StackToIT Migration Intelligence Workspace

The security acceptance of module.retail_app_ecs.module.alb.aws_lb.this MAN/security/accept/module.retail_app_ecs.module.alb.aws_lb.this:plaintext-public-listener

• accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.alb.aws_lb.this that the draft carries: The source load balancer module.retail_app_ecs.module.alb.aws_lb.this is internet-facing and every listener it states is HTTP (port 80 forwards to its targets, no listener is HTTPS or TLS): clients reach the application without transport encryption. In the draft: the drafted listener of stackit_application_load_balancer.retail_app_ecs_alb_this is plain HTTP on port 80, as the source states it; the public address is kept and no HTTPS listener or certificate is added. Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)

The security acceptance of module.retail_app_ecs.module.carts_service.aws_security_group.this MAN/security/accept/module.retail_app_ecs.module.carts_service.aws_security_group.this:open-ingress-application-port

• accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.carts_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.carts_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)

The security acceptance of module.retail_app_ecs.module.catalog_service.aws_security_group.this MAN/security/accept/module.retail_app_ecs.module.catalog_service.aws_security_group.this:open-ingress-application-port

• accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.catalog_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.catalog_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)

The security acceptance of module.retail_app_ecs.module.checkout_service.aws_security_group.this MAN/security/accept/module.retail_app_ecs.module.checkout_service.aws_security_group.this:open-ingress-application-port

• accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.checkout_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.checkout_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)

The security acceptance of module.retail_app_ecs.module.orders_service.aws_security_group.this MAN/security/accept/module.retail_app_ecs.module.orders_service.aws_security_group.this:open-ingress-application-port

• accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.orders_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.orders_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)

The security acceptance of module.retail_app_ecs.module.ui_service.aws_security_group.this MAN/security/accept/module.retail_app_ecs.module.ui_service.aws_security_group.this:open-ingress-application-port

• accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.ui_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.ui_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)

The data preflight of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/preflight

• copy volume: UNKNOWN — supplied by Data Architect (the amount of data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default to copy: the used space measured on the source; the provisioned capacity of the source is not the amount of data; closed when the measured amount and the date of the measurement are recorded)
• change rate: UNKNOWN — supplied by Data Architect (how much data the writers of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default change per hour; closed when the rate measured over a representative period is recorded, with the time a final pass needs at that rate)
• write-freeze window: UNKNOWN — supplied by Data Architect (the window in which the writers of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default stop for the final pass; closed when the owner of the application agrees the start and the end of the window and it is recorded)
• last sync: UNKNOWN — supplied by Data Architect (the time the final pass ends and its checks hold; closed when the time of the final pass and the result of its checks are recorded)
• return point: UNKNOWN — supplied by Data Architect (the state of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default the migration returns to on a rollback: the source as it was at the write freeze, or a named snapshot or backup; closed when the return point is recorded with its time and how it is restored)
• consistency check: UNKNOWN — supplied by Data Architect (how the copy of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is shown complete and unchanged after the final pass: the used space and a checksum of the data (of the files, or the row counts of the tables) agree with the source; closed when the method is agreed and its result after the final pass is recorded)
• validation on the target: UNKNOWN — supplied by Migration Owner (the test the application that uses module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default passes on STACKIT with the copied data before the cutover, agreed with the owner of the application; closed when the test passes on the target and its result is recorded)
• source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is kept is recorded)
• rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
• data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

The data preflight of module.dependencies.module.catalog_rds.aws_rds_cluster.this MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/preflight

• copy volume: UNKNOWN — supplied by Data Architect (the amount of data of module.dependencies.module.catalog_rds.aws_rds_cluster.this to copy: the used space measured on the source; the provisioned capacity of the source is not the amount of data; closed when the measured amount and the date of the measurement are recorded)
• change rate: UNKNOWN — supplied by Data Architect (how much data the writers of module.dependencies.module.catalog_rds.aws_rds_cluster.this change per hour; closed when the rate measured over a representative period is recorded, with the time a final pass needs at that rate)
• write-freeze window: UNKNOWN — supplied by Data Architect (the window in which the writers of module.dependencies.module.catalog_rds.aws_rds_cluster.this stop for the final pass; closed when the owner of the application agrees the start and the end of the window and it is recorded)
• last sync: UNKNOWN — supplied by Data Architect (the time the final pass ends and its checks hold; closed when the time of the final pass and the result of its checks are recorded)
• return point: UNKNOWN — supplied by Data Architect (the state of module.dependencies.module.catalog_rds.aws_rds_cluster.this the migration returns to on a rollback: the source as it was at the write freeze, or a named snapshot or backup; closed when the return point is recorded with its time and how it is restored)
• consistency check: UNKNOWN — supplied by Data Architect (how the copy of module.dependencies.module.catalog_rds.aws_rds_cluster.this is shown complete and unchanged after the final pass: the used space and a checksum of the data (of the files, or the row counts of the tables) agree with the source; closed when the method is agreed and its result after the final pass is recorded)
• validation on the target: UNKNOWN — supplied by Migration Owner (the test the application that uses module.dependencies.module.catalog_rds.aws_rds_cluster.this passes on STACKIT with the copied data before the cutover, agreed with the owner of the application; closed when the test passes on the target and its result is recorded)
• source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.catalog_rds.aws_rds_cluster.this is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.catalog_rds.aws_rds_cluster.this is kept is recorded)
• rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
• data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.catalog_rds.aws_rds_cluster.this before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

The data preflight of module.dependencies.module.orders_rds.aws_rds_cluster.this MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/preflight

• copy volume: UNKNOWN — supplied by Data Architect (the amount of data of module.dependencies.module.orders_rds.aws_rds_cluster.this to copy: the used space measured on the source; the provisioned capacity of the source is not the amount of data; closed when the measured amount and the date of the measurement are recorded)
• change rate: UNKNOWN — supplied by Data Architect (how much data the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this change per hour; closed when the rate measured over a representative period is recorded, with the time a final pass needs at that rate)
• write-freeze window: UNKNOWN — supplied by Data Architect (the window in which the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this stop for the final pass; closed when the owner of the application agrees the start and the end of the window and it is recorded)
• last sync: UNKNOWN — supplied by Data Architect (the time the final pass ends and its checks hold; closed when the time of the final pass and the result of its checks are recorded)
• return point: UNKNOWN — supplied by Data Architect (the state of module.dependencies.module.orders_rds.aws_rds_cluster.this the migration returns to on a rollback: the source as it was at the write freeze, or a named snapshot or backup; closed when the return point is recorded with its time and how it is restored)
• consistency check: UNKNOWN — supplied by Data Architect (how the copy of module.dependencies.module.orders_rds.aws_rds_cluster.this is shown complete and unchanged after the final pass: the used space and a checksum of the data (of the files, or the row counts of the tables) agree with the source; closed when the method is agreed and its result after the final pass is recorded)
• validation on the target: UNKNOWN — supplied by Migration Owner (the test the application that uses module.dependencies.module.orders_rds.aws_rds_cluster.this passes on STACKIT with the copied data before the cutover, agreed with the owner of the application; closed when the test passes on the target and its result is recorded)
• source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.orders_rds.aws_rds_cluster.this is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.orders_rds.aws_rds_cluster.this is kept is recorded)
• rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
• data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.orders_rds.aws_rds_cluster.this before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

The switch of the applications that use module.dependencies.module.catalog_rds.aws_rds_cluster.this MAN/cutover/connection/module.dependencies.module.catalog_rds.aws_rds_cluster.this

• source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.catalog_rds.aws_rds_cluster.this is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.catalog_rds.aws_rds_cluster.this is kept is recorded)
• rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
• data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.catalog_rds.aws_rds_cluster.this before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

The switch of the applications that use module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default MAN/cutover/connection/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default

• source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is kept is recorded)
• rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
• data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

The export of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/export/own-tool

• copy volume: UNKNOWN — supplied by Data Architect (the amount of data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this to copy: the used space measured on the source; the provisioned capacity of the source is not the amount of data; closed when the measured amount and the date of the measurement are recorded)
• change rate: UNKNOWN — supplied by Data Architect (how much data the writers of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this change per hour; closed when the rate measured over a representative period is recorded, with the time a final pass needs at that rate)
• write-freeze window: UNKNOWN — supplied by Data Architect (the window in which the writers of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this stop for the final pass; closed when the owner of the application agrees the start and the end of the window and it is recorded)
• last sync: UNKNOWN — supplied by Data Architect (the time the final pass ends and its checks hold; closed when the time of the final pass and the result of its checks are recorded)
• return point: UNKNOWN — supplied by Data Architect (the state of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this the migration returns to on a rollback: the source as it was at the write freeze, or a named snapshot or backup; closed when the return point is recorded with its time and how it is restored)
• consistency check: UNKNOWN — supplied by Data Architect (how the copy of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is shown complete and unchanged after the final pass: the used space and a checksum of the data (of the files, or the row counts of the tables) agree with the source; closed when the method is agreed and its result after the final pass is recorded)
• validation on the target: UNKNOWN — supplied by Migration Owner (the test the application that uses module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this passes on STACKIT with the copied data before the cutover, agreed with the owner of the application; closed when the test passes on the target and its result is recorded)
• source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is kept is recorded)
• rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
• data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

The switch of the applications that use module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this MAN/cutover/connection/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this

• source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is kept is recorded)
• rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
• data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

The switch of the applications that use module.dependencies.module.orders_rds.aws_rds_cluster.this MAN/cutover/connection/module.dependencies.module.orders_rds.aws_rds_cluster.this

• source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.orders_rds.aws_rds_cluster.this is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.orders_rds.aws_rds_cluster.this is kept is recorded)
• rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
• data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.orders_rds.aws_rds_cluster.this before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

The switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_db MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db

• source retention: UNKNOWN — supplied by Migration Owner (module.retail_app_ecs.aws_secretsmanager_secret.catalog_db is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.retail_app_ecs.aws_secretsmanager_secret.catalog_db is kept is recorded)
• rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
• data written to the target: UNKNOWN — supplied by Identity Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.retail_app_ecs.aws_secretsmanager_secret.catalog_db before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

The switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch

• source retention: UNKNOWN — supplied by Migration Owner (module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch is kept is recorded)
• rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
• data written to the target: UNKNOWN — supplied by Identity Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

The switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.mq MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.mq

• source retention: UNKNOWN — supplied by Migration Owner (module.retail_app_ecs.aws_secretsmanager_secret.mq is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.retail_app_ecs.aws_secretsmanager_secret.mq is kept is recorded)
• rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
• data written to the target: UNKNOWN — supplied by Identity Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.retail_app_ecs.aws_secretsmanager_secret.mq before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

The switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.orders_db MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.orders_db

• source retention: UNKNOWN — supplied by Migration Owner (module.retail_app_ecs.aws_secretsmanager_secret.orders_db is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.retail_app_ecs.aws_secretsmanager_secret.orders_db is kept is recorded)
• rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
• data written to the target: UNKNOWN — supplied by Identity Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.retail_app_ecs.aws_secretsmanager_secret.orders_db before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

The traffic switch of module.dependencies.aws_mq_broker.mq MAN/cutover/module.dependencies.aws_mq_broker.mq

• source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.aws_mq_broker.mq is not retired until the GO recorded at the rollback decision step; how long it is kept after that is the owner's; closed when the date until which module.dependencies.aws_mq_broker.mq is kept is recorded)
• rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
• data written to the target: UNKNOWN — supplied by Network Architect (the switch moves requests, not data: whether the switched clients write through the STACKIT address, and where those writes are stored; closed when the owner of the application records whether the clients write and, if they do, whether their writes are copied back to AWS on a rollback or accepted as lost)

The switch of the consumers of module.dependencies.aws_mq_broker.mq MAN/cutover/messaging-consumers/module.dependencies.aws_mq_broker.mq

• source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.aws_mq_broker.mq is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.aws_mq_broker.mq is kept is recorded)
• rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
• data written to the target: UNKNOWN — supplied by Platform Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.aws_mq_broker.mq before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)

The traffic switch of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this MAN/cutover/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this

• source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is not retired until the GO recorded at the rollback decision step; how long it is kept after that is the owner's; closed when the date until which module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is kept is recorded)
• rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
• data written to the target: UNKNOWN — supplied by Network Architect (the switch moves requests, not data: whether the switched clients write through the STACKIT address, and where those writes are stored; closed when the owner of the application records whether the clients write and, if they do, whether their writes are copied back to AWS on a rollback or accepted as lost)

The traffic switch of module.retail_app_ecs.module.alb.aws_lb.this MAN/cutover/module.retail_app_ecs.module.alb.aws_lb.this

• source retention: UNKNOWN — supplied by Migration Owner (module.retail_app_ecs.module.alb.aws_lb.this is not retired until the GO recorded at the rollback decision step; how long it is kept after that is the owner's; closed when the date until which module.retail_app_ecs.module.alb.aws_lb.this is kept is recorded)
• rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
• data written to the target: UNKNOWN — supplied by Network Architect (the switch moves requests, not data: whether the switched clients write through the STACKIT address, and where those writes are stored; closed when the owner of the application records whether the clients write and, if they do, whether their writes are copied back to AWS on a rollback or accepted as lost)

The DNS check of module.retail_app_ecs.module.carts_service.aws_ecs_service.this MAN/verify/dns/module.retail_app_ecs.module.carts_service.aws_ecs_service.this

• resolve carts: UNKNOWN — supplied by Network Architect (the address carts resolves to from a pod of carts, compared with what stands for it on STACKIT: carts.<namespace>.svc.cluster.local (the Kubernetes Service carts; carts from a pod of the same namespace). resolve, from a pod of a client of carts, carts and carts.<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service carts (kubectl get service carts); closed when the address the name resolves to is recorded and the application connects through it)

The DNS check of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this MAN/verify/dns/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this

• resolve the endpoint host of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch) resolves to from a pod of catalog, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_opensearch_instance.dependencies_catalog_opensearch_this (OpenSearch) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of catalog, the host of stackit_opensearch_instance.dependencies_catalog_opensearch_this and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it)
• resolve the endpoint host of module.dependencies.module.catalog_rds.aws_rds_cluster.this (Aurora): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.module.catalog_rds.aws_rds_cluster.this (Aurora) resolves to from a pod of catalog, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_mariadb_instance.dependencies_catalog_rds_this (MariaDB) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of catalog, the host of stackit_mariadb_instance.dependencies_catalog_rds_this and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it)
• resolve catalog: UNKNOWN — supplied by Network Architect (the address catalog resolves to from a pod of catalog, compared with what stands for it on STACKIT: catalog.<namespace>.svc.cluster.local (the Kubernetes Service catalog; catalog from a pod of the same namespace). resolve, from a pod of a client of catalog, catalog and catalog.<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service catalog (kubectl get service catalog); closed when the address the name resolves to is recorded and the application connects through it)

The DNS check of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this MAN/verify/dns/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this

• resolve the endpoint host of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (ElastiCache): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (ElastiCache) resolves to from a pod of checkout, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_valkey_instance.dependencies_checkout_elasticache_redis_default (Key Value Store (Valkey)) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of checkout, the host of stackit_valkey_instance.dependencies_checkout_elasticache_redis_default and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it)
• resolve checkout: UNKNOWN — supplied by Network Architect (the address checkout resolves to from a pod of checkout, compared with what stands for it on STACKIT: checkout.<namespace>.svc.cluster.local (the Kubernetes Service checkout; checkout from a pod of the same namespace). resolve, from a pod of a client of checkout, checkout and checkout.<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service checkout (kubectl get service checkout); closed when the address the name resolves to is recorded and the application connects through it)

The DNS check of module.retail_app_ecs.module.orders_service.aws_ecs_service.this MAN/verify/dns/module.retail_app_ecs.module.orders_service.aws_ecs_service.this

• resolve the endpoint host of module.dependencies.aws_mq_broker.mq (Amazon MQ): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.aws_mq_broker.mq (Amazon MQ) resolves to from a pod of orders, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_rabbitmq_instance.dependencies_mq (RabbitMQ) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of orders, the host of stackit_rabbitmq_instance.dependencies_mq and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it)
• resolve the endpoint host of module.dependencies.module.orders_rds.aws_rds_cluster.this (Aurora): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.module.orders_rds.aws_rds_cluster.this (Aurora) resolves to from a pod of orders, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_postgresflex_instance.dependencies_orders_rds_this (PostgreSQL Flex) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of orders, the host of stackit_postgresflex_instance.dependencies_orders_rds_this and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it)
• resolve orders: UNKNOWN — supplied by Network Architect (the address orders resolves to from a pod of orders, compared with what stands for it on STACKIT: orders.<namespace>.svc.cluster.local (the Kubernetes Service orders; orders from a pod of the same namespace). resolve, from a pod of a client of orders, orders and orders.<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service orders (kubectl get service orders); closed when the address the name resolves to is recorded and the application connects through it)

The DNS check of module.retail_app_ecs.module.ui_service.aws_ecs_service.this MAN/verify/dns/module.retail_app_ecs.module.ui_service.aws_ecs_service.this

• resolve ui: UNKNOWN — supplied by Network Architect (the address ui resolves to from a pod of ui, compared with what stands for it on STACKIT: ui.<namespace>.svc.cluster.local (the Kubernetes Service ui; ui from a pod of the same namespace). resolve, from a pod of a client of ui, ui and ui.<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service ui (kubectl get service ui); closed when the address the name resolves to is recorded and the application connects through it)

The run wrote migration/technical-sequencing.md.

It holds the waves computed from the dependencies between the units: a unit comes after every unit it depends on, and the units of one wave do not depend on each other. That is a technical order only. It is not a schedule, it does not rank the units by what the business needs first, and nothing in it has been checked against the data or the applications.