partly decided only at plan time · aws not locked; random not locked
STACKIT target profile
Stable network model: the experimental STACKIT VPC resources are not used (STACKIT_STABLE)
STACKIT provider version
0.121.0
Knowledge base version
0.384.0
Evidence freshness
○ Not assessed — Evidence freshness as one measure is not assessed in this build. Dated evidence is shown where it is used: each STACKIT support option and each assurance row states when it was verified (verified_at, and recheck_after for support), in support_suitability and assurance. The date beside a readiness dimension is the assessment date, not a retrieval date.
Staleness:○ Not assessed — This build has no change detection, so there has been no re-check since the assessment was made (Generated 2026-11-02 12:08 UTC). The source may have changed since.
Source checks: Built-in source checks passed — OpenTofu validation of the source did not run (LOCK_FILE)
Run status: COMPLETE (report published). Source: partly decided only at plan time. Draft: GENERATED. The report was written whole; this is not a statement that the migration is ready.
Executive lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.
Architect lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.
Platform lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.
Security lens: the sections are in the order this reader usually wants, and Costs and Migration Plan are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.
Application owner lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.
Programme lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.
FinOps lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.
Engineering lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.
Decisions, group g08: Identity, Access & Secrets
Group g08 of 8. Work package Identity, Access & Secrets: the full cards of 13 records. The Decisions page holds the records and lists every group.
13 records: 9 manual work · 4 requires verification
What the 5 records below share:
What the draft does
In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a "not carried" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.
Still open
Review the IAM managed customer policy setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the IAM managed customer policy setting: A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several. Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit). Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried.
Ways out
Review the IAM managed customer policy setting: Bring the closing evidence the finding names, or record the decision it asks for; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.; regeneration: not stated — treated as required; risk: A decision recorded without the evidence the finding names leaves the difference the finding describes in place.; the draft is generated again with it
Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.; regeneration: not stated — treated as required; risk: A decision recorded without the evidence the finding names leaves the difference the finding describes in place.; the draft is generated again with it
Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person does the work outside the draft; StackToIT neither does nor verifies it.; regeneration: not stated — treated as required; risk: The work is not in the draft, so it is forgotten unless it is planned as a manual step.; the draft is generated again with it
Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account; effect: A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing.
Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person does the work outside the draft; StackToIT neither does nor verifies it.; regeneration: not stated — treated as required; risk: The work is not in the draft, so it is forgotten unless it is planned as a manual step.; the draft is generated again with it
What closes it
Review the IAM managed customer policy setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Review the IAM managed customer policy setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources. Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it. Verification: Review the IAM managed customer policy setting: the check, proof or closing evidence is recorded with its result; Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result; Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why); Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why).
Review the critical settings of an IAM role (Identity Architect) manual work
1 unit: module.retail_app_ecs.module.carts_service.aws_iam_role.task_role · owner role Identity Architect · required by phase: not stated · 1 step rests on it
Options and trade-off
1 option across its settings, each with its trade-off under Technical details
Applications touched
carts (PROPOSED)
Wave
wave 2 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Review the IAM managed customer policy setting: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings). Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings). Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings). Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings).
Still open
The unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) through this setting (the target does not carry it: it is in the class redesign), so what the reference becomes is part of this setting. Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.carts_service.aws_iam_role.task_role a policy the scan cannot read (module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_logs), a policy the scan cannot read (module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.ecs_exec), a policy the scan cannot read (module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_role_additional): a person translates each into STACKIT role assignments; the list decides nothing.
Next action
Translate the IAM permissions into STACKIT roles: Carry out the manual work the plan names for module.retail_app_ecs.module.carts_service.aws_iam_role.task_role outside the draft; the plan states no title for it.
Technical details
Record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA (open critical semantic) · action: work by hand outside the draft · decisions.json
Decision
the critical settings of a unit, of the aws.iam_role contract
The plan’s reasons
the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it
who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)
alias module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|iam-managed-customer-policy
alias module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|iam-trust-service-workload
alias module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|permissions
alias module.retail_app_ecs.module.carts_service.aws_iam_role.task_role|trust
Options
None listed.
Settings
4 critical settings of the unit, each with its own reason, state and options:
Review the IAM managed customer policy setting (iam-managed-customer-policy): Open: no decision of the record has been taken. The knowledge base cannot decide "iam-managed-customer-policy" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.module.carts_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result.
Review the IAM trust service workload setting (iam-trust-service-workload): Open: no decision of the record has been taken. The knowledge base cannot decide "iam-trust-service-workload" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.module.carts_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result.
Translate the IAM permissions into STACKIT roles (permissions): Open: no decision of the record has been taken. The knowledge base cannot decide "permissions" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.retail_app_ecs.module.carts_service.aws_iam_role.task_role outside the draft; the plan states no title for it.
bind-minimum-stackit-roles — Bind the minimum STACKIT roles the workload needs to the account. A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing.
Decide who may assume each IAM role (trust): Open: no decision of the record has been taken. The knowledge base cannot decide "trust" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.retail_app_ecs.module.carts_service.aws_iam_role.task_role outside the draft; the plan states no title for it.
Review the critical settings of an IAM role (Identity Architect) manual work
1 unit: module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role · owner role Identity Architect · required by phase: not stated · 1 step rests on it
Options and trade-off
1 option across its settings, each with its trade-off under Technical details
Applications touched
catalog (PROPOSED)
Wave
wave 2 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Review the IAM managed customer policy setting: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings). Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings). Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings). Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings).
Still open
Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role a policy the scan cannot read (module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_logs), a policy the scan cannot read (module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.ecs_exec): a person translates each into STACKIT role assignments; the list decides nothing.
Next action
Translate the IAM permissions into STACKIT roles: Carry out the manual work the plan names for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role outside the draft; the plan states no title for it.
Technical details
Record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1 (open critical semantic) · action: work by hand outside the draft · decisions.json
Decision
the critical settings of a unit, of the aws.iam_role contract
The plan’s reasons
the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it
who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)
alias module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|iam-managed-customer-policy
alias module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|iam-trust-service-workload
alias module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|permissions
alias module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role|trust
Options
None listed.
Settings
4 critical settings of the unit, each with its own reason, state and options:
Review the IAM managed customer policy setting (iam-managed-customer-policy): Open: no decision of the record has been taken. The knowledge base cannot decide "iam-managed-customer-policy" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result.
Review the IAM trust service workload setting (iam-trust-service-workload): Open: no decision of the record has been taken. The knowledge base cannot decide "iam-trust-service-workload" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result.
Translate the IAM permissions into STACKIT roles (permissions): Open: no decision of the record has been taken. The knowledge base cannot decide "permissions" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role outside the draft; the plan states no title for it.
bind-minimum-stackit-roles — Bind the minimum STACKIT roles the workload needs to the account. A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing.
Decide who may assume each IAM role (trust): Open: no decision of the record has been taken. The knowledge base cannot decide "trust" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role outside the draft; the plan states no title for it.
Review the critical settings of an IAM role (Identity Architect) manual work
1 unit: module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role · owner role Identity Architect · required by phase: not stated · 1 step rests on it
Options and trade-off
1 option across its settings, each with its trade-off under Technical details
Applications touched
checkout (PROPOSED)
Wave
wave 2 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Review the IAM managed customer policy setting: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings). Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings). Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings). Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings).
Still open
The unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) through this setting (the target does not carry it: it is in the class redesign), so what the reference becomes is part of this setting. Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role a policy the scan cannot read (module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_logs), a policy the scan cannot read (module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.ecs_exec), a policy the scan cannot read (module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_role_additional): a person translates each into STACKIT role assignments; the list decides nothing.
Next action
Translate the IAM permissions into STACKIT roles: Carry out the manual work the plan names for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role outside the draft; the plan states no title for it.
Technical details
Record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6 (open critical semantic) · action: work by hand outside the draft · decisions.json
Decision
the critical settings of a unit, of the aws.iam_role contract
The plan’s reasons
the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it
who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)
alias module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|iam-managed-customer-policy
alias module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|iam-trust-service-workload
alias module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|permissions
alias module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role|trust
Options
None listed.
Settings
4 critical settings of the unit, each with its own reason, state and options:
Review the IAM managed customer policy setting (iam-managed-customer-policy): Open: no decision of the record has been taken. The knowledge base cannot decide "iam-managed-customer-policy" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result.
Review the IAM trust service workload setting (iam-trust-service-workload): Open: no decision of the record has been taken. The knowledge base cannot decide "iam-trust-service-workload" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result.
Translate the IAM permissions into STACKIT roles (permissions): Open: no decision of the record has been taken. The knowledge base cannot decide "permissions" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role outside the draft; the plan states no title for it.
bind-minimum-stackit-roles — Bind the minimum STACKIT roles the workload needs to the account. A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing.
Decide who may assume each IAM role (trust): Open: no decision of the record has been taken. The knowledge base cannot decide "trust" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role outside the draft; the plan states no title for it.
Review the critical settings of an IAM role (Identity Architect) manual work
1 unit: module.retail_app_ecs.module.orders_service.aws_iam_role.task_role · owner role Identity Architect · required by phase: not stated · 1 step rests on it
Options and trade-off
1 option across its settings, each with its trade-off under Technical details
Applications touched
orders (PROPOSED)
Wave
wave 2 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Review the IAM managed customer policy setting: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings). Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings). Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings). Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings).
Still open
Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.orders_service.aws_iam_role.task_role a policy the scan cannot read (module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_logs), a policy the scan cannot read (module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.ecs_exec): a person translates each into STACKIT role assignments; the list decides nothing.
Next action
Translate the IAM permissions into STACKIT roles: Carry out the manual work the plan names for module.retail_app_ecs.module.orders_service.aws_iam_role.task_role outside the draft; the plan states no title for it.
Technical details
Record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65 (open critical semantic) · action: work by hand outside the draft · decisions.json
Decision
the critical settings of a unit, of the aws.iam_role contract
The plan’s reasons
the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it
who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)
alias module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|iam-managed-customer-policy
alias module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|iam-trust-service-workload
alias module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|permissions
alias module.retail_app_ecs.module.orders_service.aws_iam_role.task_role|trust
Options
None listed.
Settings
4 critical settings of the unit, each with its own reason, state and options:
Review the IAM managed customer policy setting (iam-managed-customer-policy): Open: no decision of the record has been taken. The knowledge base cannot decide "iam-managed-customer-policy" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.module.orders_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result.
Review the IAM trust service workload setting (iam-trust-service-workload): Open: no decision of the record has been taken. The knowledge base cannot decide "iam-trust-service-workload" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.module.orders_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result.
Translate the IAM permissions into STACKIT roles (permissions): Open: no decision of the record has been taken. The knowledge base cannot decide "permissions" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.retail_app_ecs.module.orders_service.aws_iam_role.task_role outside the draft; the plan states no title for it.
bind-minimum-stackit-roles — Bind the minimum STACKIT roles the workload needs to the account. A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing.
Decide who may assume each IAM role (trust): Open: no decision of the record has been taken. The knowledge base cannot decide "trust" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.retail_app_ecs.module.orders_service.aws_iam_role.task_role outside the draft; the plan states no title for it.
Review the critical settings of an IAM role (Identity Architect) manual work
1 unit: module.retail_app_ecs.module.ui_service.aws_iam_role.task_role · owner role Identity Architect · required by phase: not stated · 1 step rests on it
Options and trade-off
1 option across its settings, each with its trade-off under Technical details
Applications touched
ui (PROPOSED)
Wave
wave 2 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Review the IAM managed customer policy setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings). Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings). Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings). Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings).
Still open
Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.ui_service.aws_iam_role.task_role a policy the scan cannot read (module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_logs), a policy the scan cannot read (module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.ecs_exec): a person translates each into STACKIT role assignments; the list decides nothing.
Next action
Translate the IAM permissions into STACKIT roles: Carry out the manual work the plan names for module.retail_app_ecs.module.ui_service.aws_iam_role.task_role outside the draft; the plan states no title for it.
Technical details
Record DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE (open critical semantic) · action: work by hand outside the draft · decisions.json
Decision
the critical settings of a unit, of the aws.iam_role contract
The plan’s reasons
the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it
who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)
alias module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|iam-managed-customer-policy
alias module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|iam-trust-service-workload
alias module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|permissions
alias module.retail_app_ecs.module.ui_service.aws_iam_role.task_role|trust
Options
None listed.
Settings
4 critical settings of the unit, each with its own reason, state and options:
Review the IAM managed customer policy setting (iam-managed-customer-policy): Open: no decision of the record has been taken. The knowledge base cannot decide "iam-managed-customer-policy" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.module.ui_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result.
Review the IAM trust service workload setting (iam-trust-service-workload): Open: no decision of the record has been taken. The knowledge base cannot decide "iam-trust-service-workload" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.module.ui_service.aws_iam_role.task_role: the check, proof or closing evidence is recorded with its result.
Translate the IAM permissions into STACKIT roles (permissions): Open: no decision of the record has been taken. The knowledge base cannot decide "permissions" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.retail_app_ecs.module.ui_service.aws_iam_role.task_role outside the draft; the plan states no title for it.
bind-minimum-stackit-roles — Bind the minimum STACKIT roles the workload needs to the account. A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing.
Decide who may assume each IAM role (trust): Open: no decision of the record has been taken. The knowledge base cannot decide "trust" of the aws.iam_role contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.retail_app_ecs.module.ui_service.aws_iam_role.task_role outside the draft; the plan states no title for it.
In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a "not carried" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.
Still open
Confirm the customer-managed encryption key: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the secret value setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the customer-managed encryption key: A check of the knowledge base (secret cmk) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Critical and reading the key since 2026-09-27: the draft names it NOT CARRIED, except where it sets the instance's kms_key (below). The AWS key does not move, AWS's key per secret has no per-secret counterpart, and the draft sets the kms_key block (referencing the drafted STACKIT key) only when every source of the shared instance is an AWS secret that references that one key — otherwise it names the key NOT CARRIED with the reason; either way a person decides (REVIEW, see the customer-managed key check). Review the secret value setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The value moves to STACKIT Secrets Manager (Vault-compatible KV). The draft generates the shared instance, and the plan a WriteSecret step for an aws_secretsmanager_secret or a SecureString aws_ssm_parameter that is not repeated. The step writes the document the person supplies and does not carry this setting (the value is the person's document); for a secret repeated by count or for_each whose instances are not all known, and for a parameter whose type is not the literal SecureString, only the instance is generated. What a person decides, per secret: where the value comes from (the same value fetched from a secure source, or a new one — moving is the moment to rotate) and the Vault path the application will read, then writes it with the Vault provider or CLI — REVIEW. History: added with aws_ssm_parameter on 2026-09-24; REVIEW since 2026-09-27 (was TRANSFORMED); 2026-10-29 the wording names the WriteSecret step of the plan; 2026-10-30 the step is also made for a SecureString parameter.
Ways out
Confirm the customer-managed encryption key: Verify what the knowledge base's note asks to confirm; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.; regeneration: not stated — treated as required; risk: A setting confirmed from the draft alone, without the check, can still differ at runtime.; the draft is generated again with it
Confirm the customer-managed encryption key: Encrypt the Secrets Manager instance with a key of the STACKIT KMS; effect: The instance gets a kms_key (key ring, key, key version and the service account that performs the key operations, which holds at least the Secrets Manager Reader role) and all its secret values are encrypted with that key; a key version change re-encrypts the stored secrets. The key belongs to the instance: secrets that used different AWS keys and must stay under different keys belong in different instances. The configuration is available by API and the provider; the portal does not offer it. A review records the choice and closes no critical setting by itself.
Confirm the customer-managed encryption key: Use the Secrets Manager instance without a customer key; effect: The instance has no kms_key and the secret values are not under a key the customer controls. The pages read describe encryption with a KMS key as optional and do not state how the values are encrypted at rest without one, so this choice accepts an unstated platform default and not a proven equivalent. The review records who accepts it and the requirement the customer key served. A review records the choice and closes no critical setting by itself.
Review the secret value setting: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base); needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.; regeneration: not stated — treated as required; risk: The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes.; the draft is generated again with it
What closes it
Confirm the customer-managed encryption key: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm the customer-managed encryption key: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the secret value setting: A person decides per secret where the value comes from (the same value from a secure source, or a new one) and the Vault path the application reads, then writes it with a Vault KV v2 client. Verification: Confirm the customer-managed encryption key: the check, proof or closing evidence is recorded with its result; Review the secret value setting: the decision or the manual work is done and recorded (who, when, what was configured and why).
Review the critical settings of a Secrets Manager secret (Security Architect) manual work
1 unit: module.retail_app_ecs.aws_secretsmanager_secret.catalog_db · owner role Security Architect · required by phase: not stated · 1 step rests on it
Options and trade-off
2 options across its settings, each with its trade-off under Technical details
Applications touched
none: no applications file was given and no suggested group is known to hold an affected unit
module.retail_app_ecs.aws_secretsmanager_secret.catalog_db is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders
Wave
wave 5 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Confirm the customer-managed encryption key: The draft does not carry the setting on module.retail_app_ecs.aws_secretsmanager_secret.catalog_db; a manual step stands for it (MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db/open-settings-security-architect). Review the secret value setting: The draft does not carry the setting on module.retail_app_ecs.aws_secretsmanager_secret.catalog_db; a manual step stands for it (MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db/open-settings-security-architect).
Next action
Review the secret value setting: Carry out the manual work the plan names for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db outside the draft; the plan states no title for it.
Technical details
Record DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB (open critical semantic) · action: work by hand outside the draft · decisions.json
Decision
the critical settings of a unit, of the aws.secretsmanager_secret contract
Why it exists
The knowledge base cannot decide 2 critical settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db/open-settings-security-architect.
for the platform default: STACKIT's written statement of how the values are encrypted at rest when the instance has no KMS key, since the pages read do not state it
the STACKIT KMS key (key ring, key, key version) and the service account that performs the key operations for the instance, with a role of the Secrets Manager
which AWS keys the secrets used (one key for all, or one per secret), and which secrets must stay under separate keys
alias module.retail_app_ecs.aws_secretsmanager_secret.catalog_db|customer-managed-key
alias module.retail_app_ecs.aws_secretsmanager_secret.catalog_db|secret-value
Options
None listed.
Settings
2 critical settings of the unit, each with its own reason, state and options:
Confirm the customer-managed encryption key (customer-managed-key): Open: no decision of the record has been taken. The knowledge base cannot decide "customer-managed-key" of the aws.secretsmanager_secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db: the check, proof or closing evidence is recorded with its result.
kms-key-on-the-secrets-manager-instance — Encrypt the Secrets Manager instance with a key of the STACKIT KMS. The instance gets a kms_key (key ring, key, key version and the service account that performs the key operations, which holds at least the Secrets Manager Reader role) and all its secret values are encrypted with that key; a key version change re-encrypts the stored secrets. The key belongs to the instance: secrets that used different AWS keys and must stay under different keys belong in different instances. The configuration is available by API and the provider; the portal does not offer it. A review records the choice and closes no critical setting by itself.
accept-an-instance-without-a-customer-key — Use the Secrets Manager instance without a customer key. The instance has no kms_key and the secret values are not under a key the customer controls. The pages read describe encryption with a KMS key as optional and do not state how the values are encrypted at rest without one, so this choice accepts an unstated platform default and not a proven equivalent. The review records who accepts it and the requirement the customer key served. A review records the choice and closes no critical setting by itself.
Review the secret value setting (secret-value): Open: no decision of the record has been taken. The knowledge base cannot decide "secret-value" of the aws.secretsmanager_secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db outside the draft; the plan states no title for it.
Review the critical settings of a Secrets Manager secret (Security Architect) manual work
1 unit: module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch · owner role Security Architect · required by phase: not stated · 1 step rests on it
Options and trade-off
2 options across its settings, each with its trade-off under Technical details
Applications touched
none: no applications file was given and no suggested group is known to hold an affected unit
module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders
Wave
wave 2 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Confirm the customer-managed encryption key: The draft does not carry the setting on module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch; a manual step stands for it (MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch/open-settings-security-architect). Review the secret value setting: The draft does not carry the setting on module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch; a manual step stands for it (MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch/open-settings-security-architect).
Next action
Review the secret value setting: Carry out the manual work the plan names for module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch outside the draft; the plan states no title for it.
Technical details
Record DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E (open critical semantic) · action: work by hand outside the draft · decisions.json
Decision
the critical settings of a unit, of the aws.secretsmanager_secret contract
Why it exists
The knowledge base cannot decide 2 critical settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch/open-settings-security-architect.
for the platform default: STACKIT's written statement of how the values are encrypted at rest when the instance has no KMS key, since the pages read do not state it
the STACKIT KMS key (key ring, key, key version) and the service account that performs the key operations for the instance, with a role of the Secrets Manager
which AWS keys the secrets used (one key for all, or one per secret), and which secrets must stay under separate keys
alias module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch|customer-managed-key
alias module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch|secret-value
Options
None listed.
Settings
2 critical settings of the unit, each with its own reason, state and options:
Confirm the customer-managed encryption key (customer-managed-key): Open: no decision of the record has been taken. The knowledge base cannot decide "customer-managed-key" of the aws.secretsmanager_secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch: the check, proof or closing evidence is recorded with its result.
kms-key-on-the-secrets-manager-instance — Encrypt the Secrets Manager instance with a key of the STACKIT KMS. The instance gets a kms_key (key ring, key, key version and the service account that performs the key operations, which holds at least the Secrets Manager Reader role) and all its secret values are encrypted with that key; a key version change re-encrypts the stored secrets. The key belongs to the instance: secrets that used different AWS keys and must stay under different keys belong in different instances. The configuration is available by API and the provider; the portal does not offer it. A review records the choice and closes no critical setting by itself.
accept-an-instance-without-a-customer-key — Use the Secrets Manager instance without a customer key. The instance has no kms_key and the secret values are not under a key the customer controls. The pages read describe encryption with a KMS key as optional and do not state how the values are encrypted at rest without one, so this choice accepts an unstated platform default and not a proven equivalent. The review records who accepts it and the requirement the customer key served. A review records the choice and closes no critical setting by itself.
Review the secret value setting (secret-value): Open: no decision of the record has been taken. The knowledge base cannot decide "secret-value" of the aws.secretsmanager_secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch outside the draft; the plan states no title for it.
In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a "not carried" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.
Still open
Review the secret value setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the secret value setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The value moves to STACKIT Secrets Manager (Vault-compatible KV). The draft generates the shared instance, and the plan a WriteSecret step for an aws_secretsmanager_secret or a SecureString aws_ssm_parameter that is not repeated. The step writes the document the person supplies and does not carry this setting (the value is the person's document); for a secret repeated by count or for_each whose instances are not all known, and for a parameter whose type is not the literal SecureString, only the instance is generated. What a person decides, per secret: where the value comes from (the same value fetched from a secure source, or a new one — moving is the moment to rotate) and the Vault path the application will read, then writes it with the Vault provider or CLI — REVIEW. History: added with aws_ssm_parameter on 2026-09-24; REVIEW since 2026-09-27 (was TRANSFORMED); 2026-10-29 the wording names the WriteSecret step of the plan; 2026-10-30 the step is also made for a SecureString parameter.
Ways out
Review the secret value setting: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base); needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.; regeneration: not stated — treated as required; risk: The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes.; the draft is generated again with it
What closes it
Review the secret value setting: A person decides per secret where the value comes from (the same value from a secure source, or a new one) and the Vault path the application reads, then writes it with a Vault KV v2 client. Verification: Review the secret value setting: the decision or the manual work is done and recorded (who, when, what was configured and why).
Review the critical settings of a Secrets Manager secret (Security Architect) manual work
1 unit: module.retail_app_ecs.aws_secretsmanager_secret.mq · owner role Security Architect · required by phase: not stated · 1 step rests on it
Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
orders (PROPOSED)
Wave
wave 5 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Review the secret value setting: The draft does not carry the setting on module.retail_app_ecs.aws_secretsmanager_secret.mq; a manual step stands for it (MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.mq/secret-value).
Next action
Review the secret value setting: Carry out the manual work the plan names for module.retail_app_ecs.aws_secretsmanager_secret.mq outside the draft; the plan states no title for it.
Technical details
Record DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ (open critical semantic) · action: work by hand outside the draft · decisions.json
Decision
the critical settings of a unit, of the aws.secretsmanager_secret contract
Why it exists
The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.aws_secretsmanager_secret.mq: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
1 alias module.retail_app_ecs.aws_secretsmanager_secret.mq|secret-value
Options
None listed.
Settings
1 critical setting of the unit, each with its own reason, state and options:
Review the secret value setting (secret-value): Open: no decision of the record has been taken. The knowledge base cannot decide "secret-value" of the aws.secretsmanager_secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.retail_app_ecs.aws_secretsmanager_secret.mq outside the draft; the plan states no title for it.
Review the critical settings of a Secrets Manager secret (Security Architect) manual work
1 unit: module.retail_app_ecs.aws_secretsmanager_secret.orders_db · owner role Security Architect · required by phase: not stated · 1 step rests on it
Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
orders (PROPOSED)
Wave
wave 5 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Review the secret value setting: The draft does not carry the setting on module.retail_app_ecs.aws_secretsmanager_secret.orders_db; a manual step stands for it (MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.orders_db/secret-value).
Next action
Review the secret value setting: Carry out the manual work the plan names for module.retail_app_ecs.aws_secretsmanager_secret.orders_db outside the draft; the plan states no title for it.
Technical details
Record DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB (open critical semantic) · action: work by hand outside the draft · decisions.json
Decision
the critical settings of a unit, of the aws.secretsmanager_secret contract
Why it exists
The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.aws_secretsmanager_secret.orders_db: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
1 alias module.retail_app_ecs.aws_secretsmanager_secret.orders_db|secret-value
Options
None listed.
Settings
1 critical setting of the unit, each with its own reason, state and options:
Review the secret value setting (secret-value): Open: no decision of the record has been taken. The knowledge base cannot decide "secret-value" of the aws.secretsmanager_secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Carry out the manual work the plan names for module.retail_app_ecs.aws_secretsmanager_secret.orders_db outside the draft; the plan states no title for it.
In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a "not carried" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.
Still open
Confirm the name of the Secrets Manager secret: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the name of the Secrets Manager secret: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_secretsmanager_secret.name: Friendly name used to address the secret; losing it breaks lookups by name but does not change who may reach or read the value, its encryption or deletion behaviour (IAM statements that scope by name are assessed on the IAM policy). No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract).
Ways out
Confirm the name of the Secrets Manager secret: Verify what the knowledge base's note asks to confirm; needs the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run; effect: A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.; regeneration: not stated — treated as required; risk: A setting confirmed from the draft alone, without the check, can still differ at runtime.; the draft is generated again with it
What closes it
Confirm the name of the Secrets Manager secret: A person confirms the secret name or path the application looks up on the target, or accepts the new one. Verification: Confirm the name of the Secrets Manager secret: the check, proof or closing evidence is recorded with its result.
Review the critical settings of a Secrets Manager secret (Platform Architect) requires verification
1 unit: module.retail_app_ecs.aws_secretsmanager_secret.catalog_db · owner role Platform Architect · required by phase: not stated · 1 step rests on it
Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
none: no applications file was given and no suggested group is known to hold an affected unit
module.retail_app_ecs.aws_secretsmanager_secret.catalog_db is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders
Wave
wave 5 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Confirm the name of the Secrets Manager secret: The draft does not carry the setting on module.retail_app_ecs.aws_secretsmanager_secret.catalog_db; a manual step stands for it (MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db/tc-secretsmanager-secret-name).
Next action
Confirm the name of the Secrets Manager secret: Verify on the target for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db: the check, proof or closing evidence is recorded with its result.
Technical details
Record DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB (open critical semantic) · action: verify the behaviour · decisions.json
Decision
the critical settings of a unit, of the aws.secretsmanager_secret contract
Why it exists
The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
1 alias module.retail_app_ecs.aws_secretsmanager_secret.catalog_db|tc-secretsmanager-secret-name
Options
None listed.
Settings
1 critical setting of the unit, each with its own reason, state and options:
Confirm the name of the Secrets Manager secret (tc-secretsmanager-secret-name): Open: no decision of the record has been taken. The knowledge base cannot decide "the name of the Secrets Manager secret" of the aws.secretsmanager_secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db: the check, proof or closing evidence is recorded with its result.
Review the critical settings of a Secrets Manager secret (Platform Architect) requires verification
1 unit: module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch · owner role Platform Architect · required by phase: not stated · 1 step rests on it
Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
none: no applications file was given and no suggested group is known to hold an affected unit
module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: catalog, orders
Wave
wave 2 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Confirm the name of the Secrets Manager secret: The draft does not carry the setting on module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch; a manual step stands for it (MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch/tc-secretsmanager-secret-name).
Next action
Confirm the name of the Secrets Manager secret: Verify on the target for module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch: the check, proof or closing evidence is recorded with its result.
Technical details
Record DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E (open critical semantic) · action: verify the behaviour · decisions.json
Decision
the critical settings of a unit, of the aws.secretsmanager_secret contract
Why it exists
The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
1 alias module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch|tc-secretsmanager-secret-name
Options
None listed.
Settings
1 critical setting of the unit, each with its own reason, state and options:
Confirm the name of the Secrets Manager secret (tc-secretsmanager-secret-name): Open: no decision of the record has been taken. The knowledge base cannot decide "the name of the Secrets Manager secret" of the aws.secretsmanager_secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch: the check, proof or closing evidence is recorded with its result.
Review the critical settings of a Secrets Manager secret (Platform Architect) requires verification
1 unit: module.retail_app_ecs.aws_secretsmanager_secret.mq · owner role Platform Architect · required by phase: not stated · 1 step rests on it
Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
orders (PROPOSED)
Wave
wave 5 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Confirm the name of the Secrets Manager secret: The draft does not carry the setting on module.retail_app_ecs.aws_secretsmanager_secret.mq; a manual step stands for it (MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.mq/tc-secretsmanager-secret-name).
Next action
Confirm the name of the Secrets Manager secret: Verify on the target for module.retail_app_ecs.aws_secretsmanager_secret.mq: the check, proof or closing evidence is recorded with its result.
Technical details
Record DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ (open critical semantic) · action: verify the behaviour · decisions.json
Decision
the critical settings of a unit, of the aws.secretsmanager_secret contract
Why it exists
The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.aws_secretsmanager_secret.mq: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
1 alias module.retail_app_ecs.aws_secretsmanager_secret.mq|tc-secretsmanager-secret-name
Options
None listed.
Settings
1 critical setting of the unit, each with its own reason, state and options:
Confirm the name of the Secrets Manager secret (tc-secretsmanager-secret-name): Open: no decision of the record has been taken. The knowledge base cannot decide "the name of the Secrets Manager secret" of the aws.secretsmanager_secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.aws_secretsmanager_secret.mq: the check, proof or closing evidence is recorded with its result.
Review the critical settings of a Secrets Manager secret (Platform Architect) requires verification
1 unit: module.retail_app_ecs.aws_secretsmanager_secret.orders_db · owner role Platform Architect · required by phase: not stated · 1 step rests on it
Options and trade-off
none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file
Applications touched
orders (PROPOSED)
Wave
wave 5 · steps in security
Approval
not approved: no decisions file was given with this run
What the draft does
Confirm the name of the Secrets Manager secret: The draft does not carry the setting on module.retail_app_ecs.aws_secretsmanager_secret.orders_db; a manual step stands for it (MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.orders_db/tc-secretsmanager-secret-name).
Next action
Confirm the name of the Secrets Manager secret: Verify on the target for module.retail_app_ecs.aws_secretsmanager_secret.orders_db: the check, proof or closing evidence is recorded with its result.
Technical details
Record DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB (open critical semantic) · action: verify the behaviour · decisions.json
Decision
the critical settings of a unit, of the aws.secretsmanager_secret contract
Why it exists
The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.aws_secretsmanager_secret.orders_db: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
1 alias module.retail_app_ecs.aws_secretsmanager_secret.orders_db|tc-secretsmanager-secret-name
Options
None listed.
Settings
1 critical setting of the unit, each with its own reason, state and options:
Confirm the name of the Secrets Manager secret (tc-secretsmanager-secret-name): Open: no decision of the record has been taken. The knowledge base cannot decide "the name of the Secrets Manager secret" of the aws.secretsmanager_secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Next: Verify on the target for module.retail_app_ecs.aws_secretsmanager_secret.orders_db: the check, proof or closing evidence is recorded with its result.