariaDB (stackit_mariadb_instance.dependencies_catalog_rds_this): a dump loaded with the mysql client inside the write freeze, or a tool of your own | the plan defines the one method the STACKIT MariaDB pages document, a dump loaded with the mysql client into the empty instance, and the customer's own tool; the replication of the binary log is refused because no STACKIT page documents it; STACKIT has no managed MySQL, so a MySQL source is an engine change whose collations, DEFINER accounts, accounts and settings the checks of the plan name, and the size of the data, the downtime the business accepts and the consistency the application needs are not in the source; the steps wait for the answer | module.dependencies.module.catalog_rds.aws_rds_cluster.this | before the pilot; answer with one of its options: "Export the data from the source and import it with the clients of the target engine" or "Replicate the data with the replication of the source engine until the cutover" or "Move the data with a migration tool or a replication of the owner's own" | 83 steps |
| `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` | Choose how the keys of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default move from aws_elasticache_replication_group to STACKIT Key Value Store (stackit_valkey_instance.dependencies_checkout_elasticache_redis_default): the keys copied by a client inside the write freeze, or a tool of your own | the plan defines the one method the STACKIT pages and the ElastiCache pages allow together, a copy of the keys by a client (SCAN, DUMP, PTTL, RESTORE) inside the write freeze, and the customer's own tool; loading an exported snapshot is refused because no STACKIT page or API takes an RDB file, and following the source as a replica is refused because neither end offers it; the source does not say whether the cache holds only what the application rebuilds, the size of the data, the downtime the business accepts or the shards the keys are spread over, and the Key Value Store has no sharding; the steps wait for the answer | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | before the pilot; answer with one of its options: "Export the data from the source and import it with the clients of the target engine" or "Replicate the data with the replication of the source engine until the cutover" or "Move the data with a migration tool or a replication of the owner's own" | 83 steps |
| `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this` | Choose how the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this moves from aws_dynamodb_table to STACKIT MongoDB Flex (stackit_mongodbflex_instance.dynamodb_tables): the method, the downtime it needs and the check that the copy is complete | StackToIT moves no data and writes no runbook for aws_dynamodb_table to STACKIT MongoDB Flex; the data-movement register lists module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with the mechanism UNKNOWN, and the source states neither the size of the data nor the downtime the business tolerates nor the consistency the application needs | module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | before the pilot; answer with one of its options: "Export the data from the source and import it with the clients of the target engine" or "Replicate the data with the replication of the source engine until the cutover" or "Move the data with a migration tool or a replication of the owner's own" | 82 steps |
| `DEC-GEN-CONVERT-DATA-MOVEMENT/module.dependencies.module.orders_rds.aws_rds_cluster.this` | Choose how the data of module.dependencies.module.orders_rds.aws_rds_cluster.this moves from aws_rds_cluster to PostgreSQL Flex (stackit_postgresflex_instance.dependencies_orders_rds_this): a dump restored inside the write freeze, the engine's logical replication, or a tool of your own | the plan defines both methods of the engine (a dump restored inside the write freeze, and a logical replication that follows the changes until the freeze) and keeps them open: which one applies depends on the size of the data, the write rate and the downtime the business accepts, and the source states none of them; the steps of the methods wait for the answer | module.dependencies.module.orders_rds.aws_rds_cluster.this | before the pilot; answer with one of its options: "Export the data from the source and import it with the clients of the target engine" or "Replicate the data with the replication of the source engine until the cutover" or "Move the data with a migration tool or a replication of the owner's own" | 88 steps |
| `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE` | Choose how module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch 3.3) reaches STACKIT, which offers 2 in eu01: move the data into 2 by re-reading it from the source, run OpenSearch 3.3 yourself on SKE, or wait until STACKIT offers it | the source runs OpenSearch 3.3 (engine_version), newer than every version the eu01 catalogue (2026-10-18) lists for stackit_opensearch_instance (2): a snapshot of 3.3 cannot be restored into 2 (OpenSearch restores a snapshot into the same or a newer version only); reindex from the source, or write to both during the cutover (dual-write), is the path; whether the clients work against 2 is unknown | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | before the pilot; answer with one of its options: "Move the data into the version STACKIT offers, by re-reading it from the source" or "Run the source's engine version yourself on SKE (self-managed)" or "Wait until STACKIT offers the source's version" | 84 steps |
| `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH` | Decide how the clients of module.retail_app_ecs.module.alb.aws_lb.this reach the workloads of module.retail_app_ecs.module.ui_service.aws_ecs_service.this on SKE (aws.ingress.exposure-path): option nodeport-alb-target-pool (the drafted path: a NodePort Service of each workload and the target pool on its node port at the private IPs of the cluster's nodes, an input), ingress-controller-behind-alb (an Ingress controller on the cluster, reached by the load balancer on the controller's node port, routes to the ClusterIP Services), or stackit-alb-ingress-controller (the SKE Application Load Balancer extension provisions the load balancer from an Ingress of the IngressClass stackit-alb over NodePort Services; the drafted stackit_application_load_balancer.retail_app_ecs_alb_this is not applied) | a STACKIT target pool reaches its targets by private IP and the SKE cluster exports no node address to Terraform, so a Kubernetes workload is reachable from the load balancer only through a node port at the IPs of the nodes, which change as the node pool scales and is updated, or through an Ingress controller; the source registered the tasks of the service by their own IPs (awsvpc) | module.retail_app_ecs.module.alb.aws_lb.this | before the pilot; answer with one of its options: "Keep the draft: a NodePort Service of each workload and the target pool on its node port at the private IPs of the cluster's nodes" or "Run an Ingress controller on the cluster and put the load balancer in front of it" or "Use the STACKIT ALB as the Ingress: the SKE Application Load Balancer extension" | 66 steps |
| `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.carts_service.aws_security_group.this` | Decide how the segmentation that the security group module.retail_app_ecs.module.carts_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.carts_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_carts_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it) | the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision) | module.retail_app_ecs.module.carts_service.aws_security_group.this | before the pilot; answer with one of its options: "Carry the segmentation as a Kubernetes NetworkPolicy written from the rules of the source group" or "Carry the segmentation as a STACKIT security group on the nodes (coarser than the source)" or "Accept that the pods run without the segmentation the source group gave the tasks" | 80 steps |
| `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.catalog_service.aws_security_group.this` | Decide how the segmentation that the security group module.retail_app_ecs.module.catalog_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_catalog_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it) | the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision) | module.retail_app_ecs.module.catalog_service.aws_security_group.this | before the pilot; answer with one of its options: "Carry the segmentation as a Kubernetes NetworkPolicy written from the rules of the source group" or "Carry the segmentation as a STACKIT security group on the nodes (coarser than the source)" or "Accept that the pods run without the segmentation the source group gave the tasks" | 80 steps |
| `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.checkout_service.aws_security_group.this` | Decide how the segmentation that the security group module.retail_app_ecs.module.checkout_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_checkout_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it) | the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision) | module.retail_app_ecs.module.checkout_service.aws_security_group.this | before the pilot; answer with one of its options: "Carry the segmentation as a Kubernetes NetworkPolicy written from the rules of the source group" or "Carry the segmentation as a STACKIT security group on the nodes (coarser than the source)" or "Accept that the pods run without the segmentation the source group gave the tasks" | 80 steps |
| `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.orders_service.aws_security_group.this` | Decide how the segmentation that the security group module.retail_app_ecs.module.orders_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.orders_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_orders_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it) | the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision) | module.retail_app_ecs.module.orders_service.aws_security_group.this | before the pilot; answer with one of its options: "Carry the segmentation as a Kubernetes NetworkPolicy written from the rules of the source group" or "Carry the segmentation as a STACKIT security group on the nodes (coarser than the source)" or "Accept that the pods run without the segmentation the source group gave the tasks" | 80 steps |
| `DEC-GEN-CONVERT-POD-SEGMENTATION/module.retail_app_ecs.module.ui_service.aws_security_group.this` | Decide how the segmentation that the security group module.retail_app_ecs.module.ui_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.ui_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_ui_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it) | the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision) | module.retail_app_ecs.module.ui_service.aws_security_group.this | before the pilot; answer with one of its options: "Carry the segmentation as a Kubernetes NetworkPolicy written from the rules of the source group" or "Carry the segmentation as a STACKIT security group on the nodes (coarser than the source)" or "Accept that the pods run without the segmentation the source group gave the tasks" | 80 steps |
| `DEC-GEN-CONVERT-WORKLOAD-PLACEMENT` | Decide where the source consumers of module.vpc.module.vpc.aws_subnet.private are placed on STACKIT: the source places module.dependencies.aws_mq_broker.mq, module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, module.dependencies.module.catalog_rds.aws_rds_cluster.this, module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, module.dependencies.module.orders_rds.aws_rds_cluster.this, module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, module.retail_app_ecs.module.orders_service.aws_ecs_service.this and module.retail_app_ecs.module.ui_service.aws_ecs_service.this in it, and the draft places none of them in stackit_network.vpc_vpc_private (the target networks the draft generates for the subnets of the same VPC: stackit_network.vpc_vpc_private and stackit_network.vpc_vpc_public); the drafted Kubernetes cluster stackit_ske_cluster.retail_app_ecs_cluster of these consumers sets no network.id — option one-network-for-the-cluster-and-services (the cluster and the servers in one network, the managed services reached by access lists naming its range), keep-the-networks-and-place-by-tier, redesign-the-network-placement, or accept-the-consumers-outside-the-network (the network as drafted, holding none of them) | the source splits these workloads over subnets, and STACKIT places them differently: an SKE cluster is deployed into one network (network.id) and its node pools state no network, a managed database, cache or broker takes an access list and no network id; no one-to-one placement of the consumers in stackit_network.vpc_vpc_private follows from the source, so the network's step waits for the decision | module.vpc.module.vpc.aws_subnet.private | before the pilot; answer with one of its options: "Place the cluster and the servers in one STACKIT network, and admit the clients of the managed services by access lists naming its range" or "Keep the drafted networks and place each consumer in the network of its tier" or "Redesign the network placement of the workloads" or "Accept that the drafted network holds none of the source's consumers of its subnet" | 3 steps |
| `DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST` | Decide the egress address of module.vpc.module.vpc.aws_route_table.private: keep the changing address of the STACKIT network, or give each server that an allow-list names a STACKIT public IP | a NAT gateway's fixed egress address is lost on STACKIT: the address a routed network leaves by is the network's own, shared by every routed network of the project, not fixed and not settable | module.vpc.module.vpc.aws_route_table.private | before the pilot; answer with one of its options: "Accept the address STACKIT assigns to the network for outbound traffic" or "Give each server that an allow-list names a STACKIT public IP" | 8 steps |
| `DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS` | Decide whether the logs of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks older than 180 days are kept in an archive outside the Logs instance | the source keeps its logs for ever and a STACKIT Logs instance keeps at most 180 days, so the instance drafted for it (stackit_logs_instance.logs_retention_180d) holds only the last 180 days; logs older than that exist only if a person configures an archive beside it. Choose the archive if the workload needs them; reject it if the requirement is that more than 180 days stay inside STACKIT Logs with no external archive, which STACKIT Logs alone cannot meet | module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks | before the cutover; answer with one of its options: "Keep the logs for the 180 days of the Logs instance only" or "For the period beyond 180 days, also stream the logs to long-term storage" | 2 steps |