← AWS Retail Store Sample AppExamplesLegal NoticePrivacy

StackToIT Migration Intelligence Workspace

PROPOSAL — generated by StackToIT Assess. Architect review required before any decision.

Partially executable migration package · Proposal only · Not approved.

Technical details: run, versions, digest and evidence freshness

Assessment

Assessment
default (assessment format 0.24.0)
Assessment timestamp
Generated 2026-11-02 12:08 UTC by stacktoit 0.6.0-11562-g1966ddf116 (1966ddf116)
Run
f6267c3f-2848-4aa5-89df-5fee8b15b3b9 · source digest sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70
Source snapshot
partly decided only at plan time · aws not locked; random not locked
STACKIT target profile
Stable network model: the experimental STACKIT VPC resources are not used (STACKIT_STABLE)
STACKIT provider version
0.121.0
Knowledge base version
0.384.0
Evidence freshness
Not assessed — Evidence freshness as one measure is not assessed in this build. Dated evidence is shown where it is used: each STACKIT support option and each assurance row states when it was verified (verified_at, and recheck_after for support), in support_suitability and assurance. The date beside a readiness dimension is the assessment date, not a retrieval date.

Staleness: Not assessed — This build has no change detection, so there has been no re-check since the assessment was made (Generated 2026-11-02 12:08 UTC). The source may have changed since.

Source checks: Built-in source checks passed — OpenTofu validation of the source did not run (LOCK_FILE)

Run status: COMPLETE (report published). Source: partly decided only at plan time. Draft: GENERATED. The report was written whole; this is not a statement that the migration is ready.

Executive lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Architect lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Platform lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Security lens: the sections are in the order this reader usually wants, and Costs and Migration Plan are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Application owner lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Programme lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

FinOps lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Engineering lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Decisions, group g04: Network Security

Group g04 of 8. Work package Network Security: the full cards of 8 records. The Decisions page holds the records and lists every group.

Previous group (g03) · Next group (g05)

Network Security

8 records: 7 open input · 1 manual work

What the 3 records below share:

What the draft does
In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a "not carried" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. The plan refuses REF/root/security-group-membership-parity.
Still open
Decide the outbound (egress) rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide which networks the security group may be attached to (a STACKIT group has no network scope): That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide the outbound (egress) rules of the security group: A check of the knowledge base (sg egress restricted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0. Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project. UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true).
Ways out
  1. Decide the outbound (egress) rules of the security group: Verify what the knowledge base's note asks to confirm; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.; regeneration: not stated — treated as required; risk: A setting confirmed from the draft alone, without the check, can still differ at runtime.; the draft is generated again with it
  2. Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.; regeneration: not stated — treated as required; risk: A decision recorded without the evidence the finding names leaves the difference the finding describes in place.; the draft is generated again with it
  3. Decide which networks the security group may be attached to (a STACKIT group has no network scope): Verify what the knowledge base's note asks to confirm; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.; regeneration: not stated — treated as required; risk: A setting confirmed from the draft alone, without the check, can still differ at runtime.; the draft is generated again with it
What closes it
Decide the outbound (egress) rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Decide the outbound (egress) rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. Verification: Decide the outbound (egress) rules of the security group: the check, proof or closing evidence is recorded with its result; Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result; Decide which networks the security group may be attached to (a STACKIT group has no network scope): the check, proof or closing evidence is recorded with its result.
Review the critical settings of a security group (Network Architect) open input

1 unit: module.dependencies.aws_security_group.catalog_opensearch_sg · owner role Network Architect · required by phase: not stated · 2 steps rest on it

Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
catalog (PROPOSED)
Wave
wave 3 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Decide the outbound (egress) rules of the security group: The draft does not carry the setting on module.dependencies.aws_security_group.catalog_opensearch_sg; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings). Confirm that the project is the boundary of one network: The draft does not carry the setting on module.dependencies.aws_security_group.catalog_opensearch_sg; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings). Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.dependencies.aws_security_group.catalog_opensearch_sg. Review the standalone rule not generated setting: The draft does not carry the setting on module.dependencies.aws_security_group.catalog_opensearch_sg; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings). Review the standalone rule remote not resolved setting: The draft does not carry the setting on module.dependencies.aws_security_group.catalog_opensearch_sg; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings). Review the stateful setting: The draft does not carry the setting on module.dependencies.aws_security_group.catalog_opensearch_sg; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings).
Still open
Review the standalone rule not generated setting: the target behaviour of this setting is not established Review the standalone rule remote not resolved setting: the target behaviour of this setting is not established Review the stateful setting: the target behaviour of this setting is not established. Decide which networks the security group may be attached to (a STACKIT group has no network scope): This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). Review the standalone rule not generated setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An aws_security_group_rule the draft does not generate (the draft names its settings NOT CARRIED, or the KB cannot decide that it generates it): a prefix list, an ICMP type with every code, ICMPv6 limited by type or code, a protocol with no STACKIT counterpart, a source or protocol or port not visible statically, a source group that is not one whole reference to a security group of the draft, or a repeated or conditionally created group. A person re-creates the rule with the STACKIT range or group it needs (a rule is never widened: a stackit_security_group_rule without source allows every address, pinned provider) - REVIEW, per rule. Review the standalone rule remote not resolved setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The source of a standalone security group rule: the other security group (source_security_group_id) whose members the rule lets in. Review the stateful setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control.
What closes it
Review the standalone rule not generated setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the standalone rule remote not resolved setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A person re-creates the rule with the STACKIT security group or address range it needs; the draft does not widen it (a stackit_security_group_rule without a source allows everything, pinned provider).
Next action
Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.aws_security_group.catalog_opensearch_sg, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
Technical details

Record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG (open critical semantic) · action: verify the behaviour · decisions.json

Decision
the critical settings of a unit, of the aws.security_group contract
Affected applications
None named.
Open critical semantics (unit|semantic)
6
Show the 6 open critical semantics
  • alias module.dependencies.aws_security_group.catalog_opensearch_sg|egress-restriction
  • alias module.dependencies.aws_security_group.catalog_opensearch_sg|network-topology-boundary
  • alias module.dependencies.aws_security_group.catalog_opensearch_sg|security-group-vpc-membership
  • alias module.dependencies.aws_security_group.catalog_opensearch_sg|standalone-rule-not-generated
  • alias module.dependencies.aws_security_group.catalog_opensearch_sg|standalone-rule-remote-not-resolved
  • alias module.dependencies.aws_security_group.catalog_opensearch_sg|stateful
Options
None listed.
Settings
6 critical settings of the unit, each with its own reason, state and options:
  1. Decide the outbound (egress) rules of the security group (egress-restriction): Open: no decision of the record has been taken. The knowledge base cannot decide "egress-restriction" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.dependencies.aws_security_group.catalog_opensearch_sg: the check, proof or closing evidence is recorded with its result.
  2. Confirm that the project is the boundary of one network (network-topology-boundary): Open: no decision of the record has been taken. The knowledge base cannot decide "network-topology-boundary" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.dependencies.aws_security_group.catalog_opensearch_sg: the check, proof or closing evidence is recorded with its result.
  3. Decide which networks the security group may be attached to (a STACKIT group has no network scope) (security-group-vpc-membership): Open: no decision of the record has been taken. The knowledge base cannot decide "security-group-vpc-membership" of the aws.security_group contract for 1 unit (not available on STACKIT): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.aws_security_group.catalog_opensearch_sg, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  4. Review the standalone rule not generated setting (standalone-rule-not-generated): Open: no decision of the record has been taken. The knowledge base cannot decide "standalone-rule-not-generated" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Review the standalone rule not generated setting for module.dependencies.aws_security_group.catalog_opensearch_sg, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  5. Review the standalone rule remote not resolved setting (standalone-rule-remote-not-resolved): Open: no decision of the record has been taken. The knowledge base cannot decide "standalone-rule-remote-not-resolved" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Review the standalone rule remote not resolved setting for module.dependencies.aws_security_group.catalog_opensearch_sg, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  6. Review the stateful setting (stateful): Open: no decision of the record has been taken. The knowledge base cannot decide "stateful" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Review the stateful setting for module.dependencies.aws_security_group.catalog_opensearch_sg, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
Recommended option
None.
Status
Open: not decided yet.
Review the critical settings of a security group (Network Architect) open input

1 unit: module.dependencies.aws_security_group.mq · owner role Network Architect · required by phase: not stated · 2 steps rest on it

Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
orders (PROPOSED)
Wave
wave 3 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Decide the outbound (egress) rules of the security group: The draft does not carry the setting on module.dependencies.aws_security_group.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.mq/open-settings). Confirm that the project is the boundary of one network: The draft does not carry the setting on module.dependencies.aws_security_group.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.mq/open-settings). Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.dependencies.aws_security_group.mq. Review the standalone rule not generated setting: The draft does not carry the setting on module.dependencies.aws_security_group.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.mq/open-settings). Review the stateful setting: The draft does not carry the setting on module.dependencies.aws_security_group.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.mq/open-settings).
Still open
Review the standalone rule not generated setting: the target behaviour of this setting is not established Review the stateful setting: the target behaviour of this setting is not established. Decide which networks the security group may be attached to (a STACKIT group has no network scope): This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). Review the standalone rule not generated setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An aws_security_group_rule the draft does not generate (the draft names its settings NOT CARRIED, or the KB cannot decide that it generates it): a prefix list, an ICMP type with every code, ICMPv6 limited by type or code, a protocol with no STACKIT counterpart, a source or protocol or port not visible statically, a source group that is not one whole reference to a security group of the draft, or a repeated or conditionally created group. A person re-creates the rule with the STACKIT range or group it needs (a rule is never widened: a stackit_security_group_rule without source allows every address, pinned provider) - REVIEW, per rule. Review the stateful setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control.
What closes it
Review the standalone rule not generated setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
Next action
Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.aws_security_group.mq, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
Technical details

Record DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ (open critical semantic) · action: verify the behaviour · decisions.json

Decision
the critical settings of a unit, of the aws.security_group contract
Affected applications
None named.
Open critical semantics (unit|semantic)
5
Show the 5 open critical semantics
  • alias module.dependencies.aws_security_group.mq|egress-restriction
  • alias module.dependencies.aws_security_group.mq|network-topology-boundary
  • alias module.dependencies.aws_security_group.mq|security-group-vpc-membership
  • alias module.dependencies.aws_security_group.mq|standalone-rule-not-generated
  • alias module.dependencies.aws_security_group.mq|stateful
Options
None listed.
Settings
5 critical settings of the unit, each with its own reason, state and options:
  1. Decide the outbound (egress) rules of the security group (egress-restriction): Open: no decision of the record has been taken. The knowledge base cannot decide "egress-restriction" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.dependencies.aws_security_group.mq: the check, proof or closing evidence is recorded with its result.
  2. Confirm that the project is the boundary of one network (network-topology-boundary): Open: no decision of the record has been taken. The knowledge base cannot decide "network-topology-boundary" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.dependencies.aws_security_group.mq: the check, proof or closing evidence is recorded with its result.
  3. Decide which networks the security group may be attached to (a STACKIT group has no network scope) (security-group-vpc-membership): Open: no decision of the record has been taken. The knowledge base cannot decide "security-group-vpc-membership" of the aws.security_group contract for 1 unit (not available on STACKIT): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.aws_security_group.mq, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  4. Review the standalone rule not generated setting (standalone-rule-not-generated): Open: no decision of the record has been taken. The knowledge base cannot decide "standalone-rule-not-generated" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Review the standalone rule not generated setting for module.dependencies.aws_security_group.mq, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  5. Review the stateful setting (stateful): Open: no decision of the record has been taken. The knowledge base cannot decide "stateful" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Review the stateful setting for module.dependencies.aws_security_group.mq, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
Recommended option
None.
Status
Open: not decided yet.
Review the critical settings of a security group (Network Architect) open input

1 unit: module.retail_app_ecs.module.alb.aws_security_group.this · owner role Network Architect · required by phase: not stated · 2 steps rest on it

Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
ui (PROPOSED)
Wave
wave 2 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Decide the outbound (egress) rules of the security group: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_security_group.this/open-settings). Confirm that the project is the boundary of one network: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_security_group.this/open-settings). Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_security_group.this. Review the stateful setting: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_security_group.this/open-settings).
Still open
Review the stateful setting: the target behaviour of this setting is not established. Decide which networks the security group may be attached to (a STACKIT group has no network scope): A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). Review the stateful setting: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control.
Next action
Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.retail_app_ecs.module.alb.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
Technical details

Record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS (open critical semantic) · action: verify the behaviour · decisions.json

Decision
the critical settings of a unit, of the aws.security_group contract
Affected applications
None named.
Open critical semantics (unit|semantic)
4
Show the 4 open critical semantics
  • alias module.retail_app_ecs.module.alb.aws_security_group.this|egress-restriction
  • alias module.retail_app_ecs.module.alb.aws_security_group.this|network-topology-boundary
  • alias module.retail_app_ecs.module.alb.aws_security_group.this|security-group-vpc-membership
  • alias module.retail_app_ecs.module.alb.aws_security_group.this|stateful
Options
None listed.
Settings
4 critical settings of the unit, each with its own reason, state and options:
  1. Decide the outbound (egress) rules of the security group (egress-restriction): Open: no decision of the record has been taken. The knowledge base cannot decide "egress-restriction" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.module.alb.aws_security_group.this: the check, proof or closing evidence is recorded with its result.
  2. Confirm that the project is the boundary of one network (network-topology-boundary): Open: no decision of the record has been taken. The knowledge base cannot decide "network-topology-boundary" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.module.alb.aws_security_group.this: the check, proof or closing evidence is recorded with its result.
  3. Decide which networks the security group may be attached to (a STACKIT group has no network scope) (security-group-vpc-membership): Open: no decision of the record has been taken. The knowledge base cannot decide "security-group-vpc-membership" of the aws.security_group contract for 1 unit (not available on STACKIT): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.retail_app_ecs.module.alb.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  4. Review the stateful setting (stateful): Open: no decision of the record has been taken. The knowledge base cannot decide "stateful" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Review the stateful setting for module.retail_app_ecs.module.alb.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
Recommended option
None.
Status
Open: not decided yet.

What the 2 records below share:

What the draft does
In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a "not carried" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. The plan refuses REF/root/security-group-membership-parity.
Still open
Decide the outbound (egress) rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the ports of the rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide which networks the security group may be attached to (a STACKIT group has no network scope): That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the standalone rule values setting: the target behaviour of this setting is not established Review the stateful setting: the target behaviour of this setting is not established. Decide the outbound (egress) rules of the security group: A check of the knowledge base (sg egress restricted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0. Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project. Confirm the ports of the rules of the security group: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema). Decide which networks the security group may be attached to (a STACKIT group has no network scope): This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project. Review the standalone rule values setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. An aws_security_group_rule becomes a stackit_security_group_rule: type → direction, protocol → protocol, cidr_blocks → ip_range (one rule per range), source_security_group_id → remote_security_group_id. A rule that is not generated is named NOT CARRIED and the group is REVIEW. Review the stateful setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true).
Ways out
  1. Decide the outbound (egress) rules of the security group: Verify what the knowledge base's note asks to confirm; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.; regeneration: not stated — treated as required; risk: A setting confirmed from the draft alone, without the check, can still differ at runtime.; the draft is generated again with it
  2. Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.; regeneration: not stated — treated as required; risk: A decision recorded without the evidence the finding names leaves the difference the finding describes in place.; the draft is generated again with it
  3. Confirm the ports of the rules of the security group: Verify what the knowledge base's note asks to confirm; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.; regeneration: not stated — treated as required; risk: A setting confirmed from the draft alone, without the check, can still differ at runtime.; the draft is generated again with it
  4. Decide which networks the security group may be attached to (a STACKIT group has no network scope): Verify what the knowledge base's note asks to confirm; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.; regeneration: not stated — treated as required; risk: A setting confirmed from the draft alone, without the check, can still differ at runtime.; the draft is generated again with it
What closes it
Decide the outbound (egress) rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Decide the outbound (egress) rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm the ports of the rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm the ports of the rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. Review the standalone rule values setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. Verification: Decide the outbound (egress) rules of the security group: the check, proof or closing evidence is recorded with its result; Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result; Confirm the ports of the rules of the security group: the check, proof or closing evidence is recorded with its result; Decide which networks the security group may be attached to (a STACKIT group has no network scope): the check, proof or closing evidence is recorded with its result.
Review the critical settings of a security group (Network Architect) open input

1 unit: module.dependencies.module.catalog_rds.aws_security_group.this · owner role Network Architect · required by phase: not stated · 2 steps rest on it

Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
none: no applications file was given and no suggested group is known to hold an affected unit
  • module.dependencies.module.catalog_rds.aws_security_group.this is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders
Wave
wave 3 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Decide the outbound (egress) rules of the security group: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_security_group.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_security_group.this/open-settings). Confirm that the project is the boundary of one network: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_security_group.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_security_group.this/open-settings). Confirm the ports of the rules of the security group: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_security_group.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_security_group.this/open-settings). Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_security_group.this. Review the standalone rule values setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_security_group.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_security_group.this/open-settings). Review the stateful setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_security_group.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_security_group.this/open-settings).
Next action
Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.module.catalog_rds.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
Technical details

Record DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS (open critical semantic) · action: verify the behaviour · decisions.json

Decision
the critical settings of a unit, of the aws.security_group contract
Why it exists
The knowledge base cannot decide 6 critical settings of module.dependencies.module.catalog_rds.aws_security_group.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_rds.aws_security_group.this/open-settings.
Affected applications
None named.
Open critical semantics (unit|semantic)
6
Show the 6 open critical semantics
  • alias module.dependencies.module.catalog_rds.aws_security_group.this|egress-restriction
  • alias module.dependencies.module.catalog_rds.aws_security_group.this|network-topology-boundary
  • alias module.dependencies.module.catalog_rds.aws_security_group.this|rule-ports
  • alias module.dependencies.module.catalog_rds.aws_security_group.this|security-group-vpc-membership
  • alias module.dependencies.module.catalog_rds.aws_security_group.this|standalone-rule-values
  • alias module.dependencies.module.catalog_rds.aws_security_group.this|stateful
Options
None listed.
Settings
6 critical settings of the unit, each with its own reason, state and options:
  1. Decide the outbound (egress) rules of the security group (egress-restriction): Open: no decision of the record has been taken. The knowledge base cannot decide "egress-restriction" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.dependencies.module.catalog_rds.aws_security_group.this: the check, proof or closing evidence is recorded with its result.
  2. Confirm that the project is the boundary of one network (network-topology-boundary): Open: no decision of the record has been taken. The knowledge base cannot decide "network-topology-boundary" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.dependencies.module.catalog_rds.aws_security_group.this: the check, proof or closing evidence is recorded with its result.
  3. Confirm the ports of the rules of the security group (rule-ports): Open: no decision of the record has been taken. The knowledge base cannot decide "rule-ports" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.dependencies.module.catalog_rds.aws_security_group.this: the check, proof or closing evidence is recorded with its result.
  4. Decide which networks the security group may be attached to (a STACKIT group has no network scope) (security-group-vpc-membership): Open: no decision of the record has been taken. The knowledge base cannot decide "security-group-vpc-membership" of the aws.security_group contract for 1 unit (not available on STACKIT): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.module.catalog_rds.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  5. Review the standalone rule values setting (standalone-rule-values): Open: no decision of the record has been taken. The knowledge base cannot decide "standalone-rule-values" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Review the standalone rule values setting for module.dependencies.module.catalog_rds.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  6. Review the stateful setting (stateful): Open: no decision of the record has been taken. The knowledge base cannot decide "stateful" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Review the stateful setting for module.dependencies.module.catalog_rds.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
Recommended option
None.
Status
Open: not decided yet.
Review the critical settings of a security group (Network Architect) open input

1 unit: module.dependencies.module.orders_rds.aws_security_group.this · owner role Network Architect · required by phase: not stated · 2 steps rest on it

Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
orders (PROPOSED)
Wave
wave 3 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Decide the outbound (egress) rules of the security group: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_security_group.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_security_group.this/open-settings). Confirm that the project is the boundary of one network: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_security_group.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_security_group.this/open-settings). Confirm the ports of the rules of the security group: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_security_group.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_security_group.this/open-settings). Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.dependencies.module.orders_rds.aws_security_group.this. Review the standalone rule values setting: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_security_group.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_security_group.this/open-settings). Review the stateful setting: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_security_group.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_security_group.this/open-settings).
Next action
Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.module.orders_rds.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
Technical details

Record DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS (open critical semantic) · action: verify the behaviour · decisions.json

Decision
the critical settings of a unit, of the aws.security_group contract
Why it exists
The knowledge base cannot decide 6 critical settings of module.dependencies.module.orders_rds.aws_security_group.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.orders_rds.aws_security_group.this/open-settings.
Affected applications
None named.
Open critical semantics (unit|semantic)
6
Show the 6 open critical semantics
  • alias module.dependencies.module.orders_rds.aws_security_group.this|egress-restriction
  • alias module.dependencies.module.orders_rds.aws_security_group.this|network-topology-boundary
  • alias module.dependencies.module.orders_rds.aws_security_group.this|rule-ports
  • alias module.dependencies.module.orders_rds.aws_security_group.this|security-group-vpc-membership
  • alias module.dependencies.module.orders_rds.aws_security_group.this|standalone-rule-values
  • alias module.dependencies.module.orders_rds.aws_security_group.this|stateful
Options
None listed.
Settings
6 critical settings of the unit, each with its own reason, state and options:
  1. Decide the outbound (egress) rules of the security group (egress-restriction): Open: no decision of the record has been taken. The knowledge base cannot decide "egress-restriction" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.dependencies.module.orders_rds.aws_security_group.this: the check, proof or closing evidence is recorded with its result.
  2. Confirm that the project is the boundary of one network (network-topology-boundary): Open: no decision of the record has been taken. The knowledge base cannot decide "network-topology-boundary" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.dependencies.module.orders_rds.aws_security_group.this: the check, proof or closing evidence is recorded with its result.
  3. Confirm the ports of the rules of the security group (rule-ports): Open: no decision of the record has been taken. The knowledge base cannot decide "rule-ports" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.dependencies.module.orders_rds.aws_security_group.this: the check, proof or closing evidence is recorded with its result.
  4. Decide which networks the security group may be attached to (a STACKIT group has no network scope) (security-group-vpc-membership): Open: no decision of the record has been taken. The knowledge base cannot decide "security-group-vpc-membership" of the aws.security_group contract for 1 unit (not available on STACKIT): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.module.orders_rds.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  5. Review the standalone rule values setting (standalone-rule-values): Open: no decision of the record has been taken. The knowledge base cannot decide "standalone-rule-values" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Review the standalone rule values setting for module.dependencies.module.orders_rds.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  6. Review the stateful setting (stateful): Open: no decision of the record has been taken. The knowledge base cannot decide "stateful" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Review the stateful setting for module.dependencies.module.orders_rds.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
Recommended option
None.
Status
Open: not decided yet.

What the 2 records below share:

What the draft does
In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a "not carried" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. The plan refuses REF/root/security-group-membership-parity.
Still open
Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the ports of the rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide which networks the security group may be attached to (a STACKIT group has no network scope): That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the standalone rule empty sources setting: the target behaviour of this setting is not established Review the standalone rule other sources setting: the target behaviour of this setting is not established Review the standalone rule values setting: the target behaviour of this setting is not established Review the stateful setting: the target behaviour of this setting is not established. Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project. Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project. Review the standalone rule empty sources setting: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). self = false and empty IPv6/prefix-list lists (module defaults) add no source, as the drafted rule adds none — PRESERVED, per rule that states no source, next to rules that do (those are standalone rule other sources, REVIEW); REVIEW when a rule of the group is not generated (its settings are named NOT CARRIED, the rule not generated check) or a value is not visible statically: the draft names such a value NOT CARRIED and nothing here claims it carried. Review the standalone rule other sources setting: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). A standalone rule's own group (self) and IPv6 ranges are written where the draft places the rule (self as remote_security_group_id of the group, an IPv6 range as ip_range with ether_type IPv6), and the draft names the rule NOT CARRIED when the plan withholds it; prefix lists are not generated (as rule other sources for inline rules; prefix lists: the prefix list check), and a person adds the rule if the traffic must pass — REVIEW in every order position. An aws_security_group_rule becomes a stackit_security_group_rule: type → direction, protocol → protocol, cidr_blocks → ip_range (one rule per range), source_security_group_id → remote_security_group_id. A rule that is not generated is named NOT CARRIED and the group is REVIEW. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true).
Ways out
  1. Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.; regeneration: not stated — treated as required; risk: A decision recorded without the evidence the finding names leaves the difference the finding describes in place.; the draft is generated again with it
  2. Confirm the ports of the rules of the security group: Verify what the knowledge base's note asks to confirm; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.; regeneration: not stated — treated as required; risk: A setting confirmed from the draft alone, without the check, can still differ at runtime.; the draft is generated again with it
  3. Decide which networks the security group may be attached to (a STACKIT group has no network scope): Verify what the knowledge base's note asks to confirm; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.; regeneration: not stated — treated as required; risk: A setting confirmed from the draft alone, without the check, can still differ at runtime.; the draft is generated again with it
What closes it
Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm the ports of the rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm the ports of the rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. Review the standalone rule empty sources setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the standalone rule other sources setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the standalone rule values setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. Verification: Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result; Confirm the ports of the rules of the security group: the check, proof or closing evidence is recorded with its result; Decide which networks the security group may be attached to (a STACKIT group has no network scope): the check, proof or closing evidence is recorded with its result.
Review the critical settings of a security group (Network Architect) open input

1 unit: module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd · owner role Network Architect · required by phase: not stated · 2 steps rest on it

Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
checkout (PROPOSED)
Wave
wave 3 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Confirm that the project is the boundary of one network: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings). Confirm the ports of the rules of the security group: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings). Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd. Review the standalone rule empty sources setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings). Review the standalone rule other sources setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings). Review the standalone rule values setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings). Review the stateful setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings).
Still open
Confirm the ports of the rules of the security group: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Decide which networks the security group may be attached to (a STACKIT group has no network scope): This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). Review the standalone rule values setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. Review the stateful setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control.
Next action
Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
Technical details

Record DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0 (open critical semantic) · action: verify the behaviour · decisions.json

Decision
the critical settings of a unit, of the aws.security_group contract
Affected applications
None named.
Open critical semantics (unit|semantic)
7
Show the 7 open critical semantics
  • alias module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|network-topology-boundary
  • alias module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|rule-ports
  • alias module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|security-group-vpc-membership
  • alias module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|standalone-rule-empty-sources
  • alias module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|standalone-rule-other-sources
  • alias module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|standalone-rule-values
  • alias module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd|stateful
Options
None listed.
Settings
7 critical settings of the unit, each with its own reason, state and options:
  1. Confirm that the project is the boundary of one network (network-topology-boundary): Open: no decision of the record has been taken. The knowledge base cannot decide "network-topology-boundary" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd: the check, proof or closing evidence is recorded with its result.
  2. Confirm the ports of the rules of the security group (rule-ports): Open: no decision of the record has been taken. The knowledge base cannot decide "rule-ports" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd: the check, proof or closing evidence is recorded with its result.
  3. Decide which networks the security group may be attached to (a STACKIT group has no network scope) (security-group-vpc-membership): Open: no decision of the record has been taken. The knowledge base cannot decide "security-group-vpc-membership" of the aws.security_group contract for 1 unit (not available on STACKIT): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  4. Review the standalone rule empty sources setting (standalone-rule-empty-sources): Open: no decision of the record has been taken. The knowledge base cannot decide "standalone-rule-empty-sources" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Review the standalone rule empty sources setting for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  5. Review the standalone rule other sources setting (standalone-rule-other-sources): Open: no decision of the record has been taken. The knowledge base cannot decide "standalone-rule-other-sources" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Review the standalone rule other sources setting for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  6. Review the standalone rule values setting (standalone-rule-values): Open: no decision of the record has been taken. The knowledge base cannot decide "standalone-rule-values" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Review the standalone rule values setting for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  7. Review the stateful setting (stateful): Open: no decision of the record has been taken. The knowledge base cannot decide "stateful" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Review the stateful setting for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
Recommended option
None.
Status
Open: not decided yet.
Review the critical settings of a security group (Network Architect) open input

1 unit: module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix · owner role Network Architect · required by phase: not stated · 2 steps rest on it

Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
ui (PROPOSED)
Wave
wave 2 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Confirm that the project is the boundary of one network: The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings). Confirm the ports of the rules of the security group: The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings). Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix. Review the standalone rule empty sources setting: The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings). Review the standalone rule other sources setting: The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings). Review the standalone rule values setting: The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings). Review the stateful setting: The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings).
Still open
Confirm the ports of the rules of the security group: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Decide which networks the security group may be attached to (a STACKIT group has no network scope): A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). Review the standalone rule values setting: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Review the stateful setting: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules ("security group rules") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control.
Next action
Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
Technical details

Record DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862 (open critical semantic) · action: verify the behaviour · decisions.json

Decision
the critical settings of a unit, of the aws.security_group contract
Affected applications
None named.
Open critical semantics (unit|semantic)
7
Show the 7 open critical semantics
  • alias module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|network-topology-boundary
  • alias module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|rule-ports
  • alias module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|security-group-vpc-membership
  • alias module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|standalone-rule-empty-sources
  • alias module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|standalone-rule-other-sources
  • alias module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|standalone-rule-values
  • alias module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix|stateful
Options
None listed.
Settings
7 critical settings of the unit, each with its own reason, state and options:
  1. Confirm that the project is the boundary of one network (network-topology-boundary): Open: no decision of the record has been taken. The knowledge base cannot decide "network-topology-boundary" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix: the check, proof or closing evidence is recorded with its result.
  2. Confirm the ports of the rules of the security group (rule-ports): Open: no decision of the record has been taken. The knowledge base cannot decide "rule-ports" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix: the check, proof or closing evidence is recorded with its result.
  3. Decide which networks the security group may be attached to (a STACKIT group has no network scope) (security-group-vpc-membership): Open: no decision of the record has been taken. The knowledge base cannot decide "security-group-vpc-membership" of the aws.security_group contract for 1 unit (not available on STACKIT): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  4. Review the standalone rule empty sources setting (standalone-rule-empty-sources): Open: no decision of the record has been taken. The knowledge base cannot decide "standalone-rule-empty-sources" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Review the standalone rule empty sources setting for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  5. Review the standalone rule other sources setting (standalone-rule-other-sources): Open: no decision of the record has been taken. The knowledge base cannot decide "standalone-rule-other-sources" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Review the standalone rule other sources setting for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  6. Review the standalone rule values setting (standalone-rule-values): Open: no decision of the record has been taken. The knowledge base cannot decide "standalone-rule-values" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Review the standalone rule values setting for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  7. Review the stateful setting (stateful): Open: no decision of the record has been taken. The knowledge base cannot decide "stateful" of the aws.security_group contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Review the stateful setting for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
Recommended option
None.
Status
Open: not decided yet.
Review the critical settings of a VPC (Network Architect) manual work

1 unit: module.vpc.module.vpc.aws_vpc.this · owner role Network Architect · required by phase: not stated · 1 step rests on it

Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
none: no applications file was given and no suggested group holds an affected unit
Wave
wave 1 · steps in foundation
Approval
not approved: no decisions file was given with this run
What the draft does
Review the default nacl rules setting: The draft does not carry the setting on module.vpc.module.vpc.aws_vpc.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a "not carried" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the default route table setting: The draft does not carry the setting on module.vpc.module.vpc.aws_vpc.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect). Review the default security group omitted direction setting: The draft does not carry the setting on module.vpc.module.vpc.aws_vpc.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect). Review the main table set setting: The draft does not carry the setting on module.vpc.module.vpc.aws_vpc.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect). Confirm that the project is the boundary of one network: The draft does not carry the setting on module.vpc.module.vpc.aws_vpc.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect).
Still open
Review the default nacl rules setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the default route table setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the default security group omitted direction setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the main table set setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the default nacl rules setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The account's default network ACL is adopted by the VPC (aws_default_network_acl); a deny rule, a rule that is not all-protocol, a CIDR other than 0.0.0.0/0 or ::/0, or an explicitly empty rule list narrows or leaves undecided what the AWS default allow-all states. Review the default route table setting: A check of the knowledge base (vpc main table undecided) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The account's default route table is adopted (a facet of the VPC, aws_default_route_table, AWS provider 6.66.0). Routes other than a plain 0.0.0.0/0 to an internet or NAT gateway are REVIEW. Review the default security group omitted direction setting: A check of the knowledge base (vpc default sg no ingress rules) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The adopted default security group of the VPC (a facet, aws_default_security_group) does not state an ingress or an egress direction. Nothing is drafted for this facet, so the empty direction is not reproduced: a person decides whether servers that used the default group must stay without outbound traffic (delete the allow-all egress rules of the STACKIT group after apply) or are meant to have it, and puts them in a STACKIT group that states no ingress rule, not in the project's default group. Review the main table set setting: A check of the knowledge base (vpc main table undecided) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting names the route table that is the main route table of the VPC, when the configuration sets it or the scan cannot tell. STACKIT has no main route table. Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). STACKIT has no VPC container in its stable model: the project is the boundary of its networks and its virtual router routes between all networks of one project (docs.stackit.cloud core-networking architecture, updated Aug 20, 2026: "Routing between multiple Virtual Networks in the same project"; SNA "extends the networking architecture to enable cross-project connectivity"). Several VPCs, or a count the scan cannot see: the draft puts every network in the one var.project_id and cannot keep them apart — REVIEW, the choice is the architect's. A unit that names a VPC, or is placed in a subnet (subnet_id, subnets, vpc_config.subnet_ids, ...), without one whole reference to the VPC or to a subnet of the estate may stand in a VPC the estate does not create: the architect decides it the same way (REVIEW).
Ways out
  1. Review the default nacl rules setting: Carry out the work the knowledge base's note names, by hand; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person does the work outside the draft; StackToIT neither does nor verifies it.; regeneration: not stated — treated as required; risk: The work is not in the draft, so it is forgotten unless it is planned as a manual step.; the draft is generated again with it
  2. Review the default route table setting: Bring the closing evidence the finding names, or record the decision it asks for; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.; regeneration: not stated — treated as required; risk: A decision recorded without the evidence the finding names leaves the difference the finding describes in place.; the draft is generated again with it
  3. Review the default security group omitted direction setting: Bring the closing evidence the finding names, or record the decision it asks for; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.; regeneration: not stated — treated as required; risk: A decision recorded without the evidence the finding names leaves the difference the finding describes in place.; the draft is generated again with it
  4. Review the main table set setting: Bring the closing evidence the finding names, or record the decision it asks for; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.; regeneration: not stated — treated as required; risk: A decision recorded without the evidence the finding names leaves the difference the finding describes in place.; the draft is generated again with it
  5. Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.; regeneration: not stated — treated as required; risk: A decision recorded without the evidence the finding names leaves the difference the finding describes in place.; the draft is generated again with it
What closes it
Review the default nacl rules setting: A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic. Review the default route table setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Review the default route table setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the default security group omitted direction setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Review the default security group omitted direction setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the main table set setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Review the main table set setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Verification: Review the default nacl rules setting: the decision or the manual work is done and recorded (who, when, what was configured and why); Review the default route table setting: the check, proof or closing evidence is recorded with its result; Review the default security group omitted direction setting: the check, proof or closing evidence is recorded with its result; Review the main table set setting: the check, proof or closing evidence is recorded with its result; Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result.
Next action
Review the default nacl rules setting: Carry out the manual work the plan names for module.vpc.module.vpc.aws_vpc.this outside the draft; the plan states no title for it.
Technical details

Record DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS (open critical semantic) · action: work by hand outside the draft · decisions.json

Decision
the critical settings of a unit, of the aws.vpc contract
Affected applications
None named.
Open critical semantics (unit|semantic)
5
Show the 5 open critical semantics
  • alias module.vpc.module.vpc.aws_vpc.this|default-nacl-rules
  • alias module.vpc.module.vpc.aws_vpc.this|default-route-table
  • alias module.vpc.module.vpc.aws_vpc.this|default-security-group-omitted-direction
  • alias module.vpc.module.vpc.aws_vpc.this|main-table-set
  • alias module.vpc.module.vpc.aws_vpc.this|network-topology-boundary
Options
None listed.
Settings
5 critical settings of the unit, each with its own reason, state and options:
  1. Review the default nacl rules setting (default-nacl-rules): Open: no decision of the record has been taken. The knowledge base cannot decide "default-nacl-rules" of the aws.vpc contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.vpc.module.vpc.aws_vpc.this outside the draft; the plan states no title for it.
  2. Review the default route table setting (default-route-table): Open: no decision of the record has been taken. The knowledge base cannot decide "default-route-table" of the aws.vpc contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.vpc.module.vpc.aws_vpc.this: the check, proof or closing evidence is recorded with its result.
  3. Review the default security group omitted direction setting (default-security-group-omitted-direction): Open: no decision of the record has been taken. The knowledge base cannot decide "default-security-group-omitted-direction" of the aws.vpc contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.vpc.module.vpc.aws_vpc.this: the check, proof or closing evidence is recorded with its result.
  4. Review the main table set setting (main-table-set): Open: no decision of the record has been taken. The knowledge base cannot decide "main-table-set" of the aws.vpc contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.vpc.module.vpc.aws_vpc.this: the check, proof or closing evidence is recorded with its result.
  5. Confirm that the project is the boundary of one network (network-topology-boundary): Open: no decision of the record has been taken. The knowledge base cannot decide "network-topology-boundary" of the aws.vpc contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.vpc.module.vpc.aws_vpc.this: the check, proof or closing evidence is recorded with its result.
Recommended option
None.
Evidence
None.
Status
Open: not decided yet.