StackToIT Migration Intelligence Workspace

Executive lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Architect lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Platform lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Security lens: the sections are in the order this reader usually wants, and Costs and Migration Plan are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Application owner lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Programme lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

FinOps lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Engineering lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Work Board

Every job of the migration in one list, in four queues: who does it, what it waits for, what closes it and which file it carries out.

How the jobs are read from the plan, and the priorities, and the progress journal

Read from execution-plan.json and decisions.json: every record of the register that still asks something is a job, with the manual steps that stand for its question, and every other step of the plan is a job of its own (the OpenTofu steps of one file that wait for the same thing are one job). Steps defined: 314. Progress by kind of step: decisions to take: 89 · changes executable now: 73 · waiting: 149; 3 refused (of 314 steps). 48 of the 57 automated steps (OpenTofu or a script) can run now (1 waits for a manual prerequisite, 8 require a design decision) · 9 of those 48 rest on a default you have not confirmed (public endpoint, size derived from the source); a person can start 114 of the 254 manual steps now (4 wait for a manual prerequisite, 71 require a design decision, 65 are not executable as the plan stands); 3 steps are permanently unsupported (refused); 1 step has its verification incomplete: it carries critical settings of the source that no check validates, which a person confirms in the draft. Every step of the plan is in exactly one job; 271 jobs hold them. Nothing here has been run or approved. migration/work-board.csv holds the same jobs.

Priority: First is the first required action and the manual work every automated step waits for, Holds steps a job some step of the plan waits for (or a refusal), Later the rest.

No progress journal was given, so no job shows progress. Record what you carry out in progress-template.yaml (the run copies it to review/progress.yaml) and run the assessment again, or pass the file with --progress FILE.

Start here

First required action: Allow the calls of STACKIT APIs that are not generally available — Platform Architect. Allow STACKIT's pre-release API, which may change or be withdrawn: Secrets Manager v1 (release status not stated). 4 steps wait for this answer; allowing the calls lets the plan carry them out and makes the migration depend on that API. If you say no (record a rejection), the calls are not made: the steps of Secrets Manager stay open. Record the answer in the decisions file given with --decisions (decisions-template.yaml).

the default of 8 decisions nobody has answered: public endpoint (5), size derived from the source (3); confirm or change each in decisions.yaml; confirming one accepts what the draft does as it stands: the steps that rest on it then count among those that rest on no default left to confirm, and as approved once every decision they rest on is answered in the decisions file; decisions are counted one by one here, while the register's decisions to make and defaults to confirm count the records that group them

stages of 57 automated steps: 57 can be generated, 48 can run now, 39 rest on no default left to confirm, 0 are approved (every decision and default confirmed in the decisions file)

121 of the 271 jobs can start now: they wait for no other job of this board, read from the order of the plan’s steps and the decisions they wait for. 150 jobs wait, each listed once below under the job it waits for last. Nothing has been run, so a job waits for every job it comes after. The number beside a job counts the jobs that wait for it, directly or through other jobs; the full title of a job is in the list below.

Provide information: 59 jobs can start

Review the critical settings of an LB… · Platform Architect · 65 jobs wait for it
Review the critical settings of an OpenSearch… · Identity Architect · 65 jobs wait for it
Review the critical settings of an OpenSearch… · Network Architect · 65 jobs wait for it
Review the critical settings of an OpenSearch… · Platform Architect · 65 jobs wait for it
Review the critical settings of an OpenSearch… · Security Architect · 65 jobs wait for it

The other 54 jobs of this queue that can start

Review the critical settings of an ECS · 40 waiting
Review the critical settings of an ECS… · 40 waiting
Review the critical settings of an ECS… · 40 waiting
Review the critical settings of an ECS… · 40 waiting
Review the critical settings of an ECS · 22 waiting
Review the critical settings of an ECS… · 22 waiting
Review the critical settings of an ECS… · 22 waiting
Review the critical settings of an ECS… · 22 waiting
Review the critical settings of an ECS · 15 waiting
Review the critical settings of an ECS… · 15 waiting
Review the critical settings of an ECS… · 15 waiting
Review the critical settings of an ECS… · 15 waiting
Review the critical settings of an ECS · 15 waiting
Review the critical settings of an ECS… · 15 waiting
Review the critical settings of an ECS… · 15 waiting
Review the critical settings of an ECS… · 15 waiting
Review the critical settings of an IAM role… · 11 waiting
Review the critical settings of an ECS · 9 waiting
Review the critical settings of an ECS… · 9 waiting
Review the critical settings of an ECS… · 9 waiting
Review the critical settings of an ECS… · 9 waiting
Review the critical settings of an IAM role… · 9 waiting
Review the critical settings of an ElastiCache… · 5 waiting
Review the critical settings of an ElastiCache… · 5 waiting
Review the critical settings of an ElastiCache… · 5 waiting
Review the critical settings of an RDS cluster… · 5 waiting
Review the critical settings of an RDS cluster… · 5 waiting
Review the critical settings of an RDS cluster… · 5 waiting
Review the critical settings of an RDS cluster… · 5 waiting
Review the critical settings of an RDS cluster… · 5 waiting
Review the critical settings of an RDS cluster… · 5 waiting
Review the critical settings of an RDS cluster… · 5 waiting
Review the critical settings of an RDS cluster… · 5 waiting
Review the critical settings of an RDS cluster… · 5 waiting
Review the critical settings of an RDS cluster… · 5 waiting
Review the critical settings of a security group… · 2 waiting
Review the critical settings of a security group… · 2 waiting
Review the critical settings of a security group… · 2 waiting
Review the critical settings of a security group… · 2 waiting
Review the critical settings of a security group… · 2 waiting
Review the critical settings of a subnet… · 2 waiting
Review the critical settings of a subnet… · 2 waiting
Review the critical settings of a DynamoDB table… · 1 waiting
Review the critical settings of a DynamoDB table… · 1 waiting
Review the critical settings of a DynamoDB table… · 1 waiting
Review the critical settings of an IAM role… · 1 waiting
Review the critical settings of an IAM role… · 1 waiting
Review the critical settings of an IAM role… · 1 waiting
Review the critical settings of a KMS key… · 1 waiting
Review the critical settings of an ECS…
Review the critical settings of an ECS…
Review the critical settings of an ECS…
Review the critical settings of an ECS…
Review the critical settings of an ECS…

Approve a design: 18 jobs can start

Choose how the data is moved · Data Architect · 114 jobs wait for it
Decide how the segmentation of ECS tasks that become pods is carried · Security Architect · 91 jobs wait for it
Draft: engine version downgrade · Data Architect · 83 jobs wait for it
Allow the calls of STACKIT APIs that are not generally available · Platform Architect · 74 jobs wait for it
Decide how the clients reach an endpoint the draft exposes more widely · Security Architect · 67 jobs wait for it

The other 13 jobs of this queue that can start

Name the instance of a repeated resource a reference means · 66 waiting
Decide how a load balancer reaches a workload on SKE · 66 waiting
Review the critical settings of an LB… · 65 waiting
Approve a redesign: the target cannot carry the critical setting credentials-and-keys-settings of… REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/credentials-and-keys-settings · 65 waiting
Approve a redesign: the target cannot carry the critical setting domain-credentials-and-keys of… REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/domain-credentials-and-keys · 65 waiting
Approve a redesign: the target cannot carry the VPC membership… REF/root/security-group-membership-parity · 13 waiting
Decide the outbound address of the servers an allow-list names · 7 waiting
Review the critical settings of a route table… · 7 waiting
Review the critical settings of a route table… · 4 waiting
Decide where the workloads of a drafted network are placed · 3 waiting
Review the critical settings of a subnet… · 2 waiting
Review the critical settings of a subnet… · 2 waiting
Confirm the plan or machine type StackToIT derived from the size of the source

Perform migration work: 31 jobs can start

Apply the block of terraform/kubernetes.tf with OpenTofu TF/stackit_ske_cluster.retail_app_ecs_cluster · Platform Architect · 134 jobs wait for it
Apply the blocks of terraform/security.tf with OpenTofu… TF/stackit_kms_keyring.migrated · Identity Architect · 74 jobs wait for it
Replace a routing table by STACKIT's default routing · Network Architect · 68 jobs wait for it
Review the critical settings of an MQ broker… · Identity Architect · 67 jobs wait for it
Review the critical settings of an MQ broker… · Network Architect · 67 jobs wait for it

The other 26 jobs of this queue that can start

Review the critical settings of an MQ broker… · 67 waiting
Review the critical settings of a Secrets Manager secret… · 67 waiting
Review the critical settings of a Secrets Manager secret… · 67 waiting
Review the critical settings of a Secrets Manager secret… · 67 waiting
Review the critical settings of a Secrets Manager secret… · 67 waiting
Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.alb.aws_lb.this… MAN/security/accept/module.retail_app_ecs.module.alb.aws_lb.this:plaintext-public-listener · 57 waiting
Service account: manual review · 40 waiting
Apply the blocks of terraform/identity.tf with OpenTofu TF/stackit_service_account.retail_app_ecs_carts_service_task_execution_role · 27 waiting
Apply the blocks of terraform/security.tf with OpenTofu… TF/stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix · 9 waiting
Review the critical settings of an ElastiCache… · 5 waiting
Review the critical settings of a NAT gateway… · 5 waiting
Apply the block of terraform/observability.tf with OpenTofu TF/stackit_logs_instance.logs_retention_180d · 4 waiting
Review the critical settings of an EIP… · 3 waiting
Review the critical settings of an IAM role… · 3 waiting
Review the critical settings of an IAM role… · 3 waiting
Review the critical settings of an IAM role… · 2 waiting
Review the critical settings of an IAM role… · 2 waiting
Review the critical settings of an IAM role… · 2 waiting
Place a rule the draft could not attribute to a group · 2 waiting
Review the critical settings of a VPC… · 1 waiting
Decide how module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events… MAN/unit/module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events · 1 waiting
Decide how module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights… MAN/unit/module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights · 1 waiting
Decide how module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs… MAN/unit/module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs · 1 waiting
Review the critical settings of an MQ broker…
Configure the archive of the logs kept beyond 180 days
Choose the label a log name is sent under

Verify: 13 jobs can start

Review the critical settings of a Secrets Manager secret… · Platform Architect · 67 jobs wait for it
Review the critical settings of a Secrets Manager secret… · Platform Architect · 67 jobs wait for it
Review the critical settings of a Secrets Manager secret… · Platform Architect · 67 jobs wait for it
Review the critical settings of a Secrets Manager secret… · Platform Architect · 67 jobs wait for it
Review the critical settings of a security group… · Network Architect · 3 jobs wait for it

The other 8 jobs of this queue that can start

Review the critical settings of a security group… · 3 waiting
Review the critical settings of a security group… · 3 waiting
Review the critical settings of a security group… · 3 waiting
Review the critical settings of a security group… · 3 waiting
Review the critical settings of an internet gateway… · 2 waiting
Review the critical settings of a security group… · 2 waiting
Review the critical settings of a security group… · 2 waiting
Review the critical settings of a VPC… · 1 waiting

What these unblock

Apply the block of terraform/kubernetes.tf with OpenTofu TF/stackit_ske_cluster.retail_app_ecs_cluster: 134 jobs wait for it, directly or through other jobs (15 directly); once it is done, 3 of them can start
Which
- Apply the blocks of terraform/data.tf with OpenTofu TF/stackit_mongodbflex_instance.dynamodb_tables
- Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health MAN/draft/handover/cluster-access/kubeconfig-md
- Apply the blocks of terraform/messaging.tf with OpenTofu TF/stackit_rabbitmq_instance.dependencies_mq
Choose how the data is moved: 114 jobs wait for it, directly or through other jobs (114 directly); none of them can start on this job alone
Decide how the segmentation of ECS tasks that become pods is carried: 91 jobs wait for it, directly or through other jobs (91 directly); once it is done, 5 of them can start
Which
- Accept, or harden, the HIGH weakness of… MAN/security/accept/module.retail_app_ecs.module.carts_service.aws_security_group.this:open-ingress-application-port
- Accept, or harden, the HIGH weakness of… MAN/security/accept/module.retail_app_ecs.module.catalog_service.aws_security_group.this:open-ingress-application-port
- Accept, or harden, the HIGH weakness of… MAN/security/accept/module.retail_app_ecs.module.checkout_service.aws_security_group.this:open-ingress-application-port
- Accept, or harden, the HIGH weakness of… MAN/security/accept/module.retail_app_ecs.module.orders_service.aws_security_group.this:open-ingress-application-port
- Accept, or harden, the HIGH weakness of… MAN/security/accept/module.retail_app_ecs.module.ui_service.aws_security_group.this:open-ingress-application-port
Draft: engine version downgrade: 83 jobs wait for it, directly or through other jobs (83 directly); none of them can start on this job alone
Allow the calls of STACKIT APIs that are not generally available: 74 jobs wait for it, directly or through other jobs (74 directly); none of them can start on this job alone
Apply the blocks of terraform/security.tf with OpenTofu… TF/stackit_kms_keyring.migrated: 74 jobs wait for it, directly or through other jobs (13 directly); none of them can start on this job alone
Replace a routing table by STACKIT's default routing: 68 jobs wait for it, directly or through other jobs (4 directly); once it is done, 1 of them can start
Which
- Apply the block of terraform/network.tf with OpenTofu TF/stackit_network.vpc_vpc_public
Decide how the clients reach an endpoint the draft exposes more widely: 67 jobs wait for it, directly or through other jobs (2 directly); none of them can start on this job alone
Review the critical settings of an MQ broker…: 67 jobs wait for it, directly or through other jobs (2 directly); none of them can start on this job alone
Review the critical settings of an MQ broker…: 67 jobs wait for it, directly or through other jobs (2 directly); none of them can start on this job alone
Review the critical settings of a Secrets Manager secret…: 67 jobs wait for it, directly or through other jobs (2 directly); none of them can start on this job alone
Review the critical settings of a Secrets Manager secret…: 67 jobs wait for it, directly or through other jobs (2 directly); none of them can start on this job alone
Review the critical settings of a Secrets Manager secret…: 67 jobs wait for it, directly or through other jobs (2 directly); none of them can start on this job alone
Review the critical settings of a Secrets Manager secret…: 67 jobs wait for it, directly or through other jobs (2 directly); none of them can start on this job alone
Review the critical settings of an LB…: 65 jobs wait for it, directly or through other jobs (2 directly); none of them can start on this job alone
Review the critical settings of an OpenSearch…: 65 jobs wait for it, directly or through other jobs (2 directly); none of them can start on this job alone
Review the critical settings of an OpenSearch…: 65 jobs wait for it, directly or through other jobs (2 directly); none of them can start on this job alone
Review the critical settings of an OpenSearch…: 65 jobs wait for it, directly or through other jobs (2 directly); none of them can start on this job alone
Review the critical settings of an OpenSearch…: 65 jobs wait for it, directly or through other jobs (2 directly); none of them can start on this job alone
Review the critical settings of a security group…: 3 jobs wait for it, directly or through other jobs (1 directly); none of them can start on this job alone

Waiting jobs, each under the job it waits for last

Waits for Decide how the segmentation of ECS tasks that become pods is carried (5 jobs)

Accept, or harden, the HIGH weakness of… MAN/security/accept/module.retail_app_ecs.module.carts_service.aws_security_group.this:open-ingress-application-port
Accept, or harden, the HIGH weakness of… MAN/security/accept/module.retail_app_ecs.module.catalog_service.aws_security_group.this:open-ingress-application-port
Accept, or harden, the HIGH weakness of… MAN/security/accept/module.retail_app_ecs.module.checkout_service.aws_security_group.this:open-ingress-application-port
Accept, or harden, the HIGH weakness of… MAN/security/accept/module.retail_app_ecs.module.orders_service.aws_security_group.this:open-ingress-application-port
Accept, or harden, the HIGH weakness of… MAN/security/accept/module.retail_app_ecs.module.ui_service.aws_security_group.this:open-ingress-application-port

Waits for Allow the calls of STACKIT APIs that are not generally available (4 jobs)

Run the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db — also waits for 1 other job
Run the STACKIT API step WriteSecret of… API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch — also waits for 1 other job
Run the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq — also waits for 1 other job
Run the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db — also waits for 1 other job

Waits for Apply the block of terraform/kubernetes.tf with OpenTofu TF/stackit_ske_cluster.retail_app_ecs_cluster (3 jobs)

Apply the blocks of terraform/data.tf with OpenTofu TF/stackit_mongodbflex_instance.dynamodb_tables
Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health MAN/draft/handover/cluster-access/kubeconfig-md
Apply the blocks of terraform/messaging.tf with OpenTofu TF/stackit_rabbitmq_instance.dependencies_mq

Waits for Apply the block of terraform/observability.tf with OpenTofu TF/stackit_logs_instance.logs_retention_180d (2 jobs)

Waits for Draft: engine version downgrade (1 job)

Apply the blocks of terraform/data.tf with OpenTofu TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this — also waits for 1 other job

Waits for Decide where the workloads of a drafted network are placed (1 job)

Apply the block of terraform/network.tf with OpenTofu TF/stackit_network.vpc_vpc_private — also waits for 1 other job

Waits for Replace a routing table by STACKIT's default routing (1 job)

Apply the block of terraform/network.tf with OpenTofu TF/stackit_network.vpc_vpc_public

Waits for Apply the blocks of terraform/security.tf with OpenTofu… TF/stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix (1 job)

Complete a set the source shows only in part

Waits for Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health MAN/draft/handover/cluster-access/kubeconfig-md (5 jobs)

Fill in the required inputs of kubernetes/carts/manifests.yaml and apply it to the cluster… MAN/draft/kubernetes/carts/manifests-yaml — also waits for 2 other jobs
Fill in the required inputs of kubernetes/catalog/manifests.yaml and apply it to the cluster… MAN/draft/kubernetes/catalog/manifests-yaml — also waits for 2 other jobs
Fill in the required inputs of kubernetes/checkout/manifests.yaml and apply it to the cluster… MAN/draft/kubernetes/checkout/manifests-yaml — also waits for 2 other jobs
Fill in the required inputs of kubernetes/orders/manifests.yaml and apply it to the cluster… MAN/draft/kubernetes/orders/manifests-yaml — also waits for 2 other jobs
Fill in the required inputs of kubernetes/ui/manifests.yaml and apply it to the cluster… MAN/draft/kubernetes/ui/manifests-yaml — also waits for 2 other jobs

Waits for Apply the blocks of terraform/data.tf with OpenTofu TF/stackit_mongodbflex_instance.dynamodb_tables (4 jobs)

Close what the plan lists as UNKNOWN, from the move host, with read-only commands… MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/preflight
Close what the plan lists as UNKNOWN, from the move host, with read-only statements… MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/preflight
Preflight of the data move of module.dependencies.module.orders_rds.aws_rds_cluster.this to… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/preflight
Freeze the writers of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this… MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/write-freeze/own-tool — also waits for 1 other job

Waits for Apply the blocks of terraform/data.tf with OpenTofu TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this (2 jobs)

Freeze the writers of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this… MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/client-import — also waits for 2 other jobs
Freeze the writers of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this… MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/own-tool — also waits for 2 other jobs

Waits for Prepare what the target needs before a resource of the plan works (1 job)

Review the critical settings of a CloudWatch log group… — also waits for 1 other job

Waits for Apply the block of terraform/network.tf with OpenTofu TF/stackit_network.vpc_vpc_public (1 job)

Apply the block of terraform/loadbalancing.tf with OpenTofu TF/stackit_application_load_balancer.retail_app_ecs_alb_this — also waits for 2 other jobs

Waits for Close what the plan lists as UNKNOWN, from the move host, with read-only commands… MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/preflight (1 job)

Rehearse the copy on a sample into a scratch Key Value Store instance of the same plan and version… MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/rehearsal

Waits for Close what the plan lists as UNKNOWN, from the move host, with read-only statements… MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/preflight (1 job)

Rehearse the dump and the load into a scratch instance of the same plan and version as the draft's… MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/rehearsal

Waits for Preflight of the data move of module.dependencies.module.orders_rds.aws_rds_cluster.this to… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/preflight (1 job)

Rehearse the move of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this into a… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/rehearsal

Waits for Fill in the required inputs of kubernetes/carts/manifests.yaml and apply it to the cluster… MAN/draft/kubernetes/carts/manifests-yaml (1 job)

Check from inside the cluster that the 1 name(s) the application carts resolves in the source VPC… MAN/verify/dns/module.retail_app_ecs.module.carts_service.aws_ecs_service.this — also waits for 1 other job

Waits for Fill in the required inputs of kubernetes/catalog/manifests.yaml and apply it to the cluster… MAN/draft/kubernetes/catalog/manifests-yaml (1 job)

Check from inside the cluster that the 3 name(s) the application catalog resolves in the source VPC… MAN/verify/dns/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this — also waits for 1 other job

Waits for Fill in the required inputs of kubernetes/checkout/manifests.yaml and apply it to the cluster… MAN/draft/kubernetes/checkout/manifests-yaml (1 job)

Check from inside the cluster that the 2 name(s) the application checkout resolves in the source VPC… MAN/verify/dns/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this — also waits for 1 other job

Waits for Fill in the required inputs of kubernetes/orders/manifests.yaml and apply it to the cluster… MAN/draft/kubernetes/orders/manifests-yaml (1 job)

Check from inside the cluster that the 3 name(s) the application orders resolves in the source VPC… MAN/verify/dns/module.retail_app_ecs.module.orders_service.aws_ecs_service.this — also waits for 1 other job

Waits for Fill in the required inputs of kubernetes/ui/manifests.yaml and apply it to the cluster… MAN/draft/kubernetes/ui/manifests-yaml (1 job)

Check from inside the cluster that the 1 name(s) the application ui resolves in the source VPC… MAN/verify/dns/module.retail_app_ecs.module.ui_service.aws_ecs_service.this — also waits for 1 other job

Waits for Freeze the writers of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this… MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/client-import (1 job)

Inside the freeze, copy the indices of… MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/client-import — also waits for 2 other jobs

Copy the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this to… MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/own-tool — also waits for 2 other jobs

Waits for Freeze the writers of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this… MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/write-freeze/own-tool (1 job)

Inside the freeze, export the table retail-store-ecs-carts… MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/export/own-tool — also waits for 1 other job

Waits for Rehearse the move of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this into a… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/rehearsal (3 jobs)

Copy the existing data of module.dependencies.module.orders_rds.aws_rds_cluster.this to… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/initial-copy/logical-replication — also waits for 1 other job
Freeze the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/dump-restore — also waits for 1 other job
Freeze the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/own-tool — also waits for 1 other job

Waits for Rehearse the copy on a sample into a scratch Key Value Store instance of the same plan and version… MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/rehearsal (2 jobs)

Freeze the writers of… MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/write-freeze/client-import — also waits for 2 other jobs
Freeze the writers of… MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/write-freeze/own-tool — also waits for 2 other jobs

Waits for Rehearse the dump and the load into a scratch instance of the same plan and version as the draft's… MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/rehearsal (2 jobs)

List who writes (SELECT user, host, db, command, COUNT(*) FROM information_schema.processlist WHERE db IN ('<database-1>', '<database-2>') GROUP BY 1, 2, 3, 4;) and record the connection settings of every client where they can be restored from. Then stop the writers at the application (services, jobs, migrations, cron, replicas that write). Do not make the source read-only and do not change it. Check: SELECT COUNT(*) FROM information_schema.processlist WHERE db IN ('<database-1>', '<database-2>') AND command <> 'Sleep' AND id <> CONNECTION_ID(); is 0. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#write-freeze-dump-restore. MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/dump-restore — also waits for 1 other job
List who writes (SELECT user, host, db, command, COUNT(*) FROM information_schema.processlist WHERE db IN ('<database-1>', '<database-2>') GROUP BY 1, 2, 3, 4;) and record the connection settings of every client where they can be restored from. Then stop the writers at the application (services, jobs, migrations, cron, replicas that write). Do not make the source read-only and do not change it. Check: SELECT COUNT(*) FROM information_schema.processlist WHERE db IN ('<database-1>', '<database-2>') AND command <> 'Sleep' AND id <> CONNECTION_ID(); is 0. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#write-freeze-own-tool. MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/own-tool — also waits for 1 other job

Waits for Inside the freeze, copy the indices of… MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/client-import (1 job)

Reconcile module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this and… MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/client-import — also waits for 2 other jobs

Waits for Copy the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this to… MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/own-tool (1 job)

Reconcile module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this and… MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/own-tool — also waits for 2 other jobs

Waits for Inside the freeze, export the table retail-store-ecs-carts… MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/export/own-tool (1 job)

Convert the export of the table retail-store-ecs-carts… MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/transform/own-tool — also waits for 1 other job

Waits for Copy the existing data of module.dependencies.module.orders_rds.aws_rds_cluster.this to… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/initial-copy/logical-replication (1 job)

Keep the replication of module.dependencies.module.orders_rds.aws_rds_cluster.this running and… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/delta-sync/logical-replication — also waits for 1 other job

Waits for List who writes (

SELECT user, host, db, command, COUNT(*) FROM information_schema.processlist WHERE db IN ('<database-1>', '<database-2>') GROUP BY 1, 2, 3, 4;

) and record the connection settings of every client where they can be restored from. Then stop the writers at the application (services, jobs, migrations, cron, replicas that write). Do not make the source read-only and do not change it. Check:

SELECT COUNT(*) FROM information_schema.processlist WHERE db IN ('<database-1>', '<database-2>') AND command <> 'Sleep' AND id <> CONNECTION_ID();

is 0. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#write-freeze-dump-restore. MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/dump-restore (1 job)

Dump inside the freeze: mysqldump --host=<source-host> --port=<source-port> --user=<source-user> --password --single-transaction --routines --triggers --events --set-gtid-purged=OFF --no-tablespaces --databases <database-1> <database-2> --result-file=<dump-file>.sql. --set-gtid-purged=OFF leaves the GTID statements out, which MariaDB does not take, and --no-tablespaces leaves out the CREATE TABLESPACE statements, which MariaDB does not support for InnoDB. The target instance must be empty before the load (the STACKIT how-to of the restore says so): load the dump with the mysql client, as the user of the instance's service key, into the empty instance: mysql --host=<target-host> --port=<target-port> --user=<target-user> --password --database=<target-database> < <dump-file>.sql 2> load.log, and read every line of load.log. A DEFINER account that does not exist on the target, a collation the target does not know and a database the target does not have are the errors the checks name: each is settled by a person, never by skipping the object. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#final-sync-dump-restore. MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/dump-restore — also waits for 1 other job

Waits for List who writes (

SELECT user, host, db, command, COUNT(*) FROM information_schema.processlist WHERE db IN ('<database-1>', '<database-2>') GROUP BY 1, 2, 3, 4;

SELECT COUNT(*) FROM information_schema.processlist WHERE db IN ('<database-1>', '<database-2>') AND command <> 'Sleep' AND id <> CONNECTION_ID();

is 0. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#write-freeze-own-tool. MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/own-tool (1 job)

Copy the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this to… MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/own-tool — also waits for 1 other job

Waits for Freeze the writers of…

MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/write-freeze/client-import

(1 job)

Inside the freeze, copy every key of… MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/final-sync/client-import — also waits for 1 other job

Waits for Freeze the writers of…

MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/write-freeze/own-tool

(1 job)

Copy the data of… MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/final-sync/own-tool — also waits for 1 other job

Waits for Convert the export of the table retail-store-ecs-carts… MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/transform/own-tool (1 job)

Load the documents of the table retail-store-ecs-carts… MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/final-sync/own-tool — also waits for 1 other job

Waits for Freeze the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/dump-restore (1 job)

Inside the freeze, dump module.dependencies.module.orders_rds.aws_rds_cluster.this and restore the… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/dump-restore — also waits for 1 other job

Waits for Freeze the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/own-tool (1 job)

Copy the data of module.dependencies.module.orders_rds.aws_rds_cluster.this to… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/own-tool — also waits for 1 other job

Waits for Keep the replication of module.dependencies.module.orders_rds.aws_rds_cluster.this running and… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/delta-sync/logical-replication (1 job)

Freeze the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/logical-replication — also waits for 1 other job

Waits for Dump inside the freeze:

mysqldump --host=<source-host> --port=<source-port> --user=<source-user> --password --single-transaction --routines --triggers --events --set-gtid-purged=OFF --no-tablespaces --databases <database-1> <database-2> --result-file=<dump-file>.sql

. --set-gtid-purged=OFF leaves the GTID statements out, which MariaDB does not take, and --no-tablespaces leaves out the CREATE TABLESPACE statements, which MariaDB does not support for InnoDB. The target instance must be empty before the load (the STACKIT how-to of the restore says so): load the dump with the mysql client, as the user of the instance's service key, into the empty instance:

mysql --host=<target-host> --port=<target-port> --user=<target-user> --password --database=<target-database> < <dump-file>.sql 2> load.log

, and read every line of load.log. A DEFINER account that does not exist on the target, a collation the target does not know and a database the target does not have are the errors the checks name: each is settled by a person, never by skipping the object. Runbook section: terraform/handover/database-dependencies_catalog_rds_this/data-move.md#final-sync-dump-restore. MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/dump-restore (1 job)

Both sides, with the writers stopped… MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/dump-restore — also waits for 1 other job

Waits for Copy the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this to… MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/own-tool (1 job)

Both sides, with the writers stopped… MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/own-tool — also waits for 1 other job

Waits for Inside the freeze, copy every key of…

MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/final-sync/client-import

(1 job)

Reconcile… MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/client-import — also waits for 1 other job

Waits for Copy the data of…

MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/final-sync/own-tool

(1 job)

Reconcile… MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/own-tool — also waits for 1 other job

Waits for Load the documents of the table retail-store-ecs-carts… MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/final-sync/own-tool (1 job)

Reconcile the table retail-store-ecs-carts… MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/reconcile/own-tool — also waits for 1 other job

Waits for Inside the freeze, dump module.dependencies.module.orders_rds.aws_rds_cluster.this and restore the… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/dump-restore (1 job)

Reconcile module.dependencies.module.orders_rds.aws_rds_cluster.this and… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/dump-restore — also waits for 1 other job

Waits for Copy the data of module.dependencies.module.orders_rds.aws_rds_cluster.this to… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/own-tool (1 job)

Reconcile module.dependencies.module.orders_rds.aws_rds_cluster.this and… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/own-tool — also waits for 1 other job

Waits for Both sides, with the writers stopped… MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/dump-restore (1 job)

Switch the connection of the applications of… MAN/cutover/connection/module.dependencies.module.catalog_rds.aws_rds_cluster.this — also waits for 4 other jobs

Waits for Reconcile…

MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/client-import

(1 job)

Switch the connection of the applications of… MAN/cutover/connection/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default — also waits for 4 other jobs

Waits for Reconcile the table retail-store-ecs-carts… MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/reconcile/own-tool (1 job)

Switch the applications of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this… MAN/cutover/connection/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this — also waits for 3 other jobs

Waits for Freeze the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/logical-replication (1 job)

Inside the freeze, wait until the replication of… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/logical-replication — also waits for 1 other job

Waits for Inside the freeze, wait until the replication of… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/logical-replication (1 job)

Reconcile module.dependencies.module.orders_rds.aws_rds_cluster.this and… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/logical-replication — also waits for 1 other job

Waits for Reconcile module.dependencies.module.orders_rds.aws_rds_cluster.this and… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/logical-replication (2 jobs)

Switch the connection of the applications of… MAN/cutover/connection/module.dependencies.module.orders_rds.aws_rds_cluster.this — also waits for 5 other jobs
Confirm that every workload step and every data move of the plan is done… MAN/cutover/readiness — also waits for 21 other jobs

Waits for Confirm that every workload step and every data move of the plan is done… MAN/cutover/readiness (7 jobs)

Switch the applications that read the secret… MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db — also waits for 8 other jobs
Switch the applications that read the secret… MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch — also waits for 8 other jobs
Switch the applications that read the secret module.retail_app_ecs.aws_secretsmanager_secret.mq… MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.mq — also waits for 8 other jobs
Switch the applications that read the secret… MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.orders_db — also waits for 8 other jobs
Switch the producers of module.dependencies.aws_mq_broker.mq… MAN/cutover/module.dependencies.aws_mq_broker.mq — also waits for 8 other jobs
Switch the clients (the applications that index and search) of… MAN/cutover/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this — also waits for 16 other jobs
Switch the traffic of module.retail_app_ecs.module.alb.aws_lb.this… MAN/cutover/module.retail_app_ecs.module.alb.aws_lb.this — also waits for 8 other jobs

Waits for Switch the applications that read the secret… MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (2 jobs)

Check that the host and port of a credential of… MAN/verify/endpoint/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this — also waits for 12 other jobs
Check that the external_address of stackit_application_load_balancer.retail_app_ecs_alb_this… MAN/verify/endpoint/module.retail_app_ecs.module.alb.aws_lb.this — also waits for 14 other jobs

Waits for Switch the producers of module.dependencies.aws_mq_broker.mq… MAN/cutover/module.dependencies.aws_mq_broker.mq (1 job)

Drain the queues of the AWS broker module.dependencies.aws_mq_broker.mq… MAN/cutover/messaging-drain/module.dependencies.aws_mq_broker.mq — also waits for 3 other jobs

Waits for Drain the queues of the AWS broker module.dependencies.aws_mq_broker.mq… MAN/cutover/messaging-drain/module.dependencies.aws_mq_broker.mq (1 job)

Switch the consumers of the broker module.dependencies.aws_mq_broker.mq… MAN/cutover/messaging-consumers/module.dependencies.aws_mq_broker.mq — also waits for 3 other jobs

Waits for Switch the consumers of the broker module.dependencies.aws_mq_broker.mq… MAN/cutover/messaging-consumers/module.dependencies.aws_mq_broker.mq (2 jobs)

Confirm that every switch of the cutover is done… MAN/cutover/complete — also waits for 18 other jobs
Check that the host and port of a credential of stackit_rabbitmq_instance.dependencies_mq… MAN/verify/endpoint/module.dependencies.aws_mq_broker.mq — also waits for 12 other jobs

Waits for Confirm that every switch of the cutover is done… MAN/cutover/complete (5 jobs)

Check that the application reads the data migrated from… MAN/verify/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this — also waits for 9 other jobs
Check that the application reads the data migrated from… MAN/verify/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this — also waits for 10 other jobs
Check that the application reads the data migrated from… MAN/verify/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default — also waits for 10 other jobs
Check that the application reads the data migrated from… MAN/verify/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this — also waits for 9 other jobs
Check that the application reads the data migrated from… MAN/verify/data/module.dependencies.module.orders_rds.aws_rds_cluster.this — also waits for 11 other jobs

Waits for Check that the application reads the data migrated from… MAN/verify/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (1 job)

Decide GO or ROLLBACK for the migration once every check of the verification is done… MAN/verify/rollback-decision — also waits for 51 other jobs

Waits for Decide GO or ROLLBACK for the migration once every check of the verification is done… MAN/verify/rollback-decision (11 jobs)

Only after the target has run in production for the period the customer decides and the way back is… MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/cleanup/dump-restore — also waits for 7 other jobs
Only after the target has run in production for the period the customer decides and the way back is… MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/cleanup/client-import — also waits for 7 other jobs
Clean up what the move of module.dependencies.module.orders_rds.aws_rds_cluster.this to… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/dump-restore — also waits for 7 other jobs
Clean up what the move of module.dependencies.module.orders_rds.aws_rds_cluster.this to… MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/logical-replication — also waits for 7 other jobs
Retire module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events… MAN/decommission/module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events — also waits for 7 other jobs
Retire module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights… MAN/decommission/module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights — also waits for 7 other jobs
Retire module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs… MAN/decommission/module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs — also waits for 7 other jobs
Retire module.retail_app_ecs.module.alb.aws_lb.this… MAN/decommission/module.retail_app_ecs.module.alb.aws_lb.this — also waits for 12 other jobs
Retire module.retail_app_ecs.module.ui_service.aws_ecs_service.this… MAN/decommission/module.retail_app_ecs.module.ui_service.aws_ecs_service.this — also waits for 15 other jobs
Retire module.vpc.module.vpc.aws_route_table.private… MAN/decommission/module.vpc.module.vpc.aws_route_table.private — also waits for 9 other jobs
Retire module.vpc.module.vpc.aws_route_table.public… MAN/decommission/module.vpc.module.vpc.aws_route_table.public — also waits for 8 other jobs

Waits for Retire module.retail_app_ecs.module.ui_service.aws_ecs_service.this… MAN/decommission/module.retail_app_ecs.module.ui_service.aws_ecs_service.this (6 jobs)

Retire module.retail_app_ecs.module.carts_service.aws_ecs_service.this… MAN/decommission/module.retail_app_ecs.module.carts_service.aws_ecs_service.this — also waits for 16 other jobs
Retire module.retail_app_ecs.module.catalog_service.aws_ecs_service.this… MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this — also waits for 16 other jobs
Retire module.retail_app_ecs.module.checkout_service.aws_ecs_service.this… MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this — also waits for 16 other jobs
Retire module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role… MAN/decommission/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role — also waits for 9 other jobs
Retire module.retail_app_ecs.module.ui_service.aws_iam_role.task_role… MAN/decommission/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role — also waits for 9 other jobs
Retire module.retail_app_ecs.module.ui_service.aws_security_group.this… MAN/decommission/module.retail_app_ecs.module.ui_service.aws_security_group.this — also waits for 11 other jobs

Waits for Retire module.retail_app_ecs.module.alb.aws_lb.this… MAN/decommission/module.retail_app_ecs.module.alb.aws_lb.this (2 jobs)

Retire module.retail_app_ecs.module.alb.aws_security_group.this… MAN/decommission/module.retail_app_ecs.module.alb.aws_security_group.this — also waits for 10 other jobs
Retire module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix… MAN/decommission/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix — also waits for 12 other jobs

Waits for Retire module.vpc.module.vpc.aws_route_table.private… MAN/decommission/module.vpc.module.vpc.aws_route_table.private (1 job)

Retire module.vpc.module.vpc.aws_nat_gateway.this… MAN/decommission/module.vpc.module.vpc.aws_nat_gateway.this — also waits for 9 other jobs

Waits for Retire module.retail_app_ecs.module.checkout_service.aws_ecs_service.this… MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (4 jobs)

Retire… MAN/decommission/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default — also waits for 18 other jobs
Retire module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role… MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role — also waits for 9 other jobs
Retire module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role… MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role — also waits for 9 other jobs
Retire module.retail_app_ecs.module.orders_service.aws_ecs_service.this… MAN/decommission/module.retail_app_ecs.module.orders_service.aws_ecs_service.this — also waits for 17 other jobs

Waits for Retire module.retail_app_ecs.module.carts_service.aws_ecs_service.this… MAN/decommission/module.retail_app_ecs.module.carts_service.aws_ecs_service.this (3 jobs)

Retire module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role… MAN/decommission/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role — also waits for 9 other jobs
Retire module.retail_app_ecs.module.carts_service.aws_iam_role.task_role… MAN/decommission/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role — also waits for 9 other jobs
Retire module.retail_app_ecs.module.carts_service.aws_security_group.this… MAN/decommission/module.retail_app_ecs.module.carts_service.aws_security_group.this — also waits for 11 other jobs

Waits for Retire module.retail_app_ecs.module.catalog_service.aws_ecs_service.this… MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (3 jobs)

Retire module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this… MAN/decommission/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this — also waits for 19 other jobs
Retire module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role… MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role — also waits for 9 other jobs
Retire module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role… MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role — also waits for 9 other jobs

Waits for Retire module.vpc.module.vpc.aws_nat_gateway.this… MAN/decommission/module.vpc.module.vpc.aws_nat_gateway.this (2 jobs)

Retire module.vpc.module.vpc.aws_eip.nat… MAN/decommission/module.vpc.module.vpc.aws_eip.nat — also waits for 9 other jobs
Retire module.vpc.module.vpc.aws_subnet.public… MAN/decommission/module.vpc.module.vpc.aws_subnet.public — also waits for 13 other jobs

Waits for Retire module.retail_app_ecs.module.orders_service.aws_ecs_service.this… MAN/decommission/module.retail_app_ecs.module.orders_service.aws_ecs_service.this (3 jobs)

Retire module.retail_app_ecs.aws_ecs_cluster.cluster… MAN/decommission/module.retail_app_ecs.aws_ecs_cluster.cluster — also waits for 13 other jobs
Retire module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role… MAN/decommission/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role — also waits for 9 other jobs
Retire module.retail_app_ecs.module.orders_service.aws_iam_role.task_role… MAN/decommission/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role — also waits for 9 other jobs

Waits for Retire module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role… MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role (2 jobs)

Retire module.retail_app_ecs.aws_secretsmanager_secret.catalog_db… MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db — also waits for 13 other jobs
Retire module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch… MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch — also waits for 13 other jobs

Waits for Retire module.retail_app_ecs.module.carts_service.aws_iam_role.task_role… MAN/decommission/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role (1 job)

Retire module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this… MAN/decommission/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this — also waits for 17 other jobs

Waits for Retire module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this… MAN/decommission/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (1 job)

Retire module.dependencies.aws_security_group.catalog_opensearch_sg… MAN/decommission/module.dependencies.aws_security_group.catalog_opensearch_sg — also waits for 9 other jobs

Waits for Retire… MAN/decommission/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (1 job)

Retire… MAN/decommission/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd — also waits for 9 other jobs

Waits for Retire module.vpc.module.vpc.aws_eip.nat… MAN/decommission/module.vpc.module.vpc.aws_eip.nat (1 job)

Retire module.vpc.module.vpc.aws_internet_gateway.this… MAN/decommission/module.vpc.module.vpc.aws_internet_gateway.this — also waits for 11 other jobs

Waits for Retire module.retail_app_ecs.aws_secretsmanager_secret.catalog_db… MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (2 jobs)

Retire module.dependencies.module.catalog_rds.aws_rds_cluster.this… MAN/decommission/module.dependencies.module.catalog_rds.aws_rds_cluster.this — also waits for 19 other jobs
Retire module.retail_app_ecs.aws_kms_key.cmk… MAN/decommission/module.retail_app_ecs.aws_kms_key.cmk — also waits for 12 other jobs

Waits for Retire module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role… MAN/decommission/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role (2 jobs)

Retire module.retail_app_ecs.aws_secretsmanager_secret.mq… MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.mq — also waits for 13 other jobs
Retire module.retail_app_ecs.aws_secretsmanager_secret.orders_db… MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.orders_db — also waits for 13 other jobs

Waits for Retire… MAN/decommission/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd (1 job)

Retire module.retail_app_ecs.module.checkout_service.aws_security_group.this… MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_security_group.this — also waits for 12 other jobs

Waits for Retire module.retail_app_ecs.module.orders_service.aws_iam_role.task_role… MAN/decommission/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role (1 job)

Retire module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks… MAN/decommission/module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks — also waits for 20 other jobs

Waits for Retire module.dependencies.module.catalog_rds.aws_rds_cluster.this… MAN/decommission/module.dependencies.module.catalog_rds.aws_rds_cluster.this (1 job)

Retire module.dependencies.module.catalog_rds.aws_security_group.this… MAN/decommission/module.dependencies.module.catalog_rds.aws_security_group.this — also waits for 9 other jobs

Waits for Retire module.retail_app_ecs.aws_secretsmanager_secret.mq… MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.mq (1 job)

Retire module.dependencies.aws_mq_broker.mq… MAN/decommission/module.dependencies.aws_mq_broker.mq — also waits for 16 other jobs

Waits for Retire module.retail_app_ecs.aws_secretsmanager_secret.orders_db… MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.orders_db (1 job)

Retire module.dependencies.module.orders_rds.aws_rds_cluster.this… MAN/decommission/module.dependencies.module.orders_rds.aws_rds_cluster.this — also waits for 21 other jobs

Waits for Retire module.dependencies.aws_mq_broker.mq… MAN/decommission/module.dependencies.aws_mq_broker.mq (2 jobs)

Retire module.dependencies.aws_security_group.mq… MAN/decommission/module.dependencies.aws_security_group.mq — also waits for 9 other jobs
Retire module.vpc.module.vpc.aws_subnet.private… MAN/decommission/module.vpc.module.vpc.aws_subnet.private — also waits for 22 other jobs

Waits for Retire module.dependencies.module.catalog_rds.aws_security_group.this… MAN/decommission/module.dependencies.module.catalog_rds.aws_security_group.this (1 job)

Retire module.retail_app_ecs.module.catalog_service.aws_security_group.this… MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_security_group.this — also waits for 13 other jobs

Waits for Retire module.dependencies.module.orders_rds.aws_rds_cluster.this… MAN/decommission/module.dependencies.module.orders_rds.aws_rds_cluster.this (1 job)

Retire module.dependencies.module.orders_rds.aws_security_group.this… MAN/decommission/module.dependencies.module.orders_rds.aws_security_group.this — also waits for 9 other jobs

Waits for Retire module.dependencies.aws_security_group.mq… MAN/decommission/module.dependencies.aws_security_group.mq (1 job)

Retire module.retail_app_ecs.module.orders_service.aws_security_group.this… MAN/decommission/module.retail_app_ecs.module.orders_service.aws_security_group.this — also waits for 13 other jobs

Waits for Retire module.retail_app_ecs.module.orders_service.aws_security_group.this… MAN/decommission/module.retail_app_ecs.module.orders_service.aws_security_group.this (1 job)

Retire module.vpc.module.vpc.aws_vpc.this… MAN/decommission/module.vpc.module.vpc.aws_vpc.this — also waits for 33 other jobs

Every job, by queue

Provide information (59 jobs)

Job	Owner	Priority	Blocked by	Closes when	Evidence	Generated file
Review the critical settings of a DynamoDB table (Data Architect) `DEC-DATA-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE` Step: The review of the open settings of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this `MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-data-architect`	Data Architect	Holds steps	—	Review the key schema setting: A person designs the keys and indexes of the replacement collection (partition and sort key, attribute names and types, secondary index keys), because the draft names only the key as the collection's unique index. Review the point in time recovery setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the TTL setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.	—	—
Review the critical settings of a DynamoDB table (Platform Architect) `DEC-OPS-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE` Step: The review of the open settings of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this `MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-platform-architect`	Platform Architect	Holds steps	—	Review the index projection and name setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the name of the DynamoDB table: A person confirms the name the replacement collection carries on the target against what refers to the source name, or accepts the new name.	—	—
Review the critical settings of a DynamoDB table (Security Architect) `DEC-SEC-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE` Step: The setting `encryption-at-rest` of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this `MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/encryption-at-rest`	Security Architect	Holds steps	—	Review the encryption at rest setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.	—	—
Review the critical settings of an ECS 5 jobs of alike steps: `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`, `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`, `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` and 2 more `DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS` The review of the open settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-platform-architect` `DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883` The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-platform-architect` `DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6` The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-platform-architect` `DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS` The review of the open settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-platform-architect` `DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS` The review of the open settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-platform-architect`	Platform Architect	Holds steps	—	Review the task definition setting: A person translates the task definition into Kubernetes Deployments and Services on SKE (CPU and memory, environment, secrets and health checks become manifest fields); the rule names a Cloud Foundry push as the other way for a simple web app.	—	One file for each job, listed under it.
Review the critical settings of an ECS (Identity Architect) 5 jobs of alike steps: `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`, `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`, `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` and 2 more `DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS` The review of the open settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-identity-architect` `DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883` The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-identity-architect` `DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6` The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-identity-architect` `DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS` The review of the open settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-identity-architect` `DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS` The review of the open settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-identity-architect`	Identity Architect	Holds steps	—	Review the service execute command setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the service task definition setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the execution role ARN of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the task role ARN of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.	—	One file for each job, listed under it.
Review the critical settings of an ECS (Network Architect) 4 jobs of alike steps: `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`, `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`, `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` and 1 more `DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS` The review of the open settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-network-architect` `DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883` The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-network-architect` `DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6` The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-network-architect` `DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS` The review of the open settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-network-architect`	Network Architect	Holds steps	—	Review the service connect values setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the service discovery setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person replaces the lookups with Kubernetes Services and cluster DNS on SKE. Review the service network placement setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the service public IP setting setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the network mode of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.	—	One file for each job, listed under it.
Review the critical settings of an ECS (Platform Architect) 5 jobs of alike steps: `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`, `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`, `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` and 2 more `DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS` `DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883` `DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6` `DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS` `DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS`	Platform Architect	Later	—	Review the service desired count setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.	—	One file for each job, listed under it.
Review the critical settings of an ECS (Security Architect) 5 jobs of alike steps: `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`, `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`, `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` and 2 more `DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS` The review of the open settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect` `DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883` The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect` `DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6` The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this/open-settings-security-architect` `DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS` The review of the open settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect` `DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS` The review of the open settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-security-architect`	Security Architect	Holds steps	—	Confirm the container definitions of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the container image registry: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the container plaintext secret env: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the container secret references: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.	—	One file for each job, listed under it.
Review the critical settings of an ECS (Network Architect) `DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS` Step: The review of the open settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this `MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect`	Network Architect	Holds steps	—	Review the service connect values setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the service discovery setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person replaces the lookups with Kubernetes Services and cluster DNS on SKE. Review the service load balancer target setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the service network placement setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the service public IP setting setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the network mode of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.	—	—
Review the critical settings of an ElastiCache (Data Architect) `DEC-DATA-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374` Step: The review of the open settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default `MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-data-architect`	Data Architect	Holds steps	—	Review the seed snapshot setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the snapshots off setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.	—	—
Review the critical settings of an ElastiCache (Platform Architect) `DEC-OPS-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374` Step: The review of the open settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default `MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect`	Platform Architect	Holds steps	—	Review the failover off setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the parameter group setting: A person maps each parameter the group changes to the parameters of the Valkey instance (for example the memory policy and the keyspace notifications) and sets them there. Review the parameter group setting: A literal value or a resolved reference in the source lets the check decide, or a person verifies the value. Review the parameter group default setting: A person confirms that the defaults of the source parameter group family are what the application needs on the target and, for a cluster-mode group, treats it as the cluster-mode question. Confirm the replication group ID of the ElastiCache replication group: A person confirms the instance name the target uses against what refers to the replication group id, or accepts the new name.	—	—
Review the critical settings of an ElastiCache (Security Architect) `DEC-SEC-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374` Step: The review of the open settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default `MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-security-architect`	Security Architect	Holds steps	—	Review the at rest encryption off setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the transit encryption enabled setting of the ElastiCache replication group: A person confirms that clients reach the cache over TLS on the target, so that data and the authentication token are not sent in clear.	`https://docs.stackit.cloud/products/databases/key-value-store/` `https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/`	—
Review the critical settings of an IAM role (Identity Architect) 5 jobs of alike steps: `module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role`, `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role`, `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role` and 2 more `DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885` The review of the open settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role `MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings` `DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913` The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role `MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings` `DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673` The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role `MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings` `DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202` The review of the open settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role `MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings` `DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0` The review of the open settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role `MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings`	Identity Architect	Holds steps	—	Review the IAM managed ECS setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources. Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.	`https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40` `https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/`	One file for each job, listed under it.
Review the critical settings of a KMS key (Identity Architect) `DEC-IAM-MODULE-RETAIL-APP-ECS-AWS-KMS-KEY-CMK` Step: The setting `deletion-window` of module.retail_app_ecs.aws_kms_key.cmk `MAN/semantic/module.retail_app_ecs.aws_kms_key.cmk/deletion-window`	Identity Architect	Holds steps	—	Review the deletion window setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.	—	—
Review the critical settings of an LB (Platform Architect) `DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS` Step: The review of the open settings of module.retail_app_ecs.module.alb.aws_lb.this `MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-platform-architect`	Platform Architect	Holds steps	—	Review the LB connection timeouts setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the request header options setting: A person decides, for each setting, what the STACKIT load balancer or the application does instead, because the STACKIT application load balancer has no setting that adds, rewrites or renames a request header towards its targets (pinned provider). Confirm the name of the load balancer: A person confirms the name the load balancer carries on the target against what refers to the source name, or accepts the new name.	—	—
Review the critical settings of an OpenSearch (Identity Architect) `DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E` Step: The review of the open settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this `MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect`	Identity Architect	Holds steps	—	Review the access and encryption settings setting: A person maps each setting to the STACKIT OpenSearch instance, which has an access list, TLS protocols and ciphers and a version, but no policy document, no free-form option map and no encryption switch (pinned provider). Review the credentials and keys settings setting: A person accepts the difference or the design changes: nothing in the source can make the target carry it. Review the domain credentials and keys setting: A person accepts the difference or the design changes: nothing in the source can make the target carry it. Review the domain settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the fine grained access setting: A person re-creates the access rules another way, because fine-grained IAM access has no equivalent on STACKIT OpenSearch, which offers an access list and credentials per instance. Confirm the effect of a neighbouring OpenSearch domain policy: A person reads the policy the neighbour attaches and confirms that the replacing OpenSearch domain lets the same principals act on it, and no more, or that the access is dropped on purpose. Review the OpenSearch domain policy resource setting: A person lists the principals and conditions the policy names, decides how their separation is kept (one instance per trust level, or in the application) and puts the source ranges into sgw_acl.	—	—
Review the critical settings of an OpenSearch (Network Architect) `DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E` Step: The review of the open settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this `MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-network-architect`	Network Architect	Holds steps	—	Review the network settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the private endpoint setting: A person translates the networks that may reach the domain into the access list (a list of CIDR ranges) of the STACKIT OpenSearch instance, which has no network or subnet input (pinned provider).	—	—
Review the critical settings of an OpenSearch (Platform Architect) `DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E` Step: The review of the open settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this `MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect`	Platform Architect	Holds steps	—	Review the cluster layout settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Choose the database engine version: A person chooses the version of the STACKIT OpenSearch instance, which has a version setting (pinned provider), and checks that the domain's clients work with it. Review the storage settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the domain name of the OpenSearch domain: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.	—	—
Review the critical settings of an OpenSearch (Security Architect) `DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E` Step: The setting `encryption-at-rest` of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this `MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/encryption-at-rest`	Security Architect	Holds steps	—	Review the encryption at rest setting: A person confirms the encryption of the STACKIT OpenSearch instance on the target; the instance has no encryption setting (pinned provider), and no STACKIT fact about it is documented here.	—	—
Review the critical settings of an RDS cluster (Data Architect) `DEC-DATA-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS` Step: The review of the open settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this `MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-data-architect`	Data Architect	Holds steps	—	Review the backup retention setting: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference. Review the final snapshot setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.	—	—
Review the critical settings of an RDS cluster (Identity Architect) `DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS` Step: The setting `admin-username-not-carried` of module.dependencies.module.catalog_rds.aws_rds_cluster.this `MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/admin-username-not-carried`	Identity Architect	Holds steps	—	Review the admin username not carried setting: A person creates the administrator on the target with a name the target accepts and confirms the application connects with it.	—	—
Review the critical settings of an RDS cluster (Network Architect) `DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS` Step: The review of the open settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this `MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-network-architect`	Network Architect	Holds steps	—	Decide how clients reach the database (the endpoint STACKIT assigns and its access list): A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the member settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the security groups setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.	—	—
Review the critical settings of an RDS cluster (Platform Architect) `DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS` Step: The review of the open settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this `MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect`	Platform Architect	Holds steps	—	Choose the database engine: For a MySQL-compatible cluster a person tests the schemas and queries on STACKIT MariaDB, the closest managed engine, because STACKIT has no MySQL product; for a PostgreSQL cluster, which lands on PostgreSQL Flex, a person confirms that no Aurora-only feature (storage auto-scaling, fast clones, global databases, serverless v2 scaling) is relied on. Choose the database engine version: For a PostgreSQL cluster a person picks a major version that PostgreSQL Flex offers (14 to 18; 18 is beta in eu01, so production needs 17 or a generally available 18) and plans an upgrade for any other version. For a MySQL-compatible cluster a person tests the MySQL 8 features in use on STACKIT MariaDB. Review the member engine setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the database name of the RDS cluster: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the identifier of the RDS cluster instance: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.	—	—
Review the critical settings of an RDS cluster (Security Architect) `DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS` Step: The review of the open settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this `MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect`	Security Architect	Holds steps	—	Decide how the administrator password is supplied: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the parameter and option groups setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the storage encryption setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person confirms the at-rest encryption of the target database on STACKIT: the PostgreSQL Flex encryption block covers customer keys only and the default without it is not stated, and a MariaDB sandbox instance had database-level encryption off, so whether its volumes are encrypted is not stated (pinned provider).	`https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_user.md#L42-L61` `https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L460-L482` `https://github.com/stackitcloud/terraform-provider-stackit/tree/v0.119.0/docs/resources`	—
Review the critical settings of an RDS cluster (Data Architect) `DEC-DATA-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS` Step: The setting `final-snapshot` of module.dependencies.module.orders_rds.aws_rds_cluster.this `MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-snapshot`	Data Architect	Holds steps	—	Review the final snapshot setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.	—	—
Review the critical settings of an RDS cluster (Identity Architect) `DEC-IAM-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS` Step: The setting `admin-username-not-carried` of module.dependencies.module.orders_rds.aws_rds_cluster.this `MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/admin-username-not-carried`	Identity Architect	Holds steps	—	Review the admin username not carried setting: A person creates the administrator on the target with a name the target accepts and confirms the application connects with it.	—	—
Review the critical settings of an RDS cluster (Network Architect) `DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS` Step: The review of the open settings of module.dependencies.module.orders_rds.aws_rds_cluster.this `MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-network-architect`	Network Architect	Holds steps	—	Decide how clients reach the database (the endpoint STACKIT assigns and its access list): A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the member settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the security groups setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.	—	—
Review the critical settings of an RDS cluster (Platform Architect) `DEC-OPS-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS` Step: The setting "identifier of the RDS cluster instance" of module.dependencies.module.orders_rds.aws_rds_cluster.this `MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/tcf-rds-cluster-instance--identifier`	Platform Architect	Holds steps	—	Confirm the database name of the RDS cluster: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the identifier of the RDS cluster instance: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.	—	`terraform/data.tf`
Review the critical settings of an RDS cluster (Security Architect) `DEC-SEC-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS` Step: The review of the open settings of module.dependencies.module.orders_rds.aws_rds_cluster.this `MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect`	Security Architect	Holds steps	—	Decide how the administrator password is supplied: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the parameter and option groups setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the storage encryption setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person confirms the at-rest encryption of the target database on STACKIT: the PostgreSQL Flex encryption block covers customer keys only and the default without it is not stated, and a MariaDB sandbox instance had database-level encryption off, so whether its volumes are encrypted is not stated (pinned provider).	`https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_user.md#L42-L61` `https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L460-L482` `https://github.com/stackitcloud/terraform-provider-stackit/tree/v0.119.0/docs/resources`	—
Review the critical settings of a security group (Network Architect) 5 jobs of alike steps: `module.retail_app_ecs.module.carts_service.aws_security_group.this`, `module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `module.retail_app_ecs.module.checkout_service.aws_security_group.this` and 2 more `DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF` The review of the open settings of module.retail_app_ecs.module.carts_service.aws_security_group.this `MAN/semantic/module.retail_app_ecs.module.carts_service.aws_security_group.this/open-settings` `DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F` The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_security_group.this `MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_security_group.this/open-settings` `DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F` The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_security_group.this `MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_security_group.this/open-settings` `DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3` The review of the open settings of module.retail_app_ecs.module.orders_service.aws_security_group.this `MAN/semantic/module.retail_app_ecs.module.orders_service.aws_security_group.this/open-settings` `DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS` The review of the open settings of module.retail_app_ecs.module.ui_service.aws_security_group.this `MAN/semantic/module.retail_app_ecs.module.ui_service.aws_security_group.this/open-settings`	Network Architect	Holds steps	—	Decide how the target enforces the protocol of the outbound rules of the security group: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. Decide how the target enforces the destinations the outbound rules of the security group allow: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference. Confirm the sources the inbound rules of the security group allow: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm the sources the inbound rules of the security group allow: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference. Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm the ports of the rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm the ports of the rules of the security group: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference. Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.	—	One file for each job, listed under it.
Review the critical settings of a subnet (Network Architect) `DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE` Step: The review of the open settings of module.vpc.module.vpc.aws_subnet.private `MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect`	Network Architect	Holds steps	—	Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the prefix setting: A literal value or a resolved reference in the source closes it, or a person confirms the value. Decide how private servers reach the internet (outbound IPv4): The knowledge base states no closing condition for this setting; the run closes it when a person decides it as a check of the knowledge base (that) fired asks, and that check's closing evidence or decision is recorded. Where the scan cannot prove what the source subnet reaches, the closing evidence is the route table the subnet follows and its default route by exact references, and for a route to an internet gateway the public IPv4 address of every server in the subnet, or an architect's statement of what the source subnet reaches. Where the source subnet has no internet route, it is an architect's decision that the network may reach the internet through the STACKIT gateway with the outbound limits written as security-group egress rules, a decision that the network is isolated (routed = false), or a documented or observed setting that removes the outbound path of a routed network. Decide how private servers reach the internet (outbound IPv4): A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm which network each subnet belongs to: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm which network each subnet belongs to: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.	—	—
Review the critical settings of a subnet (Network Architect) `DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC` Step: The review of the open settings of module.vpc.module.vpc.aws_subnet.public `MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect`	Network Architect	Holds steps	—	Confirm which route table each subnet really uses: A person decides which routes the subnet's network gets: the draft attaches no routing table to the network, and a STACKIT network gets a default gateway unless it is told not to, so what the subnet reaches can differ from AWS. Confirm which route table each subnet really uses: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person decides which routes the subnet's network gets: the draft attaches no routing table to the network, and a STACKIT network gets a default gateway unless it is told not to, so what the subnet reaches can differ from AWS. Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the prefix setting: A literal value or a resolved reference in the source closes it, or a person confirms the value. Decide how private servers reach the internet (outbound IPv4): The knowledge base states no closing condition for this setting; the run closes it when a person decides it as a check of the knowledge base (that) fired asks, and that check's closing evidence or decision is recorded. Where the scan cannot prove what the source subnet reaches, the closing evidence is the route table the subnet follows and its default route by exact references, and for a route to an internet gateway the public IPv4 address of every server in the subnet, or an architect's statement of what the source subnet reaches. Where the source subnet has no internet route, it is an architect's decision that the network may reach the internet through the STACKIT gateway with the outbound limits written as security-group egress rules, a decision that the network is isolated (routed = false), or a documented or observed setting that removes the outbound path of a routed network. Decide how private servers reach the internet (outbound IPv4): A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm which network each subnet belongs to: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm which network each subnet belongs to: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.	—	—

Approve a design (19 jobs)

Job	Owner	Priority	Blocked by	Closes when	Evidence	Generated file
Name the instance of a repeated resource a reference means `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`	Platform Architect	Holds steps	—	an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option	`https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29`	`terraform/loadbalancing.tf`
Allow the calls of STACKIT APIs that are not generally available `DEC-GEN-CONVERT-API-OPT-IN`	Platform Architect	First	—	Every API the record lists is answered in the decisions file: allowed, or refused.	`https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/functions/v1alpha/functions.json#L767-L771`	—
Choose how the data is moved `DEC-GEN-CONVERT-DATA-MOVEMENT`	Data Architect	Holds steps	—	an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option	`https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_user.md#L59-L63` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_credential.md#L51-L57` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_credential.md#L51-L57` `https://docs.stackit.cloud/products/databases/mariadb/how-tos/backup-and-restore/` `https://docs.stackit.cloud/products/databases/sqlserver-flex/how-tos/import-database-backup-from-stackit-s3-into-sqlserver-flex/` `https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/` `https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/SupportedCommands.html` `https://docs.aws.amazon.com/memorydb/latest/devguide/restrictedcommands.html` `https://docs.stackit.cloud/products/databases/opensearch/how-tos/migrate-elasticsearch-data-to-an-opensearch2-service-instance/` `https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html` `https://www.postgresql.org/docs/current/logical-replication-restrictions.html` `https://www.postgresql.org/docs/current/sql-createsubscription.html` `https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html`	`terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md` `terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md`
Draft: engine version downgrade `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`	Data Architect	Holds steps	—	an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option	`https://docs.opensearch.org/latest/tuning-your-cluster/availability-and-recovery/snapshots/snapshot-restore/` `https://www.postgresql.org/docs/current/app-pgdump.html` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_instance.md#L35` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L55` `https://docs.stackit.cloud/products/databases/opensearch/release-notes/`	`terraform/data.tf`
Decide how the clients reach an endpoint the draft exposes more widely `DEC-GEN-CONVERT-EXPOSURE-WIDENED` Step: The review of the open settings of module.dependencies.aws_mq_broker.mq `MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-security-architect`	Security Architect	Holds steps	—	The knowledge base states no closing condition for a decision of the plan; it is done when an answer in the decisions file accepts the public endpoint with its access list, or when the regenerated draft carries the network-area-only scope or the redesign and the step that creates the endpoint is free. A person sets which networks may reach the STACKIT RabbitMQ instance with its access list (a list of CIDR networks); the draft sets none.	—	`terraform/messaging.tf` `terraform/data.tf`
Decide how a load balancer reaches a workload on SKE `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`	Network Architect	Holds steps	—	an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option	`https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L420` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L70-L76` `https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L88` `https://github.com/stackitcloud/professional-service/blob/main/examples/ske-nginx-rate-limit/070-helm.tf#L15-L18` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L171` `https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/ARCHITECTURE.md#L5` `https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L25-L33`	`terraform/loadbalancing.tf`
Decide how the segmentation of ECS tasks that become pods is carried `DEC-GEN-CONVERT-POD-SEGMENTATION` 5 steps The step "Design the security attachment of…" `MAN/security/attachment-design:module.retail_app_ecs.module.carts_service.aws_security_group.this` The step "Design the security attachment of…" `MAN/security/attachment-design:module.retail_app_ecs.module.catalog_service.aws_security_group.this` The step "Design the security attachment of…" `MAN/security/attachment-design:module.retail_app_ecs.module.checkout_service.aws_security_group.this` The step "Design the security attachment of…" `MAN/security/attachment-design:module.retail_app_ecs.module.orders_service.aws_security_group.this` The step "Design the security attachment of…" `MAN/security/attachment-design:module.retail_app_ecs.module.ui_service.aws_security_group.this`	Security Architect	Holds steps	—	an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option	`https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/` `https://github.com/stackitcloud/professional-service/blob/main/examples/ske-s3-csi-juicefs/README.md#L59` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L40` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md`	—
Confirm the plan or machine type StackToIT derived from the size of the source `DEC-GEN-CONVERT-SIZE-FROM-SOURCE`	Platform Architect	Later	—	an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option	`https://docs.stackit.cloud/products/databases/key-value-store/reference/service-plans/` `https://docs.stackit.cloud/products/messaging/rabbitmq/reference/service-plans/` `https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/ske/v2/ske.json#L2048` `https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L1408` `https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/sqlserverflex/v3/sqlserverflex.json#L1455` `https://docs.stackit.cloud/products/databases/mongodb-flex/reference/flavors-and-performance-classes/` `https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/iaas/v2/iaas.json#L3660` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_instance.md#L36` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/rabbitmq_instance.md#L36` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L84`	`terraform/messaging.tf` `terraform/data.tf`
Decide where the workloads of a drafted network are placed `DEC-GEN-CONVERT-WORKLOAD-PLACEMENT`	Network Architect	Holds steps	—	an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option	`https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L79-L101` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_instance.md#L44` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_instance.md#L104` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L397-L398` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L67`	`terraform/network.tf`
Decide how logs are kept beyond 180 days `DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS` Step: The step "Configure a cold-storage log flow for…" `MAN/logs/archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks`	Platform Architect	Holds steps	—	an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option	`https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/logs/v1/logs.json#L164-L169` `https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/`	—
Decide the outbound address of the servers an allow-list names `DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST` Step: The decision step of module.vpc.module.vpc.aws_route_table.private `DEC/routing/DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST`	Network Architect	Holds steps	—	the decision DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST is answered (accepted or rejected, with its evidence) in the inputs of the run and is no longer open when the run is repeated	`https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.116.0/docs/resources/public_ip.md#L35` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.116.0/docs/resources/public_ip_associate.md#L13`	—
Review the critical settings of an LB (Network Architect) `DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS` Step: The review of the open settings of module.retail_app_ecs.module.alb.aws_lb.this `MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect`	Network Architect	Holds steps	—	Decide the ALB client access: A person confirms the carried ranges against the source rules, or decides the open client-access step, and the regenerated draft carries the result. Decide the ALB client access: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person confirms the carried ranges against the source rules, or decides the open client-access step, and the regenerated draft carries the result. Review the LB routing and addressing setting: A person decides whether the STACKIT load balancer needs an equivalent for each of them, because the STACKIT application and network load balancers have no setting for any of them (pinned provider). Review the LB subnets setting: The knowledge base states no closing condition for this setting; the run closes it when a literal value or a resolved reference in the source closes it, or when a person confirms the value. Review the LB subnets setting: A literal value or a resolved reference in the source closes it, or a person confirms the value. Decide who may reach the service over the network: A person decides whether the STACKIT load balancer is private network only; the draft picks no side and leaves a boolean variable without default and a comment, because the source's internal flag is not visible statically. Decide who may reach the service over the network: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference. Review the request handling setting: A person confirms that the application does not depend on either behaviour: the STACKIT application load balancer has neither setting and its documentation does not state the behaviour (pinned provider), also for the AWS default values.	—	—
Review the critical settings of a route table (Network Architect) `DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE` Step: The review of the open settings of module.vpc.module.vpc.aws_route_table.private `MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings`	Network Architect	Holds steps	—	Decide the outbound (egress) rules of the security group: A person confirms that the servers of the private subnets keep a restricting egress rule set in their security groups, because on STACKIT the restriction of egress is carried by egress rules, not by a route. Review the NAT fixed egress address setting: A person accepts the project's shared egress address, which can change and cannot be set, or gives each server a STACKIT public IP when a third party allow-lists the old address. Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm the destinations of the routes: A person confirms every route destination that is not the default route to an internet or NAT gateway (a CIDR, a prefix list, any IPv6 route): the draft carries none, and a specific destination needs a stackit_routing_table_route, which takes IPv4 CIDR destinations only. Confirm the targets of the routes: A person decides the next hop of each route on STACKIT: an internet gateway becomes the next hop internet, an appliance (a network interface or an instance) a next hop of type ipv4. A NAT gateway, a transit gateway or a VPC peering has no STACKIT counterpart, so the connectivity design is the person's. Re-create the routes with STACKIT next hops: A person creates the routes on the STACKIT routing table (stackit_routing_table_route, experimental) and chooses the next hops anew, because they name AWS gateways. Confirm what each route table is associated with: A person decides which networks of the Network Area take the routing table and sets routing_table_id on them: STACKIT attaches a routing table to a whole network (stackit_network.routing_table_id), there is no per-subnet association, and routing tables apply only to routed Layer 3 networks in a Network Area. Confirm what each route table is associated with: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person decides which networks of the Network Area take the routing table and sets routing_table_id on them: STACKIT attaches a routing table to a whole network (stackit_network.routing_table_id), there is no per-subnet association, and routing tables apply only to routed Layer 3 networks in a Network Area. Confirm the network of the route table: A person decides which STACKIT networks the routing table governs: the draft's custom table is organisation and Network Area scoped, so the Network Area the project joins and the routing table each network is given decide it. Confirm the network of the route table: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person decides which STACKIT networks the routing table governs: the draft's custom table is organisation and Network Area scoped, so the Network Area the project joins and the routing table each network is given decide it.	—	—
Review the critical settings of a route table (Network Architect) `DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC` Step: The review of the open settings of module.vpc.module.vpc.aws_route_table.public `MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings`	Network Architect	Holds steps	—	Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm the destinations of the routes: A person confirms every route destination that is not the default route to an internet or NAT gateway (a CIDR, a prefix list, any IPv6 route): the draft carries none, and a specific destination needs a stackit_routing_table_route, which takes IPv4 CIDR destinations only. Confirm the targets of the routes: A person decides the next hop of each route on STACKIT: an internet gateway becomes the next hop internet, an appliance (a network interface or an instance) a next hop of type ipv4. A NAT gateway, a transit gateway or a VPC peering has no STACKIT counterpart, so the connectivity design is the person's. Re-create the routes with STACKIT next hops: A person creates the routes on the STACKIT routing table (stackit_routing_table_route, experimental) and chooses the next hops anew, because they name AWS gateways. Confirm the network of the route table: A person decides which STACKIT networks the routing table governs: the draft's custom table is organisation and Network Area scoped, so the Network Area the project joins and the routing table each network is given decide it. Confirm the network of the route table: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person decides which STACKIT networks the routing table governs: the draft's custom table is organisation and Network Area scoped, so the Network Area the project joins and the routing table each network is given decide it.	—	—
Review the critical settings of a subnet (Platform Architect) `DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE` Step: The setting `availability-zone` of module.vpc.module.vpc.aws_subnet.private `MAN/semantic/module.vpc.module.vpc.aws_subnet.private/availability-zone`	Platform Architect	Holds steps	—	Confirm the availability zone of the subnet: A person decides, per source zone, which STACKIT zone (eu01-1, eu01-2 or eu01-3) takes the servers and volumes that sat in it, so that the source's spread and its failure domains are kept. Confirm the availability zone of the subnet: The record closes only by the explicit acceptance of the availability-zone difference in the decisions file; an answered placement alone never closes it.	`https://docs.stackit.cloud/products/compute-engine/server/basics/regions-and-availability-zones/` `https://docs.stackit.cloud/products/storage/block-storage/basics/service-plans/`	—
Review the critical settings of a subnet (Platform Architect) `DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC` Step: The setting `availability-zone` of module.vpc.module.vpc.aws_subnet.public `MAN/semantic/module.vpc.module.vpc.aws_subnet.public/availability-zone`	Platform Architect	Holds steps	—	Confirm the availability zone of the subnet: A person decides, per source zone, which STACKIT zone (eu01-1, eu01-2 or eu01-3) takes the servers and volumes that sat in it, so that the source's spread and its failure domains are kept. Confirm the availability zone of the subnet: The record closes only by the explicit acceptance of the availability-zone difference in the decisions file; an answered placement alone never closes it.	`https://docs.stackit.cloud/products/compute-engine/server/basics/regions-and-availability-zones/` `https://docs.stackit.cloud/products/storage/block-storage/basics/service-plans/`	—
Approve a redesign: the target cannot carry the VPC membership (the critical setting `security-group-vpc-membership`) of 12 AWS security groups: `module.retail_app_ecs.module.alb.aws_security_group.this`, `module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`, `module.retail_app_ecs.module.carts_service.aws_security_group.this`, `module.retail_app_ecs.module.catalog_service.aws_security_group.this`, `module.retail_app_ecs.module.checkout_service.aws_security_group.this`, `module.retail_app_ecs.module.orders_service.aws_security_group.this`, `module.retail_app_ecs.module.ui_service.aws_security_group.this`, `module.dependencies.aws_security_group.catalog_opensearch_sg`, `module.dependencies.aws_security_group.mq`, `module.dependencies.module.catalog_rds.aws_security_group.this`, `module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd`, `module.dependencies.module.orders_rds.aws_security_group.this`; 7 of the drafted STACKIT security groups are orphaned (no block of the draft attaches the group, so its rules restrict nothing on STACKIT as drafted): `stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix`, `stackit_security_group.retail_app_ecs_alb_this`, `stackit_security_group.retail_app_ecs_carts_service_this`, `stackit_security_group.retail_app_ecs_catalog_service_this`, `stackit_security_group.retail_app_ecs_checkout_service_this`, `stackit_security_group.retail_app_ecs_orders_service_this`, `stackit_security_group.retail_app_ecs_ui_service_this` safely (the target's scope model differs from the source's, so the source's boundary has no one-to-one counterpart) The refusal of module.dependencies.aws_security_group.catalog_opensearch_sg, module.dependencies.aws_security_group.mq, module.dependencies.module.catalog_rds.aws_security_group.this and 9 more `REF/root/security-group-membership-parity`	Network Architect	Holds steps	—	A redesign is approved (the plan suggests: close it once for the estate by one of these alternatives: confirm that the estate has one VPC (the project the draft creates is then that VPC's boundary, and the setting closes); give each source VPC a STACKIT project of its own, joined through a Network Area where their networks must reach each other; or keep one project and attach each group only to the interfaces of the networks that replace its VPC, with no rule's remote_security_group_id naming a group whose members sit in a network the source VPC kept apart. A difference that is accepted instead (the groups stay project-wide) is recorded as an accepted design difference, with who accepted it and why, never as equivalent).	—	—
Approve a redesign: the target cannot carry the critical setting `credentials-and-keys-settings` of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` safely (the target has no counterpart that carries this setting of the source) The refusal of the setting `credentials-and-keys-settings` of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this `REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/credentials-and-keys-settings`	Data Architect	Holds steps	—	Not stated: the plan names no redesign.	—	—
Approve a redesign: the target cannot carry the critical setting `domain-credentials-and-keys` of `module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` safely (the target has no counterpart that carries this setting of the source) The refusal of the setting `domain-credentials-and-keys` of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this `REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/domain-credentials-and-keys`	Data Architect	Holds steps	—	Not stated: the plan names no redesign.	—	—

Perform migration work (166 jobs)

Job	Owner	Priority	Blocked by	Closes when	Evidence	Generated file
Review the critical settings of a CloudWatch log group (Platform Architect) `DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-CLOUDWATCH-LOG-GROUP-ECS-TASKS` Step: The step "Choose a static label and send the name of…" `MAN/logs/label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks`	Platform Architect	Holds steps	—	Confirm the name of the log group: A person decides the label convention under which the log group name survives in STACKIT Logs and reconfigures each producer to send it; the draft configures no shipper.	—	—
Review the critical settings of an EIP (Network Architect) `DEC-NET-MODULE-VPC-MODULE-VPC-AWS-EIP-NAT` Step: The setting `public-address` of module.vpc.module.vpc.aws_eip.nat `MAN/semantic/module.vpc.module.vpc.aws_eip.nat/public-address`	Network Architect	Holds steps	—	Review the public address setting: A person decides how peers that allow-list the Elastic IP are served: STACKIT egress uses the project's shared address, which differs from the Elastic IP, cannot be set and can change; a STACKIT public IP per server keeps its address.	—	—
Review the critical settings of an ElastiCache (Network Architect) `DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374` Step: The setting `network-placement` of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default `MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/network-placement`	Network Architect	Holds steps	—	Review the network placement setting: A person decides how clients reach the Valkey instance, which has no subnet or security-group setting, for example by limiting client CIDR ranges with its access parameter.	—	—
Review the critical settings of an IAM role (Identity Architect) 5 jobs of alike steps: `module.retail_app_ecs.module.carts_service.aws_iam_role.task_role`, `module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role`, `module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role` and 2 more `DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA` The review of the open settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role `MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings` `DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1` The review of the open settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role `MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings` `DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6` The review of the open settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role `MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings` `DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65` The review of the open settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role `MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings` `DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE` The review of the open settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role `MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings`	Identity Architect	Holds steps	—	Review the IAM managed customer policy setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Review the IAM managed customer policy setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources. Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.	`https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40` `https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/`	One file for each job, listed under it.
Review the critical settings of an MQ broker (Identity Architect) `DEC-IAM-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ` Step: The review of the open settings of module.dependencies.aws_mq_broker.mq `MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-identity-architect`	Identity Architect	Holds steps	—	Decide the users of the message broker: A person sets the permissions of each broker user on the generated RabbitMQ credentials and hands the new passwords to the clients. Confirm the user name: A person confirms the user names the clients log in with; STACKIT generates each RabbitMQ credential's username, so the clients move to the new usernames.	—	—
Review the critical settings of an MQ broker (Network Architect) `DEC-NET-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ` Step: The setting `broker-network` of module.dependencies.aws_mq_broker.mq `MAN/semantic/module.dependencies.aws_mq_broker.mq/broker-network`	Network Architect	Holds steps	—	Decide the network of the message broker: A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.	—	—
Review the critical settings of an MQ broker (Platform Architect) `DEC-OPS-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ` Step: The review of the open settings of module.dependencies.aws_mq_broker.mq `MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect`	Platform Architect	Holds steps	—	Choose the database engine version: A person picks the RabbitMQ version for the target instance, since the versions STACKIT offers are not stated for this move. Confirm the name of the message broker: A person confirms the broker name the target uses against what refers to the source broker name, or accepts the new name. Choose the deployment mode of the broker: A person decides whether the target must survive a zone failure as the source deployment mode did, and finds out which RabbitMQ plan, if any, gives that, since the zone spread of the plans is not stated.	—	—
Review the critical settings of an MQ broker (Security Architect) `DEC-SEC-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ`	Security Architect	Later	—	Decide how the user password is supplied: A person hands the clients the password of the generated target credential instead of the literal in the source.	—	—
Review the critical settings of a NAT gateway (Network Architect) `DEC-NET-MODULE-VPC-MODULE-VPC-AWS-NAT-GATEWAY-THIS` Step: The review of the open settings of module.vpc.module.vpc.aws_nat_gateway.this `MAN/semantic/module.vpc.module.vpc.aws_nat_gateway.this/open-settings`	Network Architect	Holds steps	—	Decide the fixed outbound IP address: A person decides how peers that allow-list the Elastic IP are served: a routed STACKIT network leaves by the project's shared egress address, which cannot be set and can change, so the allow-list follows it or each server gets a STACKIT public IP. Review the NAT placement setting: A person decides whether the egress path must stay in one zone or per zone, because the STACKIT documentation does not state whether the implicit outbound path is scoped to a zone. Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.	—	—
Review the critical settings of a Secrets Manager secret (Security Architect) `DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB` Step: The review of the open settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db `MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db/open-settings-security-architect`	Security Architect	Holds steps	—	Confirm the customer-managed encryption key: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm the customer-managed encryption key: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the secret value setting: A person decides per secret where the value comes from (the same value from a secure source, or a new one) and the Vault path the application reads, then writes it with a Vault KV v2 client.	`https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/secretsmanager_instance.md#L34`	—
Review the critical settings of a Secrets Manager secret (Security Architect) `DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E` Step: The review of the open settings of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch `MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch/open-settings-security-architect`	Security Architect	Holds steps	—	Confirm the customer-managed encryption key: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm the customer-managed encryption key: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the secret value setting: A person decides per secret where the value comes from (the same value from a secure source, or a new one) and the Vault path the application reads, then writes it with a Vault KV v2 client.	`https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/` `https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/secretsmanager_instance.md#L34`	—
Review the critical settings of a Secrets Manager secret (Security Architect) `DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ` Step: The setting `secret-value` of module.retail_app_ecs.aws_secretsmanager_secret.mq `MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.mq/secret-value`	Security Architect	Holds steps	—	Review the secret value setting: A person decides per secret where the value comes from (the same value from a secure source, or a new one) and the Vault path the application reads, then writes it with a Vault KV v2 client.	—	—
Review the critical settings of a Secrets Manager secret (Security Architect) `DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB` Step: The setting `secret-value` of module.retail_app_ecs.aws_secretsmanager_secret.orders_db `MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.orders_db/secret-value`	Security Architect	Holds steps	—	Review the secret value setting: A person decides per secret where the value comes from (the same value from a secure source, or a new one) and the Vault path the application reads, then writes it with a Vault KV v2 client.	—	—
Review the critical settings of a VPC (Network Architect) `DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS` Step: The review of the open settings of module.vpc.module.vpc.aws_vpc.this `MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect`	Network Architect	Holds steps	—	Review the default nacl rules setting: A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic. Review the default route table setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Review the default route table setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the default security group omitted direction setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Review the default security group omitted direction setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the main table set setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Review the main table set setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.	—	—
Configure the archive of the logs kept beyond 180 days `DEC-OPS-STACKITLOGS-ACTION-ARCHIVE-FLOW`	Platform Architect	Later	—	a line the log producers of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks send is found both in the Logs instance and in the archive, and logs older than 180 days are readable from the archive	—	—
Choose the label a log name is sent under `DEC-OPS-STACKITLOGS-ACTION-LABEL-CONVENTION`	Platform Architect	Later	—	a static label is chosen, the log producers of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks send its name as the value of that label, and a line one of them sends is found by that label	—	—
Prepare what the target needs before a resource of the plan works `DEC-OPS-STACKITLOGS-ACTION-TARGET-PRECONDITION` Step: The step "Before any log source writes to stackit_logs_instance.logs_retention_180d" `MAN/logs/token:stackit_logs_instance.logs_retention_180d`	Platform Architect	Holds steps	—	a write access token for stackit_logs_instance.logs_retention_180d exists, the access control list of the instance is set, and a log line sent with the token to the ingest address of the instance is accepted	—	—
Complete a set the source shows only in part `DEC-SEC-STACKITSG-ACTION-INCOMPLETE` 2 steps The step "Re-create the rules beyond the known set of group…" `MAN/security/aws/incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group-module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.0.:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules-b506f3` The step "Re-create the rules beyond the known set of group…" `MAN/security/aws/incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group-module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.0.:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules-a538f6`	Security Architect	Holds steps	—	every entry of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules is known and has a rule, or it is confirmed that the known entries are all every entry of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules is known and has a rule, or it is confirmed that the known entries are all	—	—
Place a rule the draft could not attribute to a group `DEC-SEC-STACKITSG-ACTION-UNPLACED` 2 steps The step "Place the source rule…" `MAN/security/aws/unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules.0-217968` The step "Place the source rule…" `MAN/security/aws/unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules.0-f26028`	Security Architect	Holds steps	—	the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] is written on the security group it belongs to the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] is written on the security group it belongs to	—	—
Replace a routing table by STACKIT's default routing `DEC-NET-STACKITROUTE-STATEMENT-NOT-DRAFTED` 2 steps The routing precondition of module.vpc.module.vpc.aws_route_table.private `MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.private` The routing precondition of module.vpc.module.vpc.aws_route_table.public `MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.public`	Network Architect	Holds steps	—	The knowledge base states no closing condition for a statement of the plan; it is done when the target project exists outside a Network Area and the reachability of its networks is observed on it. the target project exists outside a Network Area, or the architect has decided how module.vpc.module.vpc.aws_route_table.private is replaced inside the area the decision DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST is answered (accepted or rejected, with its evidence) in the inputs of the run and is no longer open when the run is repeated the target project exists outside a Network Area, or the architect has decided how module.vpc.module.vpc.aws_route_table.public is replaced inside the area	—	—
Service account: manual review `DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW` 10 steps The step "Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this…" `MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.execution_role_arn-586451` The step "Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this gets…" `MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.task_role_arn-686488` The step "Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this…" `MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.execution_role_arn-dedc98` The step "Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this…" `MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.task_role_arn-15a967` The step "Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this…" `MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.execution_role_arn-b70bc2` The step "Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this…" `MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.task_role_arn-9651e2` The step "Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this…" `MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.execution_role_arn-eacc48` The step "Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this…" `MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.task_role_arn-d0b927` The step "Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this pulls…" `MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.execution_role_arn-2d22d2` The step "Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this gets…" `MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.task_role_arn-0c66b7`	Identity Architect	Holds steps	—	the identity fact of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed the identity fact of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.carts_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed the identity fact of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed the identity fact of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed the identity fact of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed the identity fact of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed the identity fact of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed the identity fact of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.orders_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed the identity fact of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed the identity fact of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.ui_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed	—	—
Apply the block of terraform/network.tf with OpenTofu The OpenTofu step for stackit_network.vpc_vpc_private `TF/stackit_network.vpc_vpc_private`	Network Architect	Holds steps	`DEC-GEN-CONVERT-WORKLOAD-PLACEMENT`	OpenTofu applies the blocks of terraform/network.tf and the checks of their steps in execution/verify/checks.md hold.	`execution/verify/checks.md`	`terraform/network.tf`
Apply the block of terraform/network.tf with OpenTofu The OpenTofu step for stackit_network.vpc_vpc_public `TF/stackit_network.vpc_vpc_public`	Network Architect	Later	—	OpenTofu applies the blocks of terraform/network.tf and the checks of their steps in execution/verify/checks.md hold.	`execution/verify/checks.md`	`terraform/network.tf`
Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.alb.aws_lb.this (PLAINTEXT_PUBLIC_LISTENER): The source load balancer module.retail_app_ecs.module.alb.aws_lb.this is internet-facing and every listener it states is HTTP (port 80 forwards to its targets, no listener is HTTPS or TLS): clients reach the application without transport encryption. The security acceptance of module.retail_app_ecs.module.alb.aws_lb.this `MAN/security/accept/module.retail_app_ecs.module.alb.aws_lb.this:plaintext-public-listener` Open fields (1, 1 still needed) accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.alb.aws_lb.this that the draft carries: The source load balancer module.retail_app_ecs.module.alb.aws_lb.this is internet-facing and every listener it states is HTTP (port 80 forwards to its targets, no listener is HTTPS or TLS): clients reach the application without transport encryption. In the draft: the drafted listener of stackit_application_load_balancer.retail_app_ecs_alb_this is plain HTTP on port 80, as the source states it; the public address is kept and no HTTPS listener or certificate is added. Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)	Security Architect	Holds steps	—	the acceptance (who, when, reference) or the hardening is recorded for module.retail_app_ecs.module.alb.aws_lb.this (PLAINTEXT_PUBLIC_LISTENER)	—	—
Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.carts_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.carts_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. The security acceptance of module.retail_app_ecs.module.carts_service.aws_security_group.this `MAN/security/accept/module.retail_app_ecs.module.carts_service.aws_security_group.this:open-ingress-application-port` Open fields (1, 1 still needed) accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.carts_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.carts_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)	Security Architect	Holds steps	`DEC-GEN-CONVERT-POD-SEGMENTATION`	the acceptance (who, when, reference) or the hardening is recorded for module.retail_app_ecs.module.carts_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT)	—	—
Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.catalog_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.catalog_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. The security acceptance of module.retail_app_ecs.module.catalog_service.aws_security_group.this `MAN/security/accept/module.retail_app_ecs.module.catalog_service.aws_security_group.this:open-ingress-application-port` Open fields (1, 1 still needed) accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.catalog_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.catalog_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)	Security Architect	Holds steps	`DEC-GEN-CONVERT-POD-SEGMENTATION`	the acceptance (who, when, reference) or the hardening is recorded for module.retail_app_ecs.module.catalog_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT)	—	—
Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.checkout_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.checkout_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. The security acceptance of module.retail_app_ecs.module.checkout_service.aws_security_group.this `MAN/security/accept/module.retail_app_ecs.module.checkout_service.aws_security_group.this:open-ingress-application-port` Open fields (1, 1 still needed) accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.checkout_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.checkout_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)	Security Architect	Holds steps	`DEC-GEN-CONVERT-POD-SEGMENTATION`	the acceptance (who, when, reference) or the hardening is recorded for module.retail_app_ecs.module.checkout_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT)	—	—
Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.orders_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.orders_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. The security acceptance of module.retail_app_ecs.module.orders_service.aws_security_group.this `MAN/security/accept/module.retail_app_ecs.module.orders_service.aws_security_group.this:open-ingress-application-port` Open fields (1, 1 still needed) accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.orders_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.orders_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)	Security Architect	Holds steps	`DEC-GEN-CONVERT-POD-SEGMENTATION`	the acceptance (who, when, reference) or the hardening is recorded for module.retail_app_ecs.module.orders_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT)	—	—
Accept, or harden, the HIGH weakness of module.retail_app_ecs.module.ui_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT): The source security group module.retail_app_ecs.module.ui_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. The security acceptance of module.retail_app_ecs.module.ui_service.aws_security_group.this `MAN/security/accept/module.retail_app_ecs.module.ui_service.aws_security_group.this:open-ingress-application-port` Open fields (1, 1 still needed) accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.ui_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.ui_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)	Security Architect	Holds steps	`DEC-GEN-CONVERT-POD-SEGMENTATION`	the acceptance (who, when, reference) or the hardening is recorded for module.retail_app_ecs.module.ui_service.aws_security_group.this (OPEN_INGRESS_APPLICATION_PORT)	—	—
Apply the blocks of terraform/security.tf with OpenTofu (the blocks of the Identity Architect) 4 steps The OpenTofu step for stackit_kms_keyring.migrated `TF/stackit_kms_keyring.migrated` The OpenTofu step for stackit_kms_key.retail_app_ecs_cmk `TF/stackit_kms_key.retail_app_ecs_cmk` The OpenTofu step for stackit_secretsmanager_instance.migrated_secrets `TF/stackit_secretsmanager_instance.migrated_secrets` The OpenTofu step for stackit_secretsmanager_user.migration `TF/stackit_secretsmanager_user.migration`	Identity Architect	Later	—	OpenTofu applies the blocks of terraform/security.tf and the checks of their steps in execution/verify/checks.md hold.	`execution/verify/checks.md`	`terraform/security.tf`
Run the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db The STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db `API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db` STACKIT API step, generated, tested offline	Identity Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`	The call answers as the plan expects and the checks of the step in execution/verify/checks.md hold.	`execution/verify/checks.md`	—
Run the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch The STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch `API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch` STACKIT API step, generated, tested offline	Identity Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`	The call answers as the plan expects and the checks of the step in execution/verify/checks.md hold.	`execution/verify/checks.md`	—
Run the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq The STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq `API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq` STACKIT API step, generated, tested offline	Identity Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`	The call answers as the plan expects and the checks of the step in execution/verify/checks.md hold.	`execution/verify/checks.md`	—
Run the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db The STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db `API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db` STACKIT API step, generated, tested offline	Identity Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`	The call answers as the plan expects and the checks of the step in execution/verify/checks.md hold.	`execution/verify/checks.md`	—
Apply the blocks of terraform/security.tf with OpenTofu (the blocks of the Network Architect) 12 steps The OpenTofu step for stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix `TF/stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix` The OpenTofu step for stackit_security_group.retail_app_ecs_alb_this `TF/stackit_security_group.retail_app_ecs_alb_this` The OpenTofu step for stackit_security_group.retail_app_ecs_carts_service_this `TF/stackit_security_group.retail_app_ecs_carts_service_this` The OpenTofu step for stackit_security_group.retail_app_ecs_catalog_service_this `TF/stackit_security_group.retail_app_ecs_catalog_service_this` The OpenTofu step for stackit_security_group.retail_app_ecs_checkout_service_this `TF/stackit_security_group.retail_app_ecs_checkout_service_this` The OpenTofu step for stackit_security_group.retail_app_ecs_orders_service_this `TF/stackit_security_group.retail_app_ecs_orders_service_this` The OpenTofu step for stackit_security_group.retail_app_ecs_ui_service_this `TF/stackit_security_group.retail_app_ecs_ui_service_this` The OpenTofu step for stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1 `TF/stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1` The OpenTofu step for stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1 `TF/stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1` The OpenTofu step for stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1 `TF/stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1` The OpenTofu step for stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1 `TF/stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1` The OpenTofu step for stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1 `TF/stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1`	Network Architect	Later	—	OpenTofu applies the blocks of terraform/security.tf and the checks of their steps in execution/verify/checks.md hold.	`execution/verify/checks.md`	`terraform/security.tf`
Apply the blocks of terraform/identity.tf with OpenTofu 20 steps The OpenTofu step for stackit_service_account.retail_app_ecs_carts_service_task_execution_role `TF/stackit_service_account.retail_app_ecs_carts_service_task_execution_role` The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role `TF/stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role` The OpenTofu step for stackit_service_account.retail_app_ecs_carts_service_task_role `TF/stackit_service_account.retail_app_ecs_carts_service_task_role` The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role `TF/stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role` The OpenTofu step for stackit_service_account.retail_app_ecs_catalog_service_task_execution_role `TF/stackit_service_account.retail_app_ecs_catalog_service_task_execution_role` The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role `TF/stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role` The OpenTofu step for stackit_service_account.retail_app_ecs_catalog_service_task_role `TF/stackit_service_account.retail_app_ecs_catalog_service_task_role` The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role `TF/stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role` The OpenTofu step for stackit_service_account.retail_app_ecs_checkout_service_task_execution_role `TF/stackit_service_account.retail_app_ecs_checkout_service_task_execution_role` The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role `TF/stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role` The OpenTofu step for stackit_service_account.retail_app_ecs_checkout_service_task_role `TF/stackit_service_account.retail_app_ecs_checkout_service_task_role` The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role `TF/stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role` The OpenTofu step for stackit_service_account.retail_app_ecs_orders_service_task_execution_role `TF/stackit_service_account.retail_app_ecs_orders_service_task_execution_role` The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role `TF/stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role` The OpenTofu step for stackit_service_account.retail_app_ecs_orders_service_task_role `TF/stackit_service_account.retail_app_ecs_orders_service_task_role` The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role `TF/stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role` The OpenTofu step for stackit_service_account.retail_app_ecs_ui_service_task_execution_role `TF/stackit_service_account.retail_app_ecs_ui_service_task_execution_role` The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role `TF/stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role` The OpenTofu step for stackit_service_account.retail_app_ecs_ui_service_task_role `TF/stackit_service_account.retail_app_ecs_ui_service_task_role` The OpenTofu step for stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role `TF/stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role`	Identity Architect	Later	—	OpenTofu applies the blocks of terraform/identity.tf and the checks of their steps in execution/verify/checks.md hold.	`execution/verify/checks.md`	`terraform/identity.tf`
Apply the blocks of terraform/data.tf with OpenTofu 8 steps The OpenTofu step for stackit_mongodbflex_instance.dynamodb_tables `TF/stackit_mongodbflex_instance.dynamodb_tables` The OpenTofu step for stackit_valkey_instance.dependencies_checkout_elasticache_redis_default `TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default` The OpenTofu step for stackit_valkey_credential.dependencies_checkout_elasticache_redis_default `TF/stackit_valkey_credential.dependencies_checkout_elasticache_redis_default` The OpenTofu step for stackit_mariadb_instance.dependencies_catalog_rds_this `TF/stackit_mariadb_instance.dependencies_catalog_rds_this` The OpenTofu step for stackit_mariadb_credential.dependencies_catalog_rds_this `TF/stackit_mariadb_credential.dependencies_catalog_rds_this` The OpenTofu step for stackit_postgresflex_instance.dependencies_orders_rds_this `TF/stackit_postgresflex_instance.dependencies_orders_rds_this` The OpenTofu step for stackit_postgresflex_user.dependencies_orders_rds_this `TF/stackit_postgresflex_user.dependencies_orders_rds_this` The OpenTofu step for stackit_postgresflex_database.dependencies_orders_rds_this_orders `TF/stackit_postgresflex_database.dependencies_orders_rds_this_orders` Stands on a default nobody confirmed: public endpoint (TF/stackit_mariadb_instance.dependencies_catalog_rds_this, TF/stackit_mariadb_credential.dependencies_catalog_rds_this) Stands on a default nobody confirmed: size derived from the source (TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default, TF/stackit_valkey_credential.dependencies_checkout_elasticache_redis_default) Stands on a default nobody confirmed: public endpoint (TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default, TF/stackit_valkey_credential.dependencies_checkout_elasticache_redis_default) Stands on a default nobody confirmed: size derived from the source (TF/stackit_postgresflex_instance.dependencies_orders_rds_this, TF/stackit_postgresflex_user.dependencies_orders_rds_this, TF/stackit_postgresflex_database.dependencies_orders_rds_this_orders) Stands on a default nobody confirmed: public endpoint (TF/stackit_postgresflex_instance.dependencies_orders_rds_this, TF/stackit_postgresflex_user.dependencies_orders_rds_this, TF/stackit_postgresflex_database.dependencies_orders_rds_this_orders)	Data Architect	Later	—	OpenTofu applies the blocks of terraform/data.tf and the checks of their steps in execution/verify/checks.md hold.	`execution/verify/checks.md`	`terraform/data.tf`
Close what the plan lists as UNKNOWN, from the move host, with read-only commands; no password goes on a command line or into the history of the shell. Source (`valkey-cli -h <source-host> -p <source-port> --tls`, without --tls where the source has none): `INFO server` (the engine and its version), `INFO keyspace` and `DBSIZE` (the keys and the keys with an expiry; on every primary when cluster mode is on, listed with `CLUSTER NODES`), `INFO memory` (used_memory and maxmemory), `SCAN 0 COUNT 100` with `TYPE`, `DUMP` and `PTTL` of a few keys of each family (the commands of the copy; the types the copy has no branch for show here), and the credential the copy signs in with. Target (after the draft is applied and the instance and a service key exist; `valkey-cli -u rediss://<target-user>@<target-host>:<target-port> --tls --sni <target-host>`): `INFO server` (Valkey 8), `DBSIZE` (0) and `INFO memory`; do not expect `CONFIG`, `ACL` or `MODULE`, which a probe found denied to the service key. Check that the move host is in `parameters.sgw_acl` of the instance (remove it afterwards), reaches both ends, and that the clients of the cache are listed with the TLS and the credential each uses. Runbook section: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#preflight`. The data preflight of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default `MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/preflight` Open fields (10, 10 still needed) copy volume: UNKNOWN — supplied by Data Architect (the amount of data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default to copy: the used space measured on the source; the provisioned capacity of the source is not the amount of data; closed when the measured amount and the date of the measurement are recorded) change rate: UNKNOWN — supplied by Data Architect (how much data the writers of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default change per hour; closed when the rate measured over a representative period is recorded, with the time a final pass needs at that rate) write-freeze window: UNKNOWN — supplied by Data Architect (the window in which the writers of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default stop for the final pass; closed when the owner of the application agrees the start and the end of the window and it is recorded) last sync: UNKNOWN — supplied by Data Architect (the time the final pass ends and its checks hold; closed when the time of the final pass and the result of its checks are recorded) return point: UNKNOWN — supplied by Data Architect (the state of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default the migration returns to on a rollback: the source as it was at the write freeze, or a named snapshot or backup; closed when the return point is recorded with its time and how it is restored) consistency check: UNKNOWN — supplied by Data Architect (how the copy of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is shown complete and unchanged after the final pass: the used space and a checksum of the data (of the files, or the row counts of the tables) agree with the source; closed when the method is agreed and its result after the final pass is recorded) validation on the target: UNKNOWN — supplied by Migration Owner (the test the application that uses module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default passes on STACKIT with the copied data before the cutover, agreed with the owner of the application; closed when the test passes on the target and its result is recorded) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is kept is recorded) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover) data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)	Data Architect	Holds steps	—	every UNKNOWN check of the plan is HOLDS or FAILS; the engine version, the number of keys and their memory, the types of the keys and the shards of the source are known, and the clients of the cache are listed	—	`terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md`
Rehearse the copy on a sample into a scratch Key Value Store instance of the same plan and version as the draft's instance (a second instance, deleted afterwards: the real instance must stay empty for the final copy): copy the keys of a prefix or a few thousand keys of every family with the client of the copy (`SCAN` with `MATCH`, `DUMP`, `PTTL`, `RESTORE` with the remaining time to live), note the keys a second, the bytes a second and the keys RESTORE refuses, point one copy of the application at the scratch instance with TLS and run its own test suite, and compute the freeze window from the throughput: keys / (keys a second) is the lower bound of the copy. Delete the scratch instance afterwards. Runbook section: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#rehearsal`. The data rehearsal of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default `MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/rehearsal`	Data Architect	Holds steps	—	the keys a second and the refused keys are recorded, the application's tests pass against the scratch instance over TLS, and the write-freeze window is agreed from them	—	—
Decide how module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events (aws_cloudwatch_event_rule) moves to STACKIT and set its target up by hand, or record that it needs none: the draft writes no resource for it The manual migration of module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events `MAN/unit/module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events`	Platform Architect	Holds steps	—	the STACKIT counterpart of module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events is set up and checked, or the decision that it needs none is recorded	—	—
Decide how module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights (aws_cloudwatch_log_group) moves to STACKIT and set its target up by hand, or record that it needs none: the draft writes no resource for it The manual migration of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights `MAN/unit/module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights`	Platform Architect	Holds steps	—	the STACKIT counterpart of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights is set up and checked, or the decision that it needs none is recorded	—	—
Decide how module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs (aws_cloudwatch_log_resource_policy) moves to STACKIT and set its target up by hand, or record that it needs none: the draft writes no resource for it The manual migration of module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs `MAN/unit/module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs`	Platform Architect	Holds steps	—	the STACKIT counterpart of module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs is set up and checked, or the decision that it needs none is recorded	—	—
Apply the block of terraform/loadbalancing.tf with OpenTofu The OpenTofu step for stackit_application_load_balancer.retail_app_ecs_alb_this `TF/stackit_application_load_balancer.retail_app_ecs_alb_this`	Network Architect	Holds steps	`DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`	OpenTofu applies the blocks of terraform/loadbalancing.tf and the checks of their steps in execution/verify/checks.md hold.	`execution/verify/checks.md`	`terraform/loadbalancing.tf`
Apply the block of terraform/observability.tf with OpenTofu The OpenTofu step for stackit_logs_instance.logs_retention_180d `TF/stackit_logs_instance.logs_retention_180d`	Platform Architect	Later	—	OpenTofu applies the blocks of terraform/observability.tf and the checks of their steps in execution/verify/checks.md hold.	`execution/verify/checks.md`	`terraform/observability.tf`
Apply the block of terraform/kubernetes.tf with OpenTofu The OpenTofu step for stackit_ske_cluster.retail_app_ecs_cluster `TF/stackit_ske_cluster.retail_app_ecs_cluster`	Platform Architect	Later	—	OpenTofu applies the blocks of terraform/kubernetes.tf and the checks of their steps in execution/verify/checks.md hold.	`execution/verify/checks.md`	`terraform/kubernetes.tf`
Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health The step "Fetch the kubeconfig of the SKE cluster(s) of the draft and check their health" `MAN/draft/handover/cluster-access/kubeconfig-md`	Platform Architect	Holds steps	—	every step of terraform/handover/cluster-access/kubeconfig.md is done and its checks hold	—	`terraform/handover/cluster-access/kubeconfig.md`
Close what the plan lists as UNKNOWN, from the move host, with read-only statements; no password goes on a command line (the client prompts for it). Source (`mysql --host=<source-host> --port=<source-port> --user=<source-user> --password`): `SELECT VERSION();`, `SELECT table_schema, table_collation, COUNT() FROM information_schema.tables GROUP BY 1, 2;` and the same over `information_schema.columns` for the collations the columns use, `SELECT routine_schema, routine_type, COUNT() FROM information_schema.routines GROUP BY 1, 2;` and the triggers, events and views the same way, the DEFINER accounts (`SELECT DISTINCT definer FROM information_schema.routines`, and for the views and events), `SELECT user, host, plugin FROM mysql.user ORDER BY 1, 2;` and `SHOW GRANTS FOR '<user>'@'<host>';` for each (names and plugins, never the authentication string), `SELECT @@GLOBAL.sql_mode, @@GLOBAL.time_zone, @@GLOBAL.gtid_mode;`, `SHOW DATABASES;` and the engines and the tables without a primary key (the queries of the check table-engines-and-keys). Target (after the draft is applied and the instance and its service key exist; `mysql --host=<target-host> --port=<target-port> --user=<target-user> --password --database=<target-database>`): `SELECT VERSION();`, `SELECT @@GLOBAL.sql_mode, @@GLOBAL.time_zone;`, `SHOW VARIABLES LIKE 'character_set%';`, `SHOW VARIABLES LIKE 'collation%';`, `SHOW COLLATION WHERE Collation LIKE 'utf8mb4%0900%';` and `SHOW GRANTS;`. Check that the move host is in `parameters.sgw_acl` of the instance (remove it afterwards), reaches both ends and uses the custom port of the instance's service key. Runbook section: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md#preflight`. The data preflight of module.dependencies.module.catalog_rds.aws_rds_cluster.this `MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/preflight` Open fields (10, 10 still needed) copy volume: UNKNOWN — supplied by Data Architect (the amount of data of module.dependencies.module.catalog_rds.aws_rds_cluster.this to copy: the used space measured on the source; the provisioned capacity of the source is not the amount of data; closed when the measured amount and the date of the measurement are recorded) change rate: UNKNOWN — supplied by Data Architect (how much data the writers of module.dependencies.module.catalog_rds.aws_rds_cluster.this change per hour; closed when the rate measured over a representative period is recorded, with the time a final pass needs at that rate) write-freeze window: UNKNOWN — supplied by Data Architect (the window in which the writers of module.dependencies.module.catalog_rds.aws_rds_cluster.this stop for the final pass; closed when the owner of the application agrees the start and the end of the window and it is recorded) last sync: UNKNOWN — supplied by Data Architect (the time the final pass ends and its checks hold; closed when the time of the final pass and the result of its checks are recorded) return point: UNKNOWN — supplied by Data Architect (the state of module.dependencies.module.catalog_rds.aws_rds_cluster.this the migration returns to on a rollback: the source as it was at the write freeze, or a named snapshot or backup; closed when the return point is recorded with its time and how it is restored) consistency check: UNKNOWN — supplied by Data Architect (how the copy of module.dependencies.module.catalog_rds.aws_rds_cluster.this is shown complete and unchanged after the final pass: the used space and a checksum of the data (of the files, or the row counts of the tables) agree with the source; closed when the method is agreed and its result after the final pass is recorded) validation on the target: UNKNOWN — supplied by Migration Owner (the test the application that uses module.dependencies.module.catalog_rds.aws_rds_cluster.this passes on STACKIT with the copied data before the cutover, agreed with the owner of the application; closed when the test passes on the target and its result is recorded) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.catalog_rds.aws_rds_cluster.this is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.catalog_rds.aws_rds_cluster.this is kept is recorded) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover) data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.catalog_rds.aws_rds_cluster.this before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)	Data Architect	Holds steps	—	every UNKNOWN check of the plan is HOLDS or FAILS; each collation of the source is known on the target or changed, each DEFINER account exists on the target or is settled, and the databases of the source have a place on the target	—	`terraform/handover/database-dependencies_catalog_rds_this/data-move.md`
Rehearse the dump and the load into a scratch instance of the same plan and version as the draft's instance (a second STACKIT MariaDB instance, deleted afterwards: the real instance must stay empty for the final load) from a copy of the source (a restore of a snapshot into a scratch RDS or Aurora database, so that production is not loaded): `mysqldump --host=<source-host> --port=<source-port> --user=<source-user> --password --single-transaction --routines --triggers --events --set-gtid-purged=OFF --no-tablespaces --databases <database-1> <database-2> --result-file=<dump-file>.sql`, then `mysql --host=<target-host> --port=<target-port> --user=<target-user> --password --database=<target-database> < <dump-file>.sql 2> load.log` into the scratch instance. Note the elapsed time of the dump, of the load and of the verification, read every line of `load.log`, run the application's own test suite against the scratch instance, and compare the routines, triggers, events and views that were created with the source's. Delete the scratch instance and the dump afterwards. Runbook section: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md#rehearsal`. The data rehearsal of module.dependencies.module.catalog_rds.aws_rds_cluster.this `MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/rehearsal`	Data Architect	Holds steps	—	the elapsed times are recorded, every error of the load is settled, the application's tests pass against the scratch instance and the write-freeze window is agreed from them	—	—
Apply the blocks of terraform/data.tf with OpenTofu 2 steps The OpenTofu step for stackit_opensearch_instance.dependencies_catalog_opensearch_this `TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this` The OpenTofu step for stackit_opensearch_credential.dependencies_catalog_opensearch_this `TF/stackit_opensearch_credential.dependencies_catalog_opensearch_this` Stands on a default nobody confirmed: public endpoint (TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this, TF/stackit_opensearch_credential.dependencies_catalog_opensearch_this)	Data Architect	Holds steps	`DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`	OpenTofu applies the blocks of terraform/data.tf and the checks of their steps in execution/verify/checks.md hold.	`execution/verify/checks.md`	`terraform/data.tf`
Preflight of the data move of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this: close the checks the plan lists as UNKNOWN (versions, extensions, roles, network and TLS) with read-only queries on the source and on the target, before any data moves. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#decide-and-check`. The data preflight of module.dependencies.module.orders_rds.aws_rds_cluster.this `MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/preflight` Open fields (10, 10 still needed) copy volume: UNKNOWN — supplied by Data Architect (the amount of data of module.dependencies.module.orders_rds.aws_rds_cluster.this to copy: the used space measured on the source; the provisioned capacity of the source is not the amount of data; closed when the measured amount and the date of the measurement are recorded) change rate: UNKNOWN — supplied by Data Architect (how much data the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this change per hour; closed when the rate measured over a representative period is recorded, with the time a final pass needs at that rate) write-freeze window: UNKNOWN — supplied by Data Architect (the window in which the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this stop for the final pass; closed when the owner of the application agrees the start and the end of the window and it is recorded) last sync: UNKNOWN — supplied by Data Architect (the time the final pass ends and its checks hold; closed when the time of the final pass and the result of its checks are recorded) return point: UNKNOWN — supplied by Data Architect (the state of module.dependencies.module.orders_rds.aws_rds_cluster.this the migration returns to on a rollback: the source as it was at the write freeze, or a named snapshot or backup; closed when the return point is recorded with its time and how it is restored) consistency check: UNKNOWN — supplied by Data Architect (how the copy of module.dependencies.module.orders_rds.aws_rds_cluster.this is shown complete and unchanged after the final pass: the used space and a checksum of the data (of the files, or the row counts of the tables) agree with the source; closed when the method is agreed and its result after the final pass is recorded) validation on the target: UNKNOWN — supplied by Migration Owner (the test the application that uses module.dependencies.module.orders_rds.aws_rds_cluster.this passes on STACKIT with the copied data before the cutover, agreed with the owner of the application; closed when the test passes on the target and its result is recorded) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.orders_rds.aws_rds_cluster.this is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.orders_rds.aws_rds_cluster.this is kept is recorded) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover) data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.orders_rds.aws_rds_cluster.this before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)	Data Architect	Holds steps	—	every UNKNOWN check of the plan is HOLDS or FAILS; the extension list of the source is compared with `SHOW extwlist.extensions;` of the target and each difference is settled	—	`terraform/handover/database-dependencies_orders_rds_this/data-move.md`
Rehearse the move of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this into a scratch database of stackit_postgresflex_instance.dependencies_orders_rds_this from a copy of the source, and time each part of it. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#prepare-the-target`. The data rehearsal of module.dependencies.module.orders_rds.aws_rds_cluster.this `MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/rehearsal`	Data Architect	Holds steps	—	the elapsed times of each part are recorded and the write-freeze window is agreed from them	—	—
Copy the existing data of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this by logical replication: copy the schema, publish on the source and subscribe from the target, and wait until every table is copied. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#method-b-logical-replication`. The initial copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication `MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/initial-copy/logical-replication`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	every table of the target is in state `r` and the replication slot of the source is active	—	—
Keep the replication of module.dependencies.module.orders_rds.aws_rds_cluster.this running and watch its lag and the free storage of the source until the write freeze. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#method-b-logical-replication`. The replication watch of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication `MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/delta-sync/logical-replication`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	the lag stays bounded and the free storage of the source does not fall	—	—
Apply the blocks of terraform/messaging.tf with OpenTofu 2 steps The OpenTofu step for stackit_rabbitmq_instance.dependencies_mq `TF/stackit_rabbitmq_instance.dependencies_mq` The OpenTofu step for stackit_rabbitmq_credential.dependencies_mq `TF/stackit_rabbitmq_credential.dependencies_mq` Stands on a default nobody confirmed: size derived from the source (TF/stackit_rabbitmq_instance.dependencies_mq, TF/stackit_rabbitmq_credential.dependencies_mq) Stands on a default nobody confirmed: public endpoint (TF/stackit_rabbitmq_instance.dependencies_mq, TF/stackit_rabbitmq_credential.dependencies_mq)	Platform Architect	Later	—	OpenTofu applies the blocks of terraform/messaging.tf and the checks of their steps in execution/verify/checks.md hold.	`execution/verify/checks.md`	`terraform/messaging.tf`
Fill in the required inputs of kubernetes/carts/manifests.yaml and apply it to the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n <namespace> -f <manifest file> The step "Fill in the required inputs of kubernetes/carts/manifests.yaml and apply it to…" `MAN/draft/kubernetes/carts/manifests-yaml`	Platform Architect	Holds steps	`DEC-GEN-CONVERT-POD-SEGMENTATION`	every step of terraform/kubernetes/carts/manifests.yaml is done and its checks hold	—	`terraform/kubernetes/carts/manifests.yaml`
Fill in the required inputs of kubernetes/catalog/manifests.yaml and apply it to the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n <namespace> -f <manifest file> The step "Fill in the required inputs of kubernetes/catalog/manifests.yaml and apply it…" `MAN/draft/kubernetes/catalog/manifests-yaml`	Platform Architect	Holds steps	`DEC-GEN-CONVERT-POD-SEGMENTATION`	every step of terraform/kubernetes/catalog/manifests.yaml is done and its checks hold	—	`terraform/kubernetes/catalog/manifests.yaml`
Fill in the required inputs of kubernetes/checkout/manifests.yaml and apply it to the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n <namespace> -f <manifest file> The step "Fill in the required inputs of kubernetes/checkout/manifests.yaml and apply it…" `MAN/draft/kubernetes/checkout/manifests-yaml`	Platform Architect	Holds steps	`DEC-GEN-CONVERT-POD-SEGMENTATION`	every step of terraform/kubernetes/checkout/manifests.yaml is done and its checks hold	—	`terraform/kubernetes/checkout/manifests.yaml`
Fill in the required inputs of kubernetes/orders/manifests.yaml and apply it to the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n <namespace> -f <manifest file> The step "Fill in the required inputs of kubernetes/orders/manifests.yaml and apply it to…" `MAN/draft/kubernetes/orders/manifests-yaml`	Platform Architect	Holds steps	`DEC-GEN-CONVERT-POD-SEGMENTATION`	every step of terraform/kubernetes/orders/manifests.yaml is done and its checks hold	—	`terraform/kubernetes/orders/manifests.yaml`
Fill in the required inputs of kubernetes/ui/manifests.yaml and apply it to the cluster stackit_ske_cluster.retail_app_ecs_cluster: kubectl apply -n <namespace> -f <manifest file> The step "Fill in the required inputs of kubernetes/ui/manifests.yaml and apply it to the…" `MAN/draft/kubernetes/ui/manifests-yaml`	Platform Architect	Holds steps	`DEC-GEN-CONVERT-POD-SEGMENTATION`	every step of terraform/kubernetes/ui/manifests.yaml is done and its checks hold	—	`terraform/kubernetes/ui/manifests.yaml`
Freeze the writers of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: `terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#write-freeze-client-import`. The write freeze of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine `MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/client-import`	Migration Owner	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`	no client writes to the source	—	`terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md`
Inside the freeze, copy the indices of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this to stackit_opensearch_instance.dependencies_catalog_opensearch_this with the reindex operation of the service, as the OpenSearch how-to "Migrate data from Elasticsearch to OpenSearch 2" describes. Runbook section: `terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#final-sync-client-import`. The final copy of the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine `MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/client-import`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`	every index of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is in stackit_opensearch_instance.dependencies_catalog_opensearch_this and the reindex reported no failure	—	—
Reconcile module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this and stackit_opensearch_instance.dependencies_catalog_opensearch_this with the writers stopped (the number of documents of every index on each side, a checksum or a sample of their content, and one read the application does) and record GO or NO-GO. Runbook section: `terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#reconcile-client-import`. The data reconciliation of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the clients of the engine `MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/client-import`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`	the records and the sample match on both sides, the read the application does returns the same on both, and the owner records GO	—	—
Freeze the writers of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: `terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#write-freeze-own-tool`. The write freeze of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own `MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/own-tool`	Migration Owner	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`	no client writes to the source	—	—
Copy the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this to stackit_opensearch_instance.dependencies_catalog_opensearch_this with the migration tool or the replication you chose: write its steps, the checks before the move, the freeze window it needs and the way back. Runbook section: `terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#final-sync-own-tool`. The final copy of the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own `MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/own-tool`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`	the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is in stackit_opensearch_instance.dependencies_catalog_opensearch_this and the checks of the tool hold	—	—
Reconcile module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this and stackit_opensearch_instance.dependencies_catalog_opensearch_this with the writers stopped (the number of documents of every index on each side, a checksum or a sample of their content, and one read the application does) and record GO or NO-GO. Runbook section: `terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md#reconcile-own-tool`. The data reconciliation of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with a tool of your own `MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/own-tool`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`	the records and the sample match on both sides, the read the application does returns the same on both, and the owner records GO	—	—
List who writes (`SELECT user, host, db, command, COUNT() FROM information_schema.processlist WHERE db IN ('<database-1>', '<database-2>') GROUP BY 1, 2, 3, 4;`) and record the connection settings of every client where they can be restored from. Then stop the writers at the application (services, jobs, migrations, cron, replicas that write). Do not make the source read-only and do not change it. Check: `SELECT COUNT() FROM information_schema.processlist WHERE db IN ('<database-1>', '<database-2>') AND command <> 'Sleep' AND id <> CONNECTION_ID();` is 0. Runbook section: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md#write-freeze-dump-restore`. The write freeze of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore `MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/dump-restore`	Migration Owner	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	no client writes to the source	—	—
Dump inside the freeze: `mysqldump --host=<source-host> --port=<source-port> --user=<source-user> --password --single-transaction --routines --triggers --events --set-gtid-purged=OFF --no-tablespaces --databases <database-1> <database-2> --result-file=<dump-file>.sql`. `--set-gtid-purged=OFF` leaves the GTID statements out, which MariaDB does not take, and `--no-tablespaces` leaves out the CREATE TABLESPACE statements, which MariaDB does not support for InnoDB. The target instance must be empty before the load (the STACKIT how-to of the restore says so): load the dump with the mysql client, as the user of the instance's service key, into the empty instance: `mysql --host=<target-host> --port=<target-port> --user=<target-user> --password --database=<target-database> < <dump-file>.sql 2> load.log`, and read every line of `load.log`. A DEFINER account that does not exist on the target, a collation the target does not know and a database the target does not have are the errors the checks name: each is settled by a person, never by skipping the object. Runbook section: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md#final-sync-dump-restore`. The final copy of the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore `MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/dump-restore`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	the load finished, every database of the source is in the instance, and every error in load.log is settled	—	—
Both sides, with the writers stopped: per-table counts (`SELECT CONCAT('SELECT ''', table_schema, '.', table_name, ''' AS tbl, COUNT() FROM` ', table_schema, '`.`', table_name, '`;') FROM information_schema.tables WHERE table_type = 'BASE TABLE' AND table_schema NOT IN ('mysql', 'information_schema', 'performance_schema', 'sys');` and run what it prints; the table_rows of information_schema are estimates, not counts), for each table that matters an aggregate of its content (`SELECT COUNT(), MIN(<key>), MAX(<key>), SUM(<numeric-column>) FROM <schema>.<table>;`; a `CHECKSUM TABLE` value is compared only where both servers have been shown to agree on a sample in the rehearsal), the number of routines, triggers, events and views on each side (the queries of the preflight) and their definitions (`SHOW CREATE <type> <name>;`), `SELECT @@GLOBAL.sql_mode, @@GLOBAL.time_zone;` equal where they are meant to be, a TIMESTAMP column and a DATETIME column of one row read in the same session time zone, and one read query the application itself runs on its most important data, `<application-query>`: the query and the answer are the customer's, the source does not state them. Record GO or NO-GO. Runbook section: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md#reconcile-dump-restore`. The data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore `MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/dump-restore`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	counts, content aggregates, the objects and the application query agree: GO	—	—
List who writes (`SELECT user, host, db, command, COUNT() FROM information_schema.processlist WHERE db IN ('<database-1>', '<database-2>') GROUP BY 1, 2, 3, 4;`) and record the connection settings of every client where they can be restored from. Then stop the writers at the application (services, jobs, migrations, cron, replicas that write). Do not make the source read-only and do not change it. Check: `SELECT COUNT() FROM information_schema.processlist WHERE db IN ('<database-1>', '<database-2>') AND command <> 'Sleep' AND id <> CONNECTION_ID();` is 0. Runbook section: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md#write-freeze-own-tool`. The write freeze of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own `MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/own-tool`	Migration Owner	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	no client writes to the source	—	—
Copy the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this to stackit_mariadb_instance.dependencies_catalog_rds_this with the migration tool or the replication you chose: write its steps, the checks before the move, the freeze window it needs and the way back. Runbook section: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md#final-sync-own-tool`. The final copy of the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own `MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/own-tool`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this is in stackit_mariadb_instance.dependencies_catalog_rds_this and the checks of the tool hold	—	—
Both sides, with the writers stopped: per-table counts (`SELECT CONCAT('SELECT ''', table_schema, '.', table_name, ''' AS tbl, COUNT() FROM` ', table_schema, '`.`', table_name, '`;') FROM information_schema.tables WHERE table_type = 'BASE TABLE' AND table_schema NOT IN ('mysql', 'information_schema', 'performance_schema', 'sys');` and run what it prints; the table_rows of information_schema are estimates, not counts), for each table that matters an aggregate of its content (`SELECT COUNT(), MIN(<key>), MAX(<key>), SUM(<numeric-column>) FROM <schema>.<table>;`; a `CHECKSUM TABLE` value is compared only where both servers have been shown to agree on a sample in the rehearsal), the number of routines, triggers, events and views on each side (the queries of the preflight) and their definitions (`SHOW CREATE <type> <name>;`), `SELECT @@GLOBAL.sql_mode, @@GLOBAL.time_zone;` equal where they are meant to be, a TIMESTAMP column and a DATETIME column of one row read in the same session time zone, and one read query the application itself runs on its most important data, `<application-query>`: the query and the answer are the customer's, the source does not state them. Record GO or NO-GO. Runbook section: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md#reconcile-own-tool`. The data reconciliation of module.dependencies.module.catalog_rds.aws_rds_cluster.this with a tool of your own `MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/own-tool`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	counts, content aggregates, the objects and the application query agree: GO	—	—
Switch the connection of the applications of module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) to its STACKIT copy stackit_mariadb_instance.dependencies_catalog_rds_this: change the connection string (host, port, database name and credentials) in the configuration of every application that uses it (the source references it from module.retail_app_ecs.aws_secretsmanager_secret.catalog_db; an application outside the source is not read). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.dependencies.module.catalog_rds.aws_rds_cluster.this.endpoint (host): stackit_mariadb_credential.dependencies_catalog_rds_this.host; module.dependencies.module.catalog_rds.aws_rds_cluster.this.reader_endpoint (reader endpoint): stackit_mariadb_instance.dependencies_catalog_rds_this has no reader endpoint attribute (its connection_info holds the write endpoint only); module.dependencies.module.catalog_rds.aws_rds_cluster.this.port (port): stackit_mariadb_credential.dependencies_catalog_rds_this.port; module.dependencies.module.catalog_rds.aws_rds_cluster.this.database_name (database name): the name of a database of the instance: the draft writes no database block for this unit; module.dependencies.module.catalog_rds.aws_rds_cluster.this.master_username (user name): stackit_mariadb_credential.dependencies_catalog_rds_this.username. Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, attribute secret_string in module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db reads module.dependencies.module.catalog_rds.aws_rds_cluster.this through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read The switch of the applications that use module.dependencies.module.catalog_rds.aws_rds_cluster.this `MAN/cutover/connection/module.dependencies.module.catalog_rds.aws_rds_cluster.this` Open fields (3, 3 still needed) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.catalog_rds.aws_rds_cluster.this is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.catalog_rds.aws_rds_cluster.this is kept is recorded) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover) data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.catalog_rds.aws_rds_cluster.this before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	every application that used module.dependencies.module.catalog_rds.aws_rds_cluster.this connects to stackit_mariadb_instance.dependencies_catalog_rds_this, and module.dependencies.module.catalog_rds.aws_rds_cluster.this receives no reads or writes (its connection or request metrics show none)	—	—
Freeze the writers of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#write-freeze-client-import`. The write freeze of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine `MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/write-freeze/client-import`	Migration Owner	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	no client writes to the source	—	—
Inside the freeze, copy every key of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default to stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with a client that you run, not with the `MIGRATE` command: iterate the keys of the source with `SCAN` (never `KEYS`), read each key with `DUMP` and its remaining time to live with `PTTL`, and write it into stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with `RESTORE` (the TTL in milliseconds, 0 for a key that has none, and without `REPLACE`), after you isolated the source (no application connected to it) and took a backup of it. The source shows one shard (it states num_cache_clusters, which the provider documents as conflicting with num_node_groups): the copy iterates one node, the primary. Runbook section: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#final-sync-client-import`. The final copy of the data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine `MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/final-sync/client-import`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	every key of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is in stackit_valkey_instance.dependencies_checkout_elasticache_redis_default: the client reported no error and the comparison of the two key spaces ends in GO	—	—
Reconcile module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default and stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with the writers stopped (`DBSIZE` and `INFO KEYSPACE` on both sides: the number of keys and the keys and expires values must be equal, where the cache returns the section; the sorted lists of the keys of both, each listed with `SCAN` and never `KEYS`: their difference must be empty; and one read the application does) and record GO or NO-GO. Runbook section: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#reconcile-client-import`. The data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine `MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/client-import`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	the records and the sample match on both sides, the read the application does returns the same on both, and the owner records GO	—	—
Freeze the writers of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#write-freeze-own-tool`. The write freeze of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own `MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/write-freeze/own-tool`	Migration Owner	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	no client writes to the source	—	—
Copy the data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default to stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with the migration tool or the replication you chose: write its steps, the checks before the move, the freeze window it needs and the way back. Runbook section: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#final-sync-own-tool`. The final copy of the data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own `MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/final-sync/own-tool`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	the data of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is in stackit_valkey_instance.dependencies_checkout_elasticache_redis_default and the checks of the tool hold	—	—
Reconcile module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default and stackit_valkey_instance.dependencies_checkout_elasticache_redis_default with the writers stopped (`DBSIZE` and `INFO KEYSPACE` on both sides: the number of keys and the keys and expires values must be equal, where the cache returns the section; the sorted lists of the keys of both, each listed with `SCAN` and never `KEYS`: their difference must be empty; and one read the application does) and record GO or NO-GO. Runbook section: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#reconcile-own-tool`. The data reconciliation of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with a tool of your own `MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/reconcile/own-tool`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	the records and the sample match on both sides, the read the application does returns the same on both, and the owner records GO	—	—
Switch the connection of the applications of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) to its STACKIT copy stackit_valkey_instance.dependencies_checkout_elasticache_redis_default: change the endpoint (host and port) and the password or auth token in the configuration of every application that uses it (the source references it from module.retail_app_ecs.module.checkout_service.aws_ecs_service.this; an application outside the source is not read). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default.primary_endpoint_address (host), module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default.configuration_endpoint_address (host), module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default.reader_endpoint_address (reader endpoint), module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default.port (port): stackit_valkey_instance.dependencies_checkout_elasticache_redis_default has no host or port attribute (and no reader endpoint): the host and port are attributes of a stackit_valkey_credential, which the draft writes for the instance, and the provider schema gives host and load_balanced_host no description and no STACKIT page read says which of them a client connects to, so none is mapped. Where the source reads it, and what each place reads after the switch: (1) module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu, attribute alarm_name reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (2) module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu, attribute dimensions reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (3) module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory, attribute alarm_name reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (4) module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory, attribute dimensions reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (5) module.dependencies.module.checkout_elasticache_redis.module.dns.aws_route53_record.default, attribute records reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read; (6) module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this reads module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read The switch of the applications that use module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default `MAN/cutover/connection/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default` Open fields (3, 3 still needed) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is kept is recorded) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover) data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	every application that used module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default connects to stackit_valkey_instance.dependencies_checkout_elasticache_redis_default, and module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default receives no reads or writes (its connection or request metrics show none)	—	—
Freeze the writers of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write; do not change the source. Runbook section: `terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#write-freeze-own-tool`. The write freeze of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own `MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/write-freeze/own-tool`	Migration Owner	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	no client writes to the source	—	`terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md`
Inside the freeze, export the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) to S3 with the DynamoDB export to S3, which requires point-in-time recovery, and the source does not state point-in-time recovery for this table (the provider's default is off): a request for a table without it fails with PointInTimeRecoveryUnavailableException. Switch recovery on first (a change to the AWS table that this plan does not make) and request the export only after it is on, using `aws dynamodb export-table-to-point-in-time --table-arn <table ARN> --s3-bucket <bucket> --s3-prefix <prefix> --export-format DYNAMODB_JSON`; keep the manifest-summary.json (its itemCount is the count the comparison uses). Without the export, read the table in full with Scan, which consumes the read capacity of the table, and count the items you write out. Runbook section: `terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#export-own-tool`. The export of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own `MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/export/own-tool` Open fields (10, 10 still needed) copy volume: UNKNOWN — supplied by Data Architect (the amount of data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this to copy: the used space measured on the source; the provisioned capacity of the source is not the amount of data; closed when the measured amount and the date of the measurement are recorded) change rate: UNKNOWN — supplied by Data Architect (how much data the writers of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this change per hour; closed when the rate measured over a representative period is recorded, with the time a final pass needs at that rate) write-freeze window: UNKNOWN — supplied by Data Architect (the window in which the writers of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this stop for the final pass; closed when the owner of the application agrees the start and the end of the window and it is recorded) last sync: UNKNOWN — supplied by Data Architect (the time the final pass ends and its checks hold; closed when the time of the final pass and the result of its checks are recorded) return point: UNKNOWN — supplied by Data Architect (the state of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this the migration returns to on a rollback: the source as it was at the write freeze, or a named snapshot or backup; closed when the return point is recorded with its time and how it is restored) consistency check: UNKNOWN — supplied by Data Architect (how the copy of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is shown complete and unchanged after the final pass: the used space and a checksum of the data (of the files, or the row counts of the tables) agree with the source; closed when the method is agreed and its result after the final pass is recorded) validation on the target: UNKNOWN — supplied by Migration Owner (the test the application that uses module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this passes on STACKIT with the copied data before the cutover, agreed with the owner of the application; closed when the test passes on the target and its result is recorded) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is kept is recorded) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover) data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	the export of the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) is COMPLETED and its manifest-summary.json states the item count that the comparison uses	—	—
Convert the export of the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) into documents of the collection of stackit_mongodbflex_instance.dynamodb_tables with a script of your own: unwrap the type descriptors of the DynamoDB JSON (S, N, B, BOOL, NULL, M, L, SS, NS, BS) into BSON values; make the key id the _id (or a unique index on id); keep numbers in the BSON type that holds them: a DynamoDB number has up to 38 digits of precision and a decimal128 has 34, so a value of more than 34 significant digits cannot be a decimal128 without rounding (keep it as a string, as AWS advises beyond 38 digits, or report it); turn a string set, a number set and a binary set (SS, NS, BS) into an array: a set holds unique values in no order and an array does not, so the application code that relies on set operations changes; plan the secondary indexes global secondary index idx_global_customerId (customerId) as MongoDB indexes on the collection (a local index shares the key of the table, so its index leads with the table's partition key); projections are not carried (a MongoDB index finds whole documents); the item size needs no check in this direction: DynamoDB holds an item of up to 400 KB and a BSON document holds up to 16 mebibytes; the consistency the application needs is its own decision: a read of DynamoDB is eventually consistent unless the request asks for a strongly consistent read, and a global secondary index is eventually consistent only; MongoDB's read concern and read preference are chosen by the application's driver. Runbook section: `terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#conversion-own-tool`. The conversion of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own `MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/transform/own-tool`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	every item of the export of the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) is converted into a document, or is reported with the reason it was not (a number of more than 34 digits, an item the script cannot read), and the count of documents plus the count of reports equals the itemCount of the export	—	—
Load the documents of the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) into the collection of stackit_mongodbflex_instance.dynamodb_tables (STACKIT MongoDB Flex) with a MongoDB client of your choice (mongoimport, or a driver script), then create its indexes. Runbook section: `terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#final-sync-own-tool`. The final copy of the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own `MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/final-sync/own-tool`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	every document of the conversion of the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) is in the collection and the indexes the conversion named exist: the keys, then the index of the global secondary index idx_global_customerId (customerId)	—	—
Reconcile the table retail-store-ecs-carts (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this) and the collection of stackit_mongodbflex_instance.dynamodb_tables with the writers stopped: the number of documents in the collection must equal the itemCount of the export (manifest-summary.json), less the items the conversion reported, a sample of keys must read the same items on both sides, and the application's read of one item must return the same on both; record GO or NO-GO. Runbook section: `terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md#reconcile-own-tool`. The data reconciliation of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with a tool of your own `MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/reconcile/own-tool`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	the records and the sample match on both sides, the read the application does returns the same on both, and the owner records GO	—	—
Switch the applications of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) to its STACKIT copy stackit_mongodbflex_instance.dynamodb_tables: this is a change of code before it is a change of configuration. Rewrite the data access layer of every application that uses it (the source references it from module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.carts_service.aws_iam_role.task_role, module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; an application outside the source is not read) from the DynamoDB API (GetItem, PutItem, UpdateItem, DeleteItem, Query, Scan, BatchWriteItem, TransactWriteItems, condition and update expressions) to a MongoDB driver, then change the connection string of the instance, the collection name and the credentials The switch of the applications that use module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this `MAN/cutover/connection/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this` Open fields (3, 3 still needed) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is kept is recorded) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover) data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	every application that used module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this runs its rewritten data access layer against stackit_mongodbflex_instance.dynamodb_tables and its tests pass there, and module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this receives no reads or writes (its request metrics show none)	—	—
Freeze the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#cutover-window`. The write freeze of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore `MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/dump-restore`	Migration Owner	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	no client writes to the source	—	—
Inside the freeze, dump module.dependencies.module.orders_rds.aws_rds_cluster.this and restore the dump into stackit_postgresflex_instance.dependencies_orders_rds_this, and settle every error of the restore. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#method-a-dumprestore`. The final copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore `MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/dump-restore`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	pg_restore finished and every error in restore.log is settled	—	—
Reconcile module.dependencies.module.orders_rds.aws_rds_cluster.this and stackit_postgresflex_instance.dependencies_orders_rds_this with the writers stopped (row counts, checksums, sequences and one query the application runs) and record GO or NO-GO. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#verify-with-the-application`. The data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore `MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/dump-restore`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	counts, checksums, sequences and the application query agree: GO	—	—
Freeze the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#cutover-window`. The write freeze of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication `MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/logical-replication`	Migration Owner	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	no client writes to the source	—	—
Inside the freeze, wait until the replication of module.dependencies.module.orders_rds.aws_rds_cluster.this has no lag, copy the sequences to stackit_postgresflex_instance.dependencies_orders_rds_this and disable the subscription. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#cutover-window`. The final copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication `MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/logical-replication`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	the lag was 0, the sequences on the target are not lower than the source's, the subscription is disabled	—	—
Reconcile module.dependencies.module.orders_rds.aws_rds_cluster.this and stackit_postgresflex_instance.dependencies_orders_rds_this with the writers stopped (row counts, checksums, sequences and one query the application runs) and record GO or NO-GO. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#verify-with-the-application`. The data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication `MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/logical-replication`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	counts, checksums, sequences and the application query agree: GO	—	—
Freeze the writers of module.dependencies.module.orders_rds.aws_rds_cluster.this: list who writes, record the connection settings of every client, then stop the services, jobs and migrations that write. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#cutover-window`. The write freeze of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own `MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/write-freeze/own-tool`	Migration Owner	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	no client writes to the source	—	—
Copy the data of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this with the migration tool or the replication you chose: write its steps, the checks before the move, the freeze window it needs and the way back The final copy of the data of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own `MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-sync/own-tool`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	the data of module.dependencies.module.orders_rds.aws_rds_cluster.this is in stackit_postgresflex_instance.dependencies_orders_rds_this and the checks of the tool hold	—	—
Reconcile module.dependencies.module.orders_rds.aws_rds_cluster.this and stackit_postgresflex_instance.dependencies_orders_rds_this with the writers stopped (row counts, checksums, sequences and one query the application runs) and record GO or NO-GO. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#verify-with-the-application`. The data reconciliation of module.dependencies.module.orders_rds.aws_rds_cluster.this with a tool of your own `MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/reconcile/own-tool`	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	counts, checksums, sequences and the application query agree: GO	—	—
Switch the connection of the applications of module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) to its STACKIT copy stackit_postgresflex_instance.dependencies_orders_rds_this, stackit_postgresflex_database.dependencies_orders_rds_this_orders: change the connection string (host, port, database name and credentials) in the configuration of every application that uses it (the source references it from module.retail_app_ecs.aws_secretsmanager_secret.orders_db; an application outside the source is not read). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.dependencies.module.orders_rds.aws_rds_cluster.this.endpoint (host): stackit_postgresflex_instance.dependencies_orders_rds_this.connection_info.write.host; module.dependencies.module.orders_rds.aws_rds_cluster.this.reader_endpoint (reader endpoint): stackit_postgresflex_instance.dependencies_orders_rds_this has no reader endpoint attribute (its connection_info holds the write endpoint only); module.dependencies.module.orders_rds.aws_rds_cluster.this.port (port): stackit_postgresflex_instance.dependencies_orders_rds_this.connection_info.write.port; module.dependencies.module.orders_rds.aws_rds_cluster.this.database_name (database name): stackit_postgresflex_database.dependencies_orders_rds_this_orders.name; module.dependencies.module.orders_rds.aws_rds_cluster.this.master_username (user name): stackit_postgresflex_user.dependencies_orders_rds_this.username (its password is a sensitive attribute of the same block: it is read from the state or the output the draft writes, never copied into a configuration by hand). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.aws_secretsmanager_secret.orders_db, attribute secret_string in module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db reads module.dependencies.module.orders_rds.aws_rds_cluster.this through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read The switch of the applications that use module.dependencies.module.orders_rds.aws_rds_cluster.this `MAN/cutover/connection/module.dependencies.module.orders_rds.aws_rds_cluster.this` Open fields (3, 3 still needed) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.orders_rds.aws_rds_cluster.this is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.module.orders_rds.aws_rds_cluster.this is kept is recorded) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover) data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.module.orders_rds.aws_rds_cluster.this before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)	Data Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`	every application that used module.dependencies.module.orders_rds.aws_rds_cluster.this connects to stackit_postgresflex_instance.dependencies_orders_rds_this, stackit_postgresflex_database.dependencies_orders_rds_this_orders, and module.dependencies.module.orders_rds.aws_rds_cluster.this receives no reads or writes (its connection or request metrics show none)	—	—
Confirm that every workload step and every data move of the plan is done (the steps this one follows) before the first switch of the cutover: the plan does not know which workloads and data stores each entry point serves, so every switch waits for all of them The cutover readiness step `MAN/cutover/readiness`	Migration Owner	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	every step this one follows is recorded as done, and the owner records that the cutover can start	—	—
Switch the applications that read the secret module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (aws_secretsmanager_secret) to its STACKIT copy: change the reference to the secret (its ARN or its name) in the configuration of every application that reads it (the source reads it from module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; an application outside the source is not read) so that it reads the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.retail_app_ecs.aws_secretsmanager_secret.catalog_db.arn (secret's ARN): no ARN exists on STACKIT Secrets Manager; the secret is read by the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this reads module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read The switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_db `MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db` Open fields (3, 3 still needed) source retention: UNKNOWN — supplied by Migration Owner (module.retail_app_ecs.aws_secretsmanager_secret.catalog_db is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.retail_app_ecs.aws_secretsmanager_secret.catalog_db is kept is recorded) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover) data written to the target: UNKNOWN — supplied by Identity Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.retail_app_ecs.aws_secretsmanager_secret.catalog_db before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)	Identity Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	every application that read module.retail_app_ecs.aws_secretsmanager_secret.catalog_db reads the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_DB` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id), and module.retail_app_ecs.aws_secretsmanager_secret.catalog_db receives no new read (its CloudTrail events show no GetSecretValue call; CloudTrail records all API calls of Secrets Manager: docs.aws.amazon.com/secretsmanager/latest/userguide/retrieve-ct-entries.html, read 2026-10-31)	—	—
Switch the applications that read the secret module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (aws_secretsmanager_secret) to its STACKIT copy: change the reference to the secret (its ARN or its name) in the configuration of every application that reads it (the source reads it from module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; an application outside the source is not read) so that it reads the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch.arn (secret's ARN): no ARN exists on STACKIT Secrets Manager; the secret is read by the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this reads module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read The switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch `MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch` Open fields (3, 3 still needed) source retention: UNKNOWN — supplied by Migration Owner (module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch is kept is recorded) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover) data written to the target: UNKNOWN — supplied by Identity Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)	Identity Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	every application that read module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch reads the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_CATALOG_OPENSEARCH` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch) of stackit_secretsmanager_instance.migrated_secrets (its instance_id), and module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch receives no new read (its CloudTrail events show no GetSecretValue call; CloudTrail records all API calls of Secrets Manager: docs.aws.amazon.com/secretsmanager/latest/userguide/retrieve-ct-entries.html, read 2026-10-31)	—	—
Switch the applications that read the secret module.retail_app_ecs.aws_secretsmanager_secret.mq (aws_secretsmanager_secret) to its STACKIT copy: change the reference to the secret (its ARN or its name) in the configuration of every application that reads it (the source reads it from module.retail_app_ecs.module.orders_service.aws_ecs_service.this; an application outside the source is not read) so that it reads the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.retail_app_ecs.aws_secretsmanager_secret.mq.arn (secret's ARN): no ARN exists on STACKIT Secrets Manager; the secret is read by the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.orders_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this reads module.retail_app_ecs.aws_secretsmanager_secret_version.mq through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read The switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.mq `MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.mq` Open fields (3, 3 still needed) source retention: UNKNOWN — supplied by Migration Owner (module.retail_app_ecs.aws_secretsmanager_secret.mq is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.retail_app_ecs.aws_secretsmanager_secret.mq is kept is recorded) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover) data written to the target: UNKNOWN — supplied by Identity Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.retail_app_ecs.aws_secretsmanager_secret.mq before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)	Identity Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	every application that read module.retail_app_ecs.aws_secretsmanager_secret.mq reads the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_MQ` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.mq) of stackit_secretsmanager_instance.migrated_secrets (its instance_id), and module.retail_app_ecs.aws_secretsmanager_secret.mq receives no new read (its CloudTrail events show no GetSecretValue call; CloudTrail records all API calls of Secrets Manager: docs.aws.amazon.com/secretsmanager/latest/userguide/retrieve-ct-entries.html, read 2026-10-31)	—	—
Switch the applications that read the secret module.retail_app_ecs.aws_secretsmanager_secret.orders_db (aws_secretsmanager_secret) to its STACKIT copy: change the reference to the secret (its ARN or its name) in the configuration of every application that reads it (the source reads it from module.retail_app_ecs.module.orders_service.aws_ecs_service.this; an application outside the source is not read) so that it reads the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). What changes on the move (the attribute the clients read now, and where the draft holds the new value): module.retail_app_ecs.aws_secretsmanager_secret.orders_db.arn (secret's ARN): no ARN exists on STACKIT Secrets Manager; the secret is read by the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.orders_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this reads module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read The switch of the applications that use module.retail_app_ecs.aws_secretsmanager_secret.orders_db `MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.orders_db` Open fields (3, 3 still needed) source retention: UNKNOWN — supplied by Migration Owner (module.retail_app_ecs.aws_secretsmanager_secret.orders_db is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.retail_app_ecs.aws_secretsmanager_secret.orders_db is kept is recorded) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover) data written to the target: UNKNOWN — supplied by Identity Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.retail_app_ecs.aws_secretsmanager_secret.orders_db before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)	Identity Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	every application that read module.retail_app_ecs.aws_secretsmanager_secret.orders_db reads the Vault path that `STACKIT_INPUT_SECRET_NAME_RETAIL_APP_ECS_ORDERS_DB` names (an input of the STACKIT API step WriteSecret of module.retail_app_ecs.aws_secretsmanager_secret.orders_db) of stackit_secretsmanager_instance.migrated_secrets (its instance_id), and module.retail_app_ecs.aws_secretsmanager_secret.orders_db receives no new read (its CloudTrail events show no GetSecretValue call; CloudTrail records all API calls of Secrets Manager: docs.aws.amazon.com/secretsmanager/latest/userguide/retrieve-ct-entries.html, read 2026-10-31)	—	—
Switch the producers of module.dependencies.aws_mq_broker.mq (aws_mq_broker) from its AWS address (the instances[*].endpoints of module.dependencies.aws_mq_broker.mq) to the endpoint of the STACKIT instance (the host and port of a credential of stackit_rabbitmq_instance.dependencies_mq (stackit_rabbitmq_credential; the draft writes one for the instance: read its host and port after the apply)): change the clients' configuration (no Route 53 record of the source points to module.dependencies.aws_mq_broker.mq: a DNS record outside the source, or the address the clients are configured with). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.aws_secretsmanager_secret.mq, attribute secret_string in module.retail_app_ecs.aws_secretsmanager_secret_version.mq reads module.dependencies.aws_mq_broker.mq through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read. The consumers stay on the AWS broker until its queues are drained (the drain of the broker), and only then follow The traffic switch of module.dependencies.aws_mq_broker.mq `MAN/cutover/module.dependencies.aws_mq_broker.mq` Open fields (3, 3 still needed) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.aws_mq_broker.mq is not retired until the GO recorded at the rollback decision step; how long it is kept after that is the owner's; closed when the date until which module.dependencies.aws_mq_broker.mq is kept is recorded) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover) data written to the target: UNKNOWN — supplied by Network Architect (the switch moves requests, not data: whether the switched clients write through the STACKIT address, and where those writes are stored; closed when the owner of the application records whether the clients write and, if they do, whether their writes are copied back to AWS on a rollback or accepted as lost)	Network Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	every producer sends to the STACKIT instance and module.dependencies.aws_mq_broker.mq receives no new message	—	—
Drain the queues of the AWS broker module.dependencies.aws_mq_broker.mq (aws_mq_broker): its consumers go on reading them, with no producer sending to the broker any more, until every queue holds no message. Read the depth in CloudWatch: Amazon MQ for RabbitMQ publishes MessageCount (the sum of the ready and the unacknowledged messages) for the broker and, on 3.x brokers, for each queue (the dimensions Queue and VirtualHost; on 4.x brokers the figures of a queue come from the Prometheus endpoint), and Amazon MQ for ActiveMQ publishes QueueSize and InFlightCount for each queue and TotalMessageCount for the broker. An inactive durable topic subscriber (InactiveDurableTopicSubscribersCount) holds messages that only its own client can read: connect it to the AWS broker until it has read them. The plan does not read the names of the queues of the broker The drain of the queue of module.dependencies.aws_mq_broker.mq `MAN/cutover/messaging-drain/module.dependencies.aws_mq_broker.mq`	Platform Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	every queue of module.dependencies.aws_mq_broker.mq reports no ready and no unacknowledged (in-flight) message with no producer sending to it, and no inactive durable subscriber holds a message	—	—
Switch the consumers of the broker module.dependencies.aws_mq_broker.mq (aws_mq_broker) to the endpoint of the STACKIT instance (the host and port of a credential of stackit_rabbitmq_instance.dependencies_mq (stackit_rabbitmq_credential; the draft writes one for the instance: read its host and port after the apply)) once every queue of the AWS broker is empty: change the endpoint and the credentials in their configuration, start them against the STACKIT instance and stop the consumers that read the AWS broker The switch of the consumers of module.dependencies.aws_mq_broker.mq `MAN/cutover/messaging-consumers/module.dependencies.aws_mq_broker.mq` Open fields (3, 3 still needed) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.aws_mq_broker.mq is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.aws_mq_broker.mq is kept is recorded) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover) data written to the target: UNKNOWN — supplied by Platform Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.aws_mq_broker.mq before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)	Platform Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	every consumer of module.dependencies.aws_mq_broker.mq reads from the STACKIT instance and none reads the AWS broker, and the AWS broker stays empty	—	—
Switch the clients (the applications that index and search) of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) from its AWS address (the endpoint of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this) to the endpoint of the STACKIT instance (the host and port of a credential of stackit_opensearch_instance.dependencies_catalog_opensearch_this (stackit_opensearch_credential; the draft writes one for the instance: read its host and port after the apply)): change the clients' configuration (no Route 53 record of the source points to module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: a DNS record outside the source, or the address the clients are configured with). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, attribute container_definitions in module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this reads module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this through an expression the plan does not read apart (a function or a text around the reference): which attribute of it is used is not read The traffic switch of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this `MAN/cutover/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this` Open fields (3, 3 still needed) source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is not retired until the GO recorded at the rollback decision step; how long it is kept after that is the owner's; closed when the date until which module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is kept is recorded) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover) data written to the target: UNKNOWN — supplied by Network Architect (the switch moves requests, not data: whether the switched clients write through the STACKIT address, and where those writes are stored; closed when the owner of the application records whether the clients write and, if they do, whether their writes are copied back to AWS on a rollback or accepted as lost)	Network Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	requests of the clients reach the host and port of a credential of stackit_opensearch_instance.dependencies_catalog_opensearch_this (stackit_opensearch_credential; the draft writes one for the instance: read its host and port after the apply) (its access logs or metrics show them) and the endpoint of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this receives none	—	—
Switch the traffic of module.retail_app_ecs.module.alb.aws_lb.this (aws_lb) from its AWS address (the dns_name of module.retail_app_ecs.module.alb.aws_lb.this) to its STACKIT address (the external_address of stackit_application_load_balancer.retail_app_ecs_alb_this): change the clients' configuration (no Route 53 record of the source points to module.retail_app_ecs.module.alb.aws_lb.this: a DNS record outside the source, or the address the clients are configured with). Where the source reads it, and what each place reads after the switch: (1) module.retail_app_ecs.module.alb.aws_wafv2_web_acl_association.this, attribute resource_arn reads module.retail_app_ecs.module.alb.aws_lb.this.arn (the ARN); after the switch: no ARN exists on STACKIT (the access and wiring steps of the unit decide what replaces it) The traffic switch of module.retail_app_ecs.module.alb.aws_lb.this `MAN/cutover/module.retail_app_ecs.module.alb.aws_lb.this` Open fields (3, 3 still needed) source retention: UNKNOWN — supplied by Migration Owner (module.retail_app_ecs.module.alb.aws_lb.this is not retired until the GO recorded at the rollback decision step; how long it is kept after that is the owner's; closed when the date until which module.retail_app_ecs.module.alb.aws_lb.this is kept is recorded) rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover) data written to the target: UNKNOWN — supplied by Network Architect (the switch moves requests, not data: whether the switched clients write through the STACKIT address, and where those writes are stored; closed when the owner of the application records whether the clients write and, if they do, whether their writes are copied back to AWS on a rollback or accepted as lost)	Network Architect	Holds steps	`DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	requests of the clients reach the external_address of stackit_application_load_balancer.retail_app_ecs_alb_this (its access logs or metrics show them) and the dns_name of module.retail_app_ecs.module.alb.aws_lb.this receives none	—	—
Confirm that every switch of the cutover is done (the steps this one follows) before the checks of the data stores and queues start: the plan does not know which applications use which store, so each such check waits for every switch The cutover completion step `MAN/cutover/complete`	Migration Owner	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	every switch this one follows is recorded as done, and the owner records that the cutover is complete	—	—
Only after the target has run in production for the period the customer decides and the way back is no longer wanted: remove the move host from `parameters.sgw_acl` of the instance; delete the dump file `<dump-file>.sql` and `load.log` (the dump holds the data); keep a final snapshot of the source for the retention the customer decides before anything is deleted; delete the scratch instance of the rehearsal if it still exists; and replace the credential of the service key if it was ever on a ticket or in a file. Runbook section: `terraform/handover/database-dependencies_catalog_rds_this/data-move.md#clean-up-dump-restore`. The cleanup of the data move of module.dependencies.module.catalog_rds.aws_rds_cluster.this by dump and restore `MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/cleanup/dump-restore`	Data Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	no dump file is left, the move host is out of the access list, the scratch instance is deleted and the credentials are replaced where they were exposed	—	—
Only after the target has run in production for the period the customer decides and the way back is no longer wanted: remove the move host from `parameters.sgw_acl` of the instance; delete the files the copy wrote and the snapshot of the source that was taken as the fail-safe once the target is confirmed; delete the scratch instance of the rehearsal if it still exists; and replace the credential of the service key if it was ever on a ticket or in a file. The source cache is deleted only when its owner decides, after a final snapshot kept for the retention the customer decides. Runbook section: `terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md#clean-up-client-import`. The cleanup of the data move of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default with the clients of the engine `MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/cleanup/client-import`	Data Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	no copy of the data is left, the move host is out of the access list, the scratch instance is deleted and the credentials are replaced where they were exposed	—	—
Clean up what the move of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this leaves behind (the move host in the access list, the dump files, and for a replication the subscription, the publication and the slot) once the way back is no longer wanted. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#after-acceptance`. The cleanup of the data move of module.dependencies.module.orders_rds.aws_rds_cluster.this by dump and restore `MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/dump-restore`	Data Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	no slot, subscription, publication or dump file is left, the move host is out of the ACL, the credentials are rotated	—	—
Clean up what the move of module.dependencies.module.orders_rds.aws_rds_cluster.this to stackit_postgresflex_instance.dependencies_orders_rds_this leaves behind (the move host in the access list, the dump files, and for a replication the subscription, the publication and the slot) once the way back is no longer wanted. Runbook section: `terraform/handover/database-dependencies_orders_rds_this/data-move.md#after-acceptance`. The cleanup of the data move of module.dependencies.module.orders_rds.aws_rds_cluster.this by logical replication `MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/logical-replication`	Data Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	no slot, subscription, publication or dump file is left, the move host is out of the ACL, the credentials are rotated	—	—
Retire module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events (aws_cloudwatch_event_rule) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events `MAN/decommission/module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events`	Platform Architect	Later	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights (aws_cloudwatch_log_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights `MAN/decommission/module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights`	Platform Architect	Later	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs (aws_cloudwatch_log_resource_policy) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs `MAN/decommission/module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs`	Platform Architect	Later	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.module.alb.aws_lb.this (aws_lb) with its parts module.retail_app_ecs.module.alb.aws_lb_listener.frontend_http_tcp in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.alb.aws_lb.this `MAN/decommission/module.retail_app_ecs.module.alb.aws_lb.this`	Network Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.module.alb.aws_lb.this no longer exists in the AWS account and its charges stop on the bill	—	—
Retire … (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it 6 jobs of alike steps: `module.retail_app_ecs.module.alb.aws_security_group.this`, `module.retail_app_ecs.module.carts_service.aws_security_group.this`, `module.retail_app_ecs.module.catalog_service.aws_security_group.this` and 3 more Retire module.retail_app_ecs.module.alb.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.alb.aws_security_group.this `MAN/decommission/module.retail_app_ecs.module.alb.aws_security_group.this` Retire module.retail_app_ecs.module.carts_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.carts_service.aws_security_group.this `MAN/decommission/module.retail_app_ecs.module.carts_service.aws_security_group.this` Retire module.retail_app_ecs.module.catalog_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.catalog_service.aws_security_group.this `MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_security_group.this` Retire module.retail_app_ecs.module.checkout_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.checkout_service.aws_security_group.this `MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_security_group.this` Retire module.retail_app_ecs.module.orders_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.orders_service.aws_security_group.this `MAN/decommission/module.retail_app_ecs.module.orders_service.aws_security_group.this` Retire module.retail_app_ecs.module.ui_service.aws_security_group.this (aws_security_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.ui_service.aws_security_group.this `MAN/decommission/module.retail_app_ecs.module.ui_service.aws_security_group.this`	Network Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	… no longer exists in the AWS account and its charges stop on the bill	—	One file for each job, listed under it.
Retire module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix (aws_security_group) with its parts module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix `MAN/decommission/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix`	Network Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.module.ui_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.ui_service.aws_ecs_service.this `MAN/decommission/module.retail_app_ecs.module.ui_service.aws_ecs_service.this`	Platform Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.module.ui_service.aws_ecs_service.this no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.module.carts_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.carts_service.aws_ecs_service.this `MAN/decommission/module.retail_app_ecs.module.carts_service.aws_ecs_service.this`	Platform Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.module.carts_service.aws_ecs_service.this no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_execution_role_policy in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role `MAN/decommission/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role`	Identity Architect	Later	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.module.carts_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.ecs_exec, module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_role_additional in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role `MAN/decommission/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role`	Identity Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.module.carts_service.aws_iam_role.task_role no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this `MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`	Platform Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.module.catalog_service.aws_ecs_service.this no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) with its parts module.dependencies.module.catalog_opensearch.aws_opensearch_domain_policy.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this `MAN/decommission/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`	Data Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.dependencies.aws_security_group.catalog_opensearch_sg (aws_security_group) with its parts module.dependencies.aws_security_group_rule.allow_https_from_client in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.dependencies.aws_security_group.catalog_opensearch_sg `MAN/decommission/module.dependencies.aws_security_group.catalog_opensearch_sg`	Network Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.dependencies.aws_security_group.catalog_opensearch_sg no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_additional, module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_policy in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role `MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role`	Identity Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role no longer exists in the AWS account and its charges stop on the bill	—	—
Retire … (aws_secretsmanager_secret) with its parts … in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it 4 jobs of alike steps: `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db`, `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch`, `module.retail_app_ecs.aws_secretsmanager_secret.mq` and 1 more Retire module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (aws_secretsmanager_secret) with its parts module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db `MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db` Retire module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (aws_secretsmanager_secret) with its parts module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch `MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch` Retire module.retail_app_ecs.aws_secretsmanager_secret.mq (aws_secretsmanager_secret) with its parts module.retail_app_ecs.aws_secretsmanager_secret_version.mq in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.aws_secretsmanager_secret.mq `MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.mq` Retire module.retail_app_ecs.aws_secretsmanager_secret.orders_db (aws_secretsmanager_secret) with its parts module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.aws_secretsmanager_secret.orders_db `MAN/decommission/module.retail_app_ecs.aws_secretsmanager_secret.orders_db`	Identity Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	… no longer exists in the AWS account and its charges stop on the bill	—	One file for each job, listed under it.
Retire module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) with its parts module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.dependencies.module.catalog_rds.aws_rds_cluster.this `MAN/decommission/module.dependencies.module.catalog_rds.aws_rds_cluster.this`	Data Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.dependencies.module.catalog_rds.aws_rds_cluster.this no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.dependencies.module.catalog_rds.aws_security_group.this (aws_security_group) with its parts module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.dependencies.module.catalog_rds.aws_security_group.this `MAN/decommission/module.dependencies.module.catalog_rds.aws_security_group.this`	Network Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.dependencies.module.catalog_rds.aws_security_group.this no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.ecs_exec in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role `MAN/decommission/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role`	Identity Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this `MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`	Platform Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.module.checkout_service.aws_ecs_service.this no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default `MAN/decommission/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`	Data Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd (aws_security_group) with its parts module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd `MAN/decommission/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd`	Network Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_execution_role_policy in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role `MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role`	Identity Architect	Later	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.ecs_exec, module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_role_additional in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role `MAN/decommission/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role`	Identity Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this `MAN/decommission/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`	Data Architect	Later	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.module.orders_service.aws_ecs_service.this (aws_ecs_service) with its parts module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.orders_service.aws_ecs_service.this `MAN/decommission/module.retail_app_ecs.module.orders_service.aws_ecs_service.this`	Platform Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.module.orders_service.aws_ecs_service.this no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.aws_ecs_cluster.cluster (aws_ecs_cluster) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.aws_ecs_cluster.cluster `MAN/decommission/module.retail_app_ecs.aws_ecs_cluster.cluster`	Platform Architect	Later	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.aws_ecs_cluster.cluster no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_additional, module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_policy in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role `MAN/decommission/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role`	Identity Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.aws_kms_key.cmk (aws_kms_key) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.aws_kms_key.cmk `MAN/decommission/module.retail_app_ecs.aws_kms_key.cmk`	Identity Architect	Later	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.aws_kms_key.cmk no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.dependencies.aws_mq_broker.mq (aws_mq_broker) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.dependencies.aws_mq_broker.mq `MAN/decommission/module.dependencies.aws_mq_broker.mq`	Platform Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.dependencies.aws_mq_broker.mq no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.dependencies.aws_security_group.mq (aws_security_group) with its parts module.dependencies.aws_security_group_rule.mq in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.dependencies.aws_security_group.mq `MAN/decommission/module.dependencies.aws_security_group.mq`	Network Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.dependencies.aws_security_group.mq no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) with its parts module.dependencies.module.orders_rds.aws_rds_cluster_instance.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.dependencies.module.orders_rds.aws_rds_cluster.this `MAN/decommission/module.dependencies.module.orders_rds.aws_rds_cluster.this`	Data Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.dependencies.module.orders_rds.aws_rds_cluster.this no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.dependencies.module.orders_rds.aws_security_group.this (aws_security_group) with its parts module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.dependencies.module.orders_rds.aws_security_group.this `MAN/decommission/module.dependencies.module.orders_rds.aws_security_group.this`	Network Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.dependencies.module.orders_rds.aws_security_group.this no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.module.orders_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.ecs_exec in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role `MAN/decommission/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role`	Identity Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.module.orders_service.aws_iam_role.task_role no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role (aws_iam_role) with its parts module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.task_execution_role_policy in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role `MAN/decommission/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role`	Identity Architect	Later	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.module.ui_service.aws_iam_role.task_role (aws_iam_role) with its parts module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_logs, module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.ecs_exec in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role `MAN/decommission/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role`	Identity Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.retail_app_ecs.module.ui_service.aws_iam_role.task_role no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (aws_cloudwatch_log_group) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks `MAN/decommission/module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks`	Platform Architect	Later	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`, `DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS`	module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.vpc.module.vpc.aws_route_table.private (aws_route_table) with its parts module.vpc.module.vpc.aws_route.private_nat_gateway, module.vpc.module.vpc.aws_route_table_association.private in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.vpc.module.vpc.aws_route_table.private `MAN/decommission/module.vpc.module.vpc.aws_route_table.private`	Network Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`, `DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST`	module.vpc.module.vpc.aws_route_table.private no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.vpc.module.vpc.aws_nat_gateway.this (aws_nat_gateway) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.vpc.module.vpc.aws_nat_gateway.this `MAN/decommission/module.vpc.module.vpc.aws_nat_gateway.this`	Network Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`, `DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST`	module.vpc.module.vpc.aws_nat_gateway.this no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.vpc.module.vpc.aws_eip.nat (aws_eip) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.vpc.module.vpc.aws_eip.nat `MAN/decommission/module.vpc.module.vpc.aws_eip.nat`	Network Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`, `DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST`	module.vpc.module.vpc.aws_eip.nat no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.vpc.module.vpc.aws_route_table.public (aws_route_table) with its parts module.vpc.module.vpc.aws_route.public_internet_gateway, module.vpc.module.vpc.aws_route_table_association.public in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.vpc.module.vpc.aws_route_table.public `MAN/decommission/module.vpc.module.vpc.aws_route_table.public`	Network Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	module.vpc.module.vpc.aws_route_table.public no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.vpc.module.vpc.aws_internet_gateway.this (aws_internet_gateway) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.vpc.module.vpc.aws_internet_gateway.this `MAN/decommission/module.vpc.module.vpc.aws_internet_gateway.this`	Network Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`, `DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST`	module.vpc.module.vpc.aws_internet_gateway.this no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.vpc.module.vpc.aws_subnet.private (aws_subnet) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.vpc.module.vpc.aws_subnet.private `MAN/decommission/module.vpc.module.vpc.aws_subnet.private`	Network Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`, `DEC-GEN-CONVERT-WORKLOAD-PLACEMENT`, `DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST`	module.vpc.module.vpc.aws_subnet.private no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.vpc.module.vpc.aws_subnet.public (aws_subnet) in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.vpc.module.vpc.aws_subnet.public `MAN/decommission/module.vpc.module.vpc.aws_subnet.public`	Network Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`, `DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST`	module.vpc.module.vpc.aws_subnet.public no longer exists in the AWS account and its charges stop on the bill	—	—
Retire module.vpc.module.vpc.aws_vpc.this (aws_vpc) with its parts module.vpc.module.vpc.aws_default_network_acl.this, module.vpc.module.vpc.aws_default_route_table.default, module.vpc.module.vpc.aws_default_security_group.this in the AWS account after the GO: delete it the way it is managed (remove it from the source configuration and apply that, or delete it in the AWS console), once the resources that depend on it are retired (the steps it follows); a targeted destroy of the source configuration would also delete what depends on it The retirement of module.vpc.module.vpc.aws_vpc.this `MAN/decommission/module.vpc.module.vpc.aws_vpc.this`	Network Architect	Later	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`, `DEC-GEN-CONVERT-WORKLOAD-PLACEMENT`, `DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST`	module.vpc.module.vpc.aws_vpc.this no longer exists in the AWS account and its charges stop on the bill	—	—

Verify (27 jobs)

Job	Owner	Priority	Blocked by	Closes when	Evidence	Generated file
Review the critical settings of an internet gateway (Network Architect) `DEC-NET-MODULE-VPC-MODULE-VPC-AWS-INTERNET-GATEWAY-THIS` Step: The setting `network-topology-boundary` of module.vpc.module.vpc.aws_internet_gateway.this `MAN/semantic/module.vpc.module.vpc.aws_internet_gateway.this/network-topology-boundary`	Network Architect	Holds steps	—	Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.	—	—
Review the critical settings of a Secrets Manager secret (Platform Architect) 4 jobs of alike steps: `module.retail_app_ecs.aws_secretsmanager_secret.catalog_db`, `module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch`, `module.retail_app_ecs.aws_secretsmanager_secret.mq` and 1 more `DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB` The setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db `MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db/tc-secretsmanager-secret-name` `DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E` The setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch `MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch/tc-secretsmanager-secret-name` `DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ` The setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.mq `MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.mq/tc-secretsmanager-secret-name` `DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB` The setting "name" of module.retail_app_ecs.aws_secretsmanager_secret.orders_db `MAN/semantic/module.retail_app_ecs.aws_secretsmanager_secret.orders_db/tc-secretsmanager-secret-name`	Platform Architect	Holds steps	—	Confirm the name of the Secrets Manager secret: A person confirms the secret name or path the application looks up on the target, or accepts the new one.	—	One file for each job, listed under it.
Review the critical settings of a security group (Network Architect) `DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG` Step: The review of the open settings of module.dependencies.aws_security_group.catalog_opensearch_sg `MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings`	Network Architect	Holds steps	—	Decide the outbound (egress) rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Decide the outbound (egress) rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. Review the standalone rule not generated setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the standalone rule remote not resolved setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A person re-creates the rule with the STACKIT security group or address range it needs; the draft does not widen it (a stackit_security_group_rule without a source allows everything, pinned provider). Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.	—	—
Review the critical settings of a security group (Network Architect) `DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ` Step: The review of the open settings of module.dependencies.aws_security_group.mq `MAN/semantic/module.dependencies.aws_security_group.mq/open-settings`	Network Architect	Holds steps	—	Decide the outbound (egress) rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Decide the outbound (egress) rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. Review the standalone rule not generated setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.	—	—
Review the critical settings of a security group (Network Architect) `DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS` Step: The review of the open settings of module.dependencies.module.catalog_rds.aws_security_group.this `MAN/semantic/module.dependencies.module.catalog_rds.aws_security_group.this/open-settings`	Network Architect	Holds steps	—	Decide the outbound (egress) rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Decide the outbound (egress) rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm the ports of the rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm the ports of the rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. Review the standalone rule values setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.	—	—
Review the critical settings of a security group (Network Architect) `DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0` Step: The review of the open settings of module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd `MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings`	Network Architect	Holds steps	—	Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm the ports of the rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm the ports of the rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. Review the standalone rule empty sources setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the standalone rule other sources setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the standalone rule values setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.	—	—
Review the critical settings of a security group (Network Architect) `DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS` Step: The review of the open settings of module.dependencies.module.orders_rds.aws_security_group.this `MAN/semantic/module.dependencies.module.orders_rds.aws_security_group.this/open-settings`	Network Architect	Holds steps	—	Decide the outbound (egress) rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Decide the outbound (egress) rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm the ports of the rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm the ports of the rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. Review the standalone rule values setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.	—	—
Review the critical settings of a security group (Network Architect) `DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS` Step: The review of the open settings of module.retail_app_ecs.module.alb.aws_security_group.this `MAN/semantic/module.retail_app_ecs.module.alb.aws_security_group.this/open-settings`	Network Architect	Holds steps	—	Decide the outbound (egress) rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Decide the outbound (egress) rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.	—	—
Review the critical settings of a security group (Network Architect) `DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862` Step: The review of the open settings of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix `MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings`	Network Architect	Holds steps	—	Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Confirm the ports of the rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded. Confirm the ports of the rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC. Review the standalone rule empty sources setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the standalone rule other sources setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the standalone rule values setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.	—	—
Review the critical settings of a VPC (Platform Architect) `DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS` Step: The setting `dns-settings` of module.vpc.module.vpc.aws_vpc.this `MAN/semantic/module.vpc.module.vpc.aws_vpc.this/dns-settings`	Platform Architect	Holds steps	—	Confirm how names resolve for the servers of the migrated networks: A person confirms how names resolve for the servers of the migrated networks.	—	—
Check that the application reads the data migrated from module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (aws_opensearch_domain) on its STACKIT target stackit_opensearch_instance.dependencies_catalog_opensearch_this and that what it writes there is read back The data check of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this `MAN/verify/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`	Data Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	the counts of the source and the target agree, the application reads the migrated records and a test write is read back	—	—
Check that the application reads the data migrated from module.dependencies.module.catalog_rds.aws_rds_cluster.this (aws_rds_cluster) on its STACKIT target stackit_mariadb_instance.dependencies_catalog_rds_this and that what it writes there is read back The data check of module.dependencies.module.catalog_rds.aws_rds_cluster.this `MAN/verify/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this`	Data Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	the counts of the source and the target agree, the application reads the migrated records and a test write is read back	—	—
Check that the application reads the data migrated from module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (aws_elasticache_replication_group) on its STACKIT target stackit_valkey_instance.dependencies_checkout_elasticache_redis_default and that what it writes there is read back The data check of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default `MAN/verify/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`	Data Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	the counts of the source and the target agree, the application reads the migrated records and a test write is read back	—	—
Check that the application reads the data migrated from module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) on its STACKIT target stackit_mongodbflex_instance.dynamodb_tables and that what it writes there is read back The data check of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this `MAN/verify/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this`	Data Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	the counts of the source and the target agree, the application reads the migrated records and a test write is read back	—	—
Check that the application reads the data migrated from module.dependencies.module.orders_rds.aws_rds_cluster.this (aws_rds_cluster) on its STACKIT target stackit_postgresflex_instance.dependencies_orders_rds_this, stackit_postgresflex_database.dependencies_orders_rds_this_orders and that what it writes there is read back The data check of module.dependencies.module.orders_rds.aws_rds_cluster.this `MAN/verify/data/module.dependencies.module.orders_rds.aws_rds_cluster.this`	Data Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	the counts of the source and the target agree, the application reads the migrated records and a test write is read back	—	—
Check from inside the cluster that the 1 name(s) the application carts resolves in the source VPC (carts) resolve to what stands for them on STACKIT The DNS check of module.retail_app_ecs.module.carts_service.aws_ecs_service.this `MAN/verify/dns/module.retail_app_ecs.module.carts_service.aws_ecs_service.this` Open fields (1, 1 still needed) resolve carts: UNKNOWN — supplied by Network Architect (the address carts resolves to from a pod of carts, compared with what stands for it on STACKIT: carts.<namespace>.svc.cluster.local (the Kubernetes Service carts; carts from a pod of the same namespace). resolve, from a pod of a client of carts, carts and carts.<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service carts (kubectl get service carts); closed when the address the name resolves to is recorded and the application connects through it)	Network Architect	Holds steps	`DEC-GEN-CONVERT-POD-SEGMENTATION`	every name resolves from a pod of carts to the address recorded for it on STACKIT, and the application opens its connections through it	—	—
Check from inside the cluster that the 3 name(s) the application catalog resolves in the source VPC (the endpoint host of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch), the endpoint host of module.dependencies.module.catalog_rds.aws_rds_cluster.this (Aurora), catalog) resolve to what stands for them on STACKIT The DNS check of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this `MAN/verify/dns/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this` Open fields (3, 3 still needed) resolve the endpoint host of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch) resolves to from a pod of catalog, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_opensearch_instance.dependencies_catalog_opensearch_this (OpenSearch) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of catalog, the host of stackit_opensearch_instance.dependencies_catalog_opensearch_this and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it) resolve the endpoint host of module.dependencies.module.catalog_rds.aws_rds_cluster.this (Aurora): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.module.catalog_rds.aws_rds_cluster.this (Aurora) resolves to from a pod of catalog, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_mariadb_instance.dependencies_catalog_rds_this (MariaDB) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of catalog, the host of stackit_mariadb_instance.dependencies_catalog_rds_this and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it) resolve catalog: UNKNOWN — supplied by Network Architect (the address catalog resolves to from a pod of catalog, compared with what stands for it on STACKIT: catalog.<namespace>.svc.cluster.local (the Kubernetes Service catalog; catalog from a pod of the same namespace). resolve, from a pod of a client of catalog, catalog and catalog.<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service catalog (kubectl get service catalog); closed when the address the name resolves to is recorded and the application connects through it)	Network Architect	Holds steps	`DEC-GEN-CONVERT-POD-SEGMENTATION`	every name resolves from a pod of catalog to the address recorded for it on STACKIT, and the application opens its connections through it	—	—
Check from inside the cluster that the 2 name(s) the application checkout resolves in the source VPC (the endpoint host of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (ElastiCache), checkout) resolve to what stands for them on STACKIT The DNS check of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this `MAN/verify/dns/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this` Open fields (2, 2 still needed) resolve the endpoint host of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (ElastiCache): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (ElastiCache) resolves to from a pod of checkout, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_valkey_instance.dependencies_checkout_elasticache_redis_default (Key Value Store (Valkey)) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of checkout, the host of stackit_valkey_instance.dependencies_checkout_elasticache_redis_default and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it) resolve checkout: UNKNOWN — supplied by Network Architect (the address checkout resolves to from a pod of checkout, compared with what stands for it on STACKIT: checkout.<namespace>.svc.cluster.local (the Kubernetes Service checkout; checkout from a pod of the same namespace). resolve, from a pod of a client of checkout, checkout and checkout.<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service checkout (kubectl get service checkout); closed when the address the name resolves to is recorded and the application connects through it)	Network Architect	Holds steps	`DEC-GEN-CONVERT-POD-SEGMENTATION`	every name resolves from a pod of checkout to the address recorded for it on STACKIT, and the application opens its connections through it	—	—
Check from inside the cluster that the 3 name(s) the application orders resolves in the source VPC (the endpoint host of module.dependencies.aws_mq_broker.mq (Amazon MQ), the endpoint host of module.dependencies.module.orders_rds.aws_rds_cluster.this (Aurora), orders) resolve to what stands for them on STACKIT The DNS check of module.retail_app_ecs.module.orders_service.aws_ecs_service.this `MAN/verify/dns/module.retail_app_ecs.module.orders_service.aws_ecs_service.this` Open fields (3, 3 still needed) resolve the endpoint host of module.dependencies.aws_mq_broker.mq (Amazon MQ): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.aws_mq_broker.mq (Amazon MQ) resolves to from a pod of orders, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_rabbitmq_instance.dependencies_mq (RabbitMQ) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of orders, the host of stackit_rabbitmq_instance.dependencies_mq and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it) resolve the endpoint host of module.dependencies.module.orders_rds.aws_rds_cluster.this (Aurora): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.module.orders_rds.aws_rds_cluster.this (Aurora) resolves to from a pod of orders, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_postgresflex_instance.dependencies_orders_rds_this (PostgreSQL Flex) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of orders, the host of stackit_postgresflex_instance.dependencies_orders_rds_this and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it) resolve orders: UNKNOWN — supplied by Network Architect (the address orders resolves to from a pod of orders, compared with what stands for it on STACKIT: orders.<namespace>.svc.cluster.local (the Kubernetes Service orders; orders from a pod of the same namespace). resolve, from a pod of a client of orders, orders and orders.<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service orders (kubectl get service orders); closed when the address the name resolves to is recorded and the application connects through it)	Network Architect	Holds steps	`DEC-GEN-CONVERT-POD-SEGMENTATION`	every name resolves from a pod of orders to the address recorded for it on STACKIT, and the application opens its connections through it	—	—
Check from inside the cluster that the 1 name(s) the application ui resolves in the source VPC (ui) resolve to what stands for them on STACKIT The DNS check of module.retail_app_ecs.module.ui_service.aws_ecs_service.this `MAN/verify/dns/module.retail_app_ecs.module.ui_service.aws_ecs_service.this` Open fields (1, 1 still needed) resolve ui: UNKNOWN — supplied by Network Architect (the address ui resolves to from a pod of ui, compared with what stands for it on STACKIT: ui.<namespace>.svc.cluster.local (the Kubernetes Service ui; ui from a pod of the same namespace). resolve, from a pod of a client of ui, ui and ui.<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service ui (kubectl get service ui); closed when the address the name resolves to is recorded and the application connects through it)	Network Architect	Holds steps	`DEC-GEN-CONVERT-POD-SEGMENTATION`	every name resolves from a pod of ui to the address recorded for it on STACKIT, and the application opens its connections through it	—	—
Check that the host and port of a credential of stackit_rabbitmq_instance.dependencies_mq (stackit_rabbitmq_credential; the draft writes one for the instance: read its host and port after the apply) answers the requests the clients of module.dependencies.aws_mq_broker.mq send, over the STACKIT address, as the instances[*].endpoints of module.dependencies.aws_mq_broker.mq did The endpoint check of module.dependencies.aws_mq_broker.mq `MAN/verify/endpoint/module.dependencies.aws_mq_broker.mq`	Network Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	every request answers over the STACKIT address with the status and content the AWS address gave	—	—
Check that the host and port of a credential of stackit_opensearch_instance.dependencies_catalog_opensearch_this (stackit_opensearch_credential; the draft writes one for the instance: read its host and port after the apply) answers the requests the clients of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this send, over the STACKIT address, as the endpoint of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this did The endpoint check of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this `MAN/verify/endpoint/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`	Network Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	every request answers over the STACKIT address with the status and content the AWS address gave	—	—
Check that the external_address of stackit_application_load_balancer.retail_app_ecs_alb_this answers the requests the clients of module.retail_app_ecs.module.alb.aws_lb.this send, over the STACKIT address, as the dns_name of module.retail_app_ecs.module.alb.aws_lb.this did The endpoint check of module.retail_app_ecs.module.alb.aws_lb.this `MAN/verify/endpoint/module.retail_app_ecs.module.alb.aws_lb.this`	Network Architect	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	every request answers over the STACKIT address with the status and content the AWS address gave	—	—
Decide GO or ROLLBACK for the migration once every check of the verification is done: GO lets the source resources be retired, ROLLBACK reverts the cutover and keeps AWS serving The rollback decision step `MAN/verify/rollback-decision`	Migration Owner	Holds steps	`DEC-GEN-CONVERT-API-OPT-IN`, `DEC-GEN-CONVERT-DATA-MOVEMENT`, `DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE`, `DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION`, `DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH`, `DEC-GEN-CONVERT-POD-SEGMENTATION`	the owner records GO or ROLLBACK, with the date and the result of each check	—	—