module.dependencies.aws_mq_broker.mq | broker-network | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_rabbitmq_instance has no subnet or security-group attribute (pinned provider): clients reach the instance at the address STACKIT assigns, restricted by parameters.sgw_acl — a person decides the ranges. | A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups. | the mapping rule for aws_mq_broker |
|---|
module.dependencies.aws_mq_broker.mq | broker-users | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Users become stackit_rabbitmq_credential entries with generated passwords; their permissions are set by a person. | A person sets the permissions of each broker user on the generated RabbitMQ credentials and hands the new passwords to the clients. | the mapping rule for aws_mq_broker |
|---|
module.dependencies.aws_mq_broker.mq | engine-version | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_rabbitmq_instance takes a STACKIT RabbitMQ version (the draft asks for it: rabbitmq_version) — which versions STACKIT offers is not in the rule's evidence. | A person picks the RabbitMQ version for the target instance, since the versions STACKIT offers are not stated for this move. | the mapping rule for aws_mq_broker |
|---|
module.dependencies.aws_mq_broker.mq | network-exposure | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The broker is either reachable from the public internet or only from private networks. | A person sets which networks may reach the STACKIT RabbitMQ instance with its access list (a list of CIDR networks); the draft sets none. | the mapping rule for aws_mq_broker |
|---|
module.dependencies.aws_mq_broker.mq | tc-mq-broker-broker-name | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The name of the message broker. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). | A person confirms the broker name the target uses against what refers to the source broker name, or accepts the new name. | the mapping rule for aws_mq_broker |
|---|
module.dependencies.aws_mq_broker.mq | tc-user--password | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_mq_broker.user.password: The broker user's login credential; a literal secret. Held CRITICAL: it carries or names a credential; the value is never copied and a person re-creates it on the target. No semantic of this family has verified it as carried. | A person hands the clients the password of the generated target credential instead of the literal in the source. | the mapping rule for aws_mq_broker |
|---|
module.dependencies.aws_mq_broker.mq | tc-user--username | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_mq_broker.user.username: The broker user's login identity. Held CRITICAL: it decides who or what may use, read or change the resource or the data behind it. No semantic of this family has verified it as carried. | A person confirms the user names the clients log in with; STACKIT generates each RabbitMQ credential's username, so the clients move to the new usernames. | the mapping rule for aws_mq_broker |
|---|
module.dependencies.aws_mq_broker.mq | tcp-deployment-mode | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_mq_broker.deployment_mode: The family's own setting for high availability already reads this as critical: it selects single instance vs. active standby multi az vs. cluster multi az, i.e. whether the broker survives an AZ failure at all. Held CRITICAL: it decides capacity, delivery guarantees, retry or failure handling that consumers depend on. | A person decides whether the target must survive a zone failure as the source deployment mode did, and finds out which RabbitMQ plan, if any, gives that, since the zone spread of the plans is not stated. | the mapping rule for aws_mq_broker |
|---|
module.dependencies.aws_security_group.catalog_opensearch_sg | egress-restriction | REVIEW | A check of the knowledge base (sg egress restricted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (sg egress restricted) |
|---|
module.dependencies.aws_security_group.catalog_opensearch_sg | network-topology-boundary | REVIEW | A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (topology vpc unproven) |
|---|
module.dependencies.aws_security_group.catalog_opensearch_sg | security-group-vpc-membership | UNSUPPORTED | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project. | A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. | a check of the knowledge base (topology vpc unproven) |
|---|
module.dependencies.aws_security_group.catalog_opensearch_sg | standalone-rule-not-generated | REVIEW | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An aws_security_group_rule the draft does not generate (the draft names its settings NOT CARRIED, or the KB cannot decide that it generates it): a prefix list, an ICMP type with every code, ICMPv6 limited by type or code, a protocol with no STACKIT counterpart, a source or protocol or port not visible statically, a source group that is not one whole reference to a security group of the draft, or a repeated or conditionally created group. A person re-creates the rule with the STACKIT range or group it needs (a rule is never widened: a stackit_security_group_rule without source allows every address, pinned provider) - REVIEW, per rule. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_security_group |
|---|
module.dependencies.aws_security_group.catalog_opensearch_sg | standalone-rule-remote-not-resolved | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The source of a standalone security group rule: the other security group (source_security_group_id) whose members the rule lets in. | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A person re-creates the rule with the STACKIT security group or address range it needs; the draft does not widen it (a stackit_security_group_rule without a source allows everything, pinned provider). | the mapping rule for aws_security_group |
|---|
module.dependencies.aws_security_group.catalog_opensearch_sg | stateful | REVIEW | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true). | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.dependencies.aws_security_group.mq | egress-restriction | REVIEW | A check of the knowledge base (sg egress restricted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (sg egress restricted) |
|---|
module.dependencies.aws_security_group.mq | network-topology-boundary | REVIEW | A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (topology vpc unproven) |
|---|
module.dependencies.aws_security_group.mq | security-group-vpc-membership | UNSUPPORTED | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project. | A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. | a check of the knowledge base (topology vpc unproven) |
|---|
module.dependencies.aws_security_group.mq | standalone-rule-not-generated | REVIEW | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An aws_security_group_rule the draft does not generate (the draft names its settings NOT CARRIED, or the KB cannot decide that it generates it): a prefix list, an ICMP type with every code, ICMPv6 limited by type or code, a protocol with no STACKIT counterpart, a source or protocol or port not visible statically, a source group that is not one whole reference to a security group of the draft, or a repeated or conditionally created group. A person re-creates the rule with the STACKIT range or group it needs (a rule is never widened: a stackit_security_group_rule without source allows every address, pinned provider) - REVIEW, per rule. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_security_group |
|---|
module.dependencies.aws_security_group.mq | stateful | REVIEW | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true). | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | access-and-encryption-settings | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The access policy, free-form engine options, fine-grained access switches, encryption at rest and between nodes, the HTTPS and TLS policy of the endpoint and the engine version of the domain, read wherever they are set. | A person maps each setting to the STACKIT OpenSearch instance, which has an access list, TLS protocols and ciphers and a version, but no policy document, no free-form option map and no encryption switch (pinned provider). | the mapping rule for aws_opensearch_domain |
|---|
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | cluster-layout-settings | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Every node-layout setting of the domain, read where it is set whatever its value (on, off, empty, a variable, a reference, a block written as an attribute object): instance count, dedicated masters, warm and cold storage, zone awareness and its zone count, multi-AZ with standby and the deployment strategy. A stackit_opensearch_instance takes a plan (plan_name) that fixes nodes, topology and storage, no zone-awareness or tier setting (pinned provider, the provider documentation of opensearch_instance) - REVIEW: a person picks the plan that matches the layout. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_opensearch_domain |
|---|
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | credentials-and-keys-settings | UNSUPPORTED | The mapping rule for this kind of unit found a setting the target has no counterpart for. The IAM master user, the master user name and password, the customer KMS key and the custom endpoint certificate, read where they are set whatever their value. STACKIT generates the OpenSearch credential (stackit_opensearch_credential username and password are computed), offers no customer KMS key for the instance and no custom endpoint certificate (pinned provider) - UNSUPPORTED; a password is never carried. | A person accepts the difference or the design changes: nothing in the source can make the target carry it. | the mapping rule for aws_opensearch_domain |
|---|
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | domain-credentials-and-keys | UNSUPPORTED | The mapping rule for this kind of unit found a setting the target has no counterpart for. STACKIT generates the OpenSearch credential (stackit_opensearch_credential username and password are computed), offers no customer KMS key for the instance and no custom endpoint certificate (pinned provider) — UNSUPPORTED. | A person accepts the difference or the design changes: nothing in the source can make the target carry it. | the mapping rule for aws_opensearch_domain |
|---|
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | domain-settings | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_opensearch_instance takes a plan (plan_name: nodes and storage), a version and parameters (sgw_acl, syslog, tls_protocols, tls_ciphers, etc.; pinned provider): the domain's node layout, zone awareness, storage, access policy, endpoint TLS and HTTPS settings, internal user database and log publishing are not generated — a person maps them to the plan and parameters — REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_opensearch_domain |
|---|
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | encryption-at-rest | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether the data the domain stores is encrypted at rest. | A person confirms the encryption of the STACKIT OpenSearch instance on the target; the instance has no encryption setting (pinned provider), and no STACKIT fact about it is documented here. | the mapping rule for aws_opensearch_domain |
|---|
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | engine-version | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states which engine and version the OpenSearch domain runs: OpenSearch or legacy Elasticsearch, with its version number. | A person chooses the version of the STACKIT OpenSearch instance, which has a version setting (pinned provider), and checks that the domain's clients work with it. | the mapping rule for aws_opensearch_domain |
|---|
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | fine-grained-access | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether fine-grained access control, with users, roles and permissions inside the domain, is switched on. | A person re-creates the access rules another way, because fine-grained IAM access has no equivalent on STACKIT OpenSearch, which offers an access list and credentials per instance. | the mapping rule for aws_opensearch_domain |
|---|
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | nbr-aws-opensearch-domain-policy | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_opensearch_domain_policy (search access policy) attaches an access policy to this domain, so who may reach and use it is decided by that policy and not by the domain's own settings. | A person reads the policy the neighbour attaches and confirms that the replacing OpenSearch domain lets the same principals act on it, and no more, or that the access is dropped on purpose. | the mapping rule for aws_opensearch_domain |
|---|
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | network-settings | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The VPC placement of the domain (subnet and security group ids, IP address type), read where it is set whatever its value. stackit_opensearch_instance has no network or subnet input; its access control is parameters.sgw_acl, a CIDR list (pinned provider) - REVIEW: a person translates the reachable networks into sgw_acl. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_opensearch_domain |
|---|
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | opensearch-domain-policy-resource | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The domain's resource-based access policy, written as aws_opensearch_domain_policy (a part of the domain), has no counterpart on STACKIT OpenSearch. | A person lists the principals and conditions the policy names, decides how their separation is kept (one instance per trust level, or in the application) and puts the source ranges into sgw_acl. | the mapping rule for aws_opensearch_domain |
|---|
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | private-endpoint | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether the domain lives inside a VPC, with subnets and security groups, instead of behind a public endpoint. | A person translates the networks that may reach the domain into the access list (a list of CIDR ranges) of the STACKIT OpenSearch instance, which has no network or subnet input (pinned provider). | the mapping rule for aws_opensearch_domain |
|---|
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | storage-settings | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether the data nodes use EBS volumes, read where it is set whatever its value. Storage of a stackit_opensearch_instance is defined by its plan (pinned provider, the provider documentation of opensearch_instance): no EBS switch - REVIEW: a person picks a plan whose disk fits the index size. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_opensearch_domain |
|---|
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | tc-opensearch-domain-domain-name | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_opensearch_domain.domain_name: Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). No semantic of this family has verified it as carried. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_opensearch_domain |
|---|
module.dependencies.module.catalog_rds.aws_rds_cluster.this | admin-password | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The source password (or its Secrets Manager management) is never copied, and no STACKIT database user takes a password: stackit_postgresflex_user and stackit_mariadb_credential compute it (password is computed and sensitive, pinned provider) and the create-user API of PostgreSQL Flex has no password field. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.catalog_rds.aws_rds_cluster.this | admin-username-not-carried | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The master username is not a literal of a single cluster that PostgreSQL Flex accepts: a name a variable supplies or that is not visible statically (the draft writes the user with a variable that has no default), a name STACKIT reserves (admin and postgres: the draft writes a variable that rejects them), or a repeated cluster (a user per cluster only when every instance is evaluated). A person chooses the administrator's name on the target — REVIEW. | A person creates the administrator on the target with a name the target accepts and confirms the application connects with it. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.catalog_rds.aws_rds_cluster.this | backup-retention | LEDGER | Whether the draft carries this setting is decided by its semantic ledger entry "backup retention", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). A retention not visible statically (a variable) is read by no fact and the draft carries nothing for it: a person compares it with the target's backup retention (REVIEW). | The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference. | ledger:backup retention |
|---|
module.dependencies.module.catalog_rds.aws_rds_cluster.this | db-network-placement | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no subnet, availability-zone or IP-family attribute (pinned provider): clients reach it at the endpoint STACKIT assigns, restricted by its ACL — a person decides how clients reach it — REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.catalog_rds.aws_rds_cluster.this | engine | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The database engine of the cluster (Aurora PostgreSQL, Aurora MySQL, or a Multi-AZ cluster on PostgreSQL or MySQL), which decides the STACKIT database service it lands on. | For a MySQL-compatible cluster a person tests the schemas and queries on STACKIT MariaDB, the closest managed engine, because STACKIT has no MySQL product; for a PostgreSQL cluster, which lands on PostgreSQL Flex, a person confirms that no Aurora-only feature (storage auto-scaling, fast clones, global databases, serverless v2 scaling) is relied on. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.catalog_rds.aws_rds_cluster.this | engine-version | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The version of the database engine that the cluster runs. | For a PostgreSQL cluster a person picks a major version that PostgreSQL Flex offers (14 to 18; 18 is beta in eu01, so production needs 17 or a generally available 18) and plans an upgrade for any other version. For a MySQL-compatible cluster a person tests the MySQL 8 features in use on STACKIT MariaDB. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.catalog_rds.aws_rds_cluster.this | final-snapshot | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no final snapshot or delete-time backup setting (pinned provider): it is deleted when Terraform destroys it — a person decides how data survives a destroy (export first) — REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.catalog_rds.aws_rds_cluster.this | member-engine | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Cluster members must run the cluster's engine and version (AWS), which the draft follows (TODO when a member states another): the members' engine and version are what the cluster's engine and the engine version setting decide — TRANSFORMED/PRESERVED for a supported PostgreSQL version, REVIEW otherwise. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.catalog_rds.aws_rds_cluster.this | member-settings | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Cluster members are not separate STACKIT resources (the flavor defines the nodes, pinned provider): a member's failover priority, parameter group, subnet group, zone, CA certificate and Performance Insights key have no attribute — a person decides what the nodes need — REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.catalog_rds.aws_rds_cluster.this | parameter-and-option-groups | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no parameter-group or option-group attribute (pinned provider): the group's settings (even a default.* group of the source engine) must be mapped to the STACKIT instance's options by a person — REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.catalog_rds.aws_rds_cluster.this | security-groups | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT database instances have no security groups: access is a CIDR ACL (network.acl, pinned provider); the draft's ACL variable defaults to the CIDRs of the groups' ingress rules where visible, and group-to-group rules cannot be expressed — a person checks the ACL — REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.catalog_rds.aws_rds_cluster.this | storage-encryption | REVIEW | A check of the knowledge base (aurora storage encrypted mariadb) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states whether the storage of the database cluster is encrypted at rest, with the AWS-managed key because no customer key is named. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person confirms the at-rest encryption of the target database on STACKIT: the PostgreSQL Flex encryption block covers customer keys only and the default without it is not stated, and a MariaDB sandbox instance had database-level encryption off, so whether its volumes are encrypted is not stated (pinned provider). | a check of the knowledge base (aurora storage encrypted mariadb) |
|---|
module.dependencies.module.catalog_rds.aws_rds_cluster.this | tc-database-name | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster.database_name: Name of the initial database created in the cluster; application setup. No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.catalog_rds.aws_rds_cluster.this | tcf-rds-cluster-instance--identifier | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster_instance.identifier (a facet of the unit): Name of the instance; it identifies the resource and changes no access, encryption, backup or availability behaviour. No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.catalog_rds.aws_security_group.this | egress-restriction | REVIEW | A check of the knowledge base (sg egress restricted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (sg egress restricted) |
|---|
module.dependencies.module.catalog_rds.aws_security_group.this | network-topology-boundary | REVIEW | A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (topology vpc unproven) |
|---|
module.dependencies.module.catalog_rds.aws_security_group.this | rule-ports | REVIEW | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema). | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (sg rule not rendered) |
|---|
module.dependencies.module.catalog_rds.aws_security_group.this | security-group-vpc-membership | UNSUPPORTED | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project. | A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. | a check of the knowledge base (topology vpc unproven) |
|---|
module.dependencies.module.catalog_rds.aws_security_group.this | standalone-rule-values | REVIEW | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). An aws_security_group_rule becomes a stackit_security_group_rule: type → direction, protocol → protocol, cidr_blocks → ip_range (one rule per range), source_security_group_id → remote_security_group_id. A rule that is not generated is named NOT CARRIED and the group is REVIEW. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (sg rule not rendered) |
|---|
module.dependencies.module.catalog_rds.aws_security_group.this | stateful | REVIEW | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true). | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | at-rest-encryption-off | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. No at-rest encryption in the source; stackit_valkey_instance states nothing about at-rest encryption (pinned provider) — REVIEW, not PRESERVED. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_elasticache_replication_group |
|---|
module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | failover-off | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A single node without failover: the draft asks for the plan (plan_name is a variable), so whether the target is a Single plan is a person's choice — REVIEW, not PRESERVED. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_elasticache_replication_group |
|---|
module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | network-placement | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_valkey_instance has no subnet, security-group, zone or IP-family attribute; client access can be limited by CIDR with parameters.sgw_acl, which the draft does not generate — a person decides it. | A person decides how clients reach the Valkey instance, which has no subnet or security-group setting, for example by limiting client CIDR ranges with its access parameter. | the mapping rule for aws_elasticache_replication_group |
|---|
module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | parameter-group | REVIEW | A check of the knowledge base (redis parameter group) needs a value the scan cannot read statically, so it could not decide. The setting states which custom set of engine parameters (a parameter group) the cache runs with. | A literal value or a resolved reference in the source lets the check decide, or a person verifies the value. | a check of the knowledge base that the source cannot settle (redis parameter group) |
|---|
module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | parameter-group-default | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A parameter group named default.<family> carries the AWS default settings of that engine family and version, and its name can carry the topology: a group with cluster.on in its name enables cluster mode. | A person confirms that the defaults of the source parameter group family are what the application needs on the target and, for a cluster-mode group, treats it as the cluster-mode question. | the mapping rule for aws_elasticache_replication_group |
|---|
module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | seed-snapshot | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The instance is created empty: the data is migrated by a person (RDB export and import, or replication); stackit_valkey_instance and stackit_redis_instance have no snapshot or restore attribute (pinned provider). snapshot_arns is observed for every set value, an empty list included: the draft names snapshot_arns NOT CARRIED even when it is empty; a conditional with a null branch stays undecided, hence REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_elasticache_replication_group |
|---|
module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | snapshots-off | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. No snapshots in the source; whether a STACKIT Valkey instance takes snapshots by default (parameters.snapshot, not generated) is not documented — REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_elasticache_replication_group |
|---|
module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | tc-elasticache-replication-group-replication-group-id | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The identifier of the cache replication group. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). | A person confirms the instance name the target uses against what refers to the replication group id, or accepts the new name. | the mapping rule for aws_elasticache_replication_group |
|---|
module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | tcp-elasticache-replication-group-transit-encryption-enabled | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_elasticache_replication_group.transit_encryption_enabled: Encryption in transit (TLS) between clients and the cache; losing it sends data and AUTH in clear. Held CRITICAL: it decides whether and with which key data or metadata is encrypted; dropping it silently could leave data unencrypted on the target. | A person confirms that clients reach the cache over TLS on the target, so that data and the authentication token are not sent in clear. | the mapping rule for aws_elasticache_replication_group |
|---|
module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd | network-topology-boundary | REVIEW | A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (topology vpc unproven) |
|---|
module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd | rule-ports | REVIEW | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema). | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (sg rule not rendered) |
|---|
module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd | security-group-vpc-membership | UNSUPPORTED | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project. | A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. | a check of the knowledge base (topology vpc unproven) |
|---|
module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd | standalone-rule-empty-sources | REVIEW | A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). self = false and empty IPv6/prefix-list lists (module defaults) add no source, as the drafted rule adds none — PRESERVED, per rule that states no source, next to rules that do (those are standalone rule other sources, REVIEW); REVIEW when a rule of the group is not generated (its settings are named NOT CARRIED, the rule not generated check) or a value is not visible statically: the draft names such a value NOT CARRIED and nothing here claims it carried. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (sg rule not rendered) |
|---|
module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd | standalone-rule-other-sources | REVIEW | A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). A standalone rule's own group (self) and IPv6 ranges are written where the draft places the rule (self as remote_security_group_id of the group, an IPv6 range as ip_range with ether_type IPv6), and the draft names the rule NOT CARRIED when the plan withholds it; prefix lists are not generated (as rule other sources for inline rules; prefix lists: the prefix list check), and a person adds the rule if the traffic must pass — REVIEW in every order position. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (sg rule not rendered) |
|---|
module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd | standalone-rule-values | REVIEW | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). An aws_security_group_rule becomes a stackit_security_group_rule: type → direction, protocol → protocol, cidr_blocks → ip_range (one rule per range), source_security_group_id → remote_security_group_id. A rule that is not generated is named NOT CARRIED and the group is REVIEW. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (sg rule not rendered) |
|---|
module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd | stateful | REVIEW | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true). | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | encryption-at-rest | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. It is not stated in stackit_mongodbflex_instance (no encryption attribute) whether STACKIT MongoDB Flex encrypts data at rest: REVIEW (the customer managed key setting reads the key). | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_dynamodb_table |
|---|
module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | index-projection-and-name | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The projection of a secondary index (keys only, INCLUDE with its non_key_attributes, ALL) decides which attributes an index query can return, and the index name is what every Query / Scan on the index selects it by (API Query IndexName). STACKIT has no provider resource for an index (pinned provider), a person re-creates the indexes and the queries that name them in the chosen engine — REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_dynamodb_table |
|---|
module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | key-schema | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The draft names the partition/sort key as the collection's unique index; the data model is rewritten by people. | A person designs the keys and indexes of the replacement collection (partition and sort key, attribute names and types, secondary index keys), because the draft names only the key as the collection's unique index. | the mapping rule for aws_dynamodb_table |
|---|
module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | point-in-time-recovery | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. MongoDB Flex has a point-in-time window in hours (options.point_in_time_window_hours); its maximum is not documented in the provider schema. The draft carries no value for it. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_dynamodb_table |
|---|
module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | tc-dynamodb-table-name | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_dynamodb_table.name: Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). No semantic of this family has verified it as carried. | A person confirms the name the replacement collection carries on the target against what refers to the source name, or accepts the new name. | the mapping rule for aws_dynamodb_table |
|---|
module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | ttl | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. DynamoDB TTL reads epoch seconds; a MongoDB TTL index expires only BSON dates, so the attribute changes type. The time-to-live check still fires only for enabled = true; the case handler REVIEW covers the other states. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_dynamodb_table |
|---|
module.dependencies.module.orders_rds.aws_rds_cluster.this | admin-password | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The source password (or its Secrets Manager management) is never copied, and no STACKIT database user takes a password: stackit_postgresflex_user and stackit_mariadb_credential compute it (password is computed and sensitive, pinned provider) and the create-user API of PostgreSQL Flex has no password field. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.orders_rds.aws_rds_cluster.this | admin-username-not-carried | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The master username is not a literal of a single cluster that PostgreSQL Flex accepts: a name a variable supplies or that is not visible statically (the draft writes the user with a variable that has no default), a name STACKIT reserves (admin and postgres: the draft writes a variable that rejects them), or a repeated cluster (a user per cluster only when every instance is evaluated). A person chooses the administrator's name on the target — REVIEW. | A person creates the administrator on the target with a name the target accepts and confirms the application connects with it. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.orders_rds.aws_rds_cluster.this | db-network-placement | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no subnet, availability-zone or IP-family attribute (pinned provider): clients reach it at the endpoint STACKIT assigns, restricted by its ACL — a person decides how clients reach it — REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.orders_rds.aws_rds_cluster.this | final-snapshot | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no final snapshot or delete-time backup setting (pinned provider): it is deleted when Terraform destroys it — a person decides how data survives a destroy (export first) — REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.orders_rds.aws_rds_cluster.this | member-settings | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Cluster members are not separate STACKIT resources (the flavor defines the nodes, pinned provider): a member's failover priority, parameter group, subnet group, zone, CA certificate and Performance Insights key have no attribute — a person decides what the nodes need — REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.orders_rds.aws_rds_cluster.this | parameter-and-option-groups | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no parameter-group or option-group attribute (pinned provider): the group's settings (even a default.* group of the source engine) must be mapped to the STACKIT instance's options by a person — REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.orders_rds.aws_rds_cluster.this | security-groups | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT database instances have no security groups: access is a CIDR ACL (network.acl, pinned provider); the draft's ACL variable defaults to the CIDRs of the groups' ingress rules where visible, and group-to-group rules cannot be expressed — a person checks the ACL — REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.orders_rds.aws_rds_cluster.this | storage-encryption | REVIEW | A check of the knowledge base (aurora storage encrypted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states whether the storage of the database cluster is encrypted at rest, with the AWS-managed key because no customer key is named. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person confirms the at-rest encryption of the target database on STACKIT: the PostgreSQL Flex encryption block covers customer keys only and the default without it is not stated, and a MariaDB sandbox instance had database-level encryption off, so whether its volumes are encrypted is not stated (pinned provider). | a check of the knowledge base (aurora storage encrypted) |
|---|
module.dependencies.module.orders_rds.aws_rds_cluster.this | tc-database-name | REVIEW
confirm only: the draft already carries it, by TF/stackit_postgresflex_database.dependencies_orders_rds_this_orders (TERRAFORM): the source `database_name` = `orders` is written as `name` = `orders` by the draft (`terraform/data.tf`, block `stackit_postgresflex_database.dependencies_orders_rds_this_orders`): the value is the source's, the connection strings of the application that name the database are a person's to confirm | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster.database_name: Name of the initial database created in the cluster; application setup. No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.orders_rds.aws_rds_cluster.this | tcf-rds-cluster-instance--identifier | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster_instance.identifier (a facet of the unit): Name of the instance; it identifies the resource and changes no access, encryption, backup or availability behaviour. No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_rds_cluster |
|---|
module.dependencies.module.orders_rds.aws_security_group.this | egress-restriction | REVIEW | A check of the knowledge base (sg egress restricted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (sg egress restricted) |
|---|
module.dependencies.module.orders_rds.aws_security_group.this | network-topology-boundary | REVIEW | A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (topology vpc unproven) |
|---|
module.dependencies.module.orders_rds.aws_security_group.this | rule-ports | REVIEW | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema). | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (sg rule not rendered) |
|---|
module.dependencies.module.orders_rds.aws_security_group.this | security-group-vpc-membership | UNSUPPORTED | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project. | A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. | a check of the knowledge base (topology vpc unproven) |
|---|
module.dependencies.module.orders_rds.aws_security_group.this | standalone-rule-values | REVIEW | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). An aws_security_group_rule becomes a stackit_security_group_rule: type → direction, protocol → protocol, cidr_blocks → ip_range (one rule per range), source_security_group_id → remote_security_group_id. A rule that is not generated is named NOT CARRIED and the group is REVIEW. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (sg rule not rendered) |
|---|
module.dependencies.module.orders_rds.aws_security_group.this | stateful | REVIEW | This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true). | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks | tc-name | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_cloudwatch_log_group.name is the address a log producer writes to (awslogs-group, PutLogEvents logGroupName). The name is therefore not carried by anything the draft generates, and no producer is rewired: a person decides the label convention and reconfigures each producer - REVIEW (the plan holds it as a label convention manual action). Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). | A person decides the label convention under which the log group name survives in STACKIT Logs and reconfigures each producer to send it; the draft configures no shipper. | the mapping rule for aws_cloudwatch_log_group |
|---|
module.retail_app_ecs.aws_kms_key.cmk | deletion-window | REVIEW | A check of the knowledge base (kms deletion window) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). STACKIT KMS deletes a key scheduled for deletion after 30 days (docs create-and-manage-keys, 'Delete a key'), with no setting: 30 is PRESERVED, another window REVIEW. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (kms deletion window) |
|---|
module.retail_app_ecs.aws_secretsmanager_secret.catalog_db | customer-managed-key | REVIEW | A check of the knowledge base (secret cmk) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Critical and reading the key since 2026-09-27: the draft names it NOT CARRIED, except where it sets the instance's kms_key (below). The AWS key does not move, AWS's key per secret has no per-secret counterpart, and the draft sets the kms_key block (referencing the drafted STACKIT key) only when every source of the shared instance is an AWS secret that references that one key — otherwise it names the key NOT CARRIED with the reason; either way a person decides (REVIEW, see the customer-managed key check). | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (secret cmk) |
|---|
module.retail_app_ecs.aws_secretsmanager_secret.catalog_db | secret-value | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The value moves to STACKIT Secrets Manager (Vault-compatible KV). The draft generates the shared instance, and the plan a WriteSecret step for an aws_secretsmanager_secret or a SecureString aws_ssm_parameter that is not repeated. The step writes the document the person supplies and does not carry this setting (the value is the person's document); for a secret repeated by count or for_each whose instances are not all known, and for a parameter whose type is not the literal SecureString, only the instance is generated. What a person decides, per secret: where the value comes from (the same value fetched from a secure source, or a new one — moving is the moment to rotate) and the Vault path the application will read, then writes it with the Vault provider or CLI — REVIEW. History: added with aws_ssm_parameter on 2026-09-24; REVIEW since 2026-09-27 (was TRANSFORMED); 2026-10-29 the wording names the WriteSecret step of the plan; 2026-10-30 the step is also made for a SecureString parameter. | A person decides per secret where the value comes from (the same value from a secure source, or a new one) and the Vault path the application reads, then writes it with a Vault KV v2 client. | the mapping rule for aws_secretsmanager_secret |
|---|
module.retail_app_ecs.aws_secretsmanager_secret.catalog_db | tc-secretsmanager-secret-name | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_secretsmanager_secret.name: Friendly name used to address the secret; losing it breaks lookups by name but does not change who may reach or read the value, its encryption or deletion behaviour (IAM statements that scope by name are assessed on the IAM policy). No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). | A person confirms the secret name or path the application looks up on the target, or accepts the new one. | the mapping rule for aws_secretsmanager_secret |
|---|
module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch | customer-managed-key | REVIEW | A check of the knowledge base (secret cmk) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Critical and reading the key since 2026-09-27: the draft names it NOT CARRIED, except where it sets the instance's kms_key (below). The AWS key does not move, AWS's key per secret has no per-secret counterpart, and the draft sets the kms_key block (referencing the drafted STACKIT key) only when every source of the shared instance is an AWS secret that references that one key — otherwise it names the key NOT CARRIED with the reason; either way a person decides (REVIEW, see the customer-managed key check). | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (secret cmk) |
|---|
module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch | secret-value | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The value moves to STACKIT Secrets Manager (Vault-compatible KV). The draft generates the shared instance, and the plan a WriteSecret step for an aws_secretsmanager_secret or a SecureString aws_ssm_parameter that is not repeated. The step writes the document the person supplies and does not carry this setting (the value is the person's document); for a secret repeated by count or for_each whose instances are not all known, and for a parameter whose type is not the literal SecureString, only the instance is generated. What a person decides, per secret: where the value comes from (the same value fetched from a secure source, or a new one — moving is the moment to rotate) and the Vault path the application will read, then writes it with the Vault provider or CLI — REVIEW. History: added with aws_ssm_parameter on 2026-09-24; REVIEW since 2026-09-27 (was TRANSFORMED); 2026-10-29 the wording names the WriteSecret step of the plan; 2026-10-30 the step is also made for a SecureString parameter. | A person decides per secret where the value comes from (the same value from a secure source, or a new one) and the Vault path the application reads, then writes it with a Vault KV v2 client. | the mapping rule for aws_secretsmanager_secret |
|---|
module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch | tc-secretsmanager-secret-name | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_secretsmanager_secret.name: Friendly name used to address the secret; losing it breaks lookups by name but does not change who may reach or read the value, its encryption or deletion behaviour (IAM statements that scope by name are assessed on the IAM policy). No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). | A person confirms the secret name or path the application looks up on the target, or accepts the new one. | the mapping rule for aws_secretsmanager_secret |
|---|
module.retail_app_ecs.aws_secretsmanager_secret.mq | secret-value | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The value moves to STACKIT Secrets Manager (Vault-compatible KV). The draft generates the shared instance, and the plan a WriteSecret step for an aws_secretsmanager_secret or a SecureString aws_ssm_parameter that is not repeated. The step writes the document the person supplies and does not carry this setting (the value is the person's document); for a secret repeated by count or for_each whose instances are not all known, and for a parameter whose type is not the literal SecureString, only the instance is generated. What a person decides, per secret: where the value comes from (the same value fetched from a secure source, or a new one — moving is the moment to rotate) and the Vault path the application will read, then writes it with the Vault provider or CLI — REVIEW. History: added with aws_ssm_parameter on 2026-09-24; REVIEW since 2026-09-27 (was TRANSFORMED); 2026-10-29 the wording names the WriteSecret step of the plan; 2026-10-30 the step is also made for a SecureString parameter. | A person decides per secret where the value comes from (the same value from a secure source, or a new one) and the Vault path the application reads, then writes it with a Vault KV v2 client. | the mapping rule for aws_secretsmanager_secret |
|---|
module.retail_app_ecs.aws_secretsmanager_secret.mq | tc-secretsmanager-secret-name | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_secretsmanager_secret.name: Friendly name used to address the secret; losing it breaks lookups by name but does not change who may reach or read the value, its encryption or deletion behaviour (IAM statements that scope by name are assessed on the IAM policy). No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). | A person confirms the secret name or path the application looks up on the target, or accepts the new one. | the mapping rule for aws_secretsmanager_secret |
|---|
module.retail_app_ecs.aws_secretsmanager_secret.orders_db | secret-value | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The value moves to STACKIT Secrets Manager (Vault-compatible KV). The draft generates the shared instance, and the plan a WriteSecret step for an aws_secretsmanager_secret or a SecureString aws_ssm_parameter that is not repeated. The step writes the document the person supplies and does not carry this setting (the value is the person's document); for a secret repeated by count or for_each whose instances are not all known, and for a parameter whose type is not the literal SecureString, only the instance is generated. What a person decides, per secret: where the value comes from (the same value fetched from a secure source, or a new one — moving is the moment to rotate) and the Vault path the application will read, then writes it with the Vault provider or CLI — REVIEW. History: added with aws_ssm_parameter on 2026-09-24; REVIEW since 2026-09-27 (was TRANSFORMED); 2026-10-29 the wording names the WriteSecret step of the plan; 2026-10-30 the step is also made for a SecureString parameter. | A person decides per secret where the value comes from (the same value from a secure source, or a new one) and the Vault path the application reads, then writes it with a Vault KV v2 client. | the mapping rule for aws_secretsmanager_secret |
|---|
module.retail_app_ecs.aws_secretsmanager_secret.orders_db | tc-secretsmanager-secret-name | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_secretsmanager_secret.name: Friendly name used to address the secret; losing it breaks lookups by name but does not change who may reach or read the value, its encryption or deletion behaviour (IAM statements that scope by name are assessed on the IAM policy). No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). | A person confirms the secret name or path the application looks up on the target, or accepts the new one. | the mapping rule for aws_secretsmanager_secret |
|---|
module.retail_app_ecs.module.alb.aws_lb.this | client-restriction | REVIEW | A check of the knowledge base (lb security groups) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Who may reach the load balancer, read from the ingress rules of the security groups that filter its clients. A group reference, a prefix list, an IPv6 range or a variable is not carried: the plan lists the clients the target would block and adds the client-access manual step for the Security Architect. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person confirms the carried ranges against the source rules, or decides the open client-access step, and the regenerated draft carries the result. | a check of the knowledge base (lb security groups) |
|---|
module.retail_app_ecs.module.alb.aws_lb.this | lb-connection-timeouts | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_lb.idle_timeout and client_keep_alive (aws 6.66.0): how long the load balancer lets a client connection idle and how long it keeps it open. The STACKIT application load balancer has no such attribute and the draft does not carry them - REVIEW: a person decides whether the applications behind the load balancer (long polling, streaming, WebSockets, slow requests) cope with the STACKIT default. aws_alb, the alias type, is not read here. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_lb |
|---|
module.retail_app_ecs.module.alb.aws_lb.this | lb-routing-and-addressing | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states how the load balancer answers DNS for clients (Availability Zone affinity), whether it still forwards to targets when AWS WAF cannot be reached (fail open), zonal shift, customer-owned address pools and IPv6 source NAT prefixes. | A person decides whether the STACKIT load balancer needs an equivalent for each of them, because the STACKIT application and network load balancers have no setting for any of them (pinned provider). | the mapping rule for aws_lb |
|---|
module.retail_app_ecs.module.alb.aws_lb.this | lb-subnets | REVIEW | The value is not visible statically (a case of the mapping rule for this kind of unit), so nothing is credited for it. The load balancer takes the network of its one converted subnet (networks.network_id; several subnets are lb subnets several, REVIEW): STACKIT networks are regional, one network holds what the source spread over zonal subnets. | A literal value or a resolved reference in the source closes it, or a person confirms the value. | the value could not be read; the mapping rule for aws_lb |
|---|
module.retail_app_ecs.module.alb.aws_lb.this | network-exposure | LEDGER | Whether the draft carries this setting is decided by its semantic ledger entry "network exposure", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). internal not visible statically (a variable): the source states no exposure and the draft carries nothing for it; a person decides whether the STACKIT load balancer is private_network_only (REVIEW). | The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference. | ledger:network exposure |
|---|
module.retail_app_ecs.module.alb.aws_lb.this | request-handling | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states how the load balancer treats HTTP requests that may carry a request-smuggling (desync) risk, and how it rewrites the X-Forwarded-For header before the target sees it. | A person confirms that the application does not depend on either behaviour: the STACKIT application load balancer has neither setting and its documentation does not state the behaviour (pinned provider), also for the AWS default values. | the mapping rule for aws_lb |
|---|
module.retail_app_ecs.module.alb.aws_lb.this | request-header-options | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states which extra headers the load balancer adds to the request the target receives (TLS version and cipher suite, the client port in X-Forwarded-For) and whether it keeps the original Host header. | A person decides, for each setting, what the STACKIT load balancer or the application does instead, because the STACKIT application load balancer has no setting that adds, rewrites or renames a request header towards its targets (pinned provider). | the mapping rule for aws_lb |
|---|
module.retail_app_ecs.module.alb.aws_lb.this | tc-lb-name | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_lb.name: Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). No semantic of this family has verified it as carried. | A person confirms the name the load balancer carries on the target against what refers to the source name, or accepts the new name. | the mapping rule for aws_lb |
|---|
module.retail_app_ecs.module.alb.aws_security_group.this | egress-restriction | REVIEW | A check of the knowledge base (sg egress restricted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (sg egress restricted) |
|---|
module.retail_app_ecs.module.alb.aws_security_group.this | network-topology-boundary | REVIEW | A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (topology vpc unproven) |
|---|
module.retail_app_ecs.module.alb.aws_security_group.this | security-group-vpc-membership | UNSUPPORTED | A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project. | A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. | a check of the knowledge base (topology vpc unproven) |
|---|
module.retail_app_ecs.module.alb.aws_security_group.this | stateful | REVIEW | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true). | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | network-topology-boundary | REVIEW | A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (topology vpc unproven) |
|---|
module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | rule-ports | REVIEW | A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema). | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (sg rule not rendered) |
|---|
module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | security-group-vpc-membership | UNSUPPORTED | A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project. | A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. | a check of the knowledge base (topology vpc unproven) |
|---|
module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | standalone-rule-empty-sources | REVIEW | A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). self = false and empty IPv6/prefix-list lists (module defaults) add no source, as the drafted rule adds none — PRESERVED, per rule that states no source, next to rules that do (those are standalone rule other sources, REVIEW); REVIEW when a rule of the group is not generated (its settings are named NOT CARRIED, the rule not generated check) or a value is not visible statically: the draft names such a value NOT CARRIED and nothing here claims it carried. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (sg rule not rendered) |
|---|
module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | standalone-rule-other-sources | REVIEW | A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). A standalone rule's own group (self) and IPv6 ranges are written where the draft places the rule (self as remote_security_group_id of the group, an IPv6 range as ip_range with ether_type IPv6), and the draft names the rule NOT CARRIED when the plan withholds it; prefix lists are not generated (as rule other sources for inline rules; prefix lists: the prefix list check), and a person adds the rule if the traffic must pass — REVIEW in every order position. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (sg rule not rendered) |
|---|
module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | standalone-rule-values | REVIEW | A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). An aws_security_group_rule becomes a stackit_security_group_rule: type → direction, protocol → protocol, cidr_blocks → ip_range (one rule per range), source_security_group_id → remote_security_group_id. A rule that is not generated is named NOT CARRIED and the group is REVIEW. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (sg rule not rendered) |
|---|
module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | stateful | REVIEW | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true). | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.retail_app_ecs.module.carts_service.aws_ecs_service.this | service-connect-values | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Service Connect's switch, namespace, service names, client aliases (DNS name and port), traffic-test header rules, mTLS settings (KMS key, role, private CA) and proxy logging: an AWS-managed service mesh with no draft counterpart; discovery on SKE is Kubernetes Services and DNS, mesh features a person's choice. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.carts_service.aws_ecs_service.this | service-desired-count | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. desired_count is the number of tasks ECS keeps running (ecs_service docs: 'Number of instances of the task definition to place and keep running'); on SKE it becomes Deployment replicas or a HorizontalPodAutoscaler floor. The draft writes it as the replicas of the Deployment in kubernetes/<service>/manifests.yaml when it is a literal number (a HorizontalPodAutoscaler owns the count where the service has a scaling target and policy the draft translates; a number that is not visible statically is a REQUIRED_ token) — a person confirms the number, REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.carts_service.aws_ecs_service.this | service-discovery | REVIEW | A check of the knowledge base (ecs service discovery) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states how ECS services find each other: AWS Cloud Map registries and namespaces, or ECS Service Connect. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person replaces the lookups with Kubernetes Services and cluster DNS on SKE. | a check of the knowledge base (ecs service discovery) |
|---|
module.retail_app_ecs.module.carts_service.aws_ecs_service.this | service-execute-command | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ECS Exec opens a shell in a running task; kubectl exec (and who may use it through RBAC) is the counterpart and is not part of the draft. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.carts_service.aws_ecs_service.this | service-network-placement | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The subnets and security groups the tasks' network interfaces use (awsvpc mode); on SKE pods take the cluster's network and NetworkPolicies decide reachability — a person re-expresses the security group rules. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.carts_service.aws_ecs_service.this | service-public-ip-setting | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. assign_public_ip in either state (the public ip setting reads only true through the public address check): tasks with a public address are exposed unless a person decides the exposure on SKE explicitly (LoadBalancer services, network policies); false is the private default and is still re-checked, the draft carries no service block. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.carts_service.aws_ecs_service.this | service-task-definition | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition the service runs (family:revision or ARN) becomes the Deployment's pod template; ecs_service.task_definition names it as a string, the definition itself is a separate resource a person translates. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.carts_service.aws_ecs_service.this | task-definition | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The ECS task definition: the containers a service runs, with their CPU and memory, environment, secrets and health checks. | A person translates the task definition into Kubernetes Deployments and Services on SKE (CPU and memory, environment, secrets and health checks become manifest fields); the rule names a Cloud Foundry push as the other way for a simple web app. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.carts_service.aws_ecs_service.this | td-container-definitions | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.container_definitions of the unit that runs the task. The containers of the task: images, commands, environment, secret references, ports, health checks, log configuration - the workload itself, and where its credentials are injected. Decide per container: the image and where it lives, command and entry point, environment, ports and health check, cpu/memory as requests and limits, and the log destination; the secret references and the plaintext secrets among the environment entries are read by the settings of the secret references and of the plaintext secrets, the registry by the setting of the image registry. The unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) through this setting (the target does not carry it: it is in the class redesign), so what the reference becomes is part of this setting. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.carts_service.aws_ecs_service.this | td-container-image-registry | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A container image comes from Amazon ECR (a `.dkr.ecr.` or public.ecr.aws registry host) or needs `repositoryCredentials`. The images are not moved by the draft and a pod on STACKIT cannot assume the ECR pull rights of the ECS execution role. Decide: where the images live on STACKIT (the STACKIT Container Registry has a GA API, the Container Registry API specification, but no Terraform resource in pinned provider; a registry of your choice works too), how they are copied, and the pull secret the cluster uses. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.carts_service.aws_ecs_service.this | td-container-plaintext-secret-env | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An `environment` entry whose NAME looks like a credential (password, secret, token, api key, private key, credential) carries a non-empty plaintext value in the task definition (a name heuristic, not a proof: the value is never shown). Decide: whether the value is a secret; if it is, it must not be copied into a Kubernetes manifest or a Terraform variable default but stored in a STACKIT Secrets Manager entry and the plaintext copy in the AWS state and task definition rotated. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.carts_service.aws_ecs_service.this | td-container-secret-references | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition's container_definitions state secret references (the `secrets` list: name and valueFrom, "the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store", AWS ECS API reference, Secret). A person decides first which STACKIT Secrets Manager instance holds each referenced secret (stackit_secretsmanager_instance, pinned provider: name, acls, kms_key; the secret entries themselves have no Terraform resource in the pinned provider, they are created through the API or the portal, and their VALUES are never in the Terraform sources - a person copies them). Second, a person decides how the pods read them (the STACKIT Secrets Manager authenticates with Vault-compatible tokens and AppRole, docs.stackit.cloud/products/security/secrets-manager/; ECS injects valueFrom into environment variables when the container starts, and no STACKIT equivalent of that injection is stated on the documentation page checked 2026-10-06, so the Kubernetes Secret or the in-pod fetch is a design of its own). | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.carts_service.aws_ecs_service.this | td-execution-role-arn | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.execution_role_arn of the template the group builds its instances from: The role ECS uses to pull images and read the secrets it injects into the containers. Not verified as carried by any semantic of this family — reviewed. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.carts_service.aws_ecs_service.this | td-network-mode | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.network_mode of the template the group builds its instances from: How the containers are networked (awsvpc, bridge, host, none): whether each task has its own interface and security groups or shares the host's network. Not verified as carried by any semantic of this family — reviewed. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.carts_service.aws_ecs_service.this | td-task-role-arn | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.task_role_arn of the template the group builds its instances from: The role the application in the containers acts as towards AWS APIs. Not verified as carried by any semantic of this family — reviewed. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role | iam-managed-ecs | REVIEW | A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam managed ecs) |
|---|
module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role | iam-trust-service-workload | REVIEW | A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit). | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam trust service workload) |
|---|
module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role | permissions | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. | A person translates each permission of the attached policies into STACKIT roles on the target resources. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role | trust | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried. | A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.carts_service.aws_iam_role.task_role | iam-managed-customer-policy | REVIEW | A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam managed customer policy) |
|---|
module.retail_app_ecs.module.carts_service.aws_iam_role.task_role | iam-trust-service-workload | REVIEW | A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit). | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam trust service workload) |
|---|
module.retail_app_ecs.module.carts_service.aws_iam_role.task_role | permissions | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. The unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) through this setting (the target does not carry it: it is in the class redesign), so what the reference becomes is part of this setting. | A person translates each permission of the attached policies into STACKIT roles on the target resources. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.carts_service.aws_iam_role.task_role | trust | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried. | A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.carts_service.aws_security_group.this | egress-rule-protocol | REVIEW | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. protocol → stackit_security_group_rule.protocol (pinned provider). the egress restriction setting reads the same attribute and is REVIEW exactly when the egress restriction check fires; this semantic is then REVIEW as well, so the two critical readers of egress.protocol never disagree (TRANSFORMED only when neither check fires). | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.retail_app_ecs.module.carts_service.aws_security_group.this | egress-sources | REVIEW | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. As ingress sources; the egress restriction setting reads egress.cidr_blocks too and is REVIEW exactly when the egress restriction check fires — the same order here, so the two never disagree. | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.retail_app_ecs.module.carts_service.aws_security_group.this | ingress-sources | LEDGER | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27). | The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference. | ledger:security group rules |
|---|
module.retail_app_ecs.module.carts_service.aws_security_group.this | network-topology-boundary | REVIEW | A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (topology vpc unproven) |
|---|
module.retail_app_ecs.module.carts_service.aws_security_group.this | rule-ports | LEDGER | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema). | The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference. | ledger:security group rules |
|---|
module.retail_app_ecs.module.carts_service.aws_security_group.this | security-group-vpc-membership | UNSUPPORTED | A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project. | A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. | a check of the knowledge base (topology vpc unproven) |
|---|
module.retail_app_ecs.module.carts_service.aws_security_group.this | stateful | REVIEW | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true). | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | service-connect-values | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Service Connect's switch, namespace, service names, client aliases (DNS name and port), traffic-test header rules, mTLS settings (KMS key, role, private CA) and proxy logging: an AWS-managed service mesh with no draft counterpart; discovery on SKE is Kubernetes Services and DNS, mesh features a person's choice. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | service-desired-count | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. desired_count is the number of tasks ECS keeps running (ecs_service docs: 'Number of instances of the task definition to place and keep running'); on SKE it becomes Deployment replicas or a HorizontalPodAutoscaler floor. The draft writes it as the replicas of the Deployment in kubernetes/<service>/manifests.yaml when it is a literal number (a HorizontalPodAutoscaler owns the count where the service has a scaling target and policy the draft translates; a number that is not visible statically is a REQUIRED_ token) — a person confirms the number, REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | service-discovery | REVIEW | A check of the knowledge base (ecs service discovery) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states how ECS services find each other: AWS Cloud Map registries and namespaces, or ECS Service Connect. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person replaces the lookups with Kubernetes Services and cluster DNS on SKE. | a check of the knowledge base (ecs service discovery) |
|---|
module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | service-execute-command | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ECS Exec opens a shell in a running task; kubectl exec (and who may use it through RBAC) is the counterpart and is not part of the draft. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | service-network-placement | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The subnets and security groups the tasks' network interfaces use (awsvpc mode); on SKE pods take the cluster's network and NetworkPolicies decide reachability — a person re-expresses the security group rules. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | service-public-ip-setting | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. assign_public_ip in either state (the public ip setting reads only true through the public address check): tasks with a public address are exposed unless a person decides the exposure on SKE explicitly (LoadBalancer services, network policies); false is the private default and is still re-checked, the draft carries no service block. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | service-task-definition | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition the service runs (family:revision or ARN) becomes the Deployment's pod template; ecs_service.task_definition names it as a string, the definition itself is a separate resource a person translates. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | task-definition | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The ECS task definition: the containers a service runs, with their CPU and memory, environment, secrets and health checks. | A person translates the task definition into Kubernetes Deployments and Services on SKE (CPU and memory, environment, secrets and health checks become manifest fields); the rule names a Cloud Foundry push as the other way for a simple web app. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | td-container-definitions | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.container_definitions of the unit that runs the task. The containers of the task: images, commands, environment, secret references, ports, health checks, log configuration - the workload itself, and where its credentials are injected. Decide per container: the image and where it lives, command and entry point, environment, ports and health check, cpu/memory as requests and limits, and the log destination; the secret references and the plaintext secrets among the environment entries are read by the settings of the secret references and of the plaintext secrets, the registry by the setting of the image registry. The unit names 2 resources through this setting whose references the draft does not resolve: module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db (aws_secretsmanager_secret_version), module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch (aws_secretsmanager_secret_version). What each reference becomes is part of this setting. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | td-container-image-registry | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A container image comes from Amazon ECR (a `.dkr.ecr.` or public.ecr.aws registry host) or needs `repositoryCredentials`. The images are not moved by the draft and a pod on STACKIT cannot assume the ECR pull rights of the ECS execution role. Decide: where the images live on STACKIT (the STACKIT Container Registry has a GA API, the Container Registry API specification, but no Terraform resource in pinned provider; a registry of your choice works too), how they are copied, and the pull secret the cluster uses. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | td-container-plaintext-secret-env | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An `environment` entry whose NAME looks like a credential (password, secret, token, api key, private key, credential) carries a non-empty plaintext value in the task definition (a name heuristic, not a proof: the value is never shown). Decide: whether the value is a secret; if it is, it must not be copied into a Kubernetes manifest or a Terraform variable default but stored in a STACKIT Secrets Manager entry and the plaintext copy in the AWS state and task definition rotated. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | td-container-secret-references | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition's container_definitions state secret references (the `secrets` list: name and valueFrom, "the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store", AWS ECS API reference, Secret). A person decides first which STACKIT Secrets Manager instance holds each referenced secret (stackit_secretsmanager_instance, pinned provider: name, acls, kms_key; the secret entries themselves have no Terraform resource in the pinned provider, they are created through the API or the portal, and their VALUES are never in the Terraform sources - a person copies them). Second, a person decides how the pods read them (the STACKIT Secrets Manager authenticates with Vault-compatible tokens and AppRole, docs.stackit.cloud/products/security/secrets-manager/; ECS injects valueFrom into environment variables when the container starts, and no STACKIT equivalent of that injection is stated on the documentation page checked 2026-10-06, so the Kubernetes Secret or the in-pod fetch is a design of its own). | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | td-execution-role-arn | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.execution_role_arn of the template the group builds its instances from: The role ECS uses to pull images and read the secrets it injects into the containers. Not verified as carried by any semantic of this family — reviewed. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | td-network-mode | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.network_mode of the template the group builds its instances from: How the containers are networked (awsvpc, bridge, host, none): whether each task has its own interface and security groups or shares the host's network. Not verified as carried by any semantic of this family — reviewed. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | td-task-role-arn | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.task_role_arn of the template the group builds its instances from: The role the application in the containers acts as towards AWS APIs. Not verified as carried by any semantic of this family — reviewed. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role | iam-managed-ecs | REVIEW | A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam managed ecs) |
|---|
module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role | iam-trust-service-workload | REVIEW | A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit). | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam trust service workload) |
|---|
module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role | permissions | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. The unit names 2 resources through this setting whose references the draft does not resolve: module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (aws_secretsmanager_secret), module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (aws_secretsmanager_secret). What each reference becomes is part of this setting. | A person translates each permission of the attached policies into STACKIT roles on the target resources. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role | trust | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried. | A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role | iam-managed-customer-policy | REVIEW | A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam managed customer policy) |
|---|
module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role | iam-trust-service-workload | REVIEW | A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit). | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam trust service workload) |
|---|
module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role | permissions | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. | A person translates each permission of the attached policies into STACKIT roles on the target resources. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role | trust | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried. | A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.catalog_service.aws_security_group.this | egress-rule-protocol | REVIEW | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. protocol → stackit_security_group_rule.protocol (pinned provider). the egress restriction setting reads the same attribute and is REVIEW exactly when the egress restriction check fires; this semantic is then REVIEW as well, so the two critical readers of egress.protocol never disagree (TRANSFORMED only when neither check fires). | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.retail_app_ecs.module.catalog_service.aws_security_group.this | egress-sources | REVIEW | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. As ingress sources; the egress restriction setting reads egress.cidr_blocks too and is REVIEW exactly when the egress restriction check fires — the same order here, so the two never disagree. | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.retail_app_ecs.module.catalog_service.aws_security_group.this | ingress-sources | LEDGER | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27). | The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference. | ledger:security group rules |
|---|
module.retail_app_ecs.module.catalog_service.aws_security_group.this | network-topology-boundary | REVIEW | A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (topology vpc unproven) |
|---|
module.retail_app_ecs.module.catalog_service.aws_security_group.this | rule-ports | LEDGER | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema). | The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference. | ledger:security group rules |
|---|
module.retail_app_ecs.module.catalog_service.aws_security_group.this | security-group-vpc-membership | UNSUPPORTED | A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project. | A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. | a check of the knowledge base (topology vpc unproven) |
|---|
module.retail_app_ecs.module.catalog_service.aws_security_group.this | stateful | REVIEW | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true). | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | service-connect-values | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Service Connect's switch, namespace, service names, client aliases (DNS name and port), traffic-test header rules, mTLS settings (KMS key, role, private CA) and proxy logging: an AWS-managed service mesh with no draft counterpart; discovery on SKE is Kubernetes Services and DNS, mesh features a person's choice. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | service-desired-count | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. desired_count is the number of tasks ECS keeps running (ecs_service docs: 'Number of instances of the task definition to place and keep running'); on SKE it becomes Deployment replicas or a HorizontalPodAutoscaler floor. The draft writes it as the replicas of the Deployment in kubernetes/<service>/manifests.yaml when it is a literal number (a HorizontalPodAutoscaler owns the count where the service has a scaling target and policy the draft translates; a number that is not visible statically is a REQUIRED_ token) — a person confirms the number, REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | service-discovery | REVIEW | A check of the knowledge base (ecs service discovery) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states how ECS services find each other: AWS Cloud Map registries and namespaces, or ECS Service Connect. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person replaces the lookups with Kubernetes Services and cluster DNS on SKE. | a check of the knowledge base (ecs service discovery) |
|---|
module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | service-execute-command | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ECS Exec opens a shell in a running task; kubectl exec (and who may use it through RBAC) is the counterpart and is not part of the draft. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | service-network-placement | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The subnets and security groups the tasks' network interfaces use (awsvpc mode); on SKE pods take the cluster's network and NetworkPolicies decide reachability — a person re-expresses the security group rules. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | service-public-ip-setting | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. assign_public_ip in either state (the public ip setting reads only true through the public address check): tasks with a public address are exposed unless a person decides the exposure on SKE explicitly (LoadBalancer services, network policies); false is the private default and is still re-checked, the draft carries no service block. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | service-task-definition | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition the service runs (family:revision or ARN) becomes the Deployment's pod template; ecs_service.task_definition names it as a string, the definition itself is a separate resource a person translates. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | task-definition | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The ECS task definition: the containers a service runs, with their CPU and memory, environment, secrets and health checks. | A person translates the task definition into Kubernetes Deployments and Services on SKE (CPU and memory, environment, secrets and health checks become manifest fields); the rule names a Cloud Foundry push as the other way for a simple web app. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | td-container-definitions | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.container_definitions of the unit that runs the task. The containers of the task: images, commands, environment, secret references, ports, health checks, log configuration - the workload itself, and where its credentials are injected. Decide per container: the image and where it lives, command and entry point, environment, ports and health check, cpu/memory as requests and limits, and the log destination; the secret references and the plaintext secrets among the environment entries are read by the settings of the secret references and of the plaintext secrets, the registry by the setting of the image registry. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | td-container-image-registry | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A container image comes from Amazon ECR (a `.dkr.ecr.` or public.ecr.aws registry host) or needs `repositoryCredentials`. The images are not moved by the draft and a pod on STACKIT cannot assume the ECR pull rights of the ECS execution role. Decide: where the images live on STACKIT (the STACKIT Container Registry has a GA API, the Container Registry API specification, but no Terraform resource in pinned provider; a registry of your choice works too), how they are copied, and the pull secret the cluster uses. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | td-container-plaintext-secret-env | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An `environment` entry whose NAME looks like a credential (password, secret, token, api key, private key, credential) carries a non-empty plaintext value in the task definition (a name heuristic, not a proof: the value is never shown). Decide: whether the value is a secret; if it is, it must not be copied into a Kubernetes manifest or a Terraform variable default but stored in a STACKIT Secrets Manager entry and the plaintext copy in the AWS state and task definition rotated. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | td-container-secret-references | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition's container_definitions state secret references (the `secrets` list: name and valueFrom, "the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store", AWS ECS API reference, Secret). A person decides first which STACKIT Secrets Manager instance holds each referenced secret (stackit_secretsmanager_instance, pinned provider: name, acls, kms_key; the secret entries themselves have no Terraform resource in the pinned provider, they are created through the API or the portal, and their VALUES are never in the Terraform sources - a person copies them). Second, a person decides how the pods read them (the STACKIT Secrets Manager authenticates with Vault-compatible tokens and AppRole, docs.stackit.cloud/products/security/secrets-manager/; ECS injects valueFrom into environment variables when the container starts, and no STACKIT equivalent of that injection is stated on the documentation page checked 2026-10-06, so the Kubernetes Secret or the in-pod fetch is a design of its own). | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | td-execution-role-arn | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.execution_role_arn of the template the group builds its instances from: The role ECS uses to pull images and read the secrets it injects into the containers. Not verified as carried by any semantic of this family — reviewed. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | td-network-mode | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.network_mode of the template the group builds its instances from: How the containers are networked (awsvpc, bridge, host, none): whether each task has its own interface and security groups or shares the host's network. Not verified as carried by any semantic of this family — reviewed. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | td-task-role-arn | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.task_role_arn of the template the group builds its instances from: The role the application in the containers acts as towards AWS APIs. Not verified as carried by any semantic of this family — reviewed. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role | iam-managed-ecs | REVIEW | A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam managed ecs) |
|---|
module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role | iam-trust-service-workload | REVIEW | A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit). | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam trust service workload) |
|---|
module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role | permissions | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. | A person translates each permission of the attached policies into STACKIT roles on the target resources. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role | trust | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried. | A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role | iam-managed-customer-policy | REVIEW | A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam managed customer policy) |
|---|
module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role | iam-trust-service-workload | REVIEW | A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit). | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam trust service workload) |
|---|
module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role | permissions | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. The unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) through this setting (the target does not carry it: it is in the class redesign), so what the reference becomes is part of this setting. | A person translates each permission of the attached policies into STACKIT roles on the target resources. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role | trust | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried. | A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.checkout_service.aws_security_group.this | egress-rule-protocol | REVIEW | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. protocol → stackit_security_group_rule.protocol (pinned provider). the egress restriction setting reads the same attribute and is REVIEW exactly when the egress restriction check fires; this semantic is then REVIEW as well, so the two critical readers of egress.protocol never disagree (TRANSFORMED only when neither check fires). | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.retail_app_ecs.module.checkout_service.aws_security_group.this | egress-sources | REVIEW | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. As ingress sources; the egress restriction setting reads egress.cidr_blocks too and is REVIEW exactly when the egress restriction check fires — the same order here, so the two never disagree. | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.retail_app_ecs.module.checkout_service.aws_security_group.this | ingress-sources | LEDGER | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27). | The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference. | ledger:security group rules |
|---|
module.retail_app_ecs.module.checkout_service.aws_security_group.this | network-topology-boundary | REVIEW | A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (topology vpc unproven) |
|---|
module.retail_app_ecs.module.checkout_service.aws_security_group.this | rule-ports | LEDGER | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema). | The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference. | ledger:security group rules |
|---|
module.retail_app_ecs.module.checkout_service.aws_security_group.this | security-group-vpc-membership | UNSUPPORTED | A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project. | A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. | a check of the knowledge base (topology vpc unproven) |
|---|
module.retail_app_ecs.module.checkout_service.aws_security_group.this | stateful | REVIEW | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true). | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.retail_app_ecs.module.orders_service.aws_ecs_service.this | service-connect-values | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Service Connect's switch, namespace, service names, client aliases (DNS name and port), traffic-test header rules, mTLS settings (KMS key, role, private CA) and proxy logging: an AWS-managed service mesh with no draft counterpart; discovery on SKE is Kubernetes Services and DNS, mesh features a person's choice. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.orders_service.aws_ecs_service.this | service-desired-count | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. desired_count is the number of tasks ECS keeps running (ecs_service docs: 'Number of instances of the task definition to place and keep running'); on SKE it becomes Deployment replicas or a HorizontalPodAutoscaler floor. The draft writes it as the replicas of the Deployment in kubernetes/<service>/manifests.yaml when it is a literal number (a HorizontalPodAutoscaler owns the count where the service has a scaling target and policy the draft translates; a number that is not visible statically is a REQUIRED_ token) — a person confirms the number, REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.orders_service.aws_ecs_service.this | service-discovery | REVIEW | A check of the knowledge base (ecs service discovery) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states how ECS services find each other: AWS Cloud Map registries and namespaces, or ECS Service Connect. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person replaces the lookups with Kubernetes Services and cluster DNS on SKE. | a check of the knowledge base (ecs service discovery) |
|---|
module.retail_app_ecs.module.orders_service.aws_ecs_service.this | service-execute-command | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ECS Exec opens a shell in a running task; kubectl exec (and who may use it through RBAC) is the counterpart and is not part of the draft. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.orders_service.aws_ecs_service.this | service-network-placement | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The subnets and security groups the tasks' network interfaces use (awsvpc mode); on SKE pods take the cluster's network and NetworkPolicies decide reachability — a person re-expresses the security group rules. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.orders_service.aws_ecs_service.this | service-public-ip-setting | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. assign_public_ip in either state (the public ip setting reads only true through the public address check): tasks with a public address are exposed unless a person decides the exposure on SKE explicitly (LoadBalancer services, network policies); false is the private default and is still re-checked, the draft carries no service block. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.orders_service.aws_ecs_service.this | service-task-definition | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition the service runs (family:revision or ARN) becomes the Deployment's pod template; ecs_service.task_definition names it as a string, the definition itself is a separate resource a person translates. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.orders_service.aws_ecs_service.this | task-definition | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The ECS task definition: the containers a service runs, with their CPU and memory, environment, secrets and health checks. | A person translates the task definition into Kubernetes Deployments and Services on SKE (CPU and memory, environment, secrets and health checks become manifest fields); the rule names a Cloud Foundry push as the other way for a simple web app. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.orders_service.aws_ecs_service.this | td-container-definitions | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.container_definitions of the unit that runs the task. The containers of the task: images, commands, environment, secret references, ports, health checks, log configuration - the workload itself, and where its credentials are injected. Decide per container: the image and where it lives, command and entry point, environment, ports and health check, cpu/memory as requests and limits, and the log destination; the secret references and the plaintext secrets among the environment entries are read by the settings of the secret references and of the plaintext secrets, the registry by the setting of the image registry. The unit names 2 resources through this setting whose references the draft does not resolve: module.retail_app_ecs.aws_secretsmanager_secret_version.mq (aws_secretsmanager_secret_version), module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db (aws_secretsmanager_secret_version). What each reference becomes is part of this setting. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.orders_service.aws_ecs_service.this | td-container-image-registry | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A container image comes from Amazon ECR (a `.dkr.ecr.` or public.ecr.aws registry host) or needs `repositoryCredentials`. The images are not moved by the draft and a pod on STACKIT cannot assume the ECR pull rights of the ECS execution role. Decide: where the images live on STACKIT (the STACKIT Container Registry has a GA API, the Container Registry API specification, but no Terraform resource in pinned provider; a registry of your choice works too), how they are copied, and the pull secret the cluster uses. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.orders_service.aws_ecs_service.this | td-container-plaintext-secret-env | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An `environment` entry whose NAME looks like a credential (password, secret, token, api key, private key, credential) carries a non-empty plaintext value in the task definition (a name heuristic, not a proof: the value is never shown). Decide: whether the value is a secret; if it is, it must not be copied into a Kubernetes manifest or a Terraform variable default but stored in a STACKIT Secrets Manager entry and the plaintext copy in the AWS state and task definition rotated. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.orders_service.aws_ecs_service.this | td-container-secret-references | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition's container_definitions state secret references (the `secrets` list: name and valueFrom, "the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store", AWS ECS API reference, Secret). A person decides first which STACKIT Secrets Manager instance holds each referenced secret (stackit_secretsmanager_instance, pinned provider: name, acls, kms_key; the secret entries themselves have no Terraform resource in the pinned provider, they are created through the API or the portal, and their VALUES are never in the Terraform sources - a person copies them). Second, a person decides how the pods read them (the STACKIT Secrets Manager authenticates with Vault-compatible tokens and AppRole, docs.stackit.cloud/products/security/secrets-manager/; ECS injects valueFrom into environment variables when the container starts, and no STACKIT equivalent of that injection is stated on the documentation page checked 2026-10-06, so the Kubernetes Secret or the in-pod fetch is a design of its own). | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.orders_service.aws_ecs_service.this | td-execution-role-arn | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.execution_role_arn of the template the group builds its instances from: The role ECS uses to pull images and read the secrets it injects into the containers. Not verified as carried by any semantic of this family — reviewed. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.orders_service.aws_ecs_service.this | td-network-mode | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.network_mode of the template the group builds its instances from: How the containers are networked (awsvpc, bridge, host, none): whether each task has its own interface and security groups or shares the host's network. Not verified as carried by any semantic of this family — reviewed. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.orders_service.aws_ecs_service.this | td-task-role-arn | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.task_role_arn of the template the group builds its instances from: The role the application in the containers acts as towards AWS APIs. Not verified as carried by any semantic of this family — reviewed. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role | iam-managed-ecs | REVIEW | A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam managed ecs) |
|---|
module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role | iam-trust-service-workload | REVIEW | A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit). | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam trust service workload) |
|---|
module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role | permissions | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. The unit names 2 resources through this setting whose references the draft does not resolve: module.retail_app_ecs.aws_secretsmanager_secret.mq (aws_secretsmanager_secret), module.retail_app_ecs.aws_secretsmanager_secret.orders_db (aws_secretsmanager_secret). What each reference becomes is part of this setting. | A person translates each permission of the attached policies into STACKIT roles on the target resources. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role | trust | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried. | A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.orders_service.aws_iam_role.task_role | iam-managed-customer-policy | REVIEW | A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam managed customer policy) |
|---|
module.retail_app_ecs.module.orders_service.aws_iam_role.task_role | iam-trust-service-workload | REVIEW | A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit). | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam trust service workload) |
|---|
module.retail_app_ecs.module.orders_service.aws_iam_role.task_role | permissions | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. | A person translates each permission of the attached policies into STACKIT roles on the target resources. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.orders_service.aws_iam_role.task_role | trust | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried. | A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.orders_service.aws_security_group.this | egress-rule-protocol | REVIEW | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. protocol → stackit_security_group_rule.protocol (pinned provider). the egress restriction setting reads the same attribute and is REVIEW exactly when the egress restriction check fires; this semantic is then REVIEW as well, so the two critical readers of egress.protocol never disagree (TRANSFORMED only when neither check fires). | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.retail_app_ecs.module.orders_service.aws_security_group.this | egress-sources | REVIEW | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. As ingress sources; the egress restriction setting reads egress.cidr_blocks too and is REVIEW exactly when the egress restriction check fires — the same order here, so the two never disagree. | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.retail_app_ecs.module.orders_service.aws_security_group.this | ingress-sources | LEDGER | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27). | The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference. | ledger:security group rules |
|---|
module.retail_app_ecs.module.orders_service.aws_security_group.this | network-topology-boundary | REVIEW | A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (topology vpc unproven) |
|---|
module.retail_app_ecs.module.orders_service.aws_security_group.this | rule-ports | LEDGER | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema). | The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference. | ledger:security group rules |
|---|
module.retail_app_ecs.module.orders_service.aws_security_group.this | security-group-vpc-membership | UNSUPPORTED | A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project. | A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. | a check of the knowledge base (topology vpc unproven) |
|---|
module.retail_app_ecs.module.orders_service.aws_security_group.this | stateful | REVIEW | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true). | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.retail_app_ecs.module.ui_service.aws_ecs_service.this | service-connect-values | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Service Connect's switch, namespace, service names, client aliases (DNS name and port), traffic-test header rules, mTLS settings (KMS key, role, private CA) and proxy logging: an AWS-managed service mesh with no draft counterpart; discovery on SKE is Kubernetes Services and DNS, mesh features a person's choice. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.ui_service.aws_ecs_service.this | service-desired-count | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. desired_count is the number of tasks ECS keeps running (ecs_service docs: 'Number of instances of the task definition to place and keep running'); on SKE it becomes Deployment replicas or a HorizontalPodAutoscaler floor. The draft writes it as the replicas of the Deployment in kubernetes/<service>/manifests.yaml when it is a literal number (a HorizontalPodAutoscaler owns the count where the service has a scaling target and policy the draft translates; a number that is not visible statically is a REQUIRED_ token) — a person confirms the number, REVIEW. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.ui_service.aws_ecs_service.this | service-discovery | REVIEW | A check of the knowledge base (ecs service discovery) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states how ECS services find each other: AWS Cloud Map registries and namespaces, or ECS Service Connect. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person replaces the lookups with Kubernetes Services and cluster DNS on SKE. | a check of the knowledge base (ecs service discovery) |
|---|
module.retail_app_ecs.module.ui_service.aws_ecs_service.this | service-execute-command | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ECS Exec opens a shell in a running task; kubectl exec (and who may use it through RBAC) is the counterpart and is not part of the draft. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.ui_service.aws_ecs_service.this | service-load-balancer-target | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states which container and port receive the load balancer's traffic, the target group or classic load balancer name, and the blue/green listener rules and role: the wiring becomes a Kubernetes Service / Ingress selector and a STACKIT load balancer target pool, written by a person (the draft has no service block to carry it). | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.ui_service.aws_ecs_service.this | service-network-placement | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The subnets and security groups the tasks' network interfaces use (awsvpc mode); on SKE pods take the cluster's network and NetworkPolicies decide reachability — a person re-expresses the security group rules. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.ui_service.aws_ecs_service.this | service-public-ip-setting | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. assign_public_ip in either state (the public ip setting reads only true through the public address check): tasks with a public address are exposed unless a person decides the exposure on SKE explicitly (LoadBalancer services, network policies); false is the private default and is still re-checked, the draft carries no service block. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.ui_service.aws_ecs_service.this | service-task-definition | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition the service runs (family:revision or ARN) becomes the Deployment's pod template; ecs_service.task_definition names it as a string, the definition itself is a separate resource a person translates. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.ui_service.aws_ecs_service.this | task-definition | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The ECS task definition: the containers a service runs, with their CPU and memory, environment, secrets and health checks. | A person translates the task definition into Kubernetes Deployments and Services on SKE (CPU and memory, environment, secrets and health checks become manifest fields); the rule names a Cloud Foundry push as the other way for a simple web app. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.ui_service.aws_ecs_service.this | td-container-definitions | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.container_definitions of the unit that runs the task. The containers of the task: images, commands, environment, secret references, ports, health checks, log configuration - the workload itself, and where its credentials are injected. Decide per container: the image and where it lives, command and entry point, environment, ports and health check, cpu/memory as requests and limits, and the log destination; the secret references and the plaintext secrets among the environment entries are read by the settings of the secret references and of the plaintext secrets, the registry by the setting of the image registry. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.ui_service.aws_ecs_service.this | td-container-image-registry | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A container image comes from Amazon ECR (a `.dkr.ecr.` or public.ecr.aws registry host) or needs `repositoryCredentials`. The images are not moved by the draft and a pod on STACKIT cannot assume the ECR pull rights of the ECS execution role. Decide: where the images live on STACKIT (the STACKIT Container Registry has a GA API, the Container Registry API specification, but no Terraform resource in pinned provider; a registry of your choice works too), how they are copied, and the pull secret the cluster uses. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.ui_service.aws_ecs_service.this | td-container-plaintext-secret-env | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An `environment` entry whose NAME looks like a credential (password, secret, token, api key, private key, credential) carries a non-empty plaintext value in the task definition (a name heuristic, not a proof: the value is never shown). Decide: whether the value is a secret; if it is, it must not be copied into a Kubernetes manifest or a Terraform variable default but stored in a STACKIT Secrets Manager entry and the plaintext copy in the AWS state and task definition rotated. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.ui_service.aws_ecs_service.this | td-container-secret-references | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition's container_definitions state secret references (the `secrets` list: name and valueFrom, "the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store", AWS ECS API reference, Secret). A person decides first which STACKIT Secrets Manager instance holds each referenced secret (stackit_secretsmanager_instance, pinned provider: name, acls, kms_key; the secret entries themselves have no Terraform resource in the pinned provider, they are created through the API or the portal, and their VALUES are never in the Terraform sources - a person copies them). Second, a person decides how the pods read them (the STACKIT Secrets Manager authenticates with Vault-compatible tokens and AppRole, docs.stackit.cloud/products/security/secrets-manager/; ECS injects valueFrom into environment variables when the container starts, and no STACKIT equivalent of that injection is stated on the documentation page checked 2026-10-06, so the Kubernetes Secret or the in-pod fetch is a design of its own). | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.ui_service.aws_ecs_service.this | td-execution-role-arn | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.execution_role_arn of the template the group builds its instances from: The role ECS uses to pull images and read the secrets it injects into the containers. Not verified as carried by any semantic of this family — reviewed. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.ui_service.aws_ecs_service.this | td-network-mode | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.network_mode of the template the group builds its instances from: How the containers are networked (awsvpc, bridge, host, none): whether each task has its own interface and security groups or shares the host's network. Not verified as carried by any semantic of this family — reviewed. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.ui_service.aws_ecs_service.this | td-task-role-arn | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.task_role_arn of the template the group builds its instances from: The role the application in the containers acts as towards AWS APIs. Not verified as carried by any semantic of this family — reviewed. | A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. | the mapping rule for aws_ecs_service |
|---|
module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role | iam-managed-ecs | REVIEW | A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam managed ecs) |
|---|
module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role | iam-trust-service-workload | REVIEW | A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit). | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam trust service workload) |
|---|
module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role | permissions | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. | A person translates each permission of the attached policies into STACKIT roles on the target resources. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role | trust | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried. | A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.ui_service.aws_iam_role.task_role | iam-managed-customer-policy | REVIEW | A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam managed customer policy) |
|---|
module.retail_app_ecs.module.ui_service.aws_iam_role.task_role | iam-trust-service-workload | REVIEW | A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit). | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (iam trust service workload) |
|---|
module.retail_app_ecs.module.ui_service.aws_iam_role.task_role | permissions | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. | A person translates each permission of the attached policies into STACKIT roles on the target resources. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.ui_service.aws_iam_role.task_role | trust | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried. | A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it. | the mapping rule for aws_iam_role |
|---|
module.retail_app_ecs.module.ui_service.aws_security_group.this | egress-rule-protocol | REVIEW | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. protocol → stackit_security_group_rule.protocol (pinned provider). the egress restriction setting reads the same attribute and is REVIEW exactly when the egress restriction check fires; this semantic is then REVIEW as well, so the two critical readers of egress.protocol never disagree (TRANSFORMED only when neither check fires). | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.retail_app_ecs.module.ui_service.aws_security_group.this | egress-sources | REVIEW | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. As ingress sources; the egress restriction setting reads egress.cidr_blocks too and is REVIEW exactly when the egress restriction check fires — the same order here, so the two never disagree. | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.retail_app_ecs.module.ui_service.aws_security_group.this | ingress-sources | LEDGER | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27). | The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference. | ledger:security group rules |
|---|
module.retail_app_ecs.module.ui_service.aws_security_group.this | network-topology-boundary | REVIEW | A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (topology vpc unproven) |
|---|
module.retail_app_ecs.module.ui_service.aws_security_group.this | rule-ports | LEDGER | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. Whether the draft carries this setting is decided by its semantic ledger entry "security group rules", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema). | The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference. | ledger:security group rules |
|---|
module.retail_app_ecs.module.ui_service.aws_security_group.this | security-group-vpc-membership | UNSUPPORTED | A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project. | A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. | a check of the knowledge base (topology vpc unproven) |
|---|
module.retail_app_ecs.module.ui_service.aws_security_group.this | stateful | REVIEW | UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true). | A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. | unenforced:security group rules |
|---|
module.vpc.module.vpc.aws_eip.nat | public-address | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The address changes. An Elastic IP of a NAT gateway is its fixed egress address, an open question on STACKIT (fixed egress ip of the NAT gateway rule). | A person decides how peers that allow-list the Elastic IP are served: STACKIT egress uses the project's shared address, which differs from the Elastic IP, cannot be set and can change; a STACKIT public IP per server keeps its address. | the mapping rule for aws_eip |
|---|
module.vpc.module.vpc.aws_nat_gateway.this | fixed-egress-ip | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A stable egress IP on STACKIT is an open question (no source in this repository answers it; the per-network SNAT address is computed and cannot be chosen or kept). | A person decides how peers that allow-list the Elastic IP are served: a routed STACKIT network leaves by the project's shared egress address, which cannot be set and can change, so the allow-list follows it or each server gets a STACKIT public IP. | the mapping rule for aws_nat_gateway |
|---|
module.vpc.module.vpc.aws_nat_gateway.this | nat-placement | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A zonal NAT gateway (subnet_id) is placed in one AZ; a regional one lists its per-AZ egress in availability_zone_address(es).availability_zone. STACKIT has no NAT gateway resource, and its documentation does not state whether the implicit outbound path is zone-scoped: REVIEW. | A person decides whether the egress path must stay in one zone or per zone, because the STACKIT documentation does not state whether the implicit outbound path is scoped to a zone. | the mapping rule for aws_nat_gateway |
|---|
module.vpc.module.vpc.aws_nat_gateway.this | network-topology-boundary | REVIEW | A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this NAT gateway included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (topology vpc unproven) |
|---|
module.vpc.module.vpc.aws_vpc.this | default-nacl-rules | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The account's default network ACL is adopted by the VPC (aws_default_network_acl); a deny rule, a rule that is not all-protocol, a CIDR other than 0.0.0.0/0 or ::/0, or an explicitly empty rule list narrows or leaves undecided what the AWS default allow-all states. | A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic. | the mapping rule for aws_vpc |
|---|
module.vpc.module.vpc.aws_vpc.this | default-route-table | REVIEW | A check of the knowledge base (vpc main table undecided) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The account's default route table is adopted (a facet of the VPC, aws_default_route_table, AWS provider 6.66.0). Routes other than a plain 0.0.0.0/0 to an internet or NAT gateway are REVIEW. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (vpc main table undecided) |
|---|
module.vpc.module.vpc.aws_vpc.this | default-security-group-omitted-direction | REVIEW | A check of the knowledge base (vpc default sg no ingress rules) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The adopted default security group of the VPC (a facet, aws_default_security_group) does not state an ingress or an egress direction. Nothing is drafted for this facet, so the empty direction is not reproduced: a person decides whether servers that used the default group must stay without outbound traffic (delete the allow-all egress rules of the STACKIT group after apply) or are meant to have it, and puts them in a STACKIT group that states no ingress rule, not in the project's default group. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (vpc default sg no ingress rules) |
|---|
module.vpc.module.vpc.aws_vpc.this | dns-settings | REVIEW | The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. enable_dns_support and enable_dns_hostnames of the VPC decide how names resolve for what runs in it; STACKIT has no VPC object (each subnet becomes a stackit_network). | A person confirms how names resolve for the servers of the migrated networks. | the mapping rule for aws_vpc |
|---|
module.vpc.module.vpc.aws_vpc.this | main-table-set | REVIEW | A check of the knowledge base (vpc main table undecided) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting names the route table that is the main route table of the VPC, when the configuration sets it or the scan cannot tell. STACKIT has no main route table. | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (vpc main table undecided) |
|---|
module.vpc.module.vpc.aws_vpc.this | network-topology-boundary | REVIEW | A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). STACKIT has no VPC container in its stable model: the project is the boundary of its networks and its virtual router routes between all networks of one project (docs.stackit.cloud core-networking architecture, updated Aug 20, 2026: "Routing between multiple Virtual Networks in the same project"; SNA "extends the networking architecture to enable cross-project connectivity"). Several VPCs, or a count the scan cannot see: the draft puts every network in the one var.project_id and cannot keep them apart — REVIEW, the choice is the architect's. A unit that names a VPC, or is placed in a subnet (subnet_id, subnets, vpc_config.subnet_ids, ...), without one whole reference to the VPC or to a subnet of the estate may stand in a VPC the estate does not create: the architect decides it the same way (REVIEW). | A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. | a check of the knowledge base (topology vpc unproven) |
|---|