partly decided only at plan time · aws not locked; random not locked
STACKIT target profile
Stable network model: the experimental STACKIT VPC resources are not used (STACKIT_STABLE)
STACKIT provider version
0.121.0
Knowledge base version
0.384.0
Evidence freshness
○ Not assessed — Evidence freshness as one measure is not assessed in this build. Dated evidence is shown where it is used: each STACKIT support option and each assurance row states when it was verified (verified_at, and recheck_after for support), in support_suitability and assurance. The date beside a readiness dimension is the assessment date, not a retrieval date.
Staleness:○ Not assessed — This build has no change detection, so there has been no re-check since the assessment was made (Generated 2026-11-02 12:08 UTC). The source may have changed since.
Source checks: Built-in source checks passed — OpenTofu validation of the source did not run (LOCK_FILE)
Run status: COMPLETE (report published). Source: partly decided only at plan time. Draft: GENERATED. The report was written whole; this is not a statement that the migration is ready.
Executive lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.
Architect lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.
Platform lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.
Security lens: the sections are in the order this reader usually wants, and Costs and Migration Plan are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.
Application owner lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.
Programme lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.
FinOps lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.
Engineering lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.
Decisions, group g07: Managed Data Services
Group g07 of 8. Work package Managed Data Services: the full cards of 5 records. The Decisions page holds the records and lists every group.
Review the critical settings of an ElastiCache (Network Architect) manual work
1 unit: module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default · owner role Network Architect · required by phase: not stated · 1 step rests on it
Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
checkout (PROPOSED)
Wave
wave 4 · steps in data services
Approval
not approved: no decisions file was given with this run
What the draft does
Review the network placement setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/network-placement). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a "not carried" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.
Still open
Review the network placement setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the network placement setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_valkey_instance has no subnet, security-group, zone or IP-family attribute; client access can be limited by CIDR with parameters.sgw_acl, which the draft does not generate — a person decides it.
Ways out
Review the network placement setting: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base); needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.; regeneration: not stated — treated as required; risk: The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes.; the draft is generated again with it
What closes it
Review the network placement setting: A person decides how clients reach the Valkey instance, which has no subnet or security-group setting, for example by limiting client CIDR ranges with its access parameter. Verification: Review the network placement setting: the decision or the manual work is done and recorded (who, when, what was configured and why).
Next action
Review the network placement setting: Carry out the manual work the plan names for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default outside the draft; the plan states no title for it.
Technical details
Record DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374 (open critical semantic) · action: work by hand outside the draft · decisions.json
Decision
the critical settings of a unit, of the aws.elasticache contract
1 alias module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default|network-placement
Options
None listed.
Settings
1 critical setting of the unit, each with its own reason, state and options:
Review the network placement setting (network-placement): Open: no decision of the record has been taken. The knowledge base cannot decide "network-placement" of the aws.elasticache contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default outside the draft; the plan states no title for it.
Review the critical settings of an MQ broker (Identity Architect) manual work
1 unit: module.dependencies.aws_mq_broker.mq · owner role Identity Architect · required by phase: not stated · 1 step rests on it
Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
orders (PROPOSED)
Wave
wave 4 · steps in platform services
Approval
not approved: no decisions file was given with this run
What the draft does
Decide the users of the message broker: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-identity-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a "not carried" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the user name: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-identity-architect).
Still open
Decide the users of the message broker: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the user name: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide the users of the message broker: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Users become stackit_rabbitmq_credential entries with generated passwords; their permissions are set by a person. Confirm the user name: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_mq_broker.user.username: The broker user's login identity. Held CRITICAL: it decides who or what may use, read or change the resource or the data behind it. No semantic of this family has verified it as carried.
Ways out
Decide the users of the message broker: Carry out the work the knowledge base's note names, by hand; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person does the work outside the draft; StackToIT neither does nor verifies it.; regeneration: not stated — treated as required; risk: The work is not in the draft, so it is forgotten unless it is planned as a manual step.; the draft is generated again with it
Confirm the user name: Verify what the knowledge base's note asks to confirm; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.; regeneration: not stated — treated as required; risk: A setting confirmed from the draft alone, without the check, can still differ at runtime.; the draft is generated again with it
What closes it
Decide the users of the message broker: A person sets the permissions of each broker user on the generated RabbitMQ credentials and hands the new passwords to the clients. Confirm the user name: A person confirms the user names the clients log in with; STACKIT generates each RabbitMQ credential's username, so the clients move to the new usernames. Verification: Decide the users of the message broker: the decision or the manual work is done and recorded (who, when, what was configured and why); Confirm the user name: the check, proof or closing evidence is recorded with its result.
Next action
Decide the users of the message broker: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it.
Technical details
Record DEC-IAM-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ (open critical semantic) · action: work by hand outside the draft · decisions.json
Decision
the critical settings of a unit, of the aws.mq_broker contract
alias module.dependencies.aws_mq_broker.mq|broker-users
alias module.dependencies.aws_mq_broker.mq|tc-user--username
Options
None listed.
Settings
2 critical settings of the unit, each with its own reason, state and options:
Decide the users of the message broker (broker-users): Open: no decision of the record has been taken. The knowledge base cannot decide "broker-users" of the aws.mq_broker contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it.
Confirm the user name (tc-user--username): Open: no decision of the record has been taken. The knowledge base cannot decide "the username of the user entry of the MQ broker" of the aws.mq_broker contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.dependencies.aws_mq_broker.mq: the check, proof or closing evidence is recorded with its result.
Review the critical settings of an MQ broker (Network Architect) manual work
1 unit: module.dependencies.aws_mq_broker.mq · owner role Network Architect · required by phase: not stated · 1 step rests on it
Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
orders (PROPOSED)
Wave
wave 4 · steps in platform services
Approval
not approved: no decisions file was given with this run
What the draft does
Decide the network of the message broker: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/broker-network). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a "not carried" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.
Still open
Decide the network of the message broker: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide the network of the message broker: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_rabbitmq_instance has no subnet or security-group attribute (pinned provider): clients reach the instance at the address STACKIT assigns, restricted by parameters.sgw_acl — a person decides the ranges.
Ways out
Decide the network of the message broker: Carry out the work the knowledge base's note names, by hand; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person does the work outside the draft; StackToIT neither does nor verifies it.; regeneration: not stated — treated as required; risk: The work is not in the draft, so it is forgotten unless it is planned as a manual step.; the draft is generated again with it
What closes it
Decide the network of the message broker: A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups. Verification: Decide the network of the message broker: the decision or the manual work is done and recorded (who, when, what was configured and why).
Next action
Decide the network of the message broker: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it.
Technical details
Record DEC-NET-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ (open critical semantic) · action: work by hand outside the draft · decisions.json
Decision
the critical settings of a unit, of the aws.mq_broker contract
1 alias module.dependencies.aws_mq_broker.mq|broker-network
Options
None listed.
Settings
1 critical setting of the unit, each with its own reason, state and options:
Decide the network of the message broker (broker-network): Open: no decision of the record has been taken. The knowledge base cannot decide "broker-network" of the aws.mq_broker contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it.
Review the critical settings of an MQ broker (Platform Architect) manual work
1 unit: module.dependencies.aws_mq_broker.mq · owner role Platform Architect · required by phase: not stated · 1 step rests on it
Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
orders (PROPOSED)
Wave
wave 4 · steps in platform services
Approval
not approved: no decisions file was given with this run
What the draft does
Choose the database engine version: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a "not carried" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the name of the message broker: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect). Choose the deployment mode of the broker: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect).
Still open
Choose the database engine version: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the name of the message broker: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Choose the deployment mode of the broker: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Choose the database engine version: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_rabbitmq_instance takes a STACKIT RabbitMQ version (the draft asks for it: rabbitmq_version) — which versions STACKIT offers is not in the rule's evidence. Confirm the name of the message broker: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The name of the message broker. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). Choose the deployment mode of the broker: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_mq_broker.deployment_mode: The family's own setting for high availability already reads this as critical: it selects single instance vs. active standby multi az vs. cluster multi az, i.e. whether the broker survives an AZ failure at all. Held CRITICAL: it decides capacity, delivery guarantees, retry or failure handling that consumers depend on.
Ways out
Choose the database engine version: Carry out the work the knowledge base's note names, by hand; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person does the work outside the draft; StackToIT neither does nor verifies it.; regeneration: not stated — treated as required; risk: The work is not in the draft, so it is forgotten unless it is planned as a manual step.; the draft is generated again with it
Confirm the name of the message broker: Verify what the knowledge base's note asks to confirm; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.; regeneration: not stated — treated as required; risk: A setting confirmed from the draft alone, without the check, can still differ at runtime.; the draft is generated again with it
Choose the deployment mode of the broker: Carry out the work the knowledge base's note names, by hand; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person does the work outside the draft; StackToIT neither does nor verifies it.; regeneration: not stated — treated as required; risk: The work is not in the draft, so it is forgotten unless it is planned as a manual step.; the draft is generated again with it
What closes it
Choose the database engine version: A person picks the RabbitMQ version for the target instance, since the versions STACKIT offers are not stated for this move. Confirm the name of the message broker: A person confirms the broker name the target uses against what refers to the source broker name, or accepts the new name. Choose the deployment mode of the broker: A person decides whether the target must survive a zone failure as the source deployment mode did, and finds out which RabbitMQ plan, if any, gives that, since the zone spread of the plans is not stated. Verification: Choose the database engine version: the decision or the manual work is done and recorded (who, when, what was configured and why); Confirm the name of the message broker: the check, proof or closing evidence is recorded with its result; Choose the deployment mode of the broker: the decision or the manual work is done and recorded (who, when, what was configured and why).
Next action
Choose the database engine version: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it.
Technical details
Record DEC-OPS-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ (open critical semantic) · action: work by hand outside the draft · decisions.json
Decision
the critical settings of a unit, of the aws.mq_broker contract
alias module.dependencies.aws_mq_broker.mq|engine-version
alias module.dependencies.aws_mq_broker.mq|tc-mq-broker-broker-name
alias module.dependencies.aws_mq_broker.mq|tcp-deployment-mode
Options
None listed.
Settings
3 critical settings of the unit, each with its own reason, state and options:
Choose the database engine version (engine-version): Open: no decision of the record has been taken. The knowledge base cannot decide "engine-version" of the aws.mq_broker contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it.
Confirm the name of the message broker (tc-mq-broker-broker-name): Open: no decision of the record has been taken. The knowledge base cannot decide "the broker name of the MQ broker" of the aws.mq_broker contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.dependencies.aws_mq_broker.mq: the check, proof or closing evidence is recorded with its result.
Choose the deployment mode of the broker (tcp-deployment-mode): Open: no decision of the record has been taken. The knowledge base cannot decide "the deployment mode of the MQ broker" of the aws.mq_broker contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it.
Review the critical settings of an MQ broker (Security Architect) manual work
1 unit: module.dependencies.aws_mq_broker.mq · owner role Security Architect · required by phase: not stated · 1 step rests on it
Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
orders (PROPOSED)
Wave
wave 4 · steps in platform services
Approval
not approved: no decisions file was given with this run
What the draft does
Decide how the user password is supplied: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-security-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a "not carried" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.
Still open
Decide how the user password is supplied: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide how the user password is supplied: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_mq_broker.user.password: The broker user's login credential; a literal secret. Held CRITICAL: it carries or names a credential; the value is never copied and a person re-creates it on the target. No semantic of this family has verified it as carried.
Ways out
Decide how the user password is supplied: Carry out the work the knowledge base's note names, by hand; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person does the work outside the draft; StackToIT neither does nor verifies it.; regeneration: not stated — treated as required; risk: The work is not in the draft, so it is forgotten unless it is planned as a manual step.; the draft is generated again with it
What closes it
Decide how the user password is supplied: A person hands the clients the password of the generated target credential instead of the literal in the source. Verification: Decide how the user password is supplied: the decision or the manual work is done and recorded (who, when, what was configured and why).
Next action
Decide how the user password is supplied: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it.
Technical details
Record DEC-SEC-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ (open critical semantic) · action: work by hand outside the draft · decisions.json
Decision
the critical settings of a unit, of the aws.mq_broker contract
1 alias module.dependencies.aws_mq_broker.mq|tc-user--password
Options
None listed.
Settings
1 critical setting of the unit, each with its own reason, state and options:
Decide how the user password is supplied (tc-user--password): Open: no decision of the record has been taken. The knowledge base cannot decide "the password of the user entry of the MQ broker" of the aws.mq_broker contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it.