{ "schema_version": "0.1.0", "tool": "stacktoit", "run_id": "f6267c3f-2848-4aa5-89df-5fee8b15b3b9", "source_digest": "sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70", "plans": [ { "family": "identity", "rendering": [], "plan": { "schema_version": "0.2.8", "producer": { "name": "stacktoit-stackitsa", "version": "0.1.0" }, "target": { "provider": "stackit", "provider_version": "0.121.0" }, "source_units": [ { "id": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "provider": "aws", "type": "aws_ecs_service", "address": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this" }, { "id": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "provider": "aws", "type": "aws_ecs_service", "address": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this" }, { "id": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "provider": "aws", "type": "aws_ecs_service", "address": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this" }, { "id": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "provider": "aws", "type": "aws_ecs_service", "address": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this" }, { "id": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "provider": "aws", "type": "aws_ecs_service", "address": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this" } ], "resources": [], "relations": [], "variables": [], "prerequisites": [], "manual_actions": [ { "id": "stackitsa:facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this#execution_role_arn", "kind": "OTHER", "on": { "unit": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "node": "module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this", "attribute": "execution_role_arn" }, "what": "Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach", "why": "the role is the platform agent's identity, not the application's (execution_role_arn of module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role). a platform agent's identity is not an application identity and has no STACKIT counterpart; the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person", "phase": "BEFORE_PILOT", "owner_role": "Identity Architect", "subjects": [ "module.retail_app_ecs.module.carts_service.aws_ecs_service.this" ], "success_condition": "the identity fact of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed" }, { "id": "stackitsa:facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this#task_role_arn", "kind": "OTHER", "on": { "unit": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "node": "module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this", "attribute": "task_role_arn" }, "what": "Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it", "why": "the workload is a container service, not a server an account is attached to (task_role_arn of module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.carts_service.aws_iam_role.task_role). the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person", "phase": "BEFORE_PILOT", "owner_role": "Identity Architect", "subjects": [ "module.retail_app_ecs.module.carts_service.aws_ecs_service.this" ], "success_condition": "the identity fact of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.carts_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed" }, { "id": "stackitsa:facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this#execution_role_arn", "kind": "OTHER", "on": { "unit": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "node": "module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this", "attribute": "execution_role_arn" }, "what": "Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach", "why": "the role is the platform agent's identity, not the application's (execution_role_arn of module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role). a platform agent's identity is not an application identity and has no STACKIT counterpart; the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person", "phase": "BEFORE_PILOT", "owner_role": "Identity Architect", "subjects": [ "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this" ], "success_condition": "the identity fact of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed" }, { "id": "stackitsa:facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this#task_role_arn", "kind": "OTHER", "on": { "unit": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "node": "module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this", "attribute": "task_role_arn" }, "what": "Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it", "why": "the workload is a container service, not a server an account is attached to (task_role_arn of module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role). the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person", "phase": "BEFORE_PILOT", "owner_role": "Identity Architect", "subjects": [ "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this" ], "success_condition": "the identity fact of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed" }, { "id": "stackitsa:facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this#execution_role_arn", "kind": "OTHER", "on": { "unit": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "node": "module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this", "attribute": "execution_role_arn" }, "what": "Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach", "why": "the role is the platform agent's identity, not the application's (execution_role_arn of module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role). a platform agent's identity is not an application identity and has no STACKIT counterpart; the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person", "phase": "BEFORE_PILOT", "owner_role": "Identity Architect", "subjects": [ "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this" ], "success_condition": "the identity fact of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed" }, { "id": "stackitsa:facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this#task_role_arn", "kind": "OTHER", "on": { "unit": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "node": "module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this", "attribute": "task_role_arn" }, "what": "Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it", "why": "the workload is a container service, not a server an account is attached to (task_role_arn of module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role). the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person", "phase": "BEFORE_PILOT", "owner_role": "Identity Architect", "subjects": [ "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this" ], "success_condition": "the identity fact of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed" }, { "id": "stackitsa:facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this#execution_role_arn", "kind": "OTHER", "on": { "unit": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "node": "module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this", "attribute": "execution_role_arn" }, "what": "Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach", "why": "the role is the platform agent's identity, not the application's (execution_role_arn of module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role). a platform agent's identity is not an application identity and has no STACKIT counterpart; the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person", "phase": "BEFORE_PILOT", "owner_role": "Identity Architect", "subjects": [ "module.retail_app_ecs.module.orders_service.aws_ecs_service.this" ], "success_condition": "the identity fact of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed" }, { "id": "stackitsa:facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this#task_role_arn", "kind": "OTHER", "on": { "unit": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "node": "module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this", "attribute": "task_role_arn" }, "what": "Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it", "why": "the workload is a container service, not a server an account is attached to (task_role_arn of module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.orders_service.aws_iam_role.task_role). the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person", "phase": "BEFORE_PILOT", "owner_role": "Identity Architect", "subjects": [ "module.retail_app_ecs.module.orders_service.aws_ecs_service.this" ], "success_condition": "the identity fact of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.orders_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed" }, { "id": "stackitsa:facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this#execution_role_arn", "kind": "OTHER", "on": { "unit": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "node": "module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this", "attribute": "execution_role_arn" }, "what": "Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach", "why": "the role is the platform agent's identity, not the application's (execution_role_arn of module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role). a platform agent's identity is not an application identity and has no STACKIT counterpart; the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person", "phase": "BEFORE_PILOT", "owner_role": "Identity Architect", "subjects": [ "module.retail_app_ecs.module.ui_service.aws_ecs_service.this" ], "success_condition": "the identity fact of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed" }, { "id": "stackitsa:facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this#task_role_arn", "kind": "OTHER", "on": { "unit": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "node": "module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this", "attribute": "task_role_arn" }, "what": "Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it", "why": "the workload is a container service, not a server an account is attached to (task_role_arn of module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.ui_service.aws_iam_role.task_role). the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person", "phase": "BEFORE_PILOT", "owner_role": "Identity Architect", "subjects": [ "module.retail_app_ecs.module.ui_service.aws_ecs_service.this" ], "success_condition": "the identity fact of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.ui_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed" } ], "decisions": [], "residual_differences": [], "ledger": [], "validation_requirements": [], "no_targets": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this", "reason": "MANUAL_REVIEW", "cause": "module.retail_app_ecs.module.carts_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person)" }, { "unit": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this", "reason": "MANUAL_REVIEW", "cause": "module.retail_app_ecs.module.catalog_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person)" }, { "unit": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this", "reason": "MANUAL_REVIEW", "cause": "module.retail_app_ecs.module.checkout_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person)" }, { "unit": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this", "reason": "MANUAL_REVIEW", "cause": "module.retail_app_ecs.module.orders_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person)" }, { "unit": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this", "reason": "MANUAL_REVIEW", "cause": "module.retail_app_ecs.module.ui_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person)" } ], "provenance": { "kb_version": "0.384.0", "rules": [ "stackitsa.account", "stackitsa.attach" ] } } }, { "family": "logs", "rendering": [ {"address":"stackit_logs_instance.logs_retention_180d","as":"RESOURCE"} ], "plan": { "schema_version": "0.2.8", "producer": { "name": "stacktoit-stackitlogs", "version": "0.1.0" }, "target": { "provider": "stackit", "provider_version": "0.121.0" }, "source_units": [ { "id": "module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_group.this", "provider": "aws", "type": "aws_cloudwatch_log_group", "address": "module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_group.this" }, { "id": "module.dependencies.module.catalog_rds.aws_cloudwatch_log_group.this", "provider": "aws", "type": "aws_cloudwatch_log_group", "address": "module.dependencies.module.catalog_rds.aws_cloudwatch_log_group.this" }, { "id": "module.dependencies.module.orders_rds.aws_cloudwatch_log_group.this", "provider": "aws", "type": "aws_cloudwatch_log_group", "address": "module.dependencies.module.orders_rds.aws_cloudwatch_log_group.this" }, { "id": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights", "provider": "aws", "type": "aws_cloudwatch_log_group", "address": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights" }, { "id": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "provider": "aws", "type": "aws_cloudwatch_log_group", "address": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks" }, { "id": "module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log", "provider": "aws", "type": "aws_cloudwatch_log_group", "address": "module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log" } ], "resources": [ { "address": "stackit_logs_instance.logs_retention_180d", "mode": "managed", "type": "stackit_logs_instance", "labels": [ "logs_retention_180d" ], "file": "observability.tf", "rule": "stackitlogs.instance", "fields": [ { "path": "display_name", "state": "EXACT", "value": "logs-retention-180d", "reason": "the display name is derived from the retention (or from the source that has an instance of its own): STACKIT Logs has no object that carries a source's name", "evidence": [ "cap:observability.logs/display-name-pattern" ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:observability.logs/display-name-pattern" ], "variant": "instance", "constraints": [ { "row": "cap:observability.logs/display-name-pattern", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "node[module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks].name", "state": "MANUAL_ACTION", "manual_action": "stackitlogs:label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "reason": "the name the source writes to has no object on the target that can hold it", "evidence": [ "cap:observability.logs/no-log-group-or-stream-object" ], "cites": [ { "unit": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "fact": "name" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:observability.logs/no-log-group-or-stream-object" ], "variant": "instance", "constraints": [ { "row": "cap:observability.logs/no-log-group-or-stream-object", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "node[module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks].retention_in_days", "state": "UNSUPPORTED", "reason": "the source keeps its logs for ever (it states no period, or 0); a Logs instance keeps at most 180 days, so the logs of this source are kept for 180 days here and anything older has to be archived elsewhere (for example in Object Storage) if it must be kept", "evidence": [ "cap:observability.logs/retention-1-to-180-days", "cap:observability.logs/retention-is-per-instance" ], "cites": [ { "unit": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "fact": "retention_in_days" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:observability.logs/retention-1-to-180-days", "cap:observability.logs/retention-is-per-instance" ], "variant": "instance", "constraints": [ { "row": "cap:observability.logs/retention-1-to-180-days", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:observability.logs/retention-is-per-instance", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "project_id", "state": "VARIABLE_REQUIRED", "variable": "project_id", "reason": "the instance belongs to a STACKIT project" }, { "path": "retention_days", "state": "EXACT", "value": 180, "reason": "the instance keeps its logs for 180 days: one instance for each retention period, because the retention is one attribute of the instance and the API has no per-source retention", "evidence": [ "cap:observability.logs/retention-1-to-180-days", "cap:observability.logs/retention-is-per-instance" ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:observability.logs/retention-1-to-180-days", "cap:observability.logs/retention-is-per-instance" ], "variant": "instance", "constraints": [ { "row": "cap:observability.logs/retention-1-to-180-days", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:observability.logs/retention-is-per-instance", "scope": "OFFICIAL_DOCUMENTED" } ] } } ], "from_intent": [ "logs:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks" ], "from_units": [ "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks" ], "comments": [] } ], "relations": [], "variables": [ { "name": "project_id", "type": "string", "sensitive": false, "reason": "STACKIT project ID the migrated resources are created in." } ], "prerequisites": [], "manual_actions": [ { "id": "stackitlogs:archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "kind": "ARCHIVE_FLOW", "on": { "unit": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "field": "node[module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks].retention_in_days" }, "what": "Configure a cold-storage log flow for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: send a copy of its logs, in parallel to the Logs instance stackit_logs_instance.logs_retention_180d, to a long-term store (for example a separate Object Storage bucket) that keeps them for the retention beyond 180 days", "why": "the source keeps its logs for ever and a STACKIT Logs instance keeps at most 180 days (retention beyond 180 days is not supported by the managed service): the first 180 days are kept in the Logs instance, and the longer retention is an archive outside it, which STACKIT recommends as a cold-storage approach (a stream of the log data to a low-cost long-term store in parallel to Logs). The plan creates no archive store, configures no stream and sets no retention of the archive. The step exists only when the decision about the logs beyond 180 days chooses the archive; where the requirement is more than 180 days inside STACKIT Logs with no external archive, the archive is rejected and the migration cannot meet that requirement with STACKIT Logs alone", "phase": "CUTOVER_PREREQUISITE", "owner_role": "Platform Architect", "subjects": [ "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks" ], "required_input": "where the archive is kept (for example an Object Storage bucket) and the retention in days the workload needs there (the source keeps its logs for ever)", "success_condition": "a line the log producers of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks send is found both in the Logs instance and in the archive, and logs older than 180 days are readable from the archive", "rollback_capability": "AVAILABLE", "rollback_how": "stop the stream to the archive and delete the archive store; the Logs instance and the logs in it are not changed", "path": "archive-longer-retention-elsewhere" }, { "id": "stackitlogs:label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "kind": "LABEL_CONVENTION", "on": { "unit": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks" }, "what": "Choose a static label and send the name of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (and of its streams) from its log producers as the value of that label", "why": "STACKIT Logs has no log group or stream object that can hold a name, only labels the shipper sends (no-log-group-or-stream-object); the plan chooses no label key and reconfigures no producer", "phase": "CUTOVER_PREREQUISITE", "owner_role": "Platform Architect", "subjects": [ "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks" ], "success_condition": "a static label is chosen, the log producers of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks send its name as the value of that label, and a line one of them sends is found by that label" }, { "id": "stackitlogs:token:stackit_logs_instance.logs_retention_180d", "kind": "TARGET_PRECONDITION", "on": { "unit": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "address": "stackit_logs_instance.logs_retention_180d" }, "what": "Before any log source writes to stackit_logs_instance.logs_retention_180d: create a write access token for the instance (stackit_logs_access_token with the permission write), set the access control list of the instance, and point the shipper at the instance's ingest_url (Loki API) or ingest_otlp_url (OpenTelemetry)", "why": "the plan generates no access token: the token is a credential written to the state, its lifetime (unset, it never expires) and its permissions are choices the source does not state, and one token belongs to one instance (capability observability.logs: logs-access-token-is-a-resource-per-instance); what an instance with no ACL entry allows is not established, so the plan sets no ACL and states no default (probe-needed-logs-acl-default)", "phase": "CUTOVER_PREREQUISITE", "owner_role": "Platform Architect", "subjects": [ "stackit_logs_instance.logs_retention_180d" ], "success_condition": "a write access token for stackit_logs_instance.logs_retention_180d exists, the access control list of the instance is set, and a log line sent with the token to the ingest address of the instance is accepted" } ], "decisions": [ { "id": "stackitlogs:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks:retention_over_180_days", "on": { "unit": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "address": "stackit_logs_instance.logs_retention_180d", "field": "node[module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks].retention_in_days" }, "status": "OPEN", "what": "Decide whether the logs of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks older than 180 days are kept in an archive outside the Logs instance", "why": "the source keeps its logs for ever and a STACKIT Logs instance keeps at most 180 days, so the instance drafted for it (stackit_logs_instance.logs_retention_180d) holds only the last 180 days; logs older than that exist only if a person configures an archive beside it. Choose the archive if the workload needs them; reject it if the requirement is that more than 180 days stay inside STACKIT Logs with no external archive, which STACKIT Logs alone cannot meet", "phase": "CUTOVER_PREREQUISITE", "subjects": [ "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks" ] } ], "residual_differences": [ { "subject": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (LOG_GROUP)", "kind": "GROUP_NOT_CREATED", "on": { "unit": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks" }, "source": "a log group with its own name, settings and facets", "target": "its logs go to the Logs instance stackit_logs_instance.logs_retention_180d, a label-based store with no group or stream object", "accepted": false }, { "subject": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks retention_in_days", "kind": "NO_EQUIVALENT", "on": { "unit": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks", "address": "stackit_logs_instance.logs_retention_180d", "field": "node[module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks].retention_in_days" }, "source": "keeps its logs for ever", "target": "the instance keeps its logs for 180 days at most; older logs are not kept", "accepted": false } ], "ledger": [], "validation_requirements": [ { "id": "stackitlogs:round-trip", "kind": "ROUND_TRIP", "what": "every rendered stackit_logs_instance reads back from the text as the plan states it: its project, its display name and its retention_days, the variable of an instance whose period is not visible, and no instance the plan does not carry", "subjects": [ "stackit_logs_instance.logs_retention_180d" ] } ], "no_targets": [ { "unit": "module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_group.this", "reason": "NOT_DRAFTED", "cause": "the source creates no instance of the log source (count or for_each yields none, or it is switched off): no stackit_logs_instance is drafted" }, { "unit": "module.dependencies.module.catalog_rds.aws_cloudwatch_log_group.this", "reason": "NOT_DRAFTED", "cause": "the source creates no instance of the log source (count or for_each yields none, or it is switched off): no stackit_logs_instance is drafted" }, { "unit": "module.dependencies.module.orders_rds.aws_cloudwatch_log_group.this", "reason": "NOT_DRAFTED", "cause": "the source creates no instance of the log source (count or for_each yields none, or it is switched off): no stackit_logs_instance is drafted" }, { "unit": "module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights", "reason": "NOT_DRAFTED", "cause": "the source creates no instance of the log source (count or for_each yields none, or it is switched off): no stackit_logs_instance is drafted" }, { "unit": "module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log", "reason": "NOT_DRAFTED", "cause": "the source creates no instance of the log source (count or for_each yields none, or it is switched off): no stackit_logs_instance is drafted" } ], "provenance": { "kb_version": "0.384.0", "rules": [ "stackitlogs.instance" ] } } }, { "family": "routing", "rendering": [], "plan": { "schema_version": "0.2.8", "producer": { "name": "stacktoit-stackitroute", "version": "0.1.0" }, "target": { "provider": "stackit", "provider_version": "0.121.0" }, "source_units": [ { "id": "module.vpc.module.vpc.aws_route_table.database", "provider": "aws", "type": "aws_route_table", "address": "module.vpc.module.vpc.aws_route_table.database" }, { "id": "module.vpc.module.vpc.aws_route_table.elasticache", "provider": "aws", "type": "aws_route_table", "address": "module.vpc.module.vpc.aws_route_table.elasticache" }, { "id": "module.vpc.module.vpc.aws_route_table.intra", "provider": "aws", "type": "aws_route_table", "address": "module.vpc.module.vpc.aws_route_table.intra" }, { "id": "module.vpc.module.vpc.aws_route_table.private", "provider": "aws", "type": "aws_route_table", "address": "module.vpc.module.vpc.aws_route_table.private" }, { "id": "module.vpc.module.vpc.aws_route_table.public", "provider": "aws", "type": "aws_route_table", "address": "module.vpc.module.vpc.aws_route_table.public" }, { "id": "module.vpc.module.vpc.aws_route_table.redshift", "provider": "aws", "type": "aws_route_table", "address": "module.vpc.module.vpc.aws_route_table.redshift" } ], "resources": [], "relations": [], "variables": [], "prerequisites": [], "manual_actions": [ { "id": "stackitroute:precondition-outside-area:module.vpc.module.vpc.aws_route_table.private", "kind": "TARGET_PRECONDITION", "on": { "unit": "module.vpc.module.vpc.aws_route_table.private" }, "what": "Create the target project outside a Network Area: module.vpc.module.vpc.aws_route_table.private is replaced by STACKIT's default routing, which was observed to give a routed network the same reachability only in a project outside a Network Area", "why": "STACKIT's default routing was observed to give a routed network the same reachability only in a project outside a Network Area (probe 16, sandbox-01, eu01, 2026-10-10); the default routing table of an area was never read (the organisation read answered 403, cap:network.routing/default-routing-table, cap:network.routing/probe-needed-default-route-internet), so a project created inside an existing area (var.project_id naming one) is not covered by this replacement and the table needs the architect's decision there", "phase": "BEFORE_PILOT", "owner_role": "Network Architect", "subjects": [ "module.vpc.module.vpc.aws_route_table.private" ], "required_input": "the STACKIT project the draft is created in (var.project_id) and whether it lies inside a Network Area", "success_condition": "the target project exists outside a Network Area, or the architect has decided how module.vpc.module.vpc.aws_route_table.private is replaced inside the area" }, { "id": "stackitroute:precondition-outside-area:module.vpc.module.vpc.aws_route_table.public", "kind": "TARGET_PRECONDITION", "on": { "unit": "module.vpc.module.vpc.aws_route_table.public" }, "what": "Create the target project outside a Network Area: module.vpc.module.vpc.aws_route_table.public is replaced by STACKIT's default routing, which was observed to give a routed network the same reachability only in a project outside a Network Area", "why": "STACKIT's default routing was observed to give a routed network the same reachability only in a project outside a Network Area (probe 16, sandbox-01, eu01, 2026-10-10); the default routing table of an area was never read (the organisation read answered 403, cap:network.routing/default-routing-table, cap:network.routing/probe-needed-default-route-internet), so a project created inside an existing area (var.project_id naming one) is not covered by this replacement and the table needs the architect's decision there. Also not equivalent for a server WITHOUT a public IP: the source's internet gateway serves only an instance with a public IPv4 or Elastic IP address, so such a server had no internet path, while on STACKIT it leaves through the network's shared SNAT address (probe 16 rows A and B, cap:network.public-ip-and-egress/snat-egress-address-is-network-publicip): that egress is new, the table does not carry it, and it is decided on the subnet (subnet-egress-ipv4-unproven)", "phase": "BEFORE_PILOT", "owner_role": "Network Architect", "subjects": [ "module.vpc.module.vpc.aws_route_table.public" ], "required_input": "the STACKIT project the draft is created in (var.project_id) and whether it lies inside a Network Area", "success_condition": "the target project exists outside a Network Area, or the architect has decided how module.vpc.module.vpc.aws_route_table.public is replaced inside the area" } ], "decisions": [ { "id": "stackitroute:module.vpc.module.vpc.aws_route_table.private:NAT_FIXED_EGRESS_ADDRESS_LOST", "on": { "unit": "module.vpc.module.vpc.aws_route_table.private" }, "status": "OPEN", "what": "Decide the egress address of module.vpc.module.vpc.aws_route_table.private: keep the changing address of the STACKIT network, or give each server that an allow-list names a STACKIT public IP", "why": "a NAT gateway's fixed egress address is lost on STACKIT: the address a routed network leaves by is the network's own, shared by every routed network of the project, not fixed and not settable (cap:network.routing/routing-table-internet-nexthop)", "phase": "BEFORE_PILOT", "subjects": [ "module.vpc.module.vpc.aws_route_table.private" ] } ], "residual_differences": [], "ledger": [], "validation_requirements": [], "no_targets": [ { "unit": "module.vpc.module.vpc.aws_route_table.database", "reason": "NOT_DRAFTED", "cause": "the source creates no instance of the table (count or for_each yields none, or it is switched off): no stackit_routing_table is drafted" }, { "unit": "module.vpc.module.vpc.aws_route_table.elasticache", "reason": "NOT_DRAFTED", "cause": "the source creates no instance of the table (count or for_each yields none, or it is switched off): no stackit_routing_table is drafted" }, { "unit": "module.vpc.module.vpc.aws_route_table.intra", "reason": "NOT_DRAFTED", "cause": "the source creates no instance of the table (count or for_each yields none, or it is switched off): no stackit_routing_table is drafted" }, { "unit": "module.vpc.module.vpc.aws_route_table.private", "reason": "NOT_DRAFTED", "cause": "STACKIT's default routing replaces the table, with a loss: a route of the table sends traffic to a NAT gateway (the others, if any, to an internet gateway), and the reachability is observed on the target for a project outside a Network Area, which this draft does not write. Observed in one sandbox project outside a Network Area (probe 16, 2026-10-10; routing tables are refused there, cap:network.routing/routing-tables-not-supported-for-sandbox-project): a routed network reaches the internet with no route and no routing table configured, a server without a public IP through the network's shared SNAT address and a server with a public IP through its own (cap:network.public-ip-and-egress/snat-egress-address-is-network-publicip, cap:network.public-ip-and-egress/public-ip-one-to-one-on-nic); nothing initiated from the internet reached a server behind the network address (cap:network.public-ip-and-egress/snat-implicit-egress); egress is restricted by the egress rules of security groups, not by a route (cap:network.security-group/egress-allow-list-restricts-outbound); routed networks reach each other with no table (cap:network.routing/internal-routing-without-table-sandbox). No stackit_routing_table is drafted. A NAT gateway adds what an internet route does not. Its fixed egress address is LOST (observed, cap:network.public-ip-and-egress/snat-egress-address-is-network-publicip): the address a routed STACKIT network leaves by is the network's publicIp, one address for every routed network of the project, not fixed (it changed twice when every network of the project was deleted) and not settable (a PATCH of it answers 202 and is ignored), so a third party's allow-list on the NAT gateway's address does not survive; a STACKIT public IP per server keeps its address, the only one the probe saw stay fixed (cap:network.public-ip-and-egress/public-ip-one-to-one-on-nic). The egress restriction (the gateway as the only way out of a private subnet) is carried by the egress rules of security groups, not by a route (observed, cap:network.security-group/egress-allow-list-restricts-outbound); whether the source restricts egress that way is for the architect. The absence of inbound paths of a private subnet is observed for a server without a public IP (tcp 22, 80 and 8080 on the network address, cap:network.public-ip-and-egress/snat-implicit-egress). Not observed: a Network Area and its default routing table (cap:network.routing/default-routing-table, cap:network.routing/probe-needed-default-route-internet). The outbound address of the servers an allow-list names is the architect's choice: keep the changing address, or give each server that an allow-list names a STACKIT public IP" }, { "unit": "module.vpc.module.vpc.aws_route_table.public", "reason": "NOT_DRAFTED", "cause": "STACKIT's default routing replaces the table: every route of the table sends traffic to an internet gateway, and the equivalence is observed on the target for a project outside a Network Area, which this draft does not write. Observed in one sandbox project outside a Network Area (probe 16, 2026-10-10; routing tables are refused there, cap:network.routing/routing-tables-not-supported-for-sandbox-project): a routed network reaches the internet with no route and no routing table configured, a server without a public IP through the network's shared SNAT address and a server with a public IP through its own (cap:network.public-ip-and-egress/snat-egress-address-is-network-publicip, cap:network.public-ip-and-egress/public-ip-one-to-one-on-nic); nothing initiated from the internet reached a server behind the network address (cap:network.public-ip-and-egress/snat-implicit-egress); egress is restricted by the egress rules of security groups, not by a route (cap:network.security-group/egress-allow-list-restricts-outbound); routed networks reach each other with no table (cap:network.routing/internal-routing-without-table-sandbox). No stackit_routing_table is drafted. Observed in one project of one region on one day, so not HIGH; not observed: a Network Area and its default routing table (cap:network.routing/default-routing-table, cap:network.routing/probe-needed-default-route-internet), where this would be open again" }, { "unit": "module.vpc.module.vpc.aws_route_table.redshift", "reason": "NOT_DRAFTED", "cause": "the source creates no instance of the table (count or for_each yields none, or it is switched off): no stackit_routing_table is drafted" } ], "provenance": { "kb_version": "0.384.0", "rules": [ "stackitroute.route", "stackitroute.table" ] } } }, { "family": "security/aws", "rendering": [ {"address":"stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix","as":"RESOURCE"}, {"address":"stackit_security_group.retail_app_ecs_alb_this","as":"RESOURCE"}, {"address":"stackit_security_group.retail_app_ecs_carts_service_this","as":"RESOURCE"}, {"address":"stackit_security_group.retail_app_ecs_catalog_service_this","as":"RESOURCE"}, {"address":"stackit_security_group.retail_app_ecs_checkout_service_this","as":"RESOURCE"}, {"address":"stackit_security_group.retail_app_ecs_orders_service_this","as":"RESOURCE"}, {"address":"stackit_security_group.retail_app_ecs_ui_service_this","as":"RESOURCE"}, {"address":"stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1","as":"RESOURCE"}, {"address":"stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1","as":"RESOURCE"}, {"address":"stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1","as":"RESOURCE"}, {"address":"stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1","as":"RESOURCE"}, {"address":"stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1","as":"RESOURCE"} ], "plan": { "schema_version": "0.2.8", "producer": { "name": "stacktoit-awssg", "version": "0.1.0" }, "target": { "provider": "stackit", "provider_version": "0.121.0" }, "source_units": [ { "id": "module.dependencies.aws_security_group.catalog_opensearch_sg", "provider": "aws", "type": "aws_security_group", "address": "module.dependencies.aws_security_group.catalog_opensearch_sg" }, { "id": "module.dependencies.aws_security_group.mq", "provider": "aws", "type": "aws_security_group", "address": "module.dependencies.aws_security_group.mq" }, { "id": "module.dependencies.module.catalog_opensearch.aws_security_group.this", "provider": "aws", "type": "aws_security_group", "address": "module.dependencies.module.catalog_opensearch.aws_security_group.this" }, { "id": "module.dependencies.module.catalog_rds.aws_security_group.this", "provider": "aws", "type": "aws_security_group", "address": "module.dependencies.module.catalog_rds.aws_security_group.this" }, { "id": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd", "provider": "aws", "type": "aws_security_group", "address": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd" }, { "id": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default", "provider": "aws", "type": "aws_security_group", "address": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default" }, { "id": "module.dependencies.module.orders_rds.aws_security_group.this", "provider": "aws", "type": "aws_security_group", "address": "module.dependencies.module.orders_rds.aws_security_group.this" }, { "id": "module.retail_app_ecs.module.alb.aws_security_group.this", "provider": "aws", "type": "aws_security_group", "address": "module.retail_app_ecs.module.alb.aws_security_group.this" }, { "id": "module.retail_app_ecs.module.alb_sg.aws_security_group.this", "provider": "aws", "type": "aws_security_group", "address": "module.retail_app_ecs.module.alb_sg.aws_security_group.this" }, { "id": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "provider": "aws", "type": "aws_security_group", "address": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix" }, { "id": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "provider": "aws", "type": "aws_security_group", "address": "module.retail_app_ecs.module.carts_service.aws_security_group.this" }, { "id": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "provider": "aws", "type": "aws_security_group", "address": "module.retail_app_ecs.module.catalog_service.aws_security_group.this" }, { "id": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "provider": "aws", "type": "aws_security_group", "address": "module.retail_app_ecs.module.checkout_service.aws_security_group.this" }, { "id": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "provider": "aws", "type": "aws_security_group", "address": "module.retail_app_ecs.module.orders_service.aws_security_group.this" }, { "id": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "provider": "aws", "type": "aws_security_group", "address": "module.retail_app_ecs.module.ui_service.aws_security_group.this" } ], "resources": [ { "address": "stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix", "mode": "managed", "type": "stackit_security_group", "labels": [ "retail_app_ecs_alb_sg_this_name_prefix" ], "file": "security.tf", "rule": "awssg.group", "fields": [ { "path": "default_egress.ipv4", "state": "SAFE_OMISSION", "reason": "the source restricts IPv4 egress, and STACKIT creates an allow-all IPv4 egress rule on this group that the draft does not manage; that rule acts on the network interface that lists the group, and no block of the draft lists this one (its members are module.retail_app_ecs.module.alb.aws_lb.this (aws_lb, written without a security group)), so there is no effect to decide about; if you attach the group to an interface by hand, that rule applies to the interface until it is deleted (stackit security-group rule list, then delete with the security group id): decide then", "evidence": [ "cap:network.security-group/default-egress-rules", "cap:network.security-group/duplicate-default-egress-rule-rejected", "mirror:hashicorp/terraform-provider-aws website/docs/r/security_group.html.markdown:67 (v6.66.0)" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "fact": "egress" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/duplicate-default-egress-rule-rejected" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/default-egress-rules", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/duplicate-default-egress-rule-rejected", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "default_egress.ipv6", "state": "SAFE_OMISSION", "reason": "the source restricts IPv6 egress, and STACKIT creates an allow-all IPv6 egress rule on this group that the draft does not manage; that rule acts on the network interface that lists the group, and no block of the draft lists this one (its members are module.retail_app_ecs.module.alb.aws_lb.this (aws_lb, written without a security group)), so there is no effect to decide about; if you attach the group to an interface by hand, that rule applies to the interface until it is deleted (stackit security-group rule list, then delete with the security group id): decide then", "evidence": [ "cap:network.security-group/default-egress-rules", "cap:network.security-group/duplicate-default-egress-rule-rejected", "mirror:hashicorp/terraform-provider-aws website/docs/r/security_group.html.markdown:67 (v6.66.0)" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "fact": "egress" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/duplicate-default-egress-rule-rejected" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/default-egress-rules", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/duplicate-default-egress-rule-rejected", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "description", "state": "EXACT", "value": "UI ALB security group", "evidence": [ "cap:network.security-group/group-description-length", "kb:criticality/aws_security_group.description NON_CRITICAL (the harvested provider documentation of the AWS security group)" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "fact": "description" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-description-length" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-description-length", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "labels", "state": "VARIABLE_REQUIRED", "variable": "sg_retail_app_ecs_alb_sg_this_name_prefix_labels", "reason": "the source reads a variable for its tags; the labels are a variable of the draft with the scan's reading as default", "evidence": [ "cap:network.security-group/group-labels-format", "kb:criticality/aws_security_group.tags NON_CRITICAL (the harvested provider documentation of the AWS security group)" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "fact": "tags" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-labels-format" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-labels-format", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "name", "state": "EXACT", "value": "retail-app-ecs-alb-sg-this-name-prefix", "reason": "derived from the address of the source group: the source group has no name of its own: AWS names it from the name_prefix \"retail-store-ecs-ui-\" and a random suffix (the draft does not use the prefix as the name)", "evidence": [ "cap:network.security-group/group-name-validator", "the harvested provider documentation of the AWS security group" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "fact": "name" } ], "behavior_evidence": { "state": "OBSERVED_ON_TARGET", "rows": [ "cap:network.security-group/group-name-validator" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-name-validator", "scope": "OBSERVED_EXACT_VARIANT", "note": "the tested constraints of STACKIT provider 0.116.0 (security_group.name)" } ] } }, { "path": "name_prefix", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL)", "evidence": [ "cap:network.security-group/group-name-validator", "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "fact": "settings" } ], "behavior_evidence": { "state": "OBSERVED_ON_TARGET", "rows": [ "cap:network.security-group/group-name-validator" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-name-validator", "scope": "OBSERVED_EXACT_VARIANT", "note": "the tested constraints of STACKIT provider 0.116.0 (security_group.name)" } ] } }, { "path": "project_id", "state": "VARIABLE_REQUIRED", "variable": "project_id", "reason": "the STACKIT project the group belongs to (a group is project-scoped)", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "revoke_rules_on_delete", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "fact": "settings" } ] }, { "path": "stateful", "state": "SAFE_OMISSION", "reason": "the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written", "evidence": [ "cap:network.security-group/stateful-default-true", "cap:network.security-group/stateful-return-traffic", "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "fact": "stateful" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/stateful-return-traffic" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/stateful-default-true", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/stateful-return-traffic", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "tags_all", "state": "SAFE_OMISSION", "reason": "tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "kb:criticality/aws_security_group.tags NON_CRITICAL (the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "fact": "settings" } ] }, { "path": "timeouts", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "fact": "settings" } ] }, { "path": "vpc_id", "state": "UNSUPPORTED", "reason": "a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "fact": "vpc_id" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } } ], "from_intent": [ "security:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix" ], "from_units": [ "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix" ], "comments": [ { "kind": "INFO", "subject": "name", "text": "name derived from the address of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]: the source group has no name of its own: AWS names it from the name_prefix \"retail-store-ecs-ui-\" and a random suffix (the draft does not use the prefix as the name)", "on": { "field": "name" } } ] }, { "address": "stackit_security_group.retail_app_ecs_alb_this", "mode": "managed", "type": "stackit_security_group", "labels": [ "retail_app_ecs_alb_this" ], "file": "security.tf", "rule": "awssg.group", "fields": [ { "path": "default_egress.ipv4", "state": "SAFE_OMISSION", "reason": "the source restricts IPv4 egress, and STACKIT creates an allow-all IPv4 egress rule on this group that the draft does not manage; that rule acts on the network interface that lists the group, and no block of the draft lists this one (its members are module.retail_app_ecs.module.alb.aws_lb.this (aws_lb, written without a security group)), so there is no effect to decide about; if you attach the group to an interface by hand, that rule applies to the interface until it is deleted (stackit security-group rule list, then delete with the security group id): decide then", "evidence": [ "cap:network.security-group/default-egress-rules", "cap:network.security-group/duplicate-default-egress-rule-rejected", "mirror:hashicorp/terraform-provider-aws website/docs/r/security_group.html.markdown:67 (v6.66.0)" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb.aws_security_group.this", "fact": "egress" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/duplicate-default-egress-rule-rejected" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/default-egress-rules", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/duplicate-default-egress-rule-rejected", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "default_egress.ipv6", "state": "SAFE_OMISSION", "reason": "the source restricts IPv6 egress, and STACKIT creates an allow-all IPv6 egress rule on this group that the draft does not manage; that rule acts on the network interface that lists the group, and no block of the draft lists this one (its members are module.retail_app_ecs.module.alb.aws_lb.this (aws_lb, written without a security group)), so there is no effect to decide about; if you attach the group to an interface by hand, that rule applies to the interface until it is deleted (stackit security-group rule list, then delete with the security group id): decide then", "evidence": [ "cap:network.security-group/default-egress-rules", "cap:network.security-group/duplicate-default-egress-rule-rejected", "mirror:hashicorp/terraform-provider-aws website/docs/r/security_group.html.markdown:67 (v6.66.0)" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb.aws_security_group.this", "fact": "egress" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/duplicate-default-egress-rule-rejected" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/default-egress-rules", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/duplicate-default-egress-rule-rejected", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "labels", "state": "VARIABLE_REQUIRED", "variable": "sg_retail_app_ecs_alb_this_labels", "reason": "the source reads a variable for its tags; the labels are a variable of the draft with the scan's reading as default", "evidence": [ "cap:network.security-group/group-labels-format", "kb:criticality/aws_security_group.tags NON_CRITICAL (the harvested provider documentation of the AWS security group)" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb.aws_security_group.this", "fact": "tags" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-labels-format" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-labels-format", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "name", "state": "EXACT", "value": "retail-app-ecs-alb-this", "reason": "derived from the address of the source group: the source group has no name of its own: AWS names it from the name_prefix \"retail-store-ecs-ui-\" and a random suffix (the draft does not use the prefix as the name)", "evidence": [ "cap:network.security-group/group-name-validator", "the harvested provider documentation of the AWS security group" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb.aws_security_group.this", "fact": "name" } ], "behavior_evidence": { "state": "OBSERVED_ON_TARGET", "rows": [ "cap:network.security-group/group-name-validator" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-name-validator", "scope": "OBSERVED_EXACT_VARIANT", "note": "the tested constraints of STACKIT provider 0.116.0 (security_group.name)" } ] } }, { "path": "name_prefix", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL)", "evidence": [ "cap:network.security-group/group-name-validator", "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb.aws_security_group.this", "fact": "settings" } ], "behavior_evidence": { "state": "OBSERVED_ON_TARGET", "rows": [ "cap:network.security-group/group-name-validator" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-name-validator", "scope": "OBSERVED_EXACT_VARIANT", "note": "the tested constraints of STACKIT provider 0.116.0 (security_group.name)" } ] } }, { "path": "project_id", "state": "VARIABLE_REQUIRED", "variable": "project_id", "reason": "the STACKIT project the group belongs to (a group is project-scoped)", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "revoke_rules_on_delete", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb.aws_security_group.this", "fact": "settings" } ] }, { "path": "stateful", "state": "SAFE_OMISSION", "reason": "the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written", "evidence": [ "cap:network.security-group/stateful-default-true", "cap:network.security-group/stateful-return-traffic", "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb.aws_security_group.this", "fact": "stateful" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/stateful-return-traffic" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/stateful-default-true", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/stateful-return-traffic", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "tags_all", "state": "SAFE_OMISSION", "reason": "tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "kb:criticality/aws_security_group.tags NON_CRITICAL (the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb.aws_security_group.this", "fact": "settings" } ] }, { "path": "timeouts", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb.aws_security_group.this", "fact": "settings" } ] }, { "path": "vpc_id", "state": "UNSUPPORTED", "reason": "a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "cites": [ { "unit": "module.retail_app_ecs.module.alb.aws_security_group.this", "fact": "vpc_id" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } } ], "from_intent": [ "security:module.retail_app_ecs.module.alb.aws_security_group.this" ], "from_units": [ "module.retail_app_ecs.module.alb.aws_security_group.this" ], "comments": [ { "kind": "INFO", "subject": "name", "text": "name derived from the address of module.retail_app_ecs.module.alb.aws_security_group.this[0]: the source group has no name of its own: AWS names it from the name_prefix \"retail-store-ecs-ui-\" and a random suffix (the draft does not use the prefix as the name)", "on": { "field": "name" } } ] }, { "address": "stackit_security_group.retail_app_ecs_carts_service_this", "mode": "managed", "type": "stackit_security_group", "labels": [ "retail_app_ecs_carts_service_this" ], "file": "security.tf", "rule": "awssg.group", "fields": [ { "path": "default_egress.ipv4", "state": "SAFE_OMISSION", "reason": "the source allows all IPv4 egress, which is the allow-all IPv4 egress rule STACKIT creates on every new group: it is covered by the STACKIT default egress rules and not produced (a duplicate is rejected with HTTP 409)", "evidence": [ "cap:network.security-group/default-egress-rules", "cap:network.security-group/duplicate-default-egress-rule-rejected", "mirror:hashicorp/terraform-provider-aws website/docs/r/security_group.html.markdown:67 (v6.66.0)" ], "cites": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "fact": "egress" }, { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.carts_service.aws_security_group.this#egress#0#909db684902e", "fact": "egress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/duplicate-default-egress-rule-rejected" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/default-egress-rules", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/duplicate-default-egress-rule-rejected", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "default_egress.ipv6", "state": "SAFE_OMISSION", "reason": "the network has no IPv6 prefix (its VPC module.vpc.module.vpc.aws_vpc.this assigns no IPv6 CIDR block and the estate associates none), and the drafted STACKIT network has none either, so the allow-all IPv6 egress rule STACKIT creates on every new group acts on no traffic, whatever IPv6 egress rules the source lists; if an IPv6 prefix is added to the network later, delete that rule (stackit security-group rule list, then delete with the security group id) or write the equivalent rules of the source: decide then", "evidence": [ "cap:network.security-group/default-egress-rules", "cap:network.security-group/duplicate-default-egress-rule-rejected", "kb:rule/subnet-ipv6 (the AWS network rules of the knowledge base; vpc-ipv6)", "mirror:hashicorp/terraform-provider-aws website/docs/r/security_group.html.markdown:67 (v6.66.0)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_network has ipv6_prefix, ipv6_prefix_length, ipv6_gateway and ipv6_nameservers: a network without an ipv6_prefix is an IPv4 network)" ], "cites": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "fact": "egress" }, { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.carts_service.aws_security_group.this#egress#0#909db684902e", "fact": "egress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/duplicate-default-egress-rule-rejected" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/default-egress-rules", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/duplicate-default-egress-rule-rejected", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "labels", "state": "SAFE_OMISSION", "reason": "the source group sets no tags, so there are no labels to write", "evidence": [ "cap:network.security-group/group-labels-format", "kb:criticality/aws_security_group.tags NON_CRITICAL (the harvested provider documentation of the AWS security group)" ], "cites": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "fact": "tags" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-labels-format" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-labels-format", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "name", "state": "VARIABLE_REQUIRED", "variable": "sg_retail_app_ecs_carts_service_this_name", "reason": "the source value comes from an overridable root variable (var.environment_name)", "evidence": [ "cap:network.security-group/group-name-validator" ], "cites": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "fact": "name" } ], "behavior_evidence": { "state": "OBSERVED_ON_TARGET", "rows": [ "cap:network.security-group/group-name-validator" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-name-validator", "scope": "OBSERVED_EXACT_VARIANT", "note": "the tested constraints of STACKIT provider 0.116.0 (security_group.name)" } ] } }, { "path": "name_prefix", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL)", "evidence": [ "cap:network.security-group/group-name-validator", "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "fact": "settings" } ], "behavior_evidence": { "state": "OBSERVED_ON_TARGET", "rows": [ "cap:network.security-group/group-name-validator" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-name-validator", "scope": "OBSERVED_EXACT_VARIANT", "note": "the tested constraints of STACKIT provider 0.116.0 (security_group.name)" } ] } }, { "path": "project_id", "state": "VARIABLE_REQUIRED", "variable": "project_id", "reason": "the STACKIT project the group belongs to (a group is project-scoped)", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "revoke_rules_on_delete", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "fact": "settings" } ] }, { "path": "stateful", "state": "SAFE_OMISSION", "reason": "the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written", "evidence": [ "cap:network.security-group/stateful-default-true", "cap:network.security-group/stateful-return-traffic", "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html" ], "cites": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "fact": "stateful" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/stateful-return-traffic" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/stateful-default-true", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/stateful-return-traffic", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "tags_all", "state": "SAFE_OMISSION", "reason": "tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "kb:criticality/aws_security_group.tags NON_CRITICAL (the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "fact": "settings" } ] }, { "path": "timeouts", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "fact": "settings" } ] }, { "path": "vpc_id", "state": "UNSUPPORTED", "reason": "a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "cites": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "fact": "vpc_id" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } } ], "from_intent": [ "security:module.retail_app_ecs.module.carts_service.aws_security_group.this" ], "from_units": [ "module.retail_app_ecs.module.carts_service.aws_security_group.this" ], "comments": [ { "kind": "INFO", "subject": "default_egress", "text": "the source's allow-all egress is covered by the STACKIT default egress rules; no rule is produced for it", "on": { "field": "default_egress" } } ] }, { "address": "stackit_security_group.retail_app_ecs_catalog_service_this", "mode": "managed", "type": "stackit_security_group", "labels": [ "retail_app_ecs_catalog_service_this" ], "file": "security.tf", "rule": "awssg.group", "fields": [ { "path": "default_egress.ipv4", "state": "SAFE_OMISSION", "reason": "the source allows all IPv4 egress, which is the allow-all IPv4 egress rule STACKIT creates on every new group: it is covered by the STACKIT default egress rules and not produced (a duplicate is rejected with HTTP 409)", "evidence": [ "cap:network.security-group/default-egress-rules", "cap:network.security-group/duplicate-default-egress-rule-rejected", "mirror:hashicorp/terraform-provider-aws website/docs/r/security_group.html.markdown:67 (v6.66.0)" ], "cites": [ { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "fact": "egress" }, { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.catalog_service.aws_security_group.this#egress#0#909db684902e", "fact": "egress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/duplicate-default-egress-rule-rejected" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/default-egress-rules", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/duplicate-default-egress-rule-rejected", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "default_egress.ipv6", "state": "SAFE_OMISSION", "reason": "the network has no IPv6 prefix (its VPC module.vpc.module.vpc.aws_vpc.this assigns no IPv6 CIDR block and the estate associates none), and the drafted STACKIT network has none either, so the allow-all IPv6 egress rule STACKIT creates on every new group acts on no traffic, whatever IPv6 egress rules the source lists; if an IPv6 prefix is added to the network later, delete that rule (stackit security-group rule list, then delete with the security group id) or write the equivalent rules of the source: decide then", "evidence": [ "cap:network.security-group/default-egress-rules", "cap:network.security-group/duplicate-default-egress-rule-rejected", "kb:rule/subnet-ipv6 (the AWS network rules of the knowledge base; vpc-ipv6)", "mirror:hashicorp/terraform-provider-aws website/docs/r/security_group.html.markdown:67 (v6.66.0)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_network has ipv6_prefix, ipv6_prefix_length, ipv6_gateway and ipv6_nameservers: a network without an ipv6_prefix is an IPv4 network)" ], "cites": [ { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "fact": "egress" }, { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.catalog_service.aws_security_group.this#egress#0#909db684902e", "fact": "egress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/duplicate-default-egress-rule-rejected" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/default-egress-rules", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/duplicate-default-egress-rule-rejected", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "labels", "state": "SAFE_OMISSION", "reason": "the source group sets no tags, so there are no labels to write", "evidence": [ "cap:network.security-group/group-labels-format", "kb:criticality/aws_security_group.tags NON_CRITICAL (the harvested provider documentation of the AWS security group)" ], "cites": [ { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "fact": "tags" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-labels-format" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-labels-format", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "name", "state": "VARIABLE_REQUIRED", "variable": "sg_retail_app_ecs_catalog_service_this_name", "reason": "the source value comes from an overridable root variable (var.environment_name)", "evidence": [ "cap:network.security-group/group-name-validator" ], "cites": [ { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "fact": "name" } ], "behavior_evidence": { "state": "OBSERVED_ON_TARGET", "rows": [ "cap:network.security-group/group-name-validator" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-name-validator", "scope": "OBSERVED_EXACT_VARIANT", "note": "the tested constraints of STACKIT provider 0.116.0 (security_group.name)" } ] } }, { "path": "name_prefix", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL)", "evidence": [ "cap:network.security-group/group-name-validator", "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "fact": "settings" } ], "behavior_evidence": { "state": "OBSERVED_ON_TARGET", "rows": [ "cap:network.security-group/group-name-validator" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-name-validator", "scope": "OBSERVED_EXACT_VARIANT", "note": "the tested constraints of STACKIT provider 0.116.0 (security_group.name)" } ] } }, { "path": "project_id", "state": "VARIABLE_REQUIRED", "variable": "project_id", "reason": "the STACKIT project the group belongs to (a group is project-scoped)", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "revoke_rules_on_delete", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "fact": "settings" } ] }, { "path": "stateful", "state": "SAFE_OMISSION", "reason": "the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written", "evidence": [ "cap:network.security-group/stateful-default-true", "cap:network.security-group/stateful-return-traffic", "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html" ], "cites": [ { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "fact": "stateful" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/stateful-return-traffic" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/stateful-default-true", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/stateful-return-traffic", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "tags_all", "state": "SAFE_OMISSION", "reason": "tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "kb:criticality/aws_security_group.tags NON_CRITICAL (the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "fact": "settings" } ] }, { "path": "timeouts", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "fact": "settings" } ] }, { "path": "vpc_id", "state": "UNSUPPORTED", "reason": "a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "cites": [ { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "fact": "vpc_id" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } } ], "from_intent": [ "security:module.retail_app_ecs.module.catalog_service.aws_security_group.this" ], "from_units": [ "module.retail_app_ecs.module.catalog_service.aws_security_group.this" ], "comments": [ { "kind": "INFO", "subject": "default_egress", "text": "the source's allow-all egress is covered by the STACKIT default egress rules; no rule is produced for it", "on": { "field": "default_egress" } } ] }, { "address": "stackit_security_group.retail_app_ecs_checkout_service_this", "mode": "managed", "type": "stackit_security_group", "labels": [ "retail_app_ecs_checkout_service_this" ], "file": "security.tf", "rule": "awssg.group", "fields": [ { "path": "default_egress.ipv4", "state": "SAFE_OMISSION", "reason": "the source allows all IPv4 egress, which is the allow-all IPv4 egress rule STACKIT creates on every new group: it is covered by the STACKIT default egress rules and not produced (a duplicate is rejected with HTTP 409)", "evidence": [ "cap:network.security-group/default-egress-rules", "cap:network.security-group/duplicate-default-egress-rule-rejected", "mirror:hashicorp/terraform-provider-aws website/docs/r/security_group.html.markdown:67 (v6.66.0)" ], "cites": [ { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "fact": "egress" }, { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.checkout_service.aws_security_group.this#egress#0#909db684902e", "fact": "egress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/duplicate-default-egress-rule-rejected" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/default-egress-rules", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/duplicate-default-egress-rule-rejected", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "default_egress.ipv6", "state": "SAFE_OMISSION", "reason": "the network has no IPv6 prefix (its VPC module.vpc.module.vpc.aws_vpc.this assigns no IPv6 CIDR block and the estate associates none), and the drafted STACKIT network has none either, so the allow-all IPv6 egress rule STACKIT creates on every new group acts on no traffic, whatever IPv6 egress rules the source lists; if an IPv6 prefix is added to the network later, delete that rule (stackit security-group rule list, then delete with the security group id) or write the equivalent rules of the source: decide then", "evidence": [ "cap:network.security-group/default-egress-rules", "cap:network.security-group/duplicate-default-egress-rule-rejected", "kb:rule/subnet-ipv6 (the AWS network rules of the knowledge base; vpc-ipv6)", "mirror:hashicorp/terraform-provider-aws website/docs/r/security_group.html.markdown:67 (v6.66.0)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_network has ipv6_prefix, ipv6_prefix_length, ipv6_gateway and ipv6_nameservers: a network without an ipv6_prefix is an IPv4 network)" ], "cites": [ { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "fact": "egress" }, { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.checkout_service.aws_security_group.this#egress#0#909db684902e", "fact": "egress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/duplicate-default-egress-rule-rejected" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/default-egress-rules", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/duplicate-default-egress-rule-rejected", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "labels", "state": "SAFE_OMISSION", "reason": "the source group sets no tags, so there are no labels to write", "evidence": [ "cap:network.security-group/group-labels-format", "kb:criticality/aws_security_group.tags NON_CRITICAL (the harvested provider documentation of the AWS security group)" ], "cites": [ { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "fact": "tags" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-labels-format" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-labels-format", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "name", "state": "VARIABLE_REQUIRED", "variable": "sg_retail_app_ecs_checkout_service_this_name", "reason": "the source value comes from an overridable root variable (var.environment_name)", "evidence": [ "cap:network.security-group/group-name-validator" ], "cites": [ { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "fact": "name" } ], "behavior_evidence": { "state": "OBSERVED_ON_TARGET", "rows": [ "cap:network.security-group/group-name-validator" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-name-validator", "scope": "OBSERVED_EXACT_VARIANT", "note": "the tested constraints of STACKIT provider 0.116.0 (security_group.name)" } ] } }, { "path": "name_prefix", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL)", "evidence": [ "cap:network.security-group/group-name-validator", "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "fact": "settings" } ], "behavior_evidence": { "state": "OBSERVED_ON_TARGET", "rows": [ "cap:network.security-group/group-name-validator" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-name-validator", "scope": "OBSERVED_EXACT_VARIANT", "note": "the tested constraints of STACKIT provider 0.116.0 (security_group.name)" } ] } }, { "path": "project_id", "state": "VARIABLE_REQUIRED", "variable": "project_id", "reason": "the STACKIT project the group belongs to (a group is project-scoped)", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "revoke_rules_on_delete", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "fact": "settings" } ] }, { "path": "stateful", "state": "SAFE_OMISSION", "reason": "the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written", "evidence": [ "cap:network.security-group/stateful-default-true", "cap:network.security-group/stateful-return-traffic", "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html" ], "cites": [ { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "fact": "stateful" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/stateful-return-traffic" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/stateful-default-true", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/stateful-return-traffic", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "tags_all", "state": "SAFE_OMISSION", "reason": "tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "kb:criticality/aws_security_group.tags NON_CRITICAL (the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "fact": "settings" } ] }, { "path": "timeouts", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "fact": "settings" } ] }, { "path": "vpc_id", "state": "UNSUPPORTED", "reason": "a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "cites": [ { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "fact": "vpc_id" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } } ], "from_intent": [ "security:module.retail_app_ecs.module.checkout_service.aws_security_group.this" ], "from_units": [ "module.retail_app_ecs.module.checkout_service.aws_security_group.this" ], "comments": [ { "kind": "INFO", "subject": "default_egress", "text": "the source's allow-all egress is covered by the STACKIT default egress rules; no rule is produced for it", "on": { "field": "default_egress" } } ] }, { "address": "stackit_security_group.retail_app_ecs_orders_service_this", "mode": "managed", "type": "stackit_security_group", "labels": [ "retail_app_ecs_orders_service_this" ], "file": "security.tf", "rule": "awssg.group", "fields": [ { "path": "default_egress.ipv4", "state": "SAFE_OMISSION", "reason": "the source allows all IPv4 egress, which is the allow-all IPv4 egress rule STACKIT creates on every new group: it is covered by the STACKIT default egress rules and not produced (a duplicate is rejected with HTTP 409)", "evidence": [ "cap:network.security-group/default-egress-rules", "cap:network.security-group/duplicate-default-egress-rule-rejected", "mirror:hashicorp/terraform-provider-aws website/docs/r/security_group.html.markdown:67 (v6.66.0)" ], "cites": [ { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "fact": "egress" }, { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.orders_service.aws_security_group.this#egress#0#909db684902e", "fact": "egress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/duplicate-default-egress-rule-rejected" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/default-egress-rules", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/duplicate-default-egress-rule-rejected", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "default_egress.ipv6", "state": "SAFE_OMISSION", "reason": "the network has no IPv6 prefix (its VPC module.vpc.module.vpc.aws_vpc.this assigns no IPv6 CIDR block and the estate associates none), and the drafted STACKIT network has none either, so the allow-all IPv6 egress rule STACKIT creates on every new group acts on no traffic, whatever IPv6 egress rules the source lists; if an IPv6 prefix is added to the network later, delete that rule (stackit security-group rule list, then delete with the security group id) or write the equivalent rules of the source: decide then", "evidence": [ "cap:network.security-group/default-egress-rules", "cap:network.security-group/duplicate-default-egress-rule-rejected", "kb:rule/subnet-ipv6 (the AWS network rules of the knowledge base; vpc-ipv6)", "mirror:hashicorp/terraform-provider-aws website/docs/r/security_group.html.markdown:67 (v6.66.0)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_network has ipv6_prefix, ipv6_prefix_length, ipv6_gateway and ipv6_nameservers: a network without an ipv6_prefix is an IPv4 network)" ], "cites": [ { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "fact": "egress" }, { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.orders_service.aws_security_group.this#egress#0#909db684902e", "fact": "egress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/duplicate-default-egress-rule-rejected" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/default-egress-rules", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/duplicate-default-egress-rule-rejected", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "labels", "state": "SAFE_OMISSION", "reason": "the source group sets no tags, so there are no labels to write", "evidence": [ "cap:network.security-group/group-labels-format", "kb:criticality/aws_security_group.tags NON_CRITICAL (the harvested provider documentation of the AWS security group)" ], "cites": [ { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "fact": "tags" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-labels-format" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-labels-format", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "name", "state": "VARIABLE_REQUIRED", "variable": "sg_retail_app_ecs_orders_service_this_name", "reason": "the source value comes from an overridable root variable (var.environment_name)", "evidence": [ "cap:network.security-group/group-name-validator" ], "cites": [ { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "fact": "name" } ], "behavior_evidence": { "state": "OBSERVED_ON_TARGET", "rows": [ "cap:network.security-group/group-name-validator" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-name-validator", "scope": "OBSERVED_EXACT_VARIANT", "note": "the tested constraints of STACKIT provider 0.116.0 (security_group.name)" } ] } }, { "path": "name_prefix", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL)", "evidence": [ "cap:network.security-group/group-name-validator", "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "fact": "settings" } ], "behavior_evidence": { "state": "OBSERVED_ON_TARGET", "rows": [ "cap:network.security-group/group-name-validator" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-name-validator", "scope": "OBSERVED_EXACT_VARIANT", "note": "the tested constraints of STACKIT provider 0.116.0 (security_group.name)" } ] } }, { "path": "project_id", "state": "VARIABLE_REQUIRED", "variable": "project_id", "reason": "the STACKIT project the group belongs to (a group is project-scoped)", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "revoke_rules_on_delete", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "fact": "settings" } ] }, { "path": "stateful", "state": "SAFE_OMISSION", "reason": "the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written", "evidence": [ "cap:network.security-group/stateful-default-true", "cap:network.security-group/stateful-return-traffic", "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html" ], "cites": [ { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "fact": "stateful" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/stateful-return-traffic" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/stateful-default-true", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/stateful-return-traffic", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "tags_all", "state": "SAFE_OMISSION", "reason": "tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "kb:criticality/aws_security_group.tags NON_CRITICAL (the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "fact": "settings" } ] }, { "path": "timeouts", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "fact": "settings" } ] }, { "path": "vpc_id", "state": "UNSUPPORTED", "reason": "a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "cites": [ { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "fact": "vpc_id" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } } ], "from_intent": [ "security:module.retail_app_ecs.module.orders_service.aws_security_group.this" ], "from_units": [ "module.retail_app_ecs.module.orders_service.aws_security_group.this" ], "comments": [ { "kind": "INFO", "subject": "default_egress", "text": "the source's allow-all egress is covered by the STACKIT default egress rules; no rule is produced for it", "on": { "field": "default_egress" } } ] }, { "address": "stackit_security_group.retail_app_ecs_ui_service_this", "mode": "managed", "type": "stackit_security_group", "labels": [ "retail_app_ecs_ui_service_this" ], "file": "security.tf", "rule": "awssg.group", "fields": [ { "path": "default_egress.ipv4", "state": "SAFE_OMISSION", "reason": "the source allows all IPv4 egress, which is the allow-all IPv4 egress rule STACKIT creates on every new group: it is covered by the STACKIT default egress rules and not produced (a duplicate is rejected with HTTP 409)", "evidence": [ "cap:network.security-group/default-egress-rules", "cap:network.security-group/duplicate-default-egress-rule-rejected", "mirror:hashicorp/terraform-provider-aws website/docs/r/security_group.html.markdown:67 (v6.66.0)" ], "cites": [ { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "fact": "egress" }, { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.ui_service.aws_security_group.this#egress#0#909db684902e", "fact": "egress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/duplicate-default-egress-rule-rejected" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/default-egress-rules", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/duplicate-default-egress-rule-rejected", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "default_egress.ipv6", "state": "SAFE_OMISSION", "reason": "the network has no IPv6 prefix (its VPC module.vpc.module.vpc.aws_vpc.this assigns no IPv6 CIDR block and the estate associates none), and the drafted STACKIT network has none either, so the allow-all IPv6 egress rule STACKIT creates on every new group acts on no traffic, whatever IPv6 egress rules the source lists; if an IPv6 prefix is added to the network later, delete that rule (stackit security-group rule list, then delete with the security group id) or write the equivalent rules of the source: decide then", "evidence": [ "cap:network.security-group/default-egress-rules", "cap:network.security-group/duplicate-default-egress-rule-rejected", "kb:rule/subnet-ipv6 (the AWS network rules of the knowledge base; vpc-ipv6)", "mirror:hashicorp/terraform-provider-aws website/docs/r/security_group.html.markdown:67 (v6.66.0)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_network has ipv6_prefix, ipv6_prefix_length, ipv6_gateway and ipv6_nameservers: a network without an ipv6_prefix is an IPv4 network)" ], "cites": [ { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "fact": "egress" }, { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.ui_service.aws_security_group.this#egress#0#909db684902e", "fact": "egress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/duplicate-default-egress-rule-rejected" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/default-egress-rules", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/duplicate-default-egress-rule-rejected", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "labels", "state": "SAFE_OMISSION", "reason": "the source group sets no tags, so there are no labels to write", "evidence": [ "cap:network.security-group/group-labels-format", "kb:criticality/aws_security_group.tags NON_CRITICAL (the harvested provider documentation of the AWS security group)" ], "cites": [ { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "fact": "tags" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-labels-format" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-labels-format", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "name", "state": "VARIABLE_REQUIRED", "variable": "sg_retail_app_ecs_ui_service_this_name", "reason": "the source value comes from an overridable root variable (var.environment_name)", "evidence": [ "cap:network.security-group/group-name-validator" ], "cites": [ { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "fact": "name" } ], "behavior_evidence": { "state": "OBSERVED_ON_TARGET", "rows": [ "cap:network.security-group/group-name-validator" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-name-validator", "scope": "OBSERVED_EXACT_VARIANT", "note": "the tested constraints of STACKIT provider 0.116.0 (security_group.name)" } ] } }, { "path": "name_prefix", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL)", "evidence": [ "cap:network.security-group/group-name-validator", "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "fact": "settings" } ], "behavior_evidence": { "state": "OBSERVED_ON_TARGET", "rows": [ "cap:network.security-group/group-name-validator" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-name-validator", "scope": "OBSERVED_EXACT_VARIANT", "note": "the tested constraints of STACKIT provider 0.116.0 (security_group.name)" } ] } }, { "path": "project_id", "state": "VARIABLE_REQUIRED", "variable": "project_id", "reason": "the STACKIT project the group belongs to (a group is project-scoped)", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "revoke_rules_on_delete", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "fact": "settings" } ] }, { "path": "stateful", "state": "SAFE_OMISSION", "reason": "the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written", "evidence": [ "cap:network.security-group/stateful-default-true", "cap:network.security-group/stateful-return-traffic", "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html" ], "cites": [ { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "fact": "stateful" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/stateful-return-traffic" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/stateful-default-true", "scope": "OBSERVED_EXACT_VARIANT", "note": "tested on a STACKIT project on 2026-10-07" }, { "row": "cap:network.security-group/stateful-return-traffic", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "tags_all", "state": "SAFE_OMISSION", "reason": "tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "kb:criticality/aws_security_group.tags NON_CRITICAL (the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "fact": "settings" } ] }, { "path": "timeouts", "state": "SAFE_OMISSION", "reason": "NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL)", "evidence": [ "kb:criticality/aws_security_group.revoke_rules_on_delete, timeouts, tags_all, name_prefix NON_CRITICAL (an owner ruling of the product; the harvested provider documentation of the AWS security group)", "the STACKIT provider schema 0.121.0 (resource_schemas.stackit_security_group has no revoke_rules_on_delete, timeouts, tags_all or name_prefix)" ], "cites": [ { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "fact": "settings" } ] }, { "path": "vpc_id", "state": "UNSUPPORTED", "reason": "a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "cites": [ { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "fact": "vpc_id" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "group", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } } ], "from_intent": [ "security:module.retail_app_ecs.module.ui_service.aws_security_group.this" ], "from_units": [ "module.retail_app_ecs.module.ui_service.aws_security_group.this" ], "comments": [ { "kind": "INFO", "subject": "default_egress", "text": "the source's allow-all egress is covered by the STACKIT default egress rules; no rule is produced for it", "on": { "field": "default_egress" } } ] }, { "address": "stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1", "mode": "managed", "type": "stackit_security_group_rule", "labels": [ "retail_app_ecs_carts_service_this_ingress_1" ], "file": "security.tf", "rule": "awssg.rule", "fields": [ { "path": "direction", "state": "EXACT", "value": "ingress", "cites": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.carts_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "direction" } ] }, { "path": "ether_type", "state": "EXACT", "value": "IPv4", "reason": "the address family of the source range", "evidence": [ "cap:network.security-group/ether-type-default-ipv4", "cap:network.security-group/ip-range-family-must-match-ether-type" ], "cites": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.carts_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ingress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/ip-range-family-must-match-ether-type" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/ether-type-default-ipv4", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/ip-range-family-must-match-ether-type", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "ip_range", "state": "EXACT", "value": "0.0.0.0/0", "evidence": [ "cap:network.security-group/ip-range-family-must-match-ether-type", "cap:network.security-group/remote-security-group-by-id" ], "cites": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.carts_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ingress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/ip-range-family-must-match-ether-type" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/ip-range-family-must-match-ether-type", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" }, { "row": "cap:network.security-group/remote-security-group-by-id", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "port_range.max", "state": "EXACT", "value": 8080, "evidence": [ "cap:network.security-group/port-range-bounds", "cap:network.security-group/port-range-is-destination-port" ], "cites": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.carts_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ports" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/port-range-is-destination-port" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/port-range-bounds", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/port-range-is-destination-port", "scope": "OBSERVED_RELATED_VARIANT", "note": "a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)" } ] } }, { "path": "port_range.min", "state": "EXACT", "value": 8080, "evidence": [ "cap:network.security-group/port-range-bounds", "cap:network.security-group/port-range-is-destination-port" ], "cites": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.carts_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ports" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/port-range-is-destination-port" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/port-range-bounds", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/port-range-is-destination-port", "scope": "OBSERVED_RELATED_VARIANT", "note": "a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)" } ] } }, { "path": "project_id", "state": "VARIABLE_REQUIRED", "variable": "project_id", "reason": "the STACKIT project the rule belongs to", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "cites": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.carts_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "security_group_id" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "protocol.name", "state": "EXACT", "value": "tcp", "evidence": [ "cap:network.security-group/protocol-name-values", "cap:network.security-group/protocol-name-xor-number" ], "cites": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.carts_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "protocol" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/protocol-name-values", "cap:network.security-group/protocol-name-xor-number" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/protocol-name-values", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/protocol-name-xor-number", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "security_group_id", "state": "EXACT", "ref": { "address": "stackit_security_group.retail_app_ecs_carts_service_this", "attribute": "security_group_id" }, "cites": [ { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.carts_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "security_group_id" } ] } ], "from_intent": [ "security:module.retail_app_ecs.module.carts_service.aws_security_group.this" ], "from_units": [ "module.retail_app_ecs.module.carts_service.aws_security_group.this" ], "comments": [] }, { "address": "stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1", "mode": "managed", "type": "stackit_security_group_rule", "labels": [ "retail_app_ecs_catalog_service_this_ingress_1" ], "file": "security.tf", "rule": "awssg.rule", "fields": [ { "path": "direction", "state": "EXACT", "value": "ingress", "cites": [ { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.catalog_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "direction" } ] }, { "path": "ether_type", "state": "EXACT", "value": "IPv4", "reason": "the address family of the source range", "evidence": [ "cap:network.security-group/ether-type-default-ipv4", "cap:network.security-group/ip-range-family-must-match-ether-type" ], "cites": [ { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.catalog_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ingress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/ip-range-family-must-match-ether-type" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/ether-type-default-ipv4", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/ip-range-family-must-match-ether-type", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "ip_range", "state": "EXACT", "value": "0.0.0.0/0", "evidence": [ "cap:network.security-group/ip-range-family-must-match-ether-type", "cap:network.security-group/remote-security-group-by-id" ], "cites": [ { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.catalog_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ingress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/ip-range-family-must-match-ether-type" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/ip-range-family-must-match-ether-type", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" }, { "row": "cap:network.security-group/remote-security-group-by-id", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "port_range.max", "state": "EXACT", "value": 8080, "evidence": [ "cap:network.security-group/port-range-bounds", "cap:network.security-group/port-range-is-destination-port" ], "cites": [ { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.catalog_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ports" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/port-range-is-destination-port" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/port-range-bounds", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/port-range-is-destination-port", "scope": "OBSERVED_RELATED_VARIANT", "note": "a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)" } ] } }, { "path": "port_range.min", "state": "EXACT", "value": 8080, "evidence": [ "cap:network.security-group/port-range-bounds", "cap:network.security-group/port-range-is-destination-port" ], "cites": [ { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.catalog_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ports" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/port-range-is-destination-port" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/port-range-bounds", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/port-range-is-destination-port", "scope": "OBSERVED_RELATED_VARIANT", "note": "a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)" } ] } }, { "path": "project_id", "state": "VARIABLE_REQUIRED", "variable": "project_id", "reason": "the STACKIT project the rule belongs to", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "cites": [ { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.catalog_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "security_group_id" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "protocol.name", "state": "EXACT", "value": "tcp", "evidence": [ "cap:network.security-group/protocol-name-values", "cap:network.security-group/protocol-name-xor-number" ], "cites": [ { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.catalog_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "protocol" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/protocol-name-values", "cap:network.security-group/protocol-name-xor-number" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/protocol-name-values", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/protocol-name-xor-number", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "security_group_id", "state": "EXACT", "ref": { "address": "stackit_security_group.retail_app_ecs_catalog_service_this", "attribute": "security_group_id" }, "cites": [ { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.catalog_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "security_group_id" } ] } ], "from_intent": [ "security:module.retail_app_ecs.module.catalog_service.aws_security_group.this" ], "from_units": [ "module.retail_app_ecs.module.catalog_service.aws_security_group.this" ], "comments": [] }, { "address": "stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1", "mode": "managed", "type": "stackit_security_group_rule", "labels": [ "retail_app_ecs_checkout_service_this_ingress_1" ], "file": "security.tf", "rule": "awssg.rule", "fields": [ { "path": "direction", "state": "EXACT", "value": "ingress", "cites": [ { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.checkout_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "direction" } ] }, { "path": "ether_type", "state": "EXACT", "value": "IPv4", "reason": "the address family of the source range", "evidence": [ "cap:network.security-group/ether-type-default-ipv4", "cap:network.security-group/ip-range-family-must-match-ether-type" ], "cites": [ { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.checkout_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ingress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/ip-range-family-must-match-ether-type" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/ether-type-default-ipv4", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/ip-range-family-must-match-ether-type", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "ip_range", "state": "EXACT", "value": "0.0.0.0/0", "evidence": [ "cap:network.security-group/ip-range-family-must-match-ether-type", "cap:network.security-group/remote-security-group-by-id" ], "cites": [ { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.checkout_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ingress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/ip-range-family-must-match-ether-type" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/ip-range-family-must-match-ether-type", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" }, { "row": "cap:network.security-group/remote-security-group-by-id", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "port_range.max", "state": "EXACT", "value": 8080, "evidence": [ "cap:network.security-group/port-range-bounds", "cap:network.security-group/port-range-is-destination-port" ], "cites": [ { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.checkout_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ports" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/port-range-is-destination-port" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/port-range-bounds", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/port-range-is-destination-port", "scope": "OBSERVED_RELATED_VARIANT", "note": "a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)" } ] } }, { "path": "port_range.min", "state": "EXACT", "value": 8080, "evidence": [ "cap:network.security-group/port-range-bounds", "cap:network.security-group/port-range-is-destination-port" ], "cites": [ { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.checkout_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ports" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/port-range-is-destination-port" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/port-range-bounds", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/port-range-is-destination-port", "scope": "OBSERVED_RELATED_VARIANT", "note": "a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)" } ] } }, { "path": "project_id", "state": "VARIABLE_REQUIRED", "variable": "project_id", "reason": "the STACKIT project the rule belongs to", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "cites": [ { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.checkout_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "security_group_id" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "protocol.name", "state": "EXACT", "value": "tcp", "evidence": [ "cap:network.security-group/protocol-name-values", "cap:network.security-group/protocol-name-xor-number" ], "cites": [ { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.checkout_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "protocol" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/protocol-name-values", "cap:network.security-group/protocol-name-xor-number" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/protocol-name-values", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/protocol-name-xor-number", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "security_group_id", "state": "EXACT", "ref": { "address": "stackit_security_group.retail_app_ecs_checkout_service_this", "attribute": "security_group_id" }, "cites": [ { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.checkout_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "security_group_id" } ] } ], "from_intent": [ "security:module.retail_app_ecs.module.checkout_service.aws_security_group.this" ], "from_units": [ "module.retail_app_ecs.module.checkout_service.aws_security_group.this" ], "comments": [] }, { "address": "stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1", "mode": "managed", "type": "stackit_security_group_rule", "labels": [ "retail_app_ecs_orders_service_this_ingress_1" ], "file": "security.tf", "rule": "awssg.rule", "fields": [ { "path": "direction", "state": "EXACT", "value": "ingress", "cites": [ { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.orders_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "direction" } ] }, { "path": "ether_type", "state": "EXACT", "value": "IPv4", "reason": "the address family of the source range", "evidence": [ "cap:network.security-group/ether-type-default-ipv4", "cap:network.security-group/ip-range-family-must-match-ether-type" ], "cites": [ { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.orders_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ingress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/ip-range-family-must-match-ether-type" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/ether-type-default-ipv4", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/ip-range-family-must-match-ether-type", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "ip_range", "state": "EXACT", "value": "0.0.0.0/0", "evidence": [ "cap:network.security-group/ip-range-family-must-match-ether-type", "cap:network.security-group/remote-security-group-by-id" ], "cites": [ { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.orders_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ingress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/ip-range-family-must-match-ether-type" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/ip-range-family-must-match-ether-type", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" }, { "row": "cap:network.security-group/remote-security-group-by-id", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "port_range.max", "state": "EXACT", "value": 8080, "evidence": [ "cap:network.security-group/port-range-bounds", "cap:network.security-group/port-range-is-destination-port" ], "cites": [ { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.orders_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ports" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/port-range-is-destination-port" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/port-range-bounds", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/port-range-is-destination-port", "scope": "OBSERVED_RELATED_VARIANT", "note": "a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)" } ] } }, { "path": "port_range.min", "state": "EXACT", "value": 8080, "evidence": [ "cap:network.security-group/port-range-bounds", "cap:network.security-group/port-range-is-destination-port" ], "cites": [ { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.orders_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ports" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/port-range-is-destination-port" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/port-range-bounds", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/port-range-is-destination-port", "scope": "OBSERVED_RELATED_VARIANT", "note": "a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)" } ] } }, { "path": "project_id", "state": "VARIABLE_REQUIRED", "variable": "project_id", "reason": "the STACKIT project the rule belongs to", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "cites": [ { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.orders_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "security_group_id" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "protocol.name", "state": "EXACT", "value": "tcp", "evidence": [ "cap:network.security-group/protocol-name-values", "cap:network.security-group/protocol-name-xor-number" ], "cites": [ { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.orders_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "protocol" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/protocol-name-values", "cap:network.security-group/protocol-name-xor-number" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/protocol-name-values", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/protocol-name-xor-number", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "security_group_id", "state": "EXACT", "ref": { "address": "stackit_security_group.retail_app_ecs_orders_service_this", "attribute": "security_group_id" }, "cites": [ { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.orders_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "security_group_id" } ] } ], "from_intent": [ "security:module.retail_app_ecs.module.orders_service.aws_security_group.this" ], "from_units": [ "module.retail_app_ecs.module.orders_service.aws_security_group.this" ], "comments": [] }, { "address": "stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1", "mode": "managed", "type": "stackit_security_group_rule", "labels": [ "retail_app_ecs_ui_service_this_ingress_1" ], "file": "security.tf", "rule": "awssg.rule", "fields": [ { "path": "direction", "state": "EXACT", "value": "ingress", "cites": [ { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.ui_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "direction" } ] }, { "path": "ether_type", "state": "EXACT", "value": "IPv4", "reason": "the address family of the source range", "evidence": [ "cap:network.security-group/ether-type-default-ipv4", "cap:network.security-group/ip-range-family-must-match-ether-type" ], "cites": [ { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.ui_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ingress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/ip-range-family-must-match-ether-type" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/ether-type-default-ipv4", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/ip-range-family-must-match-ether-type", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" } ] } }, { "path": "ip_range", "state": "EXACT", "value": "0.0.0.0/0", "evidence": [ "cap:network.security-group/ip-range-family-must-match-ether-type", "cap:network.security-group/remote-security-group-by-id" ], "cites": [ { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.ui_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ingress[0].cidr_blocks[0]" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/ip-range-family-must-match-ether-type" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/ip-range-family-must-match-ether-type", "scope": "NOT_VERIFIED_FOR_VARIANT", "note": "its probes state no scope" }, { "row": "cap:network.security-group/remote-security-group-by-id", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "port_range.max", "state": "EXACT", "value": 8080, "evidence": [ "cap:network.security-group/port-range-bounds", "cap:network.security-group/port-range-is-destination-port" ], "cites": [ { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.ui_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ports" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/port-range-is-destination-port" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/port-range-bounds", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/port-range-is-destination-port", "scope": "OBSERVED_RELATED_VARIANT", "note": "a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)" } ] } }, { "path": "port_range.min", "state": "EXACT", "value": 8080, "evidence": [ "cap:network.security-group/port-range-bounds", "cap:network.security-group/port-range-is-destination-port" ], "cites": [ { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.ui_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "ports" } ], "behavior_evidence": { "state": "NOT_VERIFIED_FOR_VARIANT", "rows": [ "cap:network.security-group/port-range-is-destination-port" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/port-range-bounds", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/port-range-is-destination-port", "scope": "OBSERVED_RELATED_VARIANT", "note": "a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)" } ] } }, { "path": "project_id", "state": "VARIABLE_REQUIRED", "variable": "project_id", "reason": "the STACKIT project the rule belongs to", "evidence": [ "cap:network.security-group/group-is-project-scoped" ], "cites": [ { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.ui_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "security_group_id" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/group-is-project-scoped" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/group-is-project-scoped", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "protocol.name", "state": "EXACT", "value": "tcp", "evidence": [ "cap:network.security-group/protocol-name-values", "cap:network.security-group/protocol-name-xor-number" ], "cites": [ { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.ui_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "protocol" } ], "behavior_evidence": { "state": "OFFICIAL_DOCUMENTED", "rows": [ "cap:network.security-group/protocol-name-values", "cap:network.security-group/protocol-name-xor-number" ], "variant": "rule tcp ingress IPv4 public_cidr any", "constraints": [ { "row": "cap:network.security-group/protocol-name-values", "scope": "OFFICIAL_DOCUMENTED" }, { "row": "cap:network.security-group/protocol-name-xor-number", "scope": "OFFICIAL_DOCUMENTED" } ] } }, { "path": "security_group_id", "state": "EXACT", "ref": { "address": "stackit_security_group.retail_app_ecs_ui_service_this", "attribute": "security_group_id" }, "cites": [ { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "rule": "module.retail_app_ecs.module.ui_service.aws_security_group.this#ingress#0#3d8f71de8dab", "fact": "security_group_id" } ] } ], "from_intent": [ "security:module.retail_app_ecs.module.ui_service.aws_security_group.this" ], "from_units": [ "module.retail_app_ecs.module.ui_service.aws_security_group.this" ], "comments": [] } ], "relations": [ { "kind": "ATTACHMENT", "from": "stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1", "to": "stackit_security_group.retail_app_ecs_carts_service_this" }, { "kind": "REFERENCE", "from": "stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1", "to": "stackit_security_group.retail_app_ecs_carts_service_this", "via": "security_group_id", "proof": "proof:inline-block:module.retail_app_ecs.module.carts_service.aws_security_group.this#ingress#0#3d8f71de8dab->module.retail_app_ecs.module.carts_service.aws_security_group.this" }, { "kind": "ATTACHMENT", "from": "stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1", "to": "stackit_security_group.retail_app_ecs_catalog_service_this" }, { "kind": "REFERENCE", "from": "stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1", "to": "stackit_security_group.retail_app_ecs_catalog_service_this", "via": "security_group_id", "proof": "proof:inline-block:module.retail_app_ecs.module.catalog_service.aws_security_group.this#ingress#0#3d8f71de8dab->module.retail_app_ecs.module.catalog_service.aws_security_group.this" }, { "kind": "ATTACHMENT", "from": "stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1", "to": "stackit_security_group.retail_app_ecs_checkout_service_this" }, { "kind": "REFERENCE", "from": "stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1", "to": "stackit_security_group.retail_app_ecs_checkout_service_this", "via": "security_group_id", "proof": "proof:inline-block:module.retail_app_ecs.module.checkout_service.aws_security_group.this#ingress#0#3d8f71de8dab->module.retail_app_ecs.module.checkout_service.aws_security_group.this" }, { "kind": "ATTACHMENT", "from": "stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1", "to": "stackit_security_group.retail_app_ecs_orders_service_this" }, { "kind": "REFERENCE", "from": "stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1", "to": "stackit_security_group.retail_app_ecs_orders_service_this", "via": "security_group_id", "proof": "proof:inline-block:module.retail_app_ecs.module.orders_service.aws_security_group.this#ingress#0#3d8f71de8dab->module.retail_app_ecs.module.orders_service.aws_security_group.this" }, { "kind": "ATTACHMENT", "from": "stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1", "to": "stackit_security_group.retail_app_ecs_ui_service_this" }, { "kind": "REFERENCE", "from": "stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1", "to": "stackit_security_group.retail_app_ecs_ui_service_this", "via": "security_group_id", "proof": "proof:inline-block:module.retail_app_ecs.module.ui_service.aws_security_group.this#ingress#0#3d8f71de8dab->module.retail_app_ecs.module.ui_service.aws_security_group.this" } ], "variables": [ { "name": "project_id", "type": "string", "sensitive": false, "reason": "the STACKIT project the draft is created in; security groups and their rules belong to a project, not to a network" }, { "name": "sg_retail_app_ecs_alb_sg_this_name_prefix_labels", "type": "map(string)", "sensitive": false, "default": { "Name": "retail-store-ecs-ui" }, "reason": "the labels of stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix, from the tags of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix: the source reads a variable for its tags (or its provider's default_tags), so the values here are the scan's reading of the variable's default, not proven: set the labels you want" }, { "name": "sg_retail_app_ecs_alb_this_labels", "type": "map(string)", "sensitive": false, "default": { "Name": "retail-store-ecs-ui" }, "reason": "the labels of stackit_security_group.retail_app_ecs_alb_this, from the tags of module.retail_app_ecs.module.alb.aws_security_group.this: the source reads a variable for its tags (or its provider's default_tags), so the values here are the scan's reading of the variable's default, not proven: set the labels you want" }, { "name": "sg_retail_app_ecs_carts_service_this_name", "type": "string", "sensitive": false, "reason": "the name of module.retail_app_ecs.module.carts_service.aws_security_group.this comes from a root variable that a tfvars or -var can override: its default is not a fact of the source (1 to 63 characters, alphanumeric runs joined by one separator)" }, { "name": "sg_retail_app_ecs_catalog_service_this_name", "type": "string", "sensitive": false, "reason": "the name of module.retail_app_ecs.module.catalog_service.aws_security_group.this comes from a root variable that a tfvars or -var can override: its default is not a fact of the source (1 to 63 characters, alphanumeric runs joined by one separator)" }, { "name": "sg_retail_app_ecs_checkout_service_this_name", "type": "string", "sensitive": false, "reason": "the name of module.retail_app_ecs.module.checkout_service.aws_security_group.this comes from a root variable that a tfvars or -var can override: its default is not a fact of the source (1 to 63 characters, alphanumeric runs joined by one separator)" }, { "name": "sg_retail_app_ecs_orders_service_this_name", "type": "string", "sensitive": false, "reason": "the name of module.retail_app_ecs.module.orders_service.aws_security_group.this comes from a root variable that a tfvars or -var can override: its default is not a fact of the source (1 to 63 characters, alphanumeric runs joined by one separator)" }, { "name": "sg_retail_app_ecs_ui_service_this_name", "type": "string", "sensitive": false, "reason": "the name of module.retail_app_ecs.module.ui_service.aws_security_group.this comes from a root variable that a tfvars or -var can override: its default is not a fact of the source (1 to 63 characters, alphanumeric runs joined by one separator)" } ], "prerequisites": [], "manual_actions": [ { "id": "awssg:incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules", "kind": "INCOMPLETE", "on": { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "attribute": "module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules" }, "what": "Re-create the rules beyond the known set of group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0] (rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules)", "why": "an unknown number of entries of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules are not visible statically (group-choice): only the known ones were produced", "phase": "BEFORE_PILOT", "owner_role": "Security Architect", "subjects": [ "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix" ], "success_condition": "every entry of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules is known and has a rule, or it is confirmed that the known entries are all" }, { "id": "awssg:incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules", "kind": "INCOMPLETE", "on": { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "attribute": "module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules" }, "what": "Re-create the rules beyond the known set of group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0] (rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules)", "why": "an unknown number of entries of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules are not visible statically (group-choice): only the known ones were produced", "phase": "BEFORE_PILOT", "owner_role": "Security Architect", "subjects": [ "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix" ], "success_condition": "every entry of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules is known and has a rule, or it is confirmed that the known entries are all" }, { "id": "awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0]", "kind": "UNPLACED", "on": { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "rule": "module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0]" }, "what": "Place the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] on the security group it belongs to and write it", "why": "the rule is attached to module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix but cannot be attributed to one of its groups (group-choice); a rule on the wrong group allows what the source did not allow there, so none was produced", "phase": "BEFORE_PILOT", "owner_role": "Security Architect", "subjects": [ "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix" ], "success_condition": "the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] is written on the security group it belongs to" }, { "id": "awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0]", "kind": "UNPLACED", "on": { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "rule": "module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0]" }, "what": "Place the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] on the security group it belongs to and write it", "why": "the rule is attached to module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix but cannot be attributed to one of its groups (group-choice); a rule on the wrong group allows what the source did not allow there, so none was produced", "phase": "BEFORE_PILOT", "owner_role": "Security Architect", "subjects": [ "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix" ], "success_condition": "the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] is written on the security group it belongs to" } ], "decisions": [], "residual_differences": [ { "subject": "module.dependencies.aws_security_group.catalog_opensearch_sg", "kind": "GROUP_NOT_CREATED", "on": { "unit": "module.dependencies.aws_security_group.catalog_opensearch_sg" }, "source": "an aws_security_group unit with 1 ingress, 0 egress and 0 other rules", "target": "no stackit_security_group and no rule is produced: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (stackit_opensearch_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried", "accepted": false }, { "subject": "module.dependencies.aws_security_group.mq", "kind": "GROUP_NOT_CREATED", "on": { "unit": "module.dependencies.aws_security_group.mq" }, "source": "an aws_security_group unit with 1 ingress, 0 egress and 0 other rules", "target": "no stackit_security_group and no rule is produced: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.aws_mq_broker.mq (stackit_rabbitmq_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried", "accepted": false }, { "subject": "module.dependencies.module.catalog_rds.aws_security_group.this", "kind": "GROUP_NOT_CREATED", "on": { "unit": "module.dependencies.module.catalog_rds.aws_security_group.this" }, "source": "an aws_security_group unit with 1 ingress, 0 egress and 0 other rules", "target": "no stackit_security_group and no rule is produced: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.catalog_rds.aws_rds_cluster.this (stackit_mariadb_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried", "accepted": false }, { "subject": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd", "kind": "GROUP_NOT_CREATED", "on": { "unit": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd" }, "source": "an aws_security_group unit with 1 ingress, 1 egress and 0 other rules", "target": "no stackit_security_group and no rule is produced: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (stackit_valkey_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried", "accepted": false }, { "subject": "module.dependencies.module.orders_rds.aws_security_group.this", "kind": "GROUP_NOT_CREATED", "on": { "unit": "module.dependencies.module.orders_rds.aws_security_group.this" }, "source": "an aws_security_group unit with 1 ingress, 0 egress and 0 other rules", "target": "no stackit_security_group and no rule is produced: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.orders_rds.aws_rds_cluster.this (stackit_postgresflex_instance, access list network.acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried", "accepted": false }, { "subject": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0]", "kind": "RULE_WITHHELD", "on": { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "rule": "module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0]" }, "source": "an allow rule of the unit's security group", "target": "no rule is produced: it cannot be attributed to a group (group-choice)", "accepted": false }, { "subject": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0]", "kind": "RULE_WITHHELD", "on": { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "rule": "module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0]" }, "source": "an allow rule of the unit's security group", "target": "no rule is produced: it cannot be attributed to a group (group-choice)", "accepted": false }, { "subject": "stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix ingress", "kind": "INTRA_GROUP_IPV6", "on": { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "address": "stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix" }, "source": "the members of the group reach each other only where a rule of the group allows it", "target": "IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08 (capability ipv6-network-creation-not-implemented); IPv4 needs an explicit rule and has one wherever the source has a self rule", "accepted": false }, { "subject": "stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules", "kind": "RULES_BEYOND_KNOWN", "on": { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "address": "stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix", "attribute": "module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules" }, "source": "the source allows more than the entries that are visible statically", "target": "only the known entries are produced; an unknown number of unknown entries of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules are not (group-choice)", "accepted": false }, { "subject": "stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules", "kind": "RULES_BEYOND_KNOWN", "on": { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "address": "stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix", "attribute": "module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules" }, "source": "the source allows more than the entries that are visible statically", "target": "only the known entries are produced; an unknown number of unknown entries of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules are not (group-choice)", "accepted": false }, { "subject": "stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix name", "kind": "DERIVED", "on": { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "address": "stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix", "field": "name" }, "source": "the source group has no name of its own: AWS names it from the name_prefix \"retail-store-ecs-ui-\" and a random suffix (the draft does not use the prefix as the name)", "target": "name retail-app-ecs-alb-sg-this-name-prefix derived from the address module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]", "accepted": false }, { "subject": "stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix vpc_id", "kind": "PROJECT_SCOPED", "on": { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "address": "stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix", "field": "vpc_id" }, "source": "the group belongs to one VPC and can be attached only to resources in it", "target": "the group is project-scoped and can be attached to network interfaces of any network of the project", "accepted": false }, { "subject": "stackit_security_group.retail_app_ecs_alb_this ingress", "kind": "INTRA_GROUP_IPV6", "on": { "unit": "module.retail_app_ecs.module.alb.aws_security_group.this", "address": "stackit_security_group.retail_app_ecs_alb_this" }, "source": "the members of the group reach each other only where a rule of the group allows it", "target": "IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08 (capability ipv6-network-creation-not-implemented); IPv4 needs an explicit rule and has one wherever the source has a self rule", "accepted": false }, { "subject": "stackit_security_group.retail_app_ecs_alb_this name", "kind": "DERIVED", "on": { "unit": "module.retail_app_ecs.module.alb.aws_security_group.this", "address": "stackit_security_group.retail_app_ecs_alb_this", "field": "name" }, "source": "the source group has no name of its own: AWS names it from the name_prefix \"retail-store-ecs-ui-\" and a random suffix (the draft does not use the prefix as the name)", "target": "name retail-app-ecs-alb-this derived from the address module.retail_app_ecs.module.alb.aws_security_group.this[0]", "accepted": false }, { "subject": "stackit_security_group.retail_app_ecs_alb_this vpc_id", "kind": "PROJECT_SCOPED", "on": { "unit": "module.retail_app_ecs.module.alb.aws_security_group.this", "address": "stackit_security_group.retail_app_ecs_alb_this", "field": "vpc_id" }, "source": "the group belongs to one VPC and can be attached only to resources in it", "target": "the group is project-scoped and can be attached to network interfaces of any network of the project", "accepted": false }, { "subject": "stackit_security_group.retail_app_ecs_carts_service_this ingress", "kind": "INTRA_GROUP_IPV6", "on": { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "address": "stackit_security_group.retail_app_ecs_carts_service_this" }, "source": "the members of the group reach each other only where a rule of the group allows it", "target": "IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08 (capability ipv6-network-creation-not-implemented); IPv4 needs an explicit rule and has one wherever the source has a self rule", "accepted": false }, { "subject": "stackit_security_group.retail_app_ecs_carts_service_this vpc_id", "kind": "PROJECT_SCOPED", "on": { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "address": "stackit_security_group.retail_app_ecs_carts_service_this", "field": "vpc_id" }, "source": "the group belongs to one VPC and can be attached only to resources in it", "target": "the group is project-scoped and can be attached to network interfaces of any network of the project", "accepted": false }, { "subject": "stackit_security_group.retail_app_ecs_catalog_service_this ingress", "kind": "INTRA_GROUP_IPV6", "on": { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "address": "stackit_security_group.retail_app_ecs_catalog_service_this" }, "source": "the members of the group reach each other only where a rule of the group allows it", "target": "IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08 (capability ipv6-network-creation-not-implemented); IPv4 needs an explicit rule and has one wherever the source has a self rule", "accepted": false }, { "subject": "stackit_security_group.retail_app_ecs_catalog_service_this vpc_id", "kind": "PROJECT_SCOPED", "on": { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "address": "stackit_security_group.retail_app_ecs_catalog_service_this", "field": "vpc_id" }, "source": "the group belongs to one VPC and can be attached only to resources in it", "target": "the group is project-scoped and can be attached to network interfaces of any network of the project", "accepted": false }, { "subject": "stackit_security_group.retail_app_ecs_checkout_service_this ingress", "kind": "INTRA_GROUP_IPV6", "on": { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "address": "stackit_security_group.retail_app_ecs_checkout_service_this" }, "source": "the members of the group reach each other only where a rule of the group allows it", "target": "IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08 (capability ipv6-network-creation-not-implemented); IPv4 needs an explicit rule and has one wherever the source has a self rule", "accepted": false }, { "subject": "stackit_security_group.retail_app_ecs_checkout_service_this vpc_id", "kind": "PROJECT_SCOPED", "on": { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "address": "stackit_security_group.retail_app_ecs_checkout_service_this", "field": "vpc_id" }, "source": "the group belongs to one VPC and can be attached only to resources in it", "target": "the group is project-scoped and can be attached to network interfaces of any network of the project", "accepted": false }, { "subject": "stackit_security_group.retail_app_ecs_orders_service_this ingress", "kind": "INTRA_GROUP_IPV6", "on": { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "address": "stackit_security_group.retail_app_ecs_orders_service_this" }, "source": "the members of the group reach each other only where a rule of the group allows it", "target": "IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08 (capability ipv6-network-creation-not-implemented); IPv4 needs an explicit rule and has one wherever the source has a self rule", "accepted": false }, { "subject": "stackit_security_group.retail_app_ecs_orders_service_this vpc_id", "kind": "PROJECT_SCOPED", "on": { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "address": "stackit_security_group.retail_app_ecs_orders_service_this", "field": "vpc_id" }, "source": "the group belongs to one VPC and can be attached only to resources in it", "target": "the group is project-scoped and can be attached to network interfaces of any network of the project", "accepted": false }, { "subject": "stackit_security_group.retail_app_ecs_ui_service_this ingress", "kind": "INTRA_GROUP_IPV6", "on": { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "address": "stackit_security_group.retail_app_ecs_ui_service_this" }, "source": "the members of the group reach each other only where a rule of the group allows it", "target": "IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08 (capability ipv6-network-creation-not-implemented); IPv4 needs an explicit rule and has one wherever the source has a self rule", "accepted": false }, { "subject": "stackit_security_group.retail_app_ecs_ui_service_this vpc_id", "kind": "PROJECT_SCOPED", "on": { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "address": "stackit_security_group.retail_app_ecs_ui_service_this", "field": "vpc_id" }, "source": "the group belongs to one VPC and can be attached only to resources in it", "target": "the group is project-scoped and can be attached to network interfaces of any network of the project", "accepted": false } ], "ledger": [ { "unit": "module.dependencies.aws_security_group.catalog_opensearch_sg", "property": "repeated group rules", "status": "REVIEW", "causes": [ "no group is produced for the unit", "no rule of the group is produced as a stackit_security_group_rule: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (stackit_opensearch_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried" ] }, { "unit": "module.dependencies.aws_security_group.catalog_opensearch_sg", "property": "security group rules", "status": "REVIEW", "causes": [ "no rule of the group is produced as a stackit_security_group_rule: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (stackit_opensearch_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried" ] }, { "unit": "module.dependencies.aws_security_group.mq", "property": "repeated group rules", "status": "REVIEW", "causes": [ "no group is produced for the unit", "no rule of the group is produced as a stackit_security_group_rule: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.aws_mq_broker.mq (stackit_rabbitmq_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried" ] }, { "unit": "module.dependencies.aws_security_group.mq", "property": "security group rules", "status": "REVIEW", "causes": [ "no rule of the group is produced as a stackit_security_group_rule: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.aws_mq_broker.mq (stackit_rabbitmq_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried" ] }, { "unit": "module.dependencies.module.catalog_rds.aws_security_group.this", "property": "repeated group rules", "status": "REVIEW", "causes": [ "no group is produced for the unit", "no rule of the group is produced as a stackit_security_group_rule: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.catalog_rds.aws_rds_cluster.this (stackit_mariadb_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried" ] }, { "unit": "module.dependencies.module.catalog_rds.aws_security_group.this", "property": "security group rules", "status": "REVIEW", "causes": [ "no rule of the group is produced as a stackit_security_group_rule: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.catalog_rds.aws_rds_cluster.this (stackit_mariadb_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried" ] }, { "unit": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd", "property": "repeated group rules", "status": "REVIEW", "causes": [ "no group is produced for the unit", "no rule of the group is produced as a stackit_security_group_rule: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (stackit_valkey_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried" ] }, { "unit": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd", "property": "security group rules", "status": "REVIEW", "causes": [ "no rule of the group is produced as a stackit_security_group_rule: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (stackit_valkey_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried" ] }, { "unit": "module.dependencies.module.orders_rds.aws_security_group.this", "property": "repeated group rules", "status": "REVIEW", "causes": [ "no group is produced for the unit", "no rule of the group is produced as a stackit_security_group_rule: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.orders_rds.aws_rds_cluster.this (stackit_postgresflex_instance, access list network.acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried" ] }, { "unit": "module.dependencies.module.orders_rds.aws_security_group.this", "property": "security group rules", "status": "REVIEW", "causes": [ "no rule of the group is produced as a stackit_security_group_rule: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.orders_rds.aws_rds_cluster.this (stackit_postgresflex_instance, access list network.acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried" ] }, { "unit": "module.retail_app_ecs.module.alb.aws_security_group.this", "property": "repeated group rules", "status": "TRANSFORMED" }, { "unit": "module.retail_app_ecs.module.alb.aws_security_group.this", "property": "security group rules", "status": "REVIEW", "causes": [ "ORPHANED: no block of the draft attaches stackit_security_group.retail_app_ecs_alb_this, so the rules of module.retail_app_ecs.module.alb.aws_security_group.this restrict nothing on STACKIT (its members are module.retail_app_ecs.module.alb.aws_lb.this (aws_lb, written without a security group))" ] }, { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "property": "repeated group rules", "status": "REVIEW", "causes": [ "the set of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules is a lower bound: more entries exist than are visible (awssg:incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules)", "the set of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules is a lower bound: more entries exist than are visible (awssg:incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules)", "the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] is not produced (awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0])", "the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] is not produced (awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0])" ] }, { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix", "property": "security group rules", "status": "REVIEW", "causes": [ "ORPHANED: no block of the draft attaches stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix, so the rules of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix restrict nothing on STACKIT (its members are module.retail_app_ecs.module.alb.aws_lb.this (aws_lb, written without a security group))", "the set of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules is a lower bound: more entries exist than are visible (awssg:incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules)", "the set of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules is a lower bound: more entries exist than are visible (awssg:incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules)", "the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] is not produced (awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0])", "the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] is not produced (awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0])" ] }, { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "property": "repeated group rules", "status": "TRANSFORMED" }, { "unit": "module.retail_app_ecs.module.carts_service.aws_security_group.this", "property": "security group rules", "status": "REVIEW", "causes": [ "ORPHANED: no block of the draft attaches stackit_security_group.retail_app_ecs_carts_service_this, so the rules of module.retail_app_ecs.module.carts_service.aws_security_group.this restrict nothing on STACKIT (its members are module.retail_app_ecs.module.carts_service.aws_ecs_service.this (an ECS service: its tasks become pods)); decision DEC-GEN-CONVERT-POD-SEGMENTATION" ] }, { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "property": "repeated group rules", "status": "TRANSFORMED" }, { "unit": "module.retail_app_ecs.module.catalog_service.aws_security_group.this", "property": "security group rules", "status": "REVIEW", "causes": [ "ORPHANED: no block of the draft attaches stackit_security_group.retail_app_ecs_catalog_service_this, so the rules of module.retail_app_ecs.module.catalog_service.aws_security_group.this restrict nothing on STACKIT (its members are module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (an ECS service: its tasks become pods)); decision DEC-GEN-CONVERT-POD-SEGMENTATION" ] }, { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "property": "repeated group rules", "status": "TRANSFORMED" }, { "unit": "module.retail_app_ecs.module.checkout_service.aws_security_group.this", "property": "security group rules", "status": "REVIEW", "causes": [ "ORPHANED: no block of the draft attaches stackit_security_group.retail_app_ecs_checkout_service_this, so the rules of module.retail_app_ecs.module.checkout_service.aws_security_group.this restrict nothing on STACKIT (its members are module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (an ECS service: its tasks become pods)); decision DEC-GEN-CONVERT-POD-SEGMENTATION" ] }, { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "property": "repeated group rules", "status": "TRANSFORMED" }, { "unit": "module.retail_app_ecs.module.orders_service.aws_security_group.this", "property": "security group rules", "status": "REVIEW", "causes": [ "ORPHANED: no block of the draft attaches stackit_security_group.retail_app_ecs_orders_service_this, so the rules of module.retail_app_ecs.module.orders_service.aws_security_group.this restrict nothing on STACKIT (its members are module.retail_app_ecs.module.orders_service.aws_ecs_service.this (an ECS service: its tasks become pods)); decision DEC-GEN-CONVERT-POD-SEGMENTATION" ] }, { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "property": "repeated group rules", "status": "TRANSFORMED" }, { "unit": "module.retail_app_ecs.module.ui_service.aws_security_group.this", "property": "security group rules", "status": "REVIEW", "causes": [ "ORPHANED: no block of the draft attaches stackit_security_group.retail_app_ecs_ui_service_this, so the rules of module.retail_app_ecs.module.ui_service.aws_security_group.this restrict nothing on STACKIT (its members are module.retail_app_ecs.module.ui_service.aws_ecs_service.this (an ECS service: its tasks become pods)); decision DEC-GEN-CONVERT-POD-SEGMENTATION" ] } ], "validation_requirements": [ { "id": "awssg:security-equivalence", "kind": "SECURITY_EQUIVALENCE", "what": "every rendered stackit_security_group_rule allows no more than the source rule it derives from, and the plan's open decisions are not rendered as if decided", "subjects": [ "stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix", "stackit_security_group.retail_app_ecs_alb_this", "stackit_security_group.retail_app_ecs_carts_service_this", "stackit_security_group.retail_app_ecs_catalog_service_this", "stackit_security_group.retail_app_ecs_checkout_service_this", "stackit_security_group.retail_app_ecs_orders_service_this", "stackit_security_group.retail_app_ecs_ui_service_this" ] } ], "no_targets": [ { "unit": "module.dependencies.aws_security_group.catalog_opensearch_sg", "reason": "NOT_DRAFTED", "cause": "every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (stackit_opensearch_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried" }, { "unit": "module.dependencies.aws_security_group.mq", "reason": "NOT_DRAFTED", "cause": "every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.aws_mq_broker.mq (stackit_rabbitmq_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried" }, { "unit": "module.dependencies.module.catalog_opensearch.aws_security_group.this", "reason": "NOT_DRAFTED", "cause": "the source creates no instance of the group (count or for_each yields none, or it is switched off): no stackit_security_group is drafted" }, { "unit": "module.dependencies.module.catalog_rds.aws_security_group.this", "reason": "NOT_DRAFTED", "cause": "every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.catalog_rds.aws_rds_cluster.this (stackit_mariadb_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried" }, { "unit": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd", "reason": "NOT_DRAFTED", "cause": "every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (stackit_valkey_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried" }, { "unit": "module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default", "reason": "NOT_DRAFTED", "cause": "the source creates no instance of the group (count or for_each yields none, or it is switched off): no stackit_security_group is drafted" }, { "unit": "module.dependencies.module.orders_rds.aws_security_group.this", "reason": "NOT_DRAFTED", "cause": "every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.orders_rds.aws_rds_cluster.this (stackit_postgresflex_instance, access list network.acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried" }, { "unit": "module.retail_app_ecs.module.alb_sg.aws_security_group.this", "reason": "NOT_DRAFTED", "cause": "the source creates no instance of the group (count or for_each yields none, or it is switched off): no stackit_security_group is drafted" } ], "provenance": { "kb_version": "0.384.0", "rules": [ "awssg.group", "awssg.rule" ] } } } ] }