← AWS Retail Store Sample AppExamplesLegal NoticePrivacy

StackToIT Migration Intelligence Workspace

PROPOSAL — generated by StackToIT Assess. Architect review required before any decision.

Partially executable migration package · Proposal only · Not approved.

Technical details: run, versions, digest and evidence freshness

Assessment

Assessment
default (assessment format 0.24.0)
Assessment timestamp
Generated 2026-11-02 12:08 UTC by stacktoit 0.6.0-11562-g1966ddf116 (1966ddf116)
Run
f6267c3f-2848-4aa5-89df-5fee8b15b3b9 · source digest sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70
Source snapshot
partly decided only at plan time · aws not locked; random not locked
STACKIT target profile
Stable network model: the experimental STACKIT VPC resources are not used (STACKIT_STABLE)
STACKIT provider version
0.121.0
Knowledge base version
0.384.0
Evidence freshness
Not assessed — Evidence freshness as one measure is not assessed in this build. Dated evidence is shown where it is used: each STACKIT support option and each assurance row states when it was verified (verified_at, and recheck_after for support), in support_suitability and assurance. The date beside a readiness dimension is the assessment date, not a retrieval date.

Staleness: Not assessed — This build has no change detection, so there has been no re-check since the assessment was made (Generated 2026-11-02 12:08 UTC). The source may have changed since.

Source checks: Built-in source checks passed — OpenTofu validation of the source did not run (LOCK_FILE)

Run status: COMPLETE (report published). Source: partly decided only at plan time. Draft: GENERATED. The report was written whole; this is not a statement that the migration is ready.

Executive lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Architect lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Platform lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Security lens: the sections are in the order this reader usually wants, and Costs and Migration Plan are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Application owner lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Programme lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

FinOps lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Engineering lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Target Fit

How well each STACKIT target fits: service, interface, Terraform, region, maturity, quota, lifecycle, operability, support and security.

Support options with fresh evidence as of 2026-11-02: Essential Support, Advanced Support, Ultimate Support.

How this matrix works

Every STACKIT capability is shown along independent dimensions. There is no overall verdict, no score and no yes or no: a dimension is assessed only where the capability catalogue carries a value for it with evidence, and "not assessed" means the catalogue states nothing, which is not the same as not available. A list of evidenced facts (quota limits, known issues) is counted beside its dimension and does not complete it.

The catalogue holds 321 capabilities; the Terraform facts are derived from the stackit provider schema 0.121.0. Evidence is judged as of 2026-11-02, the date of the assessment; stale evidence is no longer vouched for, which is not the same as false.

The 83 units that state a STACKIT target are joined to the catalogue by the resource types of their target: 67 have every type listed by a capability, 0 some, 2 none although the STACKIT provider 0.121.0 has every one of their resource types (the capability metadata for them is incomplete: the resource exists, its fit is not assessed), 0 none with a type the provider schema does not have (the matrix says nothing about these units, which is not the same as unsupported), and 14 need no STACKIT resource. 10 units state no target.

Catalogue standing of the units, counted apart for the units that exist, those whose existence the plan decides and those switched off
UnitsState a targetEvery type listedSome listedProvider has the resource, metadata incompleteType not in the provider schemaNeed no STACKIT resourceState no target
Exists443700070
Decided at plan time8400040
Switched off3126020310
Capabilities that units of this estate reach (18 of 321), by dimension
CapabilityUnitsFunctional parityServiceAPITerraformRegionMaturityQuotaLifecycleOperabilitySecuritySupportEvidence and probes
compute.managed-kubernetes 6 Not assessed Not assessed Not assessed Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE Not assessed Not assessed Not assessed Not assessed Assessed ESTABLISHED REPORTED 3 PROVEN PLATFORM BUG 0 RESOLVED 0 BLOCKING EFFECT 0 Not assessed Not assessed Not assessed
data.opensearch-instance 1 Not assessed Not assessed Assessed AVAILABLE Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed
data.valkey-instance 1 Not assessed Not assessed Assessed AVAILABLE Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed
database.mariadb 1 Not assessed Not assessed Assessed AVAILABLE Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed
database.mongodb-flex 3 Not assessed Not assessed Assessed AVAILABLE Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed
database.postgresql-flex 1 Not assessed Assessed AVAILABLE Assessed AVAILABLE Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE Not assessed Not assessed Not assessed Not assessed Assessed ESTABLISHED REPORTED 1 PROVEN PLATFORM BUG 0 RESOLVED 0 BLOCKING EFFECT 0 Not assessed Not assessed Not assessed
identity.role-assignment 10 Not assessed Assessed AVAILABLE Assessed AVAILABLE Assessed RESOURCE_AVAILABLE,EXPERIMENTAL Not assessed Assessed EXPERIMENTAL Not assessed LIMIT 1 Not assessed Assessed ESTABLISHED REPORTED 1 PROVEN PLATFORM BUG 0 RESOLVED 0 BLOCKING EFFECT 0 Not assessed Not assessed Not assessed
identity.server-service-account 10 Not assessed Assessed AVAILABLE Assessed WRITE_SUPPORTED Assessed RESOURCE_AVAILABLE Not assessed Not assessed Not assessed LIMIT 1 Not assessed Not assessed Not assessed Not assessed Assessed RECORDED PROBES 9 EVIDENCE ITEMS 0
identity.service-account-key 10 Not assessed Assessed AVAILABLE Assessed AVAILABLE Assessed RESOURCE_AVAILABLE Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed
messaging.mqtt-broker 1 Not assessed Not assessed Not assessed Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed
messaging.rabbitmq-credential 1 Not assessed Not assessed Assessed AVAILABLE Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed
network.application-load-balancer 1 Not assessed Assessed AVAILABLE Assessed AVAILABLE Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE Not assessed Not assessed Not assessed Not assessed Assessed ESTABLISHED REPORTED 2 PROVEN PLATFORM BUG 0 RESOLVED 0 BLOCKING EFFECT 0 Not assessed Not assessed Not assessed
network.network 10 Not assessed Assessed AVAILABLE Assessed WRITE_SUPPORTED Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE Not assessed Not assessed Not assessed LIMIT 4 Not assessed Assessed ESTABLISHED REPORTED 2 PROVEN PLATFORM BUG 0 RESOLVED 0 BLOCKING EFFECT 0 Not assessed Not assessed Assessed RECORDED PROBES 4 EVIDENCE ITEMS 0
network.security-group
sources disagree		 17 Not assessed Assessed AVAILABLE Assessed WRITE_SUPPORTED Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE Not assessed Not assessed Not assessed LIMIT 9 Not assessed Assessed ESTABLISHED REPORTED 2 PROVEN PLATFORM BUG 0 RESOLVED 0 BLOCKING EFFECT 0 Not assessed Not assessed Assessed RECORDED PROBES 8 EVIDENCE ITEMS 0
observability.logs 8 Not assessed Assessed AVAILABLE Assessed WRITE_SUPPORTED Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE Not assessed Assessed GA Not assessed LIMIT 3 Not assessed Not assessed Not assessed Not assessed Not assessed
observability.metrics-and-alerting 2 Not assessed Not assessed Assessed AVAILABLE Assessed RESOURCE_AVAILABLE Not assessed Not assessed Not assessed Not assessed Assessed ESTABLISHED REPORTED 1 PROVEN PLATFORM BUG 0 RESOLVED 0 BLOCKING EFFECT 0 Not assessed Not assessed Not assessed
security.kms 1 Not assessed Not assessed Assessed AVAILABLE Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE Not assessed Not assessed Not assessed Not assessed Assessed ESTABLISHED REPORTED 2 PROVEN PLATFORM BUG 0 RESOLVED 0 BLOCKING EFFECT 0 Not assessed Not assessed Not assessed
security.secrets-manager 4 Not assessed Not assessed Assessed AVAILABLE Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed Not assessed

Why each capability cell has its state

compute.managed-kubernetes
  • functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
  • service — Not assessed. The registry states no service availability for this capability.
  • api — Not assessed. The registry states no API capability for this capability.
  • terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_ske_cluster: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_ske_cluster; unknown]
  • region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
  • maturity — Not assessed. The registry states no maturity for this capability.
  • quota — Not assessed. The registry has no complete statement of the quotas of this capability.
  • lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
  • operability — Assessed ESTABLISHED. Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug. [TARGET OFFICIAL DOC: https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/; fresh] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0: resource_schemas.stackit_ske_cluster extensions.argus; fresh] [PUBLIC ISSUE: https://github.com/stackitcloud/terraform-provider-stackit/issues/1713; fresh]
  • security — Not assessed. The registry states no security features or defaults for this capability.
  • support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
  • evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.
data.opensearch-instance
  • functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
  • service — Not assessed. The registry states no service availability for this capability.
  • api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/opensearch/v2/opensearch.json:837; stackitcloud/stackit-api-specifications, services/opensearch/v2/opensearch.json:1337 (knowledge-base evidence, not in this folder); unknown]
  • terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_opensearch_credential: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_opensearch_instance: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_opensearch_credential; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_opensearch_instance; unknown]
  • region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
  • maturity — Not assessed. The registry states no maturity for this capability.
  • quota — Not assessed. The registry has no complete statement of the quotas of this capability.
  • lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
  • operability — Not assessed. No provider or backend behaviour is recorded for this capability. That is not the same as having none.
  • security — Not assessed. The registry states no security features or defaults for this capability.
  • support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
  • evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.
data.valkey-instance
  • functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
  • service — Not assessed. The registry states no service availability for this capability.
  • api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/valkey/v2/valkey.json:864; stackitcloud/stackit-api-specifications, services/valkey/v2/valkey.json:1364 (knowledge-base evidence, not in this folder); unknown]
  • terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_valkey_credential: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_valkey_instance: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_valkey_credential; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_valkey_instance; unknown]
  • region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
  • maturity — Not assessed. The registry states no maturity for this capability.
  • quota — Not assessed. The registry has no complete statement of the quotas of this capability.
  • lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
  • operability — Not assessed. No provider or backend behaviour is recorded for this capability. That is not the same as having none.
  • security — Not assessed. The registry states no security features or defaults for this capability.
  • support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
  • evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.
database.mariadb
  • functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
  • service — Not assessed. The registry states no service availability for this capability.
  • api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/mariadb/v2/mariadb.json:778; stackitcloud/stackit-api-specifications, services/mariadb/v2/mariadb.json:1278 (knowledge-base evidence, not in this folder); unknown]
  • terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_mariadb_credential: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_mariadb_instance: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_mariadb_credential; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_mariadb_instance; unknown]
  • region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
  • maturity — Not assessed. The registry states no maturity for this capability.
  • quota — Not assessed. The registry has no complete statement of the quotas of this capability.
  • lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
  • operability — Not assessed. No provider or backend behaviour is recorded for this capability. That is not the same as having none.
  • security — Not assessed. The registry states no security features or defaults for this capability.
  • support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
  • evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.
database.mongodb-flex
  • functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
  • service — Not assessed. The registry states no service availability for this capability.
  • api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/mongodb-flex/v2/mongodb-flex.json:1185; stackitcloud/stackit-api-specifications, services/mongodb-flex/v2/mongodb-flex.json:2924 (knowledge-base evidence, not in this folder); unknown]
  • terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_mongodbflex_instance: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_mongodbflex_user: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_mongodbflex_instance; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_mongodbflex_user; unknown]
  • region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
  • maturity — Not assessed. The registry states no maturity for this capability.
  • quota — Not assessed. The registry has no complete statement of the quotas of this capability.
  • lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
  • operability — Not assessed. No provider or backend behaviour is recorded for this capability. That is not the same as having none.
  • security — Not assessed. The registry states no security features or defaults for this capability.
  • support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
  • evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.
database.postgresql-flex
  • functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
  • service — Assessed AVAILABLE. Service availability of the capability, as the registry states it with evidence. [TARGET OFFICIAL DOC: https://docs.stackit.cloud/products/databases/postgresql-flex/basics/architecture-of-postgresql-flex/; stackitcloud/docs.stackit.cloud, products/databases/postgresql-flex/basics/architecture-of-postgresql-flex.txt; unknown]
  • api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/postgres-flex/v3/postgres-flex.json:2050-2332; stackitcloud/stackit-api-specifications, services/postgres-flex/v3/postgres-flex.json:3554; stackitcloud/stackit-api-specifications, services/postgres-flex/v3/postgres-flex.json:4744 (knowledge-base evidence, not in this folder); unknown]
  • terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_postgresflex_database: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_postgresflex_instance: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_postgresflex_user: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_postgresflex_database; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_postgresflex_instance; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_postgresflex_user; unknown]
  • region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
  • maturity — Not assessed. The registry states no maturity for this capability.
  • quota — Not assessed. The registry has no complete statement of the quotas of this capability.
  • lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
  • operability — Assessed ESTABLISHED. Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug. [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0: resource_schemas.stackit_postgresflex_instance (acl, flavor, replicas deprecated: true); fresh]
  • security — Not assessed. The registry states no security features or defaults for this capability.
  • support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
  • evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.
identity.role-assignment
  • functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
  • service — Assessed AVAILABLE. Service availability of the capability, as the registry states it with evidence. [TARGET OFFICIAL DOC: https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/roles-permissions/; unknown]
  • api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/authorization/v2/authorization.json:807-840 (knowledge-base evidence, not in this folder); unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown]
  • terraform — Assessed RESOURCE_AVAILABLE,EXPERIMENTAL. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_authorization_folder_role_assignment: RESOURCE_AVAILABLE, EXPERIMENTAL (experiment iam); stackit_authorization_organization_role_assignment: RESOURCE_AVAILABLE, EXPERIMENTAL (experiment iam); stackit_authorization_project_custom_role: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_authorization_project_role_assignment: RESOURCE_AVAILABLE, EXPERIMENTAL (experiment iam); stackit_authorization_service_account_role_assignment: RESOURCE_AVAILABLE, EXPERIMENTAL (experiment iam); [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_folder_role_assignment; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_organization_role_assignment; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_project_custom_role; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_project_role_assignment; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_service_account_role_assignment; unknown]
  • region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
  • maturity — Assessed EXPERIMENTAL. Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source. [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 (resource_schemas.stackit_authorization_project_role_assignment.block.description, ..._folder_..., ..._organization_..., ..._service_account_role_assignment.block.description); unknown]
  • quota — Not assessed. The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.
  • lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
  • operability — Assessed ESTABLISHED. Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug. [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0: provider.attributes.experiments; fresh]
  • security — Not assessed. The registry states no security features or defaults for this capability.
  • support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
  • evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.
identity.server-service-account
  • functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
  • service — Assessed AVAILABLE. Service availability of the capability, as the registry states it with evidence. [TARGET OFFICIAL DOC: https://docs.stackit.cloud/products/compute-engine/server/how-tos/attaching-service-account-to-servers/; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown]
  • api — Assessed WRITE_SUPPORTED. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: STACKIT IaaS API v2 specification (path /v2/projects/{projectId}/regions/{region}/servers/{serverId}/service-accounts/{serviceAccountMail}); unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-09; unknown]
  • terraform — Assessed RESOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_server_service_account_attach: RESOURCE_AVAILABLE; stackit_service_account: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_server_service_account_attach; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_service_account; unknown]
  • region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
  • maturity — Not assessed. The registry states no maturity for this capability.
  • quota — Not assessed. The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.
  • lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
  • operability — Not assessed. No provider or backend behaviour is recorded for this capability. That is not the same as having none.
  • security — Not assessed. The registry states no security features or defaults for this capability.
  • support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
  • evidence — Assessed RECORDED. Probes of the live target and evidence of the capability as a whole. A probe is an observation of one exact variant, not of the capability. A disagreement between sources is listed as a conflict of the row. [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-09; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-09; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-09; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-09; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-10; unknown]
identity.service-account-key
  • functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
  • service — Assessed AVAILABLE. Service availability of the capability, as the registry states it with evidence. [TARGET OFFICIAL DOC: https://docs.stackit.cloud/platform/access-and-identity/service-accounts/; unknown]
  • api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/service-account/v2/service-account.json:1680-1740 (knowledge-base evidence, not in this folder); unknown]
  • terraform — Assessed RESOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_service_account_key: RESOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_service_account_key; unknown]
  • region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
  • maturity — Not assessed. The registry states no maturity for this capability.
  • quota — Not assessed. The registry has no complete statement of the quotas of this capability.
  • lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
  • operability — Not assessed. No provider or backend behaviour is recorded for this capability. That is not the same as having none.
  • security — Not assessed. The registry states no security features or defaults for this capability.
  • support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
  • evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.
messaging.mqtt-broker
  • functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
  • service — Not assessed. The registry states no service availability for this capability.
  • api — Not assessed. The registry states no API capability for this capability.
  • terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_rabbitmq_instance: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_rabbitmq_instance; unknown]
  • region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
  • maturity — Not assessed. The registry states no maturity for this capability.
  • quota — Not assessed. The registry has no complete statement of the quotas of this capability.
  • lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
  • operability — Not assessed. No provider or backend behaviour is recorded for this capability. That is not the same as having none.
  • security — Not assessed. The registry states no security features or defaults for this capability.
  • support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
  • evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.
messaging.rabbitmq-credential
  • functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
  • service — Not assessed. The registry states no service availability for this capability.
  • api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/rabbitmq/v2/rabbitmq.json:1379 (knowledge-base evidence, not in this folder); unknown]
  • terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_rabbitmq_credential: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_rabbitmq_credential; unknown]
  • region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
  • maturity — Not assessed. The registry states no maturity for this capability.
  • quota — Not assessed. The registry has no complete statement of the quotas of this capability.
  • lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
  • operability — Not assessed. No provider or backend behaviour is recorded for this capability. That is not the same as having none.
  • security — Not assessed. The registry states no security features or defaults for this capability.
  • support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
  • evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.
network.application-load-balancer
  • functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
  • service — Assessed AVAILABLE. Service availability of the capability, as the registry states it with evidence. [TARGET OFFICIAL DOC: https://docs.stackit.cloud/products/network/load-balancing-and-content-delivery/application-load-balancer/basics/basic-concepts-alb/; stackitcloud/docs.stackit.cloud, products/network/load-balancing-and-content-delivery/application-load-balancer/basics/basic-concepts-alb.txt; unknown]
  • api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/alb/v2/alb.json:1587-1783; stackitcloud/stackit-api-specifications, services/certificates/v2/certificates.json:343 (knowledge-base evidence, not in this folder); unknown]
  • terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_alb_certificate: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_application_load_balancer: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_alb_certificate; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_application_load_balancer; unknown]
  • region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
  • maturity — Not assessed. The registry states no maturity for this capability.
  • quota — Not assessed. The registry has no complete statement of the quotas of this capability.
  • lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
  • operability — Assessed ESTABLISHED. Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug. [LIVE TARGET PROBE: tested on a STACKIT project on 2026-09-30 (Findings Q2, Q2b, Q3); fresh] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-09-30 (Findings Q1, Q1b); fresh]
  • security — Not assessed. The registry states no security features or defaults for this capability.
  • support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
  • evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.
network.network
  • functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
  • service — Assessed AVAILABLE. Service availability of the capability, as the registry states it with evidence. [TARGET OFFICIAL DOC: https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-07; unknown]
  • api — Assessed WRITE_SUPPORTED. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: STACKIT IaaS API v2 specification (paths /v2/projects/{projectId}/regions/{region}/networks and .../networks/{networkId}, /v2/organizations/{organizationId}/network-areas and .../regions/{region} (+ network-ranges)); unknown]
  • terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_network: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_network_area: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_network_area_region: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_network; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_network_area; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_network_area_region; unknown]
  • region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
  • maturity — Not assessed. The registry states no maturity for this capability.
  • quota — Not assessed. The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.
  • lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
  • operability — Assessed ESTABLISHED. Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug. [LIVE TARGET PROBE: tested on a STACKIT project on 2026-09-24; fresh] [PUBLIC ISSUE: https://github.com/stackitcloud/terraform-provider-stackit/issues/1751; fresh]
  • security — Not assessed. The registry states no security features or defaults for this capability.
  • support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
  • evidence — Assessed RECORDED. Probes of the live target and evidence of the capability as a whole. A probe is an observation of one exact variant, not of the capability. A disagreement between sources is listed as a conflict of the row. [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-07; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-09-24; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown]
network.security-group
  • functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
  • service — Assessed AVAILABLE. Service availability of the capability, as the registry states it with evidence. [TARGET OFFICIAL DOC: https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-07; unknown]
  • api — Assessed WRITE_SUPPORTED. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: STACKIT IaaS API v2 specification (paths /v2/projects/{projectId}/regions/{region}/security-groups, .../security-groups/{securityGroupId}, .../rules); unknown]
  • terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_security_group: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_security_group_rule: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_security_group; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_security_group_rule; unknown]
  • region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
  • maturity — Not assessed. The registry states no maturity for this capability.
  • quota — Not assessed. The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.
  • lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
  • operability — Assessed ESTABLISHED. Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug. [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-07; fresh] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-07; fresh]
  • security — Not assessed. The registry states no security features or defaults for this capability.
  • support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
  • evidence — Assessed RECORDED. Probes of the live target and evidence of the capability as a whole. A probe is an observation of one exact variant, not of the capability. A disagreement between sources is listed as a conflict of the row. [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-07; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-07; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-09; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-09; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-10; unknown]
  • Sources disagree (CONSTRAINT FACT): The STACKIT documentation and the live platform disagree on whether traffic inside one security group is allowed by default; the draft follows the observed platform behaviour (an explicit rule is needed).
observability.logs
  • functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
  • service — Assessed AVAILABLE. Service availability of the capability, as the registry states it with evidence. [TARGET OFFICIAL DOC: https://docs.stackit.cloud/products/logging-and-monitoring/logs/; unknown] [TARGET RELEASE NOTE: https://docs.stackit.cloud/products/logging-and-monitoring/logs/release-notes/; unknown]
  • api — Assessed WRITE_SUPPORTED. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/logs/v1/logs.json:463-557 (knowledge-base evidence, not in this folder); unknown]
  • terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_logs_access_token: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_logs_instance: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_logs_access_token; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_logs_instance; unknown]
  • region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
  • maturity — Assessed GA. Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source. [TARGET RELEASE NOTE: https://docs.stackit.cloud/products/logging-and-monitoring/logs/release-notes/; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 (resource_schemas.stackit_logs_instance.block.description and resource_schemas.stackit_logs_access_token.block.description); unknown]
  • quota — Not assessed. The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.
  • lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
  • operability — Not assessed. No provider or backend behaviour is recorded for this capability. That is not the same as having none.
  • security — Not assessed. The registry states no security features or defaults for this capability.
  • support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
  • evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.
observability.metrics-and-alerting
  • functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
  • service — Not assessed. The registry states no service availability for this capability.
  • api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/observability/v1/observability.json:5296; stackitcloud/stackit-api-specifications, services/observability/v1/observability.json:7245; stackitcloud/stackit-api-specifications, services/observability/v1/observability.json:10619; stackitcloud/stackit-api-specifications, services/observability/v1/observability.json:11983; stackitcloud/stackit-api-specifications, services/observability/v1/observability.json:14826 (knowledge-base evidence, not in this folder); unknown]
  • terraform — Assessed RESOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_observability_alertgroup: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_observability_credential: RESOURCE_AVAILABLE; stackit_observability_instance: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_observability_logalertgroup: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_observability_scrapeconfig: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_observability_alertgroup; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_observability_credential; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_observability_instance; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_observability_logalertgroup; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_observability_scrapeconfig; unknown]
  • region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
  • maturity — Not assessed. The registry states no maturity for this capability.
  • quota — Not assessed. The registry has no complete statement of the quotas of this capability.
  • lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
  • operability — Assessed ESTABLISHED. Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug. [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0: resource_schemas.stackit_ske_cluster extensions.argus; fresh]
  • security — Not assessed. The registry states no security features or defaults for this capability.
  • support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
  • evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.
security.kms
  • functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
  • service — Not assessed. The registry states no service availability for this capability.
  • api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/kms/v1/kms.json:730; stackitcloud/stackit-api-specifications, services/kms/v1/kms.json:901; stackitcloud/stackit-api-specifications, services/kms/v1/kms.json:1863 (knowledge-base evidence, not in this folder); unknown]
  • terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_kms_key: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_kms_keyring: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_kms_wrapping_key: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_kms_key; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_kms_keyring; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_kms_wrapping_key; unknown]
  • region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
  • maturity — Not assessed. The registry states no maturity for this capability.
  • quota — Not assessed. The registry has no complete statement of the quotas of this capability.
  • lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
  • operability — Assessed ESTABLISHED. Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug. [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0: resource_schemas.stackit_kms_key block description; fresh] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0: resource_schemas.stackit_kms_keyring block description; fresh]
  • security — Not assessed. The registry states no security features or defaults for this capability.
  • support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
  • evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.
security.secrets-manager
  • functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
  • service — Not assessed. The registry states no service availability for this capability.
  • api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/secrets-manager/v1/secrets-manager.json:481; stackitcloud/stackit-api-specifications, services/secrets-manager/v1/secrets-manager.json:1922 (knowledge-base evidence, not in this folder); unknown]
  • terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_secretsmanager_instance: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_secretsmanager_user: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_secretsmanager_instance; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_secretsmanager_user; unknown]
  • region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
  • maturity — Not assessed. The registry states no maturity for this capability.
  • quota — Not assessed. The registry has no complete statement of the quotas of this capability.
  • lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
  • operability — Not assessed. No provider or backend behaviour is recorded for this capability. That is not the same as having none.
  • security — Not assessed. The registry states no security features or defaults for this capability.
  • support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
  • evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.
STACKIT resource types of the targets that no capability lists (3)
  • stackit_dns_record_set: 1 units — RESOURCE EXISTS BUT CAPABILITY UNLINKED. The pinned STACKIT provider has this resource; StackToIT's capability metadata for it is incomplete. Terraform: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE. Functional parity: Not assessed.
  • stackit_vpn_connection: 1 units — RESOURCE EXISTS BUT CAPABILITY UNLINKED. The pinned STACKIT provider has this resource; StackToIT's capability metadata for it is incomplete. Terraform: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE. Functional parity: Not assessed.
  • stackit_vpn_gateway: 1 units — RESOURCE EXISTS BUT CAPABILITY UNLINKED. The pinned STACKIT provider has this resource; StackToIT's capability metadata for it is incomplete. Terraform: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE. Functional parity: Not assessed.

Requirements only a STACKIT API carries

Where no resource of the STACKIT provider carries a requirement, the tool can write a STACKIT API step, only when the call is evidenced and a converter of the tool writes it. The tool can do this for 16 requirements; 3 more are catalogued only (the call is known, no converter writes it) and are not counted as something the tool carries. Two things are kept apart below: what this build can do (the first table) and what arose on this estate (the second table, counted from the execution plan of this run). In this run 1 of 16 requirements have a step in the plan (4 STACKIT API steps in all), 0 are named by a unit of this estate and have none, and 15 are not used by any unit of this estate. An execution plan without API steps is then not a gap of the tool unless a requirement is named by a unit and has no step.

What this build can do

API-only requirements a converter of this build can write as a STACKIT API step, in general. A step is not a verified one: each row says how far its step has come.
RequirementSource typesModeOperationMaturity of the step
compute.image-shareaws_ami_launch_permissionSTACKIT_APIiaas_v2 SetImageSharea converter writes the step; tested offline, not verified live
database.postgresql.deletion-protectionaws_db_instance, aws_rds_cluster, awscc_rds_db_instance, awscc_rds_db_clusterSTACKIT_APIpostgres-flex_v3 UpdateInstanceProtectiona converter writes the step; tested offline, not verified live
database.sqlserver.deletion-protectionaws_db_instance, awscc_rds_db_instanceSTACKIT_APIsqlserverflex_v3 UpdateInstanceProtectiona converter writes the step; tested offline, not verified live
function.httpaws_lambda_function, aws_lambda_function_url, aws_lambda_alias, aws_lambda_layer_version, aws_lambda_permissionSTACKIT_APIfunctions_v1alpha CreateFunctiona converter writes the step; tested offline, not verified live
identity.secretaws_secretsmanager_secret, aws_ssm_parameter, awscc_secretsmanager_secretSTACKIT_APIsecretsmanager-vault WriteSecreta converter writes the step; tested offline, not verified live
network.lb-block-listaws_wafv2_ip_set, awscc_wafv2_ip_setSTACKIT_APIlb-ip-lists_v1alpha UploadIPLista converter writes the step; tested offline, not verified live
network.security-group.default-egress-rulesaws_subnetSTACKIT_APIiaas_v2 DeleteSecurityGroupRulea converter writes the step; tested offline, not verified live
objectstorage.bucket.corsaws_s3_bucket_cors_configurationSTACKIT_APIs3 PutBucketCorsa converter writes the step; tested offline, not verified live
objectstorage.bucket.lifecycleaws_s3_bucket_lifecycle_configurationSTACKIT_APIs3 PutBucketLifecycleConfigurationa converter writes the step; tested offline, not verified live
objectstorage.bucket.taggingaws_s3_bucketSTACKIT_APIs3 PutBucketTagginga converter writes the step; tested offline, not verified live
objectstorage.bucket.versioningaws_s3_bucket_versioningSTACKIT_APIs3 PutBucketVersioninga converter writes the step; tested offline, not verified live
pubsub.queueaws_sqs_queueSTACKIT_APIpubsub_v1beta create-topica converter writes the step; tested offline, not verified live
pubsub.subscriptionaws_sns_topic_subscriptionSTACKIT_APIpubsub_v1beta create-subscriptiona converter writes the step; tested offline, not verified live
pubsub.topicaws_sns_topicSTACKIT_APIpubsub_v1beta create-topica converter writes the step; tested offline, not verified live
registry.repositoryaws_ecr_repository, awscc_ecr_repository, aws_ecr_pull_through_cache_ruleSTACKIT_APIregistry_v1 CreateArtifactorya converter writes the step; tested offline, not verified live
workflows.airflowaws_mwaa_environmentSTACKIT_APIworkflows_v1alpha CreateInstancea converter writes the step; tested offline, not verified live

What arises on this estate

For each requirement above: the units of this estate whose source type it names, and the steps of the execution plan of this run that carry it. Whether a unit gets the step depends on what its source sets.
RequirementUnits that existConditionalSwitched offOpenTofu blocksSTACKIT API stepsManual stepsOn this estate
compute.image-share000000Not used by any unit of this estate: no unit has the source type aws_ami_launch_permission.
database.postgresql.deletion-protection200000Not used by any unit of this estate: the 1 unit of its source types that exist (module.dependencies.module.orders_rds.aws_rds_cluster.this) asks for no deletion protection (deletion_protection is not set to true), so no step is needed.
database.sqlserver.deletion-protection000000Not used by any unit of this estate: no unit has one of the source types aws_db_instance, awscc_rds_db_instance.
function.http001000Not used by any unit of this estate that exists: the 1 unit of its source types (aws_lambda_function, aws_lambda_function_url, aws_lambda_alias, aws_lambda_layer_version, aws_lambda_permission) is switched off in this configuration.
identity.secret4000404 STACKIT API steps, generated in this run's execution plan.
network.lb-block-list000000Not used by any unit of this estate: no unit has one of the source types aws_wafv2_ip_set, awscc_wafv2_ip_set.
network.security-group.default-egress-rules025000Not used by any unit of this estate: no subnet has widened outbound access, so target.network.egress is not asked and no step deletes the default egress rules of a group.
objectstorage.bucket.cors000000Not used by any unit of this estate: no unit has the source type aws_s3_bucket_cors_configuration.
objectstorage.bucket.lifecycle000000Not used by any unit of this estate: no unit has the source type aws_s3_bucket_lifecycle_configuration.
objectstorage.bucket.tagging000000Not used by any unit of this estate: no unit has the source type aws_s3_bucket.
objectstorage.bucket.versioning000000Not used by any unit of this estate: no unit has the source type aws_s3_bucket_versioning.
pubsub.queue000000Not used by any unit of this estate: no unit has the source type aws_sqs_queue.
pubsub.subscription000000Not used by any unit of this estate: no unit has the source type aws_sns_topic_subscription.
pubsub.topic000000Not used by any unit of this estate: no unit has the source type aws_sns_topic.
registry.repository000000Not used by any unit of this estate: no unit has one of the source types aws_ecr_repository, awscc_ecr_repository, aws_ecr_pull_through_cache_rule.
workflows.airflow000000Not used by any unit of this estate: no unit has the source type aws_mwaa_environment.
Support suitability, judged against the STACKIT support options evidenced as of 2026-11-02 (a business-critical application gets a review, never a plan; stated times are not a contractual SLA)
ApplicationVerdictRequired support classOptions with fresh evidenceOptions offering the stated hoursWhy
estate NOT_ASSESSED – Essential Support, Advanced Support, Ultimate Support – No criticality stated; pass --applications to state criticality and explicit support requirements

Source and target side by side

Each source unit beside what the draft makes of it, with its settings counted in the rows of the equivalence ledger: kept as they are, changed into another form, accepted by a person on the record, and to do, which is everything else, including anything not known. Over all 93 units: 23 kept, 10 changed, 0 accepted, 947 to do. The units with the most to do come first; migration/source-target.csv lists every unit.

The 15 of 93 units with the most to do; a dash means no setting of the unit was counted
Source unitSTACKIT targetKeptChangedAcceptedTo do
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.thisSTACKIT OpenSearch00057
module.dependencies.module.catalog_rds.aws_rds_cluster.thisSTACKIT MariaDB10055
module.retail_app_ecs.module.ui_service.aws_ecs_service.thisSTACKIT Kubernetes Engine (SKE)00049
module.retail_app_ecs.module.carts_service.aws_ecs_service.thisSTACKIT Kubernetes Engine (SKE)00046
module.retail_app_ecs.module.catalog_service.aws_ecs_service.thisSTACKIT Kubernetes Engine (SKE)00046
module.retail_app_ecs.module.orders_service.aws_ecs_service.thisSTACKIT Kubernetes Engine (SKE)00046
module.retail_app_ecs.module.checkout_service.aws_ecs_service.thisSTACKIT Kubernetes Engine (SKE)00045
module.dependencies.module.orders_rds.aws_rds_cluster.thisSTACKIT PostgreSQL Flex41043
module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefixSTACKIT security group00040
module.vpc.module.vpc.aws_vpc.thisSTACKIT project networking / Network Area (SNA)11037
module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.defaultSTACKIT Key Value Store (Valkey)01032
module.retail_app_ecs.module.alb.aws_lb.thisSTACKIT Application Load Balancer43029
module.dependencies.aws_mq_broker.mqSTACKIT RabbitMQ11024
module.dependencies.module.dynamodb_carts.aws_dynamodb_table.thisSTACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)00021
module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbdThis draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only.00019

and 78 more in the sheet.

STACKIT target of each unit (83 listed; 10 without a target)
UnitTarget serviceTarget resourcesMaturityLifecycleRegionCatalogue capabilitiesEvidence references
module.dependencies.aws_mq_broker.mq STACKIT RabbitMQ stackit_rabbitmq_instance GA, stackit_rabbitmq_credential GA ga active eu01, eu02 MATCHED: messaging.mqtt-broker, messaging.rabbitmq-credential 7
module.dependencies.aws_security_group.catalog_opensearch_sg not written by this draft (stackit_security_group, stackit_security_group_rule) none needed – – not established by a catalogue snapshot NOT APPLICABLE 3
module.dependencies.aws_security_group.mq not written by this draft (stackit_security_group, stackit_security_group_rule) none needed – – not established by a catalogue snapshot NOT APPLICABLE 3
module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_group.this switched off (for_each = 0) — would map to STACKIT Logs if switched on stackit_logs_instance GA, stackit_logs_access_token GA ga active not established by a catalogue snapshot MATCHED: observability.logs 6
module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_resource_policy.this switched off (count = 0) — would map to STACKIT Logs access tokens if switched on stackit_logs_access_token GA ga active not established by a catalogue snapshot MATCHED: observability.logs 2
module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this STACKIT OpenSearch stackit_opensearch_instance GA, stackit_opensearch_credential GA ga active eu01, eu02 MATCHED: data.opensearch-instance 2
module.dependencies.module.catalog_opensearch.aws_security_group.this switched off (count = 0) — would map to STACKIT security group if switched on stackit_security_group GA, stackit_security_group_rule GA ga active not established by a catalogue snapshot MATCHED: network.security-group 3
module.dependencies.module.catalog_rds.aws_cloudwatch_log_group.this switched off (for_each = 0) — would map to STACKIT Logs if switched on stackit_logs_instance GA, stackit_logs_access_token GA ga active not established by a catalogue snapshot MATCHED: observability.logs 6
module.dependencies.module.catalog_rds.aws_rds_cluster.this STACKIT MariaDB stackit_mariadb_instance GA ga active eu01, eu02 MATCHED: database.mariadb 2
module.dependencies.module.catalog_rds.aws_security_group.this not written by this draft (stackit_security_group, stackit_security_group_rule) none needed – – not established by a catalogue snapshot NOT APPLICABLE 3
module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu switched off (count = 0) — would map to STACKIT Observability alert rules if switched on stackit_observability_instance GA, stackit_observability_alertgroup GA ga active eu01 MATCHED: observability.metrics-and-alerting 1
module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory switched off (count = 0) — would map to STACKIT Observability alert rules if switched on stackit_observability_instance GA, stackit_observability_alertgroup GA ga active eu01 MATCHED: observability.metrics-and-alerting 1
module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default STACKIT Key Value Store (Valkey) stackit_valkey_instance GA, stackit_valkey_credential GA ga active eu01, eu02 MATCHED: data.valkey-instance 3
module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd not written by this draft (stackit_security_group, stackit_security_group_rule) none needed – – not established by a catalogue snapshot NOT APPLICABLE 3
module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default switched off (count = 0) — would map to STACKIT security group if switched on stackit_security_group GA, stackit_security_group_rule GA ga active not established by a catalogue snapshot MATCHED: network.security-group 3
module.dependencies.module.checkout_elasticache_redis.module.dns.aws_route53_record.default switched off (count = 0) — would map to STACKIT DNS record set if switched on stackit_dns_record_set GA ga active not established by a catalogue snapshot RESOURCE EXISTS BUT CAPABILITY UNLINKED (not listed by any capability: stackit_dns_record_set; the STACKIT provider has stackit_dns_record_set as resources, StackToIT's capability metadata for them is incomplete) 3
module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled switched off (count = 0) — would map to STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) if switched on stackit_mongodbflex_instance GA ga active eu01, eu02 MATCHED: database.mongodb-flex 2
module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore switched off (count = 0) — would map to STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) if switched on stackit_mongodbflex_instance GA ga active eu01, eu02 MATCHED: database.mongodb-flex 2
module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) stackit_mongodbflex_instance GA ga active eu01, eu02 MATCHED: database.mongodb-flex 2
module.dependencies.module.orders_rds.aws_cloudwatch_log_group.this switched off (for_each = 0) — would map to STACKIT Logs if switched on stackit_logs_instance GA, stackit_logs_access_token GA ga active not established by a catalogue snapshot MATCHED: observability.logs 6
module.dependencies.module.orders_rds.aws_rds_cluster.this STACKIT PostgreSQL Flex stackit_postgresflex_instance GA ga active eu01, eu02 MATCHED: database.postgresql-flex 2
module.dependencies.module.orders_rds.aws_security_group.this not written by this draft (stackit_security_group, stackit_security_group_rule) none needed – – not established by a catalogue snapshot NOT APPLICABLE 3
module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events none managed — application events over RabbitMQ none needed – – not established by a catalogue snapshot NOT APPLICABLE 1
module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights STACKIT Logs stackit_logs_instance GA, stackit_logs_access_token GA ga active not established by a catalogue snapshot MATCHED: observability.logs 6
module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks STACKIT Logs stackit_logs_instance GA, stackit_logs_access_token GA ga active not established by a catalogue snapshot MATCHED: observability.logs 6
module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs STACKIT Logs access tokens stackit_logs_access_token GA ga active not established by a catalogue snapshot MATCHED: observability.logs 2
module.retail_app_ecs.aws_ecs_cluster.cluster STACKIT Kubernetes Engine (SKE) stackit_ske_cluster GA ga active eu01, eu02 MATCHED: compute.managed-kubernetes 1
module.retail_app_ecs.aws_kms_key.cmk STACKIT KMS stackit_kms_keyring GA, stackit_kms_key GA ga active not established by a catalogue snapshot MATCHED: security.kms 2
module.retail_app_ecs.aws_secretsmanager_secret.catalog_db STACKIT Secrets Manager stackit_secretsmanager_instance GA, stackit_secretsmanager_user GA ga active not established by a catalogue snapshot MATCHED: security.secrets-manager 2
module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch STACKIT Secrets Manager stackit_secretsmanager_instance GA, stackit_secretsmanager_user GA ga active not established by a catalogue snapshot MATCHED: security.secrets-manager 2
module.retail_app_ecs.aws_secretsmanager_secret.mq STACKIT Secrets Manager stackit_secretsmanager_instance GA, stackit_secretsmanager_user GA ga active not established by a catalogue snapshot MATCHED: security.secrets-manager 2
module.retail_app_ecs.aws_secretsmanager_secret.orders_db STACKIT Secrets Manager stackit_secretsmanager_instance GA, stackit_secretsmanager_user GA ga active not established by a catalogue snapshot MATCHED: security.secrets-manager 2
module.retail_app_ecs.module.alb.aws_lb.this STACKIT Application Load Balancer stackit_application_load_balancer GA, stackit_alb_certificate GA ga active eu01, eu02 MATCHED: network.application-load-balancer 3
module.retail_app_ecs.module.alb.aws_security_group.this STACKIT security group stackit_security_group GA, stackit_security_group_rule GA ga active not established by a catalogue snapshot MATCHED: network.security-group 3
module.retail_app_ecs.module.alb_sg.aws_security_group.this switched off (count = 0) — would map to STACKIT security group if switched on stackit_security_group GA, stackit_security_group_rule GA ga active not established by a catalogue snapshot MATCHED: network.security-group 3
module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix STACKIT security group stackit_security_group GA, stackit_security_group_rule GA ga active not established by a catalogue snapshot MATCHED: network.security-group 3
module.retail_app_ecs.module.carts_service.aws_ecs_service.this STACKIT Kubernetes Engine (SKE) stackit_ske_cluster GA ga active eu01, eu02 MATCHED: compute.managed-kubernetes 1
module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role STACKIT service account for the workload stackit_service_account GA, stackit_service_account_key GA, stackit_authorization_project_role_assignment EXPERIMENTAL (feature iam) experimental active not established by a catalogue snapshot MATCHED: identity.role-assignment, identity.server-service-account, identity.service-account-key 2
module.retail_app_ecs.module.carts_service.aws_iam_role.task_role STACKIT service account for the workload stackit_service_account GA, stackit_service_account_key GA, stackit_authorization_project_role_assignment EXPERIMENTAL (feature iam) experimental active not established by a catalogue snapshot MATCHED: identity.role-assignment, identity.server-service-account, identity.service-account-key 2
module.retail_app_ecs.module.carts_service.aws_security_group.this STACKIT security group stackit_security_group GA, stackit_security_group_rule GA ga active not established by a catalogue snapshot MATCHED: network.security-group 3
module.retail_app_ecs.module.catalog_service.aws_ecs_service.this STACKIT Kubernetes Engine (SKE) stackit_ske_cluster GA ga active eu01, eu02 MATCHED: compute.managed-kubernetes 1
module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role STACKIT service account for the workload stackit_service_account GA, stackit_service_account_key GA, stackit_authorization_project_role_assignment EXPERIMENTAL (feature iam) experimental active not established by a catalogue snapshot MATCHED: identity.role-assignment, identity.server-service-account, identity.service-account-key 2
module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role STACKIT service account for the workload stackit_service_account GA, stackit_service_account_key GA, stackit_authorization_project_role_assignment EXPERIMENTAL (feature iam) experimental active not established by a catalogue snapshot MATCHED: identity.role-assignment, identity.server-service-account, identity.service-account-key 2
module.retail_app_ecs.module.catalog_service.aws_security_group.this STACKIT security group stackit_security_group GA, stackit_security_group_rule GA ga active not established by a catalogue snapshot MATCHED: network.security-group 3
module.retail_app_ecs.module.checkout_service.aws_ecs_service.this STACKIT Kubernetes Engine (SKE) stackit_ske_cluster GA ga active eu01, eu02 MATCHED: compute.managed-kubernetes 1
module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role STACKIT service account for the workload stackit_service_account GA, stackit_service_account_key GA, stackit_authorization_project_role_assignment EXPERIMENTAL (feature iam) experimental active not established by a catalogue snapshot MATCHED: identity.role-assignment, identity.server-service-account, identity.service-account-key 2
module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role STACKIT service account for the workload stackit_service_account GA, stackit_service_account_key GA, stackit_authorization_project_role_assignment EXPERIMENTAL (feature iam) experimental active not established by a catalogue snapshot MATCHED: identity.role-assignment, identity.server-service-account, identity.service-account-key 2
module.retail_app_ecs.module.checkout_service.aws_security_group.this STACKIT security group stackit_security_group GA, stackit_security_group_rule GA ga active not established by a catalogue snapshot MATCHED: network.security-group 3
module.retail_app_ecs.module.orders_service.aws_ecs_service.this STACKIT Kubernetes Engine (SKE) stackit_ske_cluster GA ga active eu01, eu02 MATCHED: compute.managed-kubernetes 1
module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role STACKIT service account for the workload stackit_service_account GA, stackit_service_account_key GA, stackit_authorization_project_role_assignment EXPERIMENTAL (feature iam) experimental active not established by a catalogue snapshot MATCHED: identity.role-assignment, identity.server-service-account, identity.service-account-key 2
module.retail_app_ecs.module.orders_service.aws_iam_role.task_role STACKIT service account for the workload stackit_service_account GA, stackit_service_account_key GA, stackit_authorization_project_role_assignment EXPERIMENTAL (feature iam) experimental active not established by a catalogue snapshot MATCHED: identity.role-assignment, identity.server-service-account, identity.service-account-key 2
module.retail_app_ecs.module.orders_service.aws_security_group.this STACKIT security group stackit_security_group GA, stackit_security_group_rule GA ga active not established by a catalogue snapshot MATCHED: network.security-group 3
module.retail_app_ecs.module.ui_service.aws_ecs_service.this STACKIT Kubernetes Engine (SKE) stackit_ske_cluster GA ga active eu01, eu02 MATCHED: compute.managed-kubernetes 1
module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role STACKIT service account for the workload stackit_service_account GA, stackit_service_account_key GA, stackit_authorization_project_role_assignment EXPERIMENTAL (feature iam) experimental active not established by a catalogue snapshot MATCHED: identity.role-assignment, identity.server-service-account, identity.service-account-key 2
module.retail_app_ecs.module.ui_service.aws_iam_role.task_role STACKIT service account for the workload stackit_service_account GA, stackit_service_account_key GA, stackit_authorization_project_role_assignment EXPERIMENTAL (feature iam) experimental active not established by a catalogue snapshot MATCHED: identity.role-assignment, identity.server-service-account, identity.service-account-key 2
module.retail_app_ecs.module.ui_service.aws_security_group.this STACKIT security group stackit_security_group GA, stackit_security_group_rule GA ga active not established by a catalogue snapshot MATCHED: network.security-group 3
module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log switched off (count = 0) — would map to STACKIT Logs if switched on stackit_logs_instance GA, stackit_logs_access_token GA ga active not established by a catalogue snapshot MATCHED: observability.logs 6
module.vpc.module.vpc.aws_default_vpc.this switched off (count = 0) — would map to STACKIT project networking / Network Area (SNA) if switched on stackit_network_area GA, stackit_network GA ga active not established by a catalogue snapshot MATCHED: network.network 2
module.vpc.module.vpc.aws_eip.nat implicit (belongs to the NAT gateway) none needed – – not established by a catalogue snapshot NOT APPLICABLE 1
module.vpc.module.vpc.aws_flow_log.this switched off (count = 0) — would map to none - no packet-flow log: a capture on the servers whose records a log shipper sends to a STACKIT Logs instance is a design of its own if switched on none needed – – not established by a catalogue snapshot NOT APPLICABLE 6
module.vpc.module.vpc.aws_internet_gateway.this implicit (STACKIT network default gateway) none needed – – not established by a catalogue snapshot NOT APPLICABLE 1
module.vpc.module.vpc.aws_nat_gateway.this implicit outbound (STACKIT network) none needed – – not established by a catalogue snapshot NOT APPLICABLE 1
module.vpc.module.vpc.aws_network_acl.database switched off (count = 0) — would map to STACKIT security groups (no stateless NACLs) if switched on stackit_security_group GA, stackit_security_group_rule GA ga active not established by a catalogue snapshot MATCHED: network.security-group 11
module.vpc.module.vpc.aws_network_acl.elasticache switched off (count = 0) — would map to STACKIT security groups (no stateless NACLs) if switched on stackit_security_group GA, stackit_security_group_rule GA ga active not established by a catalogue snapshot MATCHED: network.security-group 11
module.vpc.module.vpc.aws_network_acl.intra switched off (count = 0) — would map to STACKIT security groups (no stateless NACLs) if switched on stackit_security_group GA, stackit_security_group_rule GA ga active not established by a catalogue snapshot MATCHED: network.security-group 11
module.vpc.module.vpc.aws_network_acl.outpost switched off (count = 0) — would map to STACKIT security groups (no stateless NACLs) if switched on stackit_security_group GA, stackit_security_group_rule GA ga active not established by a catalogue snapshot MATCHED: network.security-group 11
module.vpc.module.vpc.aws_network_acl.private switched off (count = 0) — would map to STACKIT security groups (no stateless NACLs) if switched on stackit_security_group GA, stackit_security_group_rule GA ga active not established by a catalogue snapshot MATCHED: network.security-group 11
module.vpc.module.vpc.aws_network_acl.public switched off (count = 0) — would map to STACKIT security groups (no stateless NACLs) if switched on stackit_security_group GA, stackit_security_group_rule GA ga active not established by a catalogue snapshot MATCHED: network.security-group 11
module.vpc.module.vpc.aws_network_acl.redshift switched off (count = 0) — would map to STACKIT security groups (no stateless NACLs) if switched on stackit_security_group GA, stackit_security_group_rule GA ga active not established by a catalogue snapshot MATCHED: network.security-group 11
module.vpc.module.vpc.aws_route_table.private implicit (STACKIT network default routing) none needed – – not established by a catalogue snapshot NOT APPLICABLE 15
module.vpc.module.vpc.aws_route_table.public implicit (STACKIT network default routing) none needed – – not established by a catalogue snapshot NOT APPLICABLE 18
module.vpc.module.vpc.aws_subnet.database switched off (count = 0) — would map to STACKIT network if switched on stackit_network GA ga active not established by a catalogue snapshot MATCHED: network.network 1
module.vpc.module.vpc.aws_subnet.elasticache switched off (count = 0) — would map to STACKIT network if switched on stackit_network GA ga active not established by a catalogue snapshot MATCHED: network.network 1
module.vpc.module.vpc.aws_subnet.intra switched off (count = 0) — would map to STACKIT network if switched on stackit_network GA ga active not established by a catalogue snapshot MATCHED: network.network 1
module.vpc.module.vpc.aws_subnet.outpost switched off (count = 0) — would map to STACKIT network if switched on stackit_network GA ga active not established by a catalogue snapshot MATCHED: network.network 1
module.vpc.module.vpc.aws_subnet.private STACKIT network stackit_network GA ga active not established by a catalogue snapshot MATCHED: network.network 1
module.vpc.module.vpc.aws_subnet.public STACKIT network stackit_network GA ga active not established by a catalogue snapshot MATCHED: network.network 1
module.vpc.module.vpc.aws_subnet.redshift switched off (count = 0) — would map to STACKIT network if switched on stackit_network GA ga active not established by a catalogue snapshot MATCHED: network.network 1
module.vpc.module.vpc.aws_vpc.this STACKIT project networking / Network Area (SNA) stackit_network_area GA, stackit_network GA ga active not established by a catalogue snapshot MATCHED: network.network 2
module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this switched off (for_each = 0) — would map to none - no account guardrail to except a VPC or subnet from if switched on none needed – – not established by a catalogue snapshot NOT APPLICABLE 6
module.vpc.module.vpc.aws_vpc_block_public_access_options.this switched off (count = 0) — would map to none - no account guardrail; exposure is set by security groups and by who may attach public IPs if switched on none needed – – not established by a catalogue snapshot NOT APPLICABLE 6
module.vpc.module.vpc.aws_vpc_dhcp_options.this switched off (count = 0) — would map to STACKIT network DNS settings if switched on stackit_network GA ga active not established by a catalogue snapshot MATCHED: network.network 1
module.vpc.module.vpc.aws_vpn_gateway.this switched off (count = 0) — would map to STACKIT VPN if switched on stackit_vpn_gateway GA, stackit_vpn_connection GA ga active not established by a catalogue snapshot RESOURCE EXISTS BUT CAPABILITY UNLINKED (not listed by any capability: stackit_vpn_connection, stackit_vpn_gateway; the STACKIT provider has stackit_vpn_connection, stackit_vpn_gateway as resources, StackToIT's capability metadata for them is incomplete) 3

Target lifecycle: SKE Kubernetes versions

Units whose target uses it: module.retail_app_ecs.aws_ecs_cluster.cluster, module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, module.retail_app_ecs.module.orders_service.aws_ecs_service.this, module.retail_app_ecs.module.ui_service.aws_ecs_service.this. The provider presents the target resources as GA. States are derived from published dates only, as of 2026-10-08, the day the sources were read; this page reads no clock, so compare the dates with today. The set is not vouched for after 2027-01-06. The 30-day window that makes a version EXPIRING is a StackToIT parameter, not a provider fact.

SKE Kubernetes versions: production suitability of the capability is SUITABLE (a version with no published end date is never read as safe)
VersionStateReleasedDeprecatedExpiresProduction suitabilityUpgrade actionMigration timing risk
1.36 SUPPORTED 2026-08-27 not stated not stated SUITABLE NONE_PUBLISHED UNKNOWN
1.35 UNKNOWN not stated not stated 2027-02-10 UNKNOWN UNKNOWN UNKNOWN
1.34 EXPIRING 2025-12-16 2026-08-28 2026-10-14 NOT_SUITABLE UPGRADE_BEFORE_EXPIRY HIGH
1.33 EXPIRED (disputed) 2025-07-29 2026-06-09 2026-06-10 (sources disagree: 2026-07-08) NOT_SUITABLE MANDATORY_UPDATE_APPLIES HIGH
1.32 EXPIRED not stated 2026-02-20 2026-04-15 NOT_SUITABLE MANDATORY_UPDATE_APPLIES HIGH

Day-2 responsibility: when a version reaches its expiry the update is performed by the provider (STACKIT). "If the Kubernetes or OS version of a cluster has reached its expiration date, SKE starts a mandatory update to the highest available patch version of the current minor version, or to the highest patch version of the consecutive minor version that is not classified as preview version." and "mandatory version updates run, even if the auto update for the Kubernetes version is deactivated". Automatic updates otherwise "only update to higher patch levels" in the cluster's maintenance window. Notice: "As a SKE user you will get informed via release notes and via email in case you are operating a cluster with a deprecated Kubernetes version." Customer: "you can check the exact expiration dates for your current Kubernetes and node pool versions in the cluster.status.expiration field via the SKE API". The page does not assign any further duty (workload readiness for the update, testing) to the customer or to STACKIT: not stated.

Sources: https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/operations/version-updates/, https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/, https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/