Operations
Whether the target can be run: identity, audit, observability, backup, restore, support and lifecycle.
Terraform generated is not workload ready: 1 of 44 units carry open workload items. A generated Terraform resource does not mark any of the dimensions below ready: no dimension is ready in this build, and a unit without evidence is not assessed, which is not the same as ready.
0 units need a decision or evidence from a person (0 of them a decision); 6 compute units carry no workload evidence at all. 49 further entries (conditional, switched off, or standing beside a unit whose attachment cannot be decided) are not measured: whether they exist is decided only when OpenTofu plans.
| Dimension | DECISION REQUIRED | EVIDENCE REQUIRED | READY WITH ACTIONS | NOT ASSESSED | NOT APPLICABLE |
|---|---|---|---|---|---|
| Bootstrap configuration | 0 | 0 | 0 | 6 | 38 |
| Source artifacts | 0 | 0 | 0 | 6 | 38 |
| Target preconditions | 0 | 0 | 1 | 6 | 37 |
| Cutover | 0 | 0 | 1 | 6 | 37 |
| Day 2 operations | 0 | 0 | 0 | 6 | 38 |
What each dimension asks, and why a unit can be not assessed
- Bootstrap configuration: How is the workload installed on this unit? Not assessed: StackToIT cannot see how the workload is installed: no provisioner block, user data or startup script was observed on the unit.
- Source artifacts: Which files do the unit's attributes or its bootstrap read that the scan did not find? Not assessed: No file the unit depends on was listed as missing, unreadable or unresolved; that does not establish that the scripts and templates are the right ones.
- Target preconditions: What must exist on STACKIT before a resource of the draft works? Not assessed: No plan manual action of the kind target precondition names the unit in this build.
- Cutover: What must be true before the cutover? Not assessed: This build reads the cutover from two things only: the DNS endpoint reading (a record whose address the draft re-binds to a generated resource carries the cutover requirement; an A or AAAA record whose address is not bound to one needs evidence) and the manual actions of the plan that are due before the cutover. A unit none of them names is not assessed, which is not ready.
- Day 2 operations: What do the plans ask after the move? Not assessed: No plan manual action due on day 2 or for optimisation names the unit in this build.
| Unit | Bootstrap configuration | Source artifacts | Target preconditions | Cutover | Day 2 operations |
|---|---|---|---|---|---|
module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks |
NOT APPLICABLE | NOT APPLICABLE | READY WITH ACTIONS action DEC-OPS-STACKITLOGS-ACTION-TARGET-PRECONDITION (alias stackitlogs:token:stackit_logs_instance.logs_retention_180d) |
READY WITH ACTIONS action DEC-OPS-STACKITLOGS-ACTION-ARCHIVE-FLOW (alias stackitlogs:archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks)action DEC-OPS-STACKITLOGS-ACTION-LABEL-CONVENTION (alias stackitlogs:label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks)action DEC-OPS-STACKITLOGS-ACTION-TARGET-PRECONDITION (alias stackitlogs:token:stackit_logs_instance.logs_retention_180d) |
NOT APPLICABLE |
Dimensions of operational readiness that this build does not state (20)
Each is not assessed. Naming them keeps the gap visible: a generated Terraform resource does not mark them ready.
- IAM: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- WIF: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- Audit logs: not assessed — the draft creates and configures no audit log: the record of administrative activity is a platform fact, not something the draft made. STACKIT Audit Log (capability registry security.audit-log): The platform-wide record of administrative activity (who called which API in an organisation, folder or project): on by default, 90 days of history in the Portal, readable with the audit-log.reader role, routed onward with the Telemetry Router. It records API calls, not the resulting configuration. No Terraform resource enables or configures it. A Telemetry Router destination is drafted for a source CloudTrail trail with logging on; the router takes the Audit Logs of STACKIT products only, so none is drafted for a CloudWatch metric stream or log delivery destination; the link that makes the router receive the project's audit events is not drafted, a person sets it up; the legacy Audit Log API was decommissioned on 2026-06-02, and the Telemetry Router is the way to take the log out.
- Application logs: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- Metrics: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- Traces: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- Alerts: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- Backup: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- Restore: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- DR: not assessed — this build states nothing about it; business recovery objectives (RTO, RPO) are not provided to this build
- Patching: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- Upgrade lifecycle: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- Support: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- Quota monitoring: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- Incident handling: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- Capacity: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- Cost allocation: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- Security posture: not assessed — the draft does not enable it and the provider has no resource for it: CSPM is a platform fact, not something the draft made. STACKIT Cloud Security Posture Management (capability registry security.posture-management): Managed security posture management (assessment of a project against fixed benchmarks): STACKIT Cloud Security Posture Management, a Portal service (generally available since 2026-10-05; enabled in the Portal or through the Service Enablement API) whose documented API reference is labelled v1beta, with no Terraform resource. It shows a project-level dashboard with a scan every 24 hours and offers no alerting. Managed threat detection is not part of it. It scans against BSI C5, ISO 27000 and the STACKIT standard. Where the estate has AWS Config or Security Hub rules they are not carried: a person enables CSPM and maps the controls.
- Secrets: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- Runbook ownership: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
- A generated Terraform resource does not mark these ready: no dimension is ready in this build, and a unit without evidence is not assessed, never ready.
- A state is read from a typed fact of the assessment or of a plan (an open critical semantic, an observed bootstrap, a source artifact the scan did not find, a manual action with its kind and phase); nothing is inferred from a resource name.
- A compute unit is a unit of the catalogue category compute; every other unit applies to a dimension only where a typed fact concerns it.
- The cutover requirement is read for the DNS records of this build only (the re-bound address of an Elastic IP, or an address record with no endpoint binding) and for the manual actions of the plan due before the cutover; the cutover of any other endpoint (load balancer, certificate, allow-list) is not read by this build. StackToIT applies no cutover and the requirement does not change a unit's class, confidence or eligibility.
Data movement
Decision required StackToIT never moves data. 6 stateful source units are listed here: a person must choose a data-movement mechanism for each, and none is chosen (the mechanism is UNKNOWN).
| Unit | Source type | Target service | State | Mechanism | Data class | RPO | Downtime tolerance | Provisioned capacity |
|---|---|---|---|---|---|---|---|---|
module.dependencies.aws_mq_broker.mq |
aws_mq_broker |
STACKIT RabbitMQ | Decision required | unknown | NOT_PROVIDED | NOT_PROVIDED | NOT_PROVIDED | not stated in the source |
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this |
aws_opensearch_domain |
STACKIT OpenSearch | Decision required | unknown | NOT_PROVIDED | NOT_PROVIDED | NOT_PROVIDED | ebs_options.volume_size 50 (provisioned capacity, not data size) |
module.dependencies.module.catalog_rds.aws_rds_cluster.this |
aws_rds_cluster |
STACKIT MariaDB | Decision required | unknown | NOT_PROVIDED | NOT_PROVIDED | NOT_PROVIDED | not stated in the source |
module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default |
aws_elasticache_replication_group |
STACKIT Key Value Store (Valkey) | Decision required | unknown | NOT_PROVIDED | NOT_PROVIDED | NOT_PROVIDED | not stated in the source |
module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this |
aws_dynamodb_table |
STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) | Decision required | unknown | NOT_PROVIDED | NOT_PROVIDED | NOT_PROVIDED | not stated in the source |
module.dependencies.module.orders_rds.aws_rds_cluster.this |
aws_rds_cluster |
STACKIT PostgreSQL Flex | Decision required | unknown | NOT_PROVIDED | NOT_PROVIDED | NOT_PROVIDED | not stated in the source |
module.dependencies.aws_mq_broker.mq: facets, unknowns and actions
No mechanism is chosen: a broker holds no dataset the source states, but its definitions (users, exchanges, queues, bindings, policies) and the messages in flight are state that has to move, and what moves them depends on the downtime the business tolerates and on the queue depths, which the source does not state. Candidate method, not chosen and not tried on a STACKIT instance: export the definitions of the Amazon MQ broker (the RabbitMQ definitions export, which lists users, vhosts, queues, exchanges, bindings and runtime parameters, not messages) and import the topology into the STACKIT RabbitMQ instance, stop the producers and drain the queues before the cutover, and point the clients at the new endpoint with new credentials: the draft copies no broker user and writes one stackit_rabbitmq_credential for the instance (a user whose username and password STACKIT generates).
- consistency requirements: Not assessed No consistency requirement is stated by the source or by this build; whether the application tolerates a copy that lags the original is a decision for a person.
- validation requirement: Not assessed This build does not state how the moved data is validated.
- cutover dependency: Observed The unit is in wave 4 of the dependency order. It depends on: module.dependencies.aws_security_group.mq, module.vpc.module.vpc.aws_subnet.private.
- rollback consideration: Not assessed No rollback consideration is stated by the source or by this build.
- encryption requirement: Not assessed No in-transit encryption requirement is stated for this unit by the source or by this build.
Unknown:
- The size of the data is not in the source.
- The rate at which the data changes is not in the source.
- The queues, their depths and the messages in flight at the cutover are not in the source.
- The downtime the business tolerates is not provided.
- The recovery point the business requires is not provided.
- The classification of the data is not provided.
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: facets, unknowns and actions
No mechanism is chosen: it depends on the size of the data, the downtime the business tolerates and the consistency the application needs, and the source states none of them.
- consistency requirements: Not assessed No consistency requirement is stated by the source or by this build; whether the application tolerates a copy that lags the original is a decision for a person.
- validation requirement: Not assessed This build does not state how the moved data is validated.
- cutover dependency: Observed The unit is in wave 4 of the dependency order. It depends on: module.dependencies.aws_security_group.catalog_opensearch_sg, module.vpc.module.vpc.aws_subnet.private.
- rollback consideration: Not assessed No rollback consideration is stated by the source or by this build.
- encryption requirement: Not assessed No in-transit encryption requirement is stated for this unit by the source or by this build.
Unknown:
- The size of the data is not in the source.
- The rate at which the data changes is not in the source.
- The downtime the business tolerates is not provided.
- The recovery point the business requires is not provided.
- The classification of the data is not provided.
module.dependencies.module.catalog_rds.aws_rds_cluster.this: facets, unknowns and actions
No mechanism is chosen: it depends on the size of the data, the downtime the business tolerates and the consistency the application needs, and the source states none of them.
- consistency requirements: Not assessed No consistency requirement is stated by the source or by this build; whether the application tolerates a copy that lags the original is a decision for a person.
- validation requirement: Not assessed This build does not state how the moved data is validated.
- cutover dependency: Observed The unit is in wave 4 of the dependency order. It depends on: module.dependencies.module.catalog_rds.aws_security_group.this, module.vpc.module.vpc.aws_subnet.private.
- rollback consideration: Not assessed No rollback consideration is stated by the source or by this build.
- encryption requirement: Not assessed The source does not state tls-enforcement; an absent setting is not read as a requirement.
Unknown:
- The size of the data is not in the source.
- The rate at which the data changes is not in the source.
- The downtime the business tolerates is not provided.
- The recovery point the business requires is not provided.
- The classification of the data is not provided.
module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: facets, unknowns and actions
No mechanism is chosen: it depends on the size of the data, the downtime the business tolerates and the consistency the application needs, and the source states none of them.
- consistency requirements: Not assessed No consistency requirement is stated by the source or by this build; whether the application tolerates a copy that lags the original is a decision for a person.
- validation requirement: Not assessed This build does not state how the moved data is validated.
- cutover dependency: Observed The unit is in wave 4 of the dependency order. It depends on: module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, module.vpc.module.vpc.aws_subnet.private.
- rollback consideration: Not assessed No rollback consideration is stated by the source or by this build.
- encryption requirement: Observed The source states that clients connect without TLS (transit_encryption_enabled = false; finding redis-transit-encryption-off). The STACKIT Key Value Store accepts TLS only: every client changes the scheme (redis:// becomes rediss://), switches its TLS option on and trusts the CA certificate of the instance before the cutover.
Unknown:
- The size of the data is not in the source.
- The rate at which the data changes is not in the source.
- The downtime the business tolerates is not provided.
- The recovery point the business requires is not provided.
- The classification of the data is not provided.
module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this: facets, unknowns and actions
No mechanism is chosen: it depends on the size of the data, the downtime the business tolerates and the consistency the application needs, and the source states none of them.
- consistency requirements: Not assessed No consistency requirement is stated by the source or by this build; whether the application tolerates a copy that lags the original is a decision for a person.
- validation requirement: Not assessed This build does not state how the moved data is validated.
- cutover dependency: Observed The unit is in wave 1 of the dependency order. It depends on no other unit.
- rollback consideration: Not assessed No rollback consideration is stated by the source or by this build.
- encryption requirement: Not assessed No in-transit encryption requirement is stated for this unit by the source or by this build.
Unknown:
- The size of the data is not in the source.
- The rate at which the data changes is not in the source.
- The downtime the business tolerates is not provided.
- The recovery point the business requires is not provided.
- The classification of the data is not provided.
module.dependencies.module.orders_rds.aws_rds_cluster.this: facets, unknowns and actions
No mechanism is chosen: it depends on the size of the data, the downtime the business tolerates and the consistency the application needs, and the source states none of them.
- consistency requirements: Not assessed No consistency requirement is stated by the source or by this build; whether the application tolerates a copy that lags the original is a decision for a person.
- validation requirement: Not assessed This build does not state how the moved data is validated.
- cutover dependency: Observed The unit is in wave 4 of the dependency order. It depends on: module.dependencies.module.orders_rds.aws_security_group.this, module.vpc.module.vpc.aws_subnet.private.
- rollback consideration: Not assessed No rollback consideration is stated by the source or by this build.
- encryption requirement: Not assessed The source does not state tls-enforcement; an absent setting is not read as a requirement.
Unknown:
- The size of the data is not in the source.
- The rate at which the data changes is not in the source.
- The downtime the business tolerates is not provided.
- The recovery point the business requires is not provided.
- The classification of the data is not provided.
- The size of the data, its change rate, the duration of a transfer, the transfer rate and the downtime are never stated: the source does not state them and this build has no way to measure them. A provisioned capacity quoted beside a unit is the size of what was provisioned, not the size of the data.
- No mechanism is chosen and nothing is executed: StackToIT is out of scope for actual data movement, and a mechanism class is a recommendation a person makes from the size, the downtime tolerated and the consistency the application needs.
- A unit is listed when its catalogue kind holds data of its own (a database, a cache, a search domain, a warehouse, a block volume, a file share, an object store). A queue or topic service, and a system installed on a server's disk, are not read as stateful and are not listed. An Amazon MQ broker is listed, because its definitions (users, exchanges, queues, bindings, policies) and the messages in flight are state that moves with the cutover; the method named beside it is a candidate a person chooses, never a method this build chose or ran. A repository of an AWS ECR registry is listed as well, because its images are data that moves to the target registry; a pull-through cache, a registry of another cloud and a registry-level feature are not.
- The data class, RPO and downtime tolerance are the customer's, from the applications file, word for word; without one, or for a unit outside an application, they are NOT_PROVIDED and no default is assumed.
Resilience
Evidence required Requirement: business requirement not provided. No RTO or RPO was stated (BUSINESS_REQUIREMENT_NOT_PROVIDED): no architecture is called resilient against it, and no value is assumed.
| Unit | Source type | Application | What the source states | Intent | State | Why |
|---|---|---|---|---|---|---|
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this |
aws_opensearch_domain |
none | availability zone: not stated in the source (an absent zone is not read as a default zone) |
unknown | Evidence required | Intent UNKNOWN: decision requires evidence. No applications file was given, so no RTO or RPO is stated. The availability-zone and metro placement of the target are NOT_ASSESSED: this build holds no evidence for them. |
module.dependencies.module.catalog_rds.aws_rds_cluster.this |
aws_rds_cluster |
none | availability zone: not stated in the source (an absent zone is not read as a default zone)contract item backup-retention: observed yes; disposition LEDGER (the state of the contract item, not a setting of the target)contract item readable-standbys: observed yes; disposition NOT_APPLICABLE (the state of the contract item, not a setting of the target) |
unknown | Evidence required | Intent UNKNOWN: decision requires evidence. No applications file was given, so no RTO or RPO is stated. The availability-zone and metro placement of the target are NOT_ASSESSED: this build holds no evidence for them. |
module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default |
aws_elasticache_replication_group |
none | multi-zone switch of the service: false (the switch as the source writes it) |
unknown | Evidence required | Intent UNKNOWN: decision requires evidence. No applications file was given, so no RTO or RPO is stated. The availability-zone and metro placement of the target are NOT_ASSESSED: this build holds no evidence for them. |
module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this |
aws_dynamodb_table |
none | availability zone: NOT_ASSESSED: no placement adapter reads this source type in this build (not read, which is not the same as not stated) |
unknown | Evidence required | Intent UNKNOWN: decision requires evidence. No applications file was given, so no RTO or RPO is stated. The availability-zone and metro placement of the target are NOT_ASSESSED: this build holds no evidence for them. |
module.dependencies.module.orders_rds.aws_rds_cluster.this |
aws_rds_cluster |
none | availability zone: not stated in the source (an absent zone is not read as a default zone)contract item backup-retention: observed yes; disposition LEDGER (the state of the contract item, not a setting of the target)contract item readable-standbys: observed yes; disposition NOT_APPLICABLE (the state of the contract item, not a setting of the target) |
unknown | Evidence required | Intent UNKNOWN: decision requires evidence. No applications file was given, so no RTO or RPO is stated. The availability-zone and metro placement of the target are NOT_ASSESSED: this build holds no evidence for them. |
module.retail_app_ecs.module.alb.aws_lb.this |
aws_lb |
none | availability zone: not stated in the source (an absent zone is not read as a default zone)contract item cross-zone: observed yes; disposition PRESERVED (the state of the contract item, not a setting of the target) |
unknown | Evidence required | Intent UNKNOWN: decision requires evidence. No applications file was given, so no RTO or RPO is stated. The availability-zone and metro placement of the target are NOT_ASSESSED: this build holds no evidence for them. |
- No unit is called resilient and no resilience intent is chosen: the intent of every unit is UNKNOWN until a person decides it from a stated requirement and the facts of the source.
- No RTO or RPO is defaulted or inferred from a resource name; the requirement is what the applications file states, word for word, or it is not provided.
- The zone facts of the source are read by the AWS placement adapter only; for every other source they are NOT_ASSESSED, which does not mean that the source states none.
- The availability zones and metro placement of the STACKIT target are NOT_ASSESSED: this build holds no evidence for them, so nothing here compares the source with the target.
- A unit is listed when it holds state or states a failure-domain, replication or backup fact; a unit that states none and holds no data is not looked at, and the network a unit stands in (a subnet, a route table, a security group) is not a unit with an intent of its own: 46 of the 52 units present in the source are not listed here, and the block says nothing about them.