Sovereignty
Dependencies, jurisdiction, data placement, key control and exit paths, source against target.
Sovereignty is not residency, and it is never expressed as a percentage or a score. This page is technical evidence and gaps: it does not certify legal compliance, and legal conclusions stay with counsel.
Requirement
Sovereignty requirement: not provided. No sovereignty requirement was provided: no applications file gives a tier or constraints. It is not inferred from the location of the company or of the provider.
The thirteen dimensions
Each dimension states the requirement, what the source shows, what the target is proposed to be, the delta, the evidence, what is unknown and the actions. A statement that reads not assessed says that this build has no evidence for it; it is not a finding.
| Dimension | State | Requirement | Observed in the source | Proposed for the target | Delta | Evidence | Unknowns | Actions |
|---|---|---|---|---|---|---|---|---|
| Data location | Evidence required | NOT_PROVIDED | Not assessed The location of the source resources is not read: this build computes no region or zone placement for the source. | Stated Name resolution: stackit_network.vpc_vpc_private, stackit_network.vpc_vpc_public take the shared variable default_ipv4_nameservers, which defaults to the addresses of the STACKIT DNS Resolver (beta) in eu01 (192.214.161.53, 213.17.17.17, 188.34.111.111), so those name queries go to the resolver STACKIT operates and not to the public resolvers 1.1.1.1, 8.8.8.8 and 9.9.9.9 that STACKIT sets in a public project when none are given. The resolver is a beta product documented for workloads inside STACKIT (docs.stackit.cloud, DNS Resolver, Concepts); no check that it answers from these networks is made here, and who operates it and under which jurisdiction is not assessed here. The capability catalogue lists the STACKIT services of the draft as available in: eu01, eu02. That a service is available in a region is a fact about the service. Region assumed for pricing: eu01 (default; no input chose a region). The catalogue lists the service of 13 units there, but no input or profile has chosen the region, so no resource is tied to it. | Not assessed No source location is established, so no change of location is stated. | pointers into workspace.json | The provider's own statement on data location is a statement of the provider with control shared: STACKIT states that the development of its cloud takes place in Germany, that its servers and data centers are located in Germany and Austria, and that its cloud operates in accordance with European data protection standards. It names no region id, so it does not tie any resource of the draft to a region. Where backups, logs and replicas are stored is the subject of the backup chain and the telemetry chain. |
|
| Jurisdiction chain | Not assessed | NOT_PROVIDED | Not assessed The jurisdiction chain (the legal seat of the provider, of its owners and of its operators, and the legal reach over them) is not assessed. It is not a fact of the Terraform source or of the draft, and legal conclusions stay external. | Not assessed No target state is stated: the source state is not established. | Not assessed No change is stated. | Which legal order applies to the provider, to its parent organisations and to its operators is a question for counsel, not for this build. |
||
| Operator access | Not assessed | NOT_PROVIDED | Not assessed Who at the provider or at an operator can reach the resources and the data, and under which conditions, is not assessed. It is not a fact of the Terraform source or of the draft. | Not assessed No target state is stated: the source state is not established. | Not assessed No change is stated. | The access model of the provider's staff and subcontractors is not a fact of the Terraform source. |
||
| Key control | Evidence required | NOT_PROVIDED | Stated A customer-managed key may be stated, but its value is not visible statically, on: module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch. | Stated A customer-managed key is a separate setting that exists only where the source names a key: no platform encryption stands in for it, and whether the key management of the source is equivalent to the STACKIT key service is not established. Which target services of the draft can use a key of the customer is not established here. | Not assessed Whether key ownership changes is not established: the key of the source and the key of the target are not compared. | pointers into workspace.json | Who holds the key material and who can use it on the target is not established. |
|
| Identity chain | Decision required | NOT_PROVIDED | Stated The source names identities for its workloads or states them as units: module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, module.retail_app_ecs.module.orders_service.aws_ecs_service.this, module.retail_app_ecs.module.ui_service.aws_ecs_service.this. | Stated The draft attaches a STACKIT service account to a server only where the identity plan attaches it exactly; every other attachment is stated as open. Where the draft writes a project role assignment (for an AWS role, machine user or IAM group it turns into service accounts or members), the role it grants is a variable the architect chooses, because an AWS action is not translated into a STACKIT role: the draft derives no role from the source. | Not assessed Whether the identity dependency changes is not established: the privilege delta and the external identity provider are not assessed. | pointers into workspace.json | Whether an external identity provider is a dependency of the sign-in of people is not assessed. The privilege delta between the source identities and the target roles is not assessed. |
the step "Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this…" the step "Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this gets…" the step "Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this…" the step "Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this…" the step "Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this…" the step "Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this…" the step "Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this…" the step "Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this…" the step "Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this pulls…" the step "Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this gets…" |
| Telemetry chain | Not assessed | NOT_PROVIDED | Not assessed No log sink of the source is read in this run. That is not a finding that no telemetry leaves the estate. | Stated The draft writes log sources as STACKIT Logs instances. Where an export of the source goes is stated in the plan of the log source, not here. | Not assessed Whether the destination of the telemetry changes is not established. | capability:observability.logs |
Where metrics, traces and agent telemetry go is not read by this build. |
|
| Backup chain | Evidence required | NOT_PROVIDED | Stated The contracts of the source observe a backup, retention or geo-replication setting on: module.dependencies.module.catalog_rds.aws_rds_cluster.this, module.dependencies.module.orders_rds.aws_rds_cluster.this. | Not assessed Where the backups of the target are stored and who operates the destination is not stated by the draft or by this build. | Not assessed Whether the destination of the backups changes is not established. | pointers into workspace.json | The destination of the backups and replicas, and the jurisdiction of that destination, are not assessed. |
|
| Supply chain | Observed | NOT_PROVIDED | Stated The source records these Terraform providers, required by its configuration or locked in its lock file: aws, random. | Stated The draft is written for the STACKIT provider 0.121.0. | Not assessed Whether the supply chain of the estate changes is not established. | pointers into workspace.json | The registries and the build chain of the providers, and the provenance of the modules the source calls, are not assessed. |
|
| Third-party processing | Evidence required | NOT_PROVIDED | Stated The source depends on providers or resource types the knowledge base holds no schema of: provider random. | Not assessed The draft names no STACKIT counterpart for these dependencies. | Not assessed Whether a third party processes the data after the move is not established. | pointers into workspace.json | What data a third-party provider or service handles is not read from the Terraform source. |
|
| Open interfaces | Not assessed | NOT_PROVIDED | Not assessed Whether the interfaces the source depends on are open standards and whether the target keeps them is not assessed. | Not assessed No target state is stated: the source state is not established. | Not assessed No change is stated. | Which of the interfaces the source uses are proprietary is not read. |
||
| Data portability | Not assessed | NOT_PROVIDED | Not assessed Whether the data can be exported in a documented format, and by which path, is not assessed. | Not assessed No target state is stated: the source state is not established. | Not assessed No change is stated. | How the data of each stateful unit leaves its service is not read. |
||
| Application coupling | Not assessed | NOT_PROVIDED | Not assessed The coupling of application code to the interfaces of the source (SDKs, proprietary protocols) is not assessed: the application code is not scanned. | Not assessed No target state is stated: the source state is not established. | Not assessed No change is stated. | Which SDKs and protocols the application code uses is not read. |
||
| Exitability | Observed | NOT_PROVIDED | Not assessed The interface, data format, code coupling, replacement complexity, extraction path and alternatives of the source's dependencies are not assessed. | Stated The draft is provider-specific Terraform for the STACKIT provider; that is the only exit fact stated, and it is listed per dependency in the exitability entries. | Not assessed No change of exit cost is stated: no cost, no duration and no complexity is estimated. | Every field of the exitability model but the Terraform coupling is not assessed, so no exit path is proven and none is ruled out. |
Dependencies, source to target
The dependencies of the source and what the draft makes of them. A dependency replaced is a unit the knowledge base maps to a STACKIT service; retained is a source type the knowledge base does not know, for which the draft names no counterpart.
| Source | Source type | Target service | Change | Dimensions it bears on |
|---|---|---|---|---|
provider:random | source provider | none | retained | supply chain, third-party processing |
module.dependencies.aws_mq_broker.mq | aws_mq_broker | STACKIT RabbitMQ | replaced | data location, exitability |
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | aws_opensearch_domain | STACKIT OpenSearch | replaced | data location, exitability |
module.dependencies.module.catalog_rds.aws_rds_cluster.this | aws_rds_cluster | STACKIT MariaDB | replaced | data location, backup chain, exitability |
module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | aws_elasticache_replication_group | STACKIT Key Value Store (Valkey) | replaced | data location, exitability |
module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | aws_dynamodb_table | STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) | replaced | data location, exitability |
module.dependencies.module.orders_rds.aws_rds_cluster.this | aws_rds_cluster | STACKIT PostgreSQL Flex | replaced | data location, backup chain, exitability |
module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks | aws_cloudwatch_log_group | STACKIT Logs | replaced | data location, exitability |
module.retail_app_ecs.aws_ecs_cluster.cluster | aws_ecs_cluster | STACKIT Kubernetes Engine (SKE) | replaced | data location, exitability |
module.retail_app_ecs.aws_kms_key.cmk | aws_kms_key | STACKIT KMS | replaced | data location, exitability |
module.retail_app_ecs.aws_secretsmanager_secret.catalog_db | aws_secretsmanager_secret | STACKIT Secrets Manager | replaced | data location, key control, exitability |
module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch | aws_secretsmanager_secret | STACKIT Secrets Manager | replaced | data location, key control, exitability |
module.retail_app_ecs.aws_secretsmanager_secret.mq | aws_secretsmanager_secret | STACKIT Secrets Manager | replaced | data location, exitability |
module.retail_app_ecs.aws_secretsmanager_secret.orders_db | aws_secretsmanager_secret | STACKIT Secrets Manager | replaced | data location, exitability |
module.retail_app_ecs.module.alb.aws_lb.this | aws_lb | STACKIT Application Load Balancer | replaced | data location, exitability |
module.retail_app_ecs.module.alb.aws_security_group.this | aws_security_group | STACKIT security group | replaced | data location, exitability |
module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | aws_security_group | STACKIT security group | replaced | data location, exitability |
module.retail_app_ecs.module.carts_service.aws_ecs_service.this | aws_ecs_service | STACKIT Kubernetes Engine (SKE) | replaced | data location, identity chain, exitability |
module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role | aws_iam_role | STACKIT service account for the workload | replaced | data location, exitability |
module.retail_app_ecs.module.carts_service.aws_iam_role.task_role | aws_iam_role | STACKIT service account for the workload | replaced | data location, exitability |
module.retail_app_ecs.module.carts_service.aws_security_group.this | aws_security_group | STACKIT security group | replaced | data location, exitability |
module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | aws_ecs_service | STACKIT Kubernetes Engine (SKE) | replaced | data location, identity chain, exitability |
module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role | aws_iam_role | STACKIT service account for the workload | replaced | data location, exitability |
module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role | aws_iam_role | STACKIT service account for the workload | replaced | data location, exitability |
module.retail_app_ecs.module.catalog_service.aws_security_group.this | aws_security_group | STACKIT security group | replaced | data location, exitability |
module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | aws_ecs_service | STACKIT Kubernetes Engine (SKE) | replaced | data location, identity chain, exitability |
module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role | aws_iam_role | STACKIT service account for the workload | replaced | data location, exitability |
module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role | aws_iam_role | STACKIT service account for the workload | replaced | data location, exitability |
module.retail_app_ecs.module.checkout_service.aws_security_group.this | aws_security_group | STACKIT security group | replaced | data location, exitability |
module.retail_app_ecs.module.orders_service.aws_ecs_service.this | aws_ecs_service | STACKIT Kubernetes Engine (SKE) | replaced | data location, identity chain, exitability |
module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role | aws_iam_role | STACKIT service account for the workload | replaced | data location, exitability |
module.retail_app_ecs.module.orders_service.aws_iam_role.task_role | aws_iam_role | STACKIT service account for the workload | replaced | data location, exitability |
module.retail_app_ecs.module.orders_service.aws_security_group.this | aws_security_group | STACKIT security group | replaced | data location, exitability |
module.retail_app_ecs.module.ui_service.aws_ecs_service.this | aws_ecs_service | STACKIT Kubernetes Engine (SKE) | replaced | data location, identity chain, exitability |
module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role | aws_iam_role | STACKIT service account for the workload | replaced | data location, exitability |
module.retail_app_ecs.module.ui_service.aws_iam_role.task_role | aws_iam_role | STACKIT service account for the workload | replaced | data location, exitability |
module.retail_app_ecs.module.ui_service.aws_security_group.this | aws_security_group | STACKIT security group | replaced | data location, exitability |
module.vpc.module.vpc.aws_vpc.this | aws_vpc | STACKIT project networking / Network Area (SNA) | replaced | data location, exitability |
- retained: The knowledge base holds no source schema of this provider and the draft names no STACKIT counterpart for it. What the provider processes is not established.
- replaced: The knowledge base maps this unit to the STACKIT service named; whether the draft writes it is stated in the plan of the unit.
Exitability
For each target dependency the model asks for the interface, the data format, the provider-specific code, the Terraform dependency, the replacement complexity, the data extraction path, the alternative implementation and the exit evidence. The only field this build states is the Terraform dependency: the draft is Terraform written for the STACKIT provider. No cost, duration or complexity is estimated.
| Dependency | Target service | State | Terraform dependency | Every other field of the model |
|---|---|---|---|---|
module.dependencies.aws_mq_broker.mq | STACKIT RabbitMQ | Provider specific | provider specific | not assessed |
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this | STACKIT OpenSearch | Provider specific | provider specific | not assessed |
module.dependencies.module.catalog_rds.aws_rds_cluster.this | STACKIT MariaDB | Provider specific | provider specific | not assessed |
module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default | STACKIT Key Value Store (Valkey) | Provider specific | provider specific | not assessed |
module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this | STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) | Provider specific | provider specific | not assessed |
module.dependencies.module.orders_rds.aws_rds_cluster.this | STACKIT PostgreSQL Flex | Provider specific | provider specific | not assessed |
module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks | STACKIT Logs | Provider specific | provider specific | not assessed |
module.retail_app_ecs.aws_ecs_cluster.cluster | STACKIT Kubernetes Engine (SKE) | Provider specific | provider specific | not assessed |
module.retail_app_ecs.aws_kms_key.cmk | STACKIT KMS | Provider specific | provider specific | not assessed |
module.retail_app_ecs.aws_secretsmanager_secret.catalog_db | STACKIT Secrets Manager | Provider specific | provider specific | not assessed |
module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch | STACKIT Secrets Manager | Provider specific | provider specific | not assessed |
module.retail_app_ecs.aws_secretsmanager_secret.mq | STACKIT Secrets Manager | Provider specific | provider specific | not assessed |
module.retail_app_ecs.aws_secretsmanager_secret.orders_db | STACKIT Secrets Manager | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.alb.aws_lb.this | STACKIT Application Load Balancer | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.alb.aws_security_group.this | STACKIT security group | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix | STACKIT security group | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.carts_service.aws_ecs_service.this | STACKIT Kubernetes Engine (SKE) | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role | STACKIT service account for the workload | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.carts_service.aws_iam_role.task_role | STACKIT service account for the workload | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.carts_service.aws_security_group.this | STACKIT security group | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | STACKIT Kubernetes Engine (SKE) | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role | STACKIT service account for the workload | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role | STACKIT service account for the workload | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.catalog_service.aws_security_group.this | STACKIT security group | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | STACKIT Kubernetes Engine (SKE) | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role | STACKIT service account for the workload | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role | STACKIT service account for the workload | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.checkout_service.aws_security_group.this | STACKIT security group | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.orders_service.aws_ecs_service.this | STACKIT Kubernetes Engine (SKE) | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role | STACKIT service account for the workload | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.orders_service.aws_iam_role.task_role | STACKIT service account for the workload | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.orders_service.aws_security_group.this | STACKIT security group | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.ui_service.aws_ecs_service.this | STACKIT Kubernetes Engine (SKE) | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role | STACKIT service account for the workload | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.ui_service.aws_iam_role.task_role | STACKIT service account for the workload | Provider specific | provider specific | not assessed |
module.retail_app_ecs.module.ui_service.aws_security_group.this | STACKIT security group | Provider specific | provider specific | not assessed |
module.vpc.module.vpc.aws_vpc.this | STACKIT project networking / Network Area (SNA) | Provider specific | provider specific | not assessed |
What this page does not say
- Legal conclusions remain external. The block provides technical evidence and gaps and does not certify legal compliance.
- Sovereignty is not residency: a region of a service is a fact about the service, never a statement about the sovereignty of a workload.
- There is no score, no percentage and no count in this block, and no dimension is compared with a requirement in this build.
- Jurisdiction, operator access, open interfaces, data portability and application coupling are not assessed, and every field of the exitability model but the Terraform coupling is not assessed.
- Dependencies are the units the knowledge base maps to a STACKIT service, the source providers the knowledge base holds no schema of and the source types it does not know. A dependency the draft introduces without a source unit is not listed, and a unit with no STACKIT resource is not listed as removed.
The same block, with the pointers of its evidence, is in assurance/sovereignty.json, and in words in assurance/sovereignty.md.