StackToIT Migration Intelligence Workspace

1 unit: module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this · owner role Identity Architect · required by phase: not stated · 3 steps rest on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

catalog (PROPOSED)

Wave

wave 4 · steps in data services

Approval

not approved: no decisions file was given with this run

What the draft does

Review the access and encryption settings setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect). Review the credentials and keys settings setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this. The plan refuses REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/credentials-and-keys-settings. Review the domain credentials and keys setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this. The plan refuses REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/domain-credentials-and-keys. Review the domain settings setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect). Review the fine grained access setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect). Confirm the effect of a neighbouring OpenSearch domain policy: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect). Review the OpenSearch domain policy resource setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect).

Still open

Review the access and encryption settings setting: the target behaviour of this setting is not established Review the credentials and keys settings setting: the target behaviour of this setting is not established Review the domain credentials and keys setting: the target behaviour of this setting is not established Review the domain settings setting: the target behaviour of this setting is not established Review the fine grained access setting: the target behaviour of this setting is not established Confirm the effect of a neighbouring OpenSearch domain policy: the target behaviour of this setting is not established Review the OpenSearch domain policy resource setting: the target behaviour of this setting is not established. Review the access and encryption settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The access policy, free-form engine options, fine-grained access switches, encryption at rest and between nodes, the HTTPS and TLS policy of the endpoint and the engine version of the domain, read wherever they are set. Review the credentials and keys settings setting: The mapping rule for this kind of unit found a setting the target has no counterpart for. The IAM master user, the master user name and password, the customer KMS key and the custom endpoint certificate, read where they are set whatever their value. STACKIT generates the OpenSearch credential (stackit_opensearch_credential username and password are computed), offers no customer KMS key for the instance and no custom endpoint certificate (pinned provider) - UNSUPPORTED; a password is never carried. Review the domain credentials and keys setting: The mapping rule for this kind of unit found a setting the target has no counterpart for. STACKIT generates the OpenSearch credential (stackit_opensearch_credential username and password are computed), offers no customer KMS key for the instance and no custom endpoint certificate (pinned provider) — UNSUPPORTED. Review the domain settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_opensearch_instance takes a plan (plan_name: nodes and storage), a version and parameters (sgw_acl, syslog, tls_protocols, tls_ciphers, etc.; pinned provider): the domain's node layout, zone awareness, storage, access policy, endpoint TLS and HTTPS settings, internal user database and log publishing are not generated — a person maps them to the plan and parameters — REVIEW. Review the fine grained access setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether fine-grained access control, with users, roles and permissions inside the domain, is switched on. Confirm the effect of a neighbouring OpenSearch domain policy: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_opensearch_domain_policy (search access policy) attaches an access policy to this domain, so who may reach and use it is decided by that policy and not by the domain's own settings. Review the OpenSearch domain policy resource setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The domain's resource-based access policy, written as aws_opensearch_domain_policy (a part of the domain), has no counterpart on STACKIT OpenSearch.

What closes it

Review the access and encryption settings setting: A person maps each setting to the STACKIT OpenSearch instance, which has an access list, TLS protocols and ciphers and a version, but no policy document, no free-form option map and no encryption switch (pinned provider). Review the credentials and keys settings setting: A person accepts the difference or the design changes: nothing in the source can make the target carry it. Review the domain credentials and keys setting: A person accepts the difference or the design changes: nothing in the source can make the target carry it. Review the domain settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the fine grained access setting: A person re-creates the access rules another way, because fine-grained IAM access has no equivalent on STACKIT OpenSearch, which offers an access list and credentials per instance. Confirm the effect of a neighbouring OpenSearch domain policy: A person reads the policy the neighbour attaches and confirms that the replacing OpenSearch domain lets the same principals act on it, and no more, or that the access is dropped on purpose. Review the OpenSearch domain policy resource setting: A person lists the principals and conditions the policy names, decides how their separation is kept (one instance per trust level, or in the application) and puts the source ranges into sgw_acl.

Next action

Review the access and encryption settings setting: Review the access and encryption settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this · owner role Network Architect · required by phase: not stated · 1 step rests on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

catalog (PROPOSED)

Wave

wave 4 · steps in data services

Approval

not approved: no decisions file was given with this run

What the draft does

Review the network settings setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-network-architect). Review the private endpoint setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-network-architect).

Still open

Review the network settings setting: the target behaviour of this setting is not established Review the private endpoint setting: the target behaviour of this setting is not established. Review the network settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The VPC placement of the domain (subnet and security group ids, IP address type), read where it is set whatever its value. stackit_opensearch_instance has no network or subnet input; its access control is parameters.sgw_acl, a CIDR list (pinned provider) - REVIEW: a person translates the reachable networks into sgw_acl. Review the private endpoint setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether the domain lives inside a VPC, with subnets and security groups, instead of behind a public endpoint.

What closes it

Review the network settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the private endpoint setting: A person translates the networks that may reach the domain into the access list (a list of CIDR ranges) of the STACKIT OpenSearch instance, which has no network or subnet input (pinned provider).

Next action

Review the network settings setting: Review the network settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this · owner role Platform Architect · required by phase: not stated · 1 step rests on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

catalog (PROPOSED)

Wave

wave 4 · steps in data services

Approval

not approved: no decisions file was given with this run

What the draft does

Review the cluster layout settings setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect). Choose the database engine version: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect). Review the storage settings setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect). Confirm the domain name of the OpenSearch domain: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect).

Still open

Review the cluster layout settings setting: the target behaviour of this setting is not established Choose the database engine version: the target behaviour of this setting is not established Review the storage settings setting: the target behaviour of this setting is not established Confirm the domain name of the OpenSearch domain: the target behaviour of this setting is not established. Review the cluster layout settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Every node-layout setting of the domain, read where it is set whatever its value (on, off, empty, a variable, a reference, a block written as an attribute object): instance count, dedicated masters, warm and cold storage, zone awareness and its zone count, multi-AZ with standby and the deployment strategy. A stackit_opensearch_instance takes a plan (plan_name) that fixes nodes, topology and storage, no zone-awareness or tier setting (pinned provider, the provider documentation of opensearch_instance) - REVIEW: a person picks the plan that matches the layout. Choose the database engine version: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states which engine and version the OpenSearch domain runs: OpenSearch or legacy Elasticsearch, with its version number. Review the storage settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether the data nodes use EBS volumes, read where it is set whatever its value. Storage of a stackit_opensearch_instance is defined by its plan (pinned provider, the provider documentation of opensearch_instance): no EBS switch - REVIEW: a person picks a plan whose disk fits the index size. Confirm the domain name of the OpenSearch domain: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_opensearch_domain.domain_name: Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). No semantic of this family has verified it as carried.

What closes it

Review the cluster layout settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Choose the database engine version: A person chooses the version of the STACKIT OpenSearch instance, which has a version setting (pinned provider), and checks that the domain's clients work with it. Review the storage settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the domain name of the OpenSearch domain: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.

Next action

Review the cluster layout settings setting: Review the cluster layout settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this · owner role Security Architect · required by phase: not stated · 1 step rests on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

catalog (PROPOSED)

Wave

wave 4 · steps in data services

Approval

not approved: no decisions file was given with this run

What the draft does

Review the encryption at rest setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/encryption-at-rest).

Still open

Review the encryption at rest setting: the target behaviour of this setting is not established. Review the encryption at rest setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether the data the domain stores is encrypted at rest.

What closes it

Review the encryption at rest setting: A person confirms the encryption of the STACKIT OpenSearch instance on the target; the instance has no encryption setting (pinned provider), and no STACKIT fact about it is documented here.

Next action

Review the encryption at rest setting: Review the encryption at rest setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.dependencies.module.catalog_rds.aws_rds_cluster.this · owner role Data Architect · required by phase: not stated · 1 step rests on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• module.dependencies.module.catalog_rds.aws_rds_cluster.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders

Wave

wave 4 · steps in data services

Approval

not approved: no decisions file was given with this run

What the draft does

Review the backup retention setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-data-architect). Review the final snapshot setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-data-architect).

Still open

Review the backup retention setting: the target behaviour of this setting is not established Review the final snapshot setting: the target behaviour of this setting is not established. Review the backup retention setting: Whether the draft carries this setting is decided by its semantic ledger entry "backup retention", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). A retention not visible statically (a variable) is read by no fact and the draft carries nothing for it: a person compares it with the target's backup retention (REVIEW). Review the final snapshot setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no final snapshot or delete-time backup setting (pinned provider): it is deleted when Terraform destroys it — a person decides how data survives a destroy (export first) — REVIEW.

What closes it

Review the backup retention setting: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference. Review the final snapshot setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.

Next action

Review the backup retention setting: Review the backup retention setting for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.dependencies.module.catalog_rds.aws_rds_cluster.this · owner role Identity Architect · required by phase: not stated · 1 step rests on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• module.dependencies.module.catalog_rds.aws_rds_cluster.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders

Wave

wave 4 · steps in data services

Approval

not approved: no decisions file was given with this run

What the draft does

Review the admin username not carried setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/admin-username-not-carried).

Still open

Review the admin username not carried setting: the target behaviour of this setting is not established. Review the admin username not carried setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The master username is not a literal of a single cluster that PostgreSQL Flex accepts: a name a variable supplies or that is not visible statically (the draft writes the user with a variable that has no default), a name STACKIT reserves (admin and postgres: the draft writes a variable that rejects them), or a repeated cluster (a user per cluster only when every instance is evaluated). A person chooses the administrator's name on the target — REVIEW.

What closes it

Review the admin username not carried setting: A person creates the administrator on the target with a name the target accepts and confirms the application connects with it.

Next action

Review the admin username not carried setting: Review the admin username not carried setting for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.dependencies.module.catalog_rds.aws_rds_cluster.this · owner role Network Architect · required by phase: not stated · 1 step rests on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• module.dependencies.module.catalog_rds.aws_rds_cluster.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders

Wave

wave 4 · steps in data services

Approval

not approved: no decisions file was given with this run

What the draft does

Decide how clients reach the database (the endpoint STACKIT assigns and its access list): The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-network-architect). Review the member settings setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-network-architect). Review the security groups setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-network-architect).

Still open

Decide how clients reach the database (the endpoint STACKIT assigns and its access list): the target behaviour of this setting is not established Review the member settings setting: the target behaviour of this setting is not established Review the security groups setting: the target behaviour of this setting is not established. Decide how clients reach the database (the endpoint STACKIT assigns and its access list): The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no subnet, availability-zone or IP-family attribute (pinned provider): clients reach it at the endpoint STACKIT assigns, restricted by its ACL — a person decides how clients reach it — REVIEW. Review the member settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Cluster members are not separate STACKIT resources (the flavor defines the nodes, pinned provider): a member's failover priority, parameter group, subnet group, zone, CA certificate and Performance Insights key have no attribute — a person decides what the nodes need — REVIEW. Review the security groups setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT database instances have no security groups: access is a CIDR ACL (network.acl, pinned provider); the draft's ACL variable defaults to the CIDRs of the groups' ingress rules where visible, and group-to-group rules cannot be expressed — a person checks the ACL — REVIEW.

What closes it

Decide how clients reach the database (the endpoint STACKIT assigns and its access list): A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the member settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the security groups setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.

Next action

Decide how clients reach the database (the endpoint STACKIT assigns and its access list): Decide how clients reach the database (the endpoint STACKIT assigns and its access list) for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.dependencies.module.catalog_rds.aws_rds_cluster.this · owner role Platform Architect · required by phase: not stated · 1 step rests on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• module.dependencies.module.catalog_rds.aws_rds_cluster.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders

Wave

wave 4 · steps in data services

Approval

not approved: no decisions file was given with this run

What the draft does

Choose the database engine: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect). Choose the database engine version: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect). Review the member engine setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect). Confirm the database name of the RDS cluster: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect). Confirm the identifier of the RDS cluster instance: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect).

Still open

Choose the database engine: the target behaviour of this setting is not established Choose the database engine version: the target behaviour of this setting is not established Review the member engine setting: the target behaviour of this setting is not established Confirm the database name of the RDS cluster: the target behaviour of this setting is not established Confirm the identifier of the RDS cluster instance: the target behaviour of this setting is not established. Choose the database engine: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The database engine of the cluster (Aurora PostgreSQL, Aurora MySQL, or a Multi-AZ cluster on PostgreSQL or MySQL), which decides the STACKIT database service it lands on. Choose the database engine version: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The version of the database engine that the cluster runs. Review the member engine setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Cluster members must run the cluster's engine and version (AWS), which the draft follows (TODO when a member states another): the members' engine and version are what the cluster's engine and the engine version setting decide — TRANSFORMED/PRESERVED for a supported PostgreSQL version, REVIEW otherwise. Confirm the database name of the RDS cluster: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster.database_name: Name of the initial database created in the cluster; application setup. No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). Confirm the identifier of the RDS cluster instance: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster_instance.identifier (a facet of the unit): Name of the instance; it identifies the resource and changes no access, encryption, backup or availability behaviour.

What closes it

Choose the database engine: For a MySQL-compatible cluster a person tests the schemas and queries on STACKIT MariaDB, the closest managed engine, because STACKIT has no MySQL product; for a PostgreSQL cluster, which lands on PostgreSQL Flex, a person confirms that no Aurora-only feature (storage auto-scaling, fast clones, global databases, serverless v2 scaling) is relied on. Choose the database engine version: For a PostgreSQL cluster a person picks a major version that PostgreSQL Flex offers (14 to 18; 18 is beta in eu01, so production needs 17 or a generally available 18) and plans an upgrade for any other version. For a MySQL-compatible cluster a person tests the MySQL 8 features in use on STACKIT MariaDB. Review the member engine setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the database name of the RDS cluster: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the identifier of the RDS cluster instance: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.

Next action

Choose the database engine: Choose the database engine for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.dependencies.module.catalog_rds.aws_rds_cluster.this · owner role Security Architect · required by phase: not stated · 1 step rests on it

Options and trade-off

2 options across its settings, each with its trade-off under Technical details

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• module.dependencies.module.catalog_rds.aws_rds_cluster.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders

Wave

wave 4 · steps in data services

Approval

not approved: no decisions file was given with this run

What the draft does

Decide how the administrator password is supplied: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect). Review the parameter and option groups setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect). Review the storage encryption setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect).

Still open

Review the storage encryption setting: A check of the knowledge base (aurora storage encrypted mariadb) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it).

Next action

Decide how the administrator password is supplied: Decide how the administrator password is supplied for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.dependencies.module.orders_rds.aws_rds_cluster.this · owner role Security Architect · required by phase: not stated · 1 step rests on it

Options and trade-off

2 options across its settings, each with its trade-off under Technical details

Applications touched

orders (PROPOSED)

Wave

wave 4 · steps in data services

Approval

not approved: no decisions file was given with this run

What the draft does

Decide how the administrator password is supplied: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect). Review the parameter and option groups setting: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect). Review the storage encryption setting: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect).

Still open

Review the storage encryption setting: A check of the knowledge base (aurora storage encrypted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it).

Next action

Decide how the administrator password is supplied: Decide how the administrator password is supplied for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.dependencies.module.orders_rds.aws_rds_cluster.this · owner role Data Architect · required by phase: not stated · 1 step rests on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

orders (PROPOSED)

Wave

wave 4 · steps in data services

Approval

not approved: no decisions file was given with this run

What the draft does

Review the final snapshot setting: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-snapshot).

Still open

Review the final snapshot setting: the target behaviour of this setting is not established. Review the final snapshot setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no final snapshot or delete-time backup setting (pinned provider): it is deleted when Terraform destroys it — a person decides how data survives a destroy (export first) — REVIEW.

What closes it

Review the final snapshot setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.

Next action

Review the final snapshot setting: Review the final snapshot setting for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.dependencies.module.orders_rds.aws_rds_cluster.this · owner role Identity Architect · required by phase: not stated · 1 step rests on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

orders (PROPOSED)

Wave

wave 4 · steps in data services

Approval

not approved: no decisions file was given with this run

What the draft does

Review the admin username not carried setting: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/admin-username-not-carried).

Still open

Review the admin username not carried setting: the target behaviour of this setting is not established. Review the admin username not carried setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The master username is not a literal of a single cluster that PostgreSQL Flex accepts: a name a variable supplies or that is not visible statically (the draft writes the user with a variable that has no default), a name STACKIT reserves (admin and postgres: the draft writes a variable that rejects them), or a repeated cluster (a user per cluster only when every instance is evaluated). A person chooses the administrator's name on the target — REVIEW.

What closes it

Review the admin username not carried setting: A person creates the administrator on the target with a name the target accepts and confirms the application connects with it.

Next action

Review the admin username not carried setting: Review the admin username not carried setting for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.dependencies.module.orders_rds.aws_rds_cluster.this · owner role Network Architect · required by phase: not stated · 1 step rests on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

orders (PROPOSED)

Wave

wave 4 · steps in data services

Approval

not approved: no decisions file was given with this run

What the draft does

Decide how clients reach the database (the endpoint STACKIT assigns and its access list): The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-network-architect). Review the member settings setting: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-network-architect). Review the security groups setting: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-network-architect).

Still open

Decide how clients reach the database (the endpoint STACKIT assigns and its access list): the target behaviour of this setting is not established Review the member settings setting: the target behaviour of this setting is not established Review the security groups setting: the target behaviour of this setting is not established. Decide how clients reach the database (the endpoint STACKIT assigns and its access list): The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no subnet, availability-zone or IP-family attribute (pinned provider): clients reach it at the endpoint STACKIT assigns, restricted by its ACL — a person decides how clients reach it — REVIEW. Review the member settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Cluster members are not separate STACKIT resources (the flavor defines the nodes, pinned provider): a member's failover priority, parameter group, subnet group, zone, CA certificate and Performance Insights key have no attribute — a person decides what the nodes need — REVIEW. Review the security groups setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT database instances have no security groups: access is a CIDR ACL (network.acl, pinned provider); the draft's ACL variable defaults to the CIDRs of the groups' ingress rules where visible, and group-to-group rules cannot be expressed — a person checks the ACL — REVIEW.

What closes it

Decide how clients reach the database (the endpoint STACKIT assigns and its access list): A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the member settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the security groups setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.

Next action

Decide how clients reach the database (the endpoint STACKIT assigns and its access list): Decide how clients reach the database (the endpoint STACKIT assigns and its access list) for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.dependencies.module.orders_rds.aws_rds_cluster.this · owner role Platform Architect · required by phase: not stated · 2 steps rest on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

orders (PROPOSED)

Wave

wave 4 · steps in data services, platform services

Approval

not approved: no decisions file was given with this run

What the draft does

Confirm the database name of the RDS cluster: The draft carries it on module.dependencies.module.orders_rds.aws_rds_cluster.this: step TF/stackit_postgresflex_database.dependencies_orders_rds_this_orders (the source `database_name` = `orders` is written as `name` = `orders` by the draft (`terraform/data.tf`, block `stackit_postgresflex_database.dependencies_orders_rds_this_orders`): the value is the source's, the connection strings of the application that name the database are a person's to confirm). Confirm the identifier of the RDS cluster instance: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/tcf-rds-cluster-instance--identifier).

Still open

Confirm the database name of the RDS cluster: a person confirms that the carried value is what the source relies on Confirm the identifier of the RDS cluster instance: the target behaviour of this setting is not established. Confirm the database name of the RDS cluster: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster.database_name: Name of the initial database created in the cluster; application setup. No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). Confirm the identifier of the RDS cluster instance: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster_instance.identifier (a facet of the unit): Name of the instance; it identifies the resource and changes no access, encryption, backup or availability behaviour.

What closes it

Confirm the database name of the RDS cluster: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the identifier of the RDS cluster instance: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.

Next action

Confirm the identifier of the RDS cluster instance: Confirm the identifier of the RDS cluster instance for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.retail_app_ecs.module.carts_service.aws_security_group.this · owner role Network Architect · required by phase: not stated · 2 steps rest on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

carts (PROPOSED)

Wave

wave 2 · steps in security

Approval

not approved: no decisions file was given with this run

What the draft does

Decide how the target enforces the protocol of the outbound rules of the security group: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_security_group.this/open-settings). Decide how the target enforces the destinations the outbound rules of the security group allow: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_security_group.this/open-settings). Confirm the sources the inbound rules of the security group allow: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_security_group.this/open-settings). Confirm that the project is the boundary of one network: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_security_group.this/open-settings). Confirm the ports of the rules of the security group: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_security_group.this/open-settings). Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_security_group.this. Review the stateful setting: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_security_group.this/open-settings).

Next action

Decide how the target enforces the protocol of the outbound rules of the security group: Decide how the target enforces the protocol of the outbound rules of the security group for module.retail_app_ecs.module.carts_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.retail_app_ecs.module.catalog_service.aws_security_group.this · owner role Network Architect · required by phase: not stated · 2 steps rest on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• module.retail_app_ecs.module.catalog_service.aws_security_group.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders

Wave

wave 2 · steps in security

Approval

not approved: no decisions file was given with this run

What the draft does

Decide how the target enforces the protocol of the outbound rules of the security group: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_security_group.this/open-settings). Decide how the target enforces the destinations the outbound rules of the security group allow: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_security_group.this/open-settings). Confirm the sources the inbound rules of the security group allow: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_security_group.this/open-settings). Confirm that the project is the boundary of one network: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_security_group.this/open-settings). Confirm the ports of the rules of the security group: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_security_group.this/open-settings). Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_security_group.this. Review the stateful setting: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_security_group.this/open-settings).

Next action

Decide how the target enforces the protocol of the outbound rules of the security group: Decide how the target enforces the protocol of the outbound rules of the security group for module.retail_app_ecs.module.catalog_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.retail_app_ecs.module.checkout_service.aws_security_group.this · owner role Network Architect · required by phase: not stated · 2 steps rest on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

checkout (PROPOSED)

Wave

wave 2 · steps in security

Approval

not approved: no decisions file was given with this run

What the draft does

Decide how the target enforces the protocol of the outbound rules of the security group: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_security_group.this/open-settings). Decide how the target enforces the destinations the outbound rules of the security group allow: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_security_group.this/open-settings). Confirm the sources the inbound rules of the security group allow: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_security_group.this/open-settings). Confirm that the project is the boundary of one network: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_security_group.this/open-settings). Confirm the ports of the rules of the security group: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_security_group.this/open-settings). Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_security_group.this. Review the stateful setting: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_security_group.this/open-settings).

Next action

Decide how the target enforces the protocol of the outbound rules of the security group: Decide how the target enforces the protocol of the outbound rules of the security group for module.retail_app_ecs.module.checkout_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.retail_app_ecs.module.orders_service.aws_security_group.this · owner role Network Architect · required by phase: not stated · 2 steps rest on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

orders (PROPOSED)

Wave

wave 2 · steps in security

Approval

not approved: no decisions file was given with this run

What the draft does

Decide how the target enforces the protocol of the outbound rules of the security group: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_security_group.this/open-settings). Decide how the target enforces the destinations the outbound rules of the security group allow: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_security_group.this/open-settings). Confirm the sources the inbound rules of the security group allow: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_security_group.this/open-settings). Confirm that the project is the boundary of one network: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_security_group.this/open-settings). Confirm the ports of the rules of the security group: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_security_group.this/open-settings). Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_security_group.this. Review the stateful setting: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_security_group.this/open-settings).

Next action

Decide how the target enforces the protocol of the outbound rules of the security group: Decide how the target enforces the protocol of the outbound rules of the security group for module.retail_app_ecs.module.orders_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.retail_app_ecs.module.ui_service.aws_security_group.this · owner role Network Architect · required by phase: not stated · 2 steps rest on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

ui (PROPOSED)

Wave

wave 2 · steps in security

Approval

not approved: no decisions file was given with this run

What the draft does

Decide how the target enforces the protocol of the outbound rules of the security group: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_security_group.this/open-settings). Decide how the target enforces the destinations the outbound rules of the security group allow: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_security_group.this/open-settings). Confirm the sources the inbound rules of the security group allow: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_security_group.this/open-settings). Confirm that the project is the boundary of one network: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_security_group.this/open-settings). Confirm the ports of the rules of the security group: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_security_group.this/open-settings). Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_security_group.this. Review the stateful setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_security_group.this/open-settings).

Next action

Decide how the target enforces the protocol of the outbound rules of the security group: Decide how the target enforces the protocol of the outbound rules of the security group for module.retail_app_ecs.module.ui_service.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.vpc.module.vpc.aws_subnet.private · owner role Network Architect · required by phase: not stated · 1 step rests on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group holds an affected unit

Wave

not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in foundation

Approval

not approved: no decisions file was given with this run

What the draft does

Confirm that the project is the boundary of one network: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a "not carried" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the prefix setting: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect). Decide how private servers reach the internet (outbound IPv4): The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect). Without a bound target environment the network keeps STACKIT's default gateway (routed and no_ipv4_gateway unset), so its servers can start outbound connections. With a target environment whose egress is none, every network the draft creates is written routed = false (an open egress decision, and a network narrower than the source: it reaches no other network either); with STACKIT's default routing it is written routed = true (wider than a source subnet without an internet route). The setting stays open for review in every case: no equivalence of the private egress is proven. Confirm which network each subnet belongs to: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect).

Still open

Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the prefix setting: the target behaviour of this setting is not established Decide how private servers reach the internet (outbound IPv4): What the source subnet reaches (where unproven); that the servers of the subnet cannot reach the internet on the target, as on the source; and, where the source resolved private names, that the target resolves them. Confirm which network each subnet belongs to: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this subnet included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project. Review the prefix setting: The value is not visible statically (a case of the mapping rule for this kind of unit), so nothing is credited for it. stackit_network.ipv4_prefix. TRANSFORMED for a CIDR the scan has seen. The draft carries the prefix as stackit_network.ipv4_prefix taken from a variable without a default (pinned provider: "The IPv4 prefix of the network (CIDR)") and says in the variable's description that the source CIDR is not visible; decide the CIDR each STACKIT network gets (the source CIDRs are reused unless the address plan changes) and enter it before plan. Decide how private servers reach the internet (outbound IPv4): A check of the knowledge base (subnet egress ipv4 unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The source and the target are not equivalent for outbound access, and the draft closes nothing: REVIEW. Confirm which network each subnet belongs to: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The VPC the subnet belongs to: the draft creates every network in one project, so the source VPC's boundary is kept only when the estate has one VPC and every resource that names a VPC provably names it; the draft states the estate's topology and what the architect decides about it once, at the top of its network file.

Ways out

1. Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.; regeneration: not stated — treated as required; risk: A decision recorded without the evidence the finding names leaves the difference the finding describes in place.; the draft is generated again with it
2. Decide how private servers reach the internet (outbound IPv4): Prove what the source subnet reaches (what the check that cannot prove it asks for); needs the route table the subnet follows and its default route, named by exact references in the source, and for a route to an internet gateway the public IPv4 address of every server in the subnet, or an architect's statement of what the source subnet reaches; effect: A rerun on the source with the exact references reads the subnet as reaching the internet or not; the not-equivalent case then needs one of the other paths.; risk: A statement that is wrong about the source makes the target wider or narrower than the source without a finding.; the draft is generated again with it
3. Decide how private servers reach the internet (outbound IPv4): Accept the routed network and limit outbound traffic with security-group egress rules; needs the outbound traffic the workload really needs (protocol, port, destination), the allow-all default egress rule of each group removed after apply; effect: The network still has an internet path; what the servers may reach is limited by their groups' egress rules (an allow-list was observed enforced per destination, protocol and port).; regeneration: not stated — treated as required; risk: A server whose group keeps an allow-all egress rule reaches the internet; the exposure is wider than the source's until the rules exist.; the draft is generated again with it
4. Decide how private servers reach the internet (outbound IPv4): Isolate the networks: a bound target environment with egress none (routed = false); needs the architect's decision that no network of the project must reach another or the internet (the setting applies to every network the draft creates), a target environment file stating egress mode NONE, bound to the run (target.egress then shows the bound statement); effect: Every network is written routed = false: observed in a STACKIT test project to have no internet egress and no connection to the project's other networks. STACKIT documents no egress switch; this rests on the observation, not on documentation. routed cannot be changed by an update: a later change replaces the network.; risk: The networks are cut off from each other as well (narrower than the source); the behaviour rests on observations in one STACKIT test project.; the draft is generated again with it
5. Confirm which network each subnet belongs to: Bring the closing evidence the finding names, or record the decision it asks for; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.; regeneration: not stated — treated as required; risk: A decision recorded without the evidence the finding names leaves the difference the finding describes in place.; the draft is generated again with it

What closes it

Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the prefix setting: A literal value or a resolved reference in the source closes it, or a person confirms the value. Decide how private servers reach the internet (outbound IPv4): The knowledge base states no closing condition for this setting; the run closes it when a person decides it as a check of the knowledge base (that) fired asks, and that check's closing evidence or decision is recorded. Where the scan cannot prove what the source subnet reaches, the closing evidence is the route table the subnet follows and its default route by exact references, and for a route to an internet gateway the public IPv4 address of every server in the subnet, or an architect's statement of what the source subnet reaches. Where the source subnet has no internet route, it is an architect's decision that the network may reach the internet through the STACKIT gateway with the outbound limits written as security-group egress rules, a decision that the network is isolated (routed = false), or a documented or observed setting that removes the outbound path of a routed network. Decide how private servers reach the internet (outbound IPv4): A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm which network each subnet belongs to: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm which network each subnet belongs to: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Verification: Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result; Decide how private servers reach the internet (outbound IPv4): an outbound connection from a server of the network to an internet address fails (or succeeds only where the decision allows it) on the target; Decide how private servers reach the internet (outbound IPv4): where the source used private DNS: names resolve on the target through the resolvers the networks are given; Confirm which network each subnet belongs to: the check, proof or closing evidence is recorded with its result.

Next action

Review the prefix setting: Review the prefix setting for module.vpc.module.vpc.aws_subnet.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.vpc.module.vpc.aws_subnet.public · owner role Network Architect · required by phase: not stated · 1 step rests on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group holds an affected unit

Wave

not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in foundation

Approval

not approved: no decisions file was given with this run

What the draft does

Confirm which route table each subnet really uses: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a "not carried" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect). Review the prefix setting: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect). Decide how private servers reach the internet (outbound IPv4): The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect). Without a bound target environment the network keeps STACKIT's default gateway (routed and no_ipv4_gateway unset), so its servers can start outbound connections. With a target environment whose egress is none, every network the draft creates is written routed = false (an open egress decision, and a network narrower than the source: it reaches no other network either); with STACKIT's default routing it is written routed = true (wider than a source subnet without an internet route). The setting stays open for review in every case: no equivalence of the private egress is proven. Confirm which network each subnet belongs to: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect).

Still open

Confirm which route table each subnet really uses: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the prefix setting: the target behaviour of this setting is not established Decide how private servers reach the internet (outbound IPv4): What the source subnet reaches (where unproven); that the servers of the subnet cannot reach the internet on the target, as on the source; and, where the source resolved private names, that the target resolves them. Confirm which network each subnet belongs to: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm which route table each subnet really uses: A check of the knowledge base (subnet route table undecided) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The subnet follows the VPC's main route table when no association names a route table. Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this subnet included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project. Review the prefix setting: The value is not visible statically (a case of the mapping rule for this kind of unit), so nothing is credited for it. stackit_network.ipv4_prefix. TRANSFORMED for a CIDR the scan has seen. The draft carries the prefix as stackit_network.ipv4_prefix taken from a variable without a default (pinned provider: "The IPv4 prefix of the network (CIDR)") and says in the variable's description that the source CIDR is not visible; decide the CIDR each STACKIT network gets (the source CIDRs are reused unless the address plan changes) and enter it before plan. Decide how private servers reach the internet (outbound IPv4): A check of the knowledge base (subnet egress ipv4 unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The source and the target are not equivalent for outbound access, and the draft closes nothing: REVIEW. Confirm which network each subnet belongs to: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The VPC the subnet belongs to: the draft creates every network in one project, so the source VPC's boundary is kept only when the estate has one VPC and every resource that names a VPC provably names it; the draft states the estate's topology and what the architect decides about it once, at the top of its network file.

Ways out

1. Confirm which route table each subnet really uses: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base); needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.; regeneration: not stated — treated as required; risk: The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes.; the draft is generated again with it
2. Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.; regeneration: not stated — treated as required; risk: A decision recorded without the evidence the finding names leaves the difference the finding describes in place.; the draft is generated again with it
3. Decide how private servers reach the internet (outbound IPv4): Prove what the source subnet reaches (what the check that cannot prove it asks for); needs the route table the subnet follows and its default route, named by exact references in the source, and for a route to an internet gateway the public IPv4 address of every server in the subnet, or an architect's statement of what the source subnet reaches; effect: A rerun on the source with the exact references reads the subnet as reaching the internet or not; the not-equivalent case then needs one of the other paths.; risk: A statement that is wrong about the source makes the target wider or narrower than the source without a finding.; the draft is generated again with it
4. Decide how private servers reach the internet (outbound IPv4): Accept the routed network and limit outbound traffic with security-group egress rules; needs the outbound traffic the workload really needs (protocol, port, destination), the allow-all default egress rule of each group removed after apply; effect: The network still has an internet path; what the servers may reach is limited by their groups' egress rules (an allow-list was observed enforced per destination, protocol and port).; regeneration: not stated — treated as required; risk: A server whose group keeps an allow-all egress rule reaches the internet; the exposure is wider than the source's until the rules exist.; the draft is generated again with it
5. Decide how private servers reach the internet (outbound IPv4): Isolate the networks: a bound target environment with egress none (routed = false); needs the architect's decision that no network of the project must reach another or the internet (the setting applies to every network the draft creates), a target environment file stating egress mode NONE, bound to the run (target.egress then shows the bound statement); effect: Every network is written routed = false: observed in a STACKIT test project to have no internet egress and no connection to the project's other networks. STACKIT documents no egress switch; this rests on the observation, not on documentation. routed cannot be changed by an update: a later change replaces the network.; risk: The networks are cut off from each other as well (narrower than the source); the behaviour rests on observations in one STACKIT test project.; the draft is generated again with it
6. Confirm which network each subnet belongs to: Bring the closing evidence the finding names, or record the decision it asks for; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.; regeneration: not stated — treated as required; risk: A decision recorded without the evidence the finding names leaves the difference the finding describes in place.; the draft is generated again with it

What closes it

Confirm which route table each subnet really uses: A person decides which routes the subnet's network gets: the draft attaches no routing table to the network, and a STACKIT network gets a default gateway unless it is told not to, so what the subnet reaches can differ from AWS. Confirm which route table each subnet really uses: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person decides which routes the subnet's network gets: the draft attaches no routing table to the network, and a STACKIT network gets a default gateway unless it is told not to, so what the subnet reaches can differ from AWS. Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the prefix setting: A literal value or a resolved reference in the source closes it, or a person confirms the value. Decide how private servers reach the internet (outbound IPv4): The knowledge base states no closing condition for this setting; the run closes it when a person decides it as a check of the knowledge base (that) fired asks, and that check's closing evidence or decision is recorded. Where the scan cannot prove what the source subnet reaches, the closing evidence is the route table the subnet follows and its default route by exact references, and for a route to an internet gateway the public IPv4 address of every server in the subnet, or an architect's statement of what the source subnet reaches. Where the source subnet has no internet route, it is an architect's decision that the network may reach the internet through the STACKIT gateway with the outbound limits written as security-group egress rules, a decision that the network is isolated (routed = false), or a documented or observed setting that removes the outbound path of a routed network. Decide how private servers reach the internet (outbound IPv4): A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm which network each subnet belongs to: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm which network each subnet belongs to: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Verification: Confirm which route table each subnet really uses: the decision or the manual work is done and recorded (who, when, what was configured and why); Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result; Decide how private servers reach the internet (outbound IPv4): an outbound connection from a server of the network to an internet address fails (or succeeds only where the decision allows it) on the target; Decide how private servers reach the internet (outbound IPv4): where the source used private DNS: names resolve on the target through the resolvers the networks are given; Confirm which network each subnet belongs to: the check, proof or closing evidence is recorded with its result.

Next action

Review the prefix setting: Review the prefix setting for module.vpc.module.vpc.aws_subnet.public, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks · owner role Platform Architect · required by phase: before the cutover · 1 step rests on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: carts, catalog, checkout, orders, ui

Wave

wave 1 · steps in platform services

Approval

not approved: no decisions file was given with this run

What the draft does

The draft does not do this work; the plan lists it as manual work.

Still open

The work outside the draft is neither done nor verified by StackToIT. The plan of the draft lists the stackitlogs manual action kind "archive flow" (1 action): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.

What closes it

A line the log producers of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks send is found both in the Logs instance and in the archive, and logs older than 180 days are readable from the archive.

Next action

Outside the draft, for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: Configure a cold-storage log flow for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: send a copy of its logs, in parallel to the Logs instance stackit_logs_instance.logs_retention_180d, to a long-term store (for example a separate Object Storage bucket) that keeps them for the retention beyond 180 days; the plan lists it as manual work.

1 unit: module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks · owner role Platform Architect · required by phase: before the cutover · 1 step rests on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: carts, catalog, checkout, orders, ui

Wave

wave 1 · steps in platform services

Approval

not approved: no decisions file was given with this run

What the draft does

The draft does not do this work; the plan lists it as manual work.

Still open

The work outside the draft is neither done nor verified by StackToIT. The plan of the draft lists the stackitlogs manual action kind "label convention" (1 action): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.

What closes it

A static label is chosen, the log producers of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks send its name as the value of that label, and a line one of them sends is found by that label.

Next action

Outside the draft, for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: Choose a static label and send the name of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (and of its streams) from its log producers as the value of that label; the plan lists it as manual work.

1 unit: module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks · owner role Platform Architect · required by phase: before the cutover · 1 step rests on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: carts, catalog, checkout, orders, ui

Wave

wave 1 · steps in platform services

Approval

not approved: no decisions file was given with this run

What the draft does

The draft does not do this work; the plan lists it as manual work.

Still open

The work outside the draft is neither done nor verified by StackToIT. The plan of the draft lists the stackitlogs manual action kind "target precondition" (1 action): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.

What closes it

A write access token for stackit_logs_instance.logs_retention_180d exists, the access control list of the instance is set, and a log line sent with the token to the ingest address of the instance is accepted.

Next action

Outside the draft, for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: Before any log source writes to stackit_logs_instance.logs_retention_180d: create a write access token for the instance (stackit_logs_access_token with the permission write), set the access control list of the instance, and point the shipper at the instance's ingest_url (Loki API) or ingest_otlp_url (OpenTelemetry); the plan lists it as manual work.

1 unit: module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix · owner role Security Architect · required by phase: before the pilot · 2 steps rest on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

ui (PROPOSED)

Wave

wave 2 · steps in security

Approval

not approved: no decisions file was given with this run

What the draft does

The draft does not do this work; the plan lists it as manual work.

Still open

The work outside the draft is neither done nor verified by StackToIT. The plan of the draft lists the stackitsg manual action kind "incomplete" (2 actions): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.

What closes it

Every entry of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules is known and has a rule, or it is confirmed that the known entries are all. Every entry of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules is known and has a rule, or it is confirmed that the known entries are all.

Next action

Outside the draft, for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix: Re-create the rules beyond the known set of group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0] (rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules) (and 1 more manual steps); the plan lists it as manual work.

1 unit: module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix · owner role Security Architect · required by phase: before the pilot · 2 steps rest on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

ui (PROPOSED)

Wave

wave 2 · steps in prepare

Approval

not approved: no decisions file was given with this run

What the draft does

The draft does not do this work; the plan lists it as manual work.

Still open

The work outside the draft is neither done nor verified by StackToIT. The plan of the draft lists the stackitsg manual action kind "unplaced" (2 actions): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.

What closes it

The source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] is written on the security group it belongs to. The source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] is written on the security group it belongs to.

Next action

Outside the draft, for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix: Place the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] on the security group it belongs to and write it (and 1 more manual steps); the plan lists it as manual work.

5 units: module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.catalog_service.aws_ecs_service.this and 3 more · owner role Identity Architect · required by phase: before the pilot · 10 steps rest on it

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

carts (PROPOSED), catalog (PROPOSED), checkout (PROPOSED), orders (PROPOSED), ui (PROPOSED)

Wave

waves 3 to 9 · steps in prepare

Approval

not approved: no decisions file was given with this run

What the draft does

The draft writes no resource for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, module.retail_app_ecs.module.orders_service.aws_ecs_service.this and 1 more.

Still open

The work outside the draft is neither done nor verified by StackToIT. The stackitsa plan of the draft writes no resource for 5 units and states why (the plan states the cause for each unit: module.retail_app_ecs.module.carts_service.aws_ecs_service.this: module.retail_app_ecs.module.carts_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person); module.retail_app_ecs.module.catalog_service.aws_ecs_service.this: module.retail_app_ecs.module.catalog_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person); module.retail_app_ecs.module.checkout_service.aws_ecs_service.this: module.retail_app_ecs.module.checkout_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person); and 2 more): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.

What closes it

The identity fact of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed. The identity fact of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.carts_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed. The identity fact of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed. The identity fact of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed. The identity fact of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed. The identity fact of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed. The identity fact of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed. The identity fact of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.orders_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed. The identity fact of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed. The identity fact of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.ui_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed.

Next action

Outside the draft, for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, module.retail_app_ecs.module.orders_service.aws_ecs_service.this and 1 more: Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach (and 9 more manual steps); the plan lists it as manual work.