{"schema_version":"0.15.0","discovered":{"input":{"kind":"terraform","origin":"discovered","reason":"Terraform/OpenTofu configuration files (*.tf, *.tf.json, *.tofu, *.tofu.json) in the folder"},"project":{"state":"NONE","reason":"no stacktoit.yaml in the source folder or its parents up to the git root"},"profile":{},"variable_files":{}},"header":{"assessment":{"source":"default","assessment_schema":"0.24.0","producer":{"tool":"stacktoit","version":"0.6.0-11562-g1966ddf116","commit":"1966ddf116","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9"}},"generated_at":"2026-11-02T12:08:24Z","run":{"run_id":"f6267c3f-2848-4aa5-89df-5fee8b15b3b9","source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70"},"run_status":{"run_publication":"COMPLETE","run_reasons":[],"run_source_status":"RUNTIME_TOPOLOGY_PARTIAL","run_draft":"GENERATED"},"source_snapshot":{"status":"RUNTIME_TOPOLOGY_PARTIAL","reason":"8 unit(s) have a count/for_each that is not known statically; whether and how often they exist is decided at plan time","gaps":["RUNTIME_TOPOLOGY_PARTIAL"],"missing_modules":0,"providers":[{"name":"aws","status":"UNPINNED","tested_against":"5.100.0","identity_evidence":"PINNED_REGISTRY","note":"No lock file entry pins this provider, so the version a plan would use is not proven; the knowledge base was checked against one version only. Until the exact version is pinned (commit .terraform.lock.hcl), the units of this provider are capped at MEDIUM confidence and are not automation eligible.","constraints":["\u003e= 3.0","\u003e= 3.29","\u003e= 4.18","\u003e= 4.30","\u003e= 4.59","\u003e= 5.64","\u003e= 5.79","~\u003e 5.0"]},{"name":"random","status":"UNVERIFIED","tested_against":"","identity_evidence":"UNVERIFIED","note":"The knowledge base holds no pinned source schema of this provider, so its version cannot be checked (UNVERIFIED); the row records that the configuration uses it and changes no decision.","constraints":["\u003e= 2.2","~\u003e 3.7.0"]}],"module_calls":{"total":23,"external":13,"local":10},"checks":"Built-in source checks passed — OpenTofu validation of the source did not run (LOCK_FILE)"},"target_profile":{"id":"STACKIT_STABLE","label":"Stable network model: the experimental STACKIT VPC resources are not used"},"stackit_provider":"0.121.0","kb_version":"0.384.0","evidence_freshness":{"state":"NOT_ASSESSED","text":"Evidence freshness as one measure is not assessed in this build. Dated evidence is shown where it is used: each STACKIT support option and each assurance row states when it was verified (verified_at, and recheck_after for support), in support_suitability and assurance. The date beside a readiness dimension is the assessment date, not a retrieval date."}},"staleness":{"state":"NOT_ASSESSED","text":"This build has no change detection, so there has been no re-check since the assessment was made (Generated 2026-11-02 12:08 UTC). The source may have changed since."},"readiness":[{"id":"source_fidelity","name":"Source Fidelity","coverage_state":"PARTLY_COVERED","migration_decision_state":"BLOCKERS_OPEN","target_validation_state":"NOT_APPLICABLE","coverage":null,"blockers":1,"open_decisions":null,"last_evidence":"2026-11-02T12:08:24Z","derived_from":["assessment.json#/summary/source_status","assessment.json#/summary/source_gaps"],"detail":"For some units, whether and how many times they exist is decided only when OpenTofu plans."},{"id":"semantic_accounting_coverage","name":"Semantic Accounting","coverage_state":"COVERED","migration_decision_state":"BLOCKERS_OPEN","target_validation_state":"NOT_APPLICABLE","coverage":{"part":44,"whole":44,"percent":100,"part_label":"units with a semantic contract and no critical setting unaccounted","rest_label":"units without a contract or with a critical setting unaccounted"},"blockers":43,"open_decisions":null,"last_evidence":"2026-11-02T12:08:24Z","derived_from":["assessment.json#/units/*/result/semantics"],"detail":"Accounted for is not decided. Covered means every unit has a semantic contract and no critical setting is unaccounted; it does not mean the settings are decided, so the blockers still count the 43 units that leave one for a person. 0 units have no semantic contract; 0 units leave a critical setting unaccounted; 43 units leave one for a person to review (accounted for, not decided). A blocker here is a unit that does either of the last two."},{"id":"critical_semantic_resolution","name":"Critical Resolution","coverage_state":"PARTLY_COVERED","migration_decision_state":"BLOCKERS_OPEN","target_validation_state":"NOT_APPLICABLE","coverage":{"part":36,"whole":319,"percent":11,"part_label":"critical settings resolved","rest_label":"critical settings open"},"blockers":43,"open_decisions":null,"last_evidence":"2026-11-02T12:08:24Z","derived_from":["assessment.json#/units/*/result/semantics/items"],"detail":"36 of 319 critical settings are resolved; 43 units hold an open one (accounted for, not decided); 0 units have no semantic contract. A blocker here is a unit that does either."},{"id":"target_functional_fit","name":"Target Functional Fit","coverage_state":"NOT_ASSESSED","migration_decision_state":"NOT_ASSESSED","target_validation_state":"NOT_ASSESSED","coverage":null,"blockers":null,"open_decisions":null,"last_evidence":null,"derived_from":[],"detail":"Not assessed in this build."},{"id":"target_operability","name":"Target Operability","coverage_state":"NOT_ASSESSED","migration_decision_state":"NOT_ASSESSED","target_validation_state":"NOT_ASSESSED","coverage":null,"blockers":null,"open_decisions":null,"last_evidence":null,"derived_from":[],"detail":"Not assessed in this build."},{"id":"terraform_readiness","name":"Terraform Draft Accounting","coverage_state":"NOT_COVERED","migration_decision_state":"BLOCKERS_OPEN","target_validation_state":"STATIC_CHECKS_PASSED","coverage":{"part":0,"whole":44,"percent":0,"part_label":"units whose critical settings are all accounted for in the draft","rest_label":"units with a critical setting left to a person, or without a draft block"},"blockers":44,"open_decisions":null,"last_evidence":"2026-11-02T12:08:24Z","derived_from":["assessment.json#/units/*/property_accounting/automation_eligible"],"detail":"Not a validation. This counts only whether each unit's critical settings are accounted for in the draft; it does not mean the draft validates, plans or applies against STACKIT, and even the coverage state Covered would not mean it."},{"id":"security","name":"Security","coverage_state":"NOT_ASSESSED","migration_decision_state":"NOT_ASSESSED","target_validation_state":"NOT_ASSESSED","coverage":null,"blockers":null,"open_decisions":null,"last_evidence":null,"derived_from":[],"detail":"Not assessed in this build."},{"id":"reliability_resilience","name":"Reliability / Resilience","coverage_state":"NOT_COVERED","migration_decision_state":"BLOCKERS_OPEN","target_validation_state":"NOT_VALIDATED","coverage":null,"blockers":6,"open_decisions":0,"last_evidence":"2026-11-02T12:08:24Z","derived_from":["workspace.json#/resilience"],"detail":"6 units state a failure-domain, replication or backup fact or hold state. 6 units have no RTO or RPO the customer wrote to decide against, and 0 units have one and wait for a person to choose its resilience intent. No unit is called resilient and no intent is chosen: the source states none, and the availability-zone and metro facts of the target are not assessed."},{"id":"operational_readiness","name":"Operational Readiness","coverage_state":"PARTLY_COVERED","migration_decision_state":"NO_OPEN_ITEMS","target_validation_state":"NOT_VALIDATED","coverage":null,"blockers":0,"open_decisions":0,"last_evidence":"2026-11-02T12:08:24Z","derived_from":["workspace.json#/workload_readiness","workspace.json#/units/*/workload_readiness"],"detail":"Terraform generated is not workload ready: 1 of 44 units carry open workload items. 0 units need a decision or evidence from a person (0 of them a decision; 0 block a readiness claim, a cutover decision being a migration operation and not a blocker); 6 compute units have no workload evidence in this build. The 20 dimensions of the amendment's operational readiness (identity, logs, backup, DR, support and the rest) are not assessed. A generated Terraform resource does not mark any of them ready."},{"id":"sovereignty_exitability","name":"Sovereignty \u0026 Exitability","coverage_state":"NOT_ASSESSED","migration_decision_state":"NOT_ASSESSED","target_validation_state":"NOT_ASSESSED","coverage":null,"blockers":null,"open_decisions":null,"last_evidence":null,"derived_from":[],"detail":"No state is derived for this dimension: this build rates neither sovereignty nor exitability. What it does state (the thirteen dimensions, the source dependencies and the exitability entries, each with its own state) is in assurance/sovereignty.md and on the Sovereignty page."},{"id":"cost_confidence","name":"Cost Confidence","coverage_state":"NOT_ASSESSED","migration_decision_state":"NOT_ASSESSED","target_validation_state":"NOT_ASSESSED","coverage":null,"blockers":null,"open_decisions":null,"last_evidence":null,"derived_from":[],"detail":"Not assessed in this build."},{"id":"evidence_freshness","name":"Evidence Freshness","coverage_state":"NOT_ASSESSED","migration_decision_state":"NOT_ASSESSED","target_validation_state":"NOT_ASSESSED","coverage":null,"blockers":null,"open_decisions":null,"last_evidence":null,"derived_from":[],"detail":"Not assessed in this build."}],"overview":{"biggest_blockers":[{"kind":"FINDING_GROUP","id":"findinggroup:topology-vpc-unproven:59f69264c493","title":"topology-vpc-unproven","detail":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","words":"Confirm that every resource names the one network","owner":"unassigned (a finding records no owner role)","resources":["module.dependencies.aws_security_group.catalog_opensearch_sg","module.dependencies.aws_security_group.mq","module.dependencies.module.catalog_rds.aws_security_group.this"],"severity":"warning","units":12,"handling":"REVIEW","ref":"findinggroup/topology-vpc-unproven%3A59f69264c493"},{"kind":"OPEN_CRITICAL_SEMANTIC","id":"network-topology-boundary","title":"network-topology-boundary","words":"Confirm that the project is the boundary of one network","owner":"Network Architect","resources":["module.dependencies.aws_security_group.catalog_opensearch_sg","module.dependencies.aws_security_group.mq","module.dependencies.module.catalog_rds.aws_security_group.this"],"closes_when":"A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","units":12,"dispositions":["REVIEW"],"family":"aws.security_group","handling":"REVIEW","ref":"open-critical-semantics"},{"kind":"OPEN_CRITICAL_SEMANTIC","id":"security-group-vpc-membership","title":"security-group-vpc-membership","words":"Decide which networks the security group may be attached to (a STACKIT group has no network scope)","owner":"Network Architect","resources":["module.dependencies.aws_security_group.catalog_opensearch_sg","module.dependencies.aws_security_group.mq","module.dependencies.module.catalog_rds.aws_security_group.this"],"closes_when":"A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.","units":12,"dispositions":["UNSUPPORTED"],"family":"aws.security_group","handling":"REVIEW","ref":"open-critical-semantics"},{"kind":"OPEN_CRITICAL_SEMANTIC","id":"stateful","title":"stateful","words":"Review the stateful setting","owner":"Network Architect","resources":["module.dependencies.aws_security_group.catalog_opensearch_sg","module.dependencies.aws_security_group.mq","module.dependencies.module.catalog_rds.aws_security_group.this"],"closes_when":"A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.","units":12,"dispositions":["REVIEW"],"family":"aws.security_group","handling":"REVIEW","ref":"open-critical-semantics"},{"kind":"OPEN_CRITICAL_SEMANTIC","id":"iam-trust-service-workload","title":"iam-trust-service-workload","words":"Review the IAM trust service workload setting","owner":"Identity Architect","resources":["module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role"],"closes_when":"A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","units":10,"dispositions":["REVIEW"],"family":"aws.iam_role","handling":"REVIEW","ref":"open-critical-semantics"},{"kind":"OPEN_CRITICAL_SEMANTIC","id":"permissions","title":"permissions","words":"Translate the IAM permissions into STACKIT roles","owner":"Identity Architect","resources":["module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role"],"closes_when":"A person translates each permission of the attached policies into STACKIT roles on the target resources.","units":10,"dispositions":["REVIEW"],"family":"aws.iam_role","handling":"REVIEW","ref":"open-critical-semantics"},{"kind":"OPEN_CRITICAL_SEMANTIC","id":"trust","title":"trust","words":"Decide who may assume each IAM role","owner":"Identity Architect","resources":["module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role"],"closes_when":"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.","units":10,"dispositions":["REVIEW"],"family":"aws.iam_role","handling":"REVIEW","ref":"open-critical-semantics"},{"kind":"OPEN_CRITICAL_SEMANTIC","id":"rule-ports","title":"rule-ports","words":"Confirm the ports of the rules of the security group","owner":"Network Architect","resources":["module.dependencies.module.catalog_rds.aws_security_group.this","module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","module.dependencies.module.orders_rds.aws_security_group.this"],"closes_when":"A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","units":9,"dispositions":["LEDGER","REVIEW"],"family":"aws.security_group","handling":"REVIEW","ref":"open-critical-semantics"},{"kind":"FINDING_GROUP","id":"findinggroup:sg-egress-restricted:91a635025d36","title":"sg-egress-restricted","detail":"The source restricts egress (the AWS provider removes AWS's default allow-all egress rule; only the listed egress rules apply). Every new STACKIT security group gets two default egress rules, IPv4 and IPv6, with no ip range (any address), no protocol and no port restriction (the test of 2026-10-07, 2026-10-07: API read-back of a new group, docs concepts page), that stackit_security_group (the pinned STACKIT provider) does not manage — as generated, the draft allows all egress. After apply, delete them (stackit security-group rule list / delete --security-group-id \u003cid\u003e), or egress is wider than in the source.","words":"Re-state the restricted outbound rules of the security group","owner":"unassigned (a finding records no owner role)","resources":["module.dependencies.aws_security_group.catalog_opensearch_sg","module.dependencies.aws_security_group.mq","module.dependencies.module.catalog_opensearch.aws_security_group.this"],"severity":"warning","units":8,"handling":"REVIEW","ref":"findinggroup/sg-egress-restricted%3A91a635025d36"},{"kind":"FINDING_GROUP","id":"findinggroup:sg-rule-not-rendered:0b56dbc03fb2","title":"sg-rule-not-rendered","detail":"At least one rule of this group is not in the draft as the source has it. The plan withholds it, holds it as a commented-out rule until a value or a decision is filled in, writes it with a fact that decides what it allows not carried exactly, or cannot name it at all because the source has more rules than are visible statically (a dynamic block over a collection, a count or a rule list that is not known until apply, or a list with a hidden member: the plan's INCOMPLETE action says which set and why, the draft's TODO \"rules beyond the known set\" names it, and only the known rules are drafted). Typical causes: a protocol, port or source whose value is known only at apply time or comes from a root variable; a source group that is a choice between groups or not a group of the draft; a protocol with no STACKIT counterpart; an ICMP type with every code; an ICMP or ICMPv6 rule whose range is of the other IP family (the API answers HTTP 400, the test of 2026-10-08); a tcp or udp rule with a negative port, a port above 65535, a reversed range, or port 0 only (STACKIT stores no port range for 0 to 0, so the rule would match every port). A tcp or udp range that starts at port 0 and ends below 65535 is written from port 1 (the STACKIT API rejects a range that starts at 0; tested on a STACKIT project on 2026-10-07): port 0 itself is not carried. A stackit_security_group_rule without protocol, port_range or source allows everything (the pinned STACKIT provider), so such a rule is never widened; re-create it with the values it needs (the plan names each one).","words":"Sg rule not rendered","owner":"unassigned (a finding records no owner role)","resources":["module.dependencies.aws_security_group.catalog_opensearch_sg","module.dependencies.aws_security_group.mq","module.dependencies.module.catalog_rds.aws_security_group.this"],"severity":"warning","units":6,"handling":"REVIEW","ref":"findinggroup/sg-rule-not-rendered%3A0b56dbc03fb2"}],"source_assurance_warnings":[{"kind":"FINDING_GROUP","id":"findinggroup:source-provider-unpinned:e11f99a83eba","title":"source-provider-unpinned","detail":"No lock file entry pins aws (\u003e= 3.0, \u003e= 3.29, \u003e= 4.18, \u003e= 4.30, \u003e= 4.59, \u003e= 5.64, \u003e= 5.79, ~\u003e 5.0): the version the plan would use is not proven, so the knowledge base (checked against 5.100.0) is not taken as proof of it (stated once for the whole estate, with the units it covers and the rest of the words)","words":"Pin the version of the source provider","owner":"unassigned (a finding records no owner role)","resources":["module.dependencies.aws_mq_broker.mq","module.dependencies.aws_security_group.catalog_opensearch_sg","module.dependencies.aws_security_group.mq"],"severity":"warning","units":93,"ref":"findinggroup/source-provider-unpinned%3Ae11f99a83eba"}],"decisions":{"state":"BUILT","records":113,"plan_decisions":25,"by_source":[{"source":"PLAN_DECISION","records":11,"open_items":25,"accepted_items":0,"units":19,"conditional":0,"open_records":11,"open_units":19,"open_default_records":2,"open_draft_default_records":2},{"source":"CRITICAL_SEMANTIC","records":95,"open_items":308,"accepted_items":0,"units":48,"conditional":25,"open_records":95,"open_units":48,"open_confirm_only_items":1},{"source":"MANUAL_ACTION","records":5,"open_items":7,"accepted_items":0,"units":2,"conditional":0,"open_records":5,"open_units":2},{"source":"PLAN_STATEMENT","records":2,"open_items":7,"accepted_items":0,"units":7,"conditional":0,"open_records":2,"open_units":7}],"rejected":0,"stale":0,"unmatched_reviews":0,"ref":"decisions"},"understood":{"units_in_totals":44,"conditional":8,"switched_off":41,"uncertain_facets":0,"conditional_by_state":{"present_on_defaults":0,"disabled_on_defaults_but_overridable":3,"runtime_data_unknown":5,"variable_unknown":0,"undecided_other_cause":0},"entries":93,"not_traced":36,"trace_coverage":{"active_drafted":{"traced":36,"total":36,"from_recorded_lines":23},"active_no_block":{"traced":5,"total":8},"conditional":{"traced":5,"total":8,"from_recorded_lines":2},"switched_off":{"traced":11,"total":41}},"critical_semantics":{"resolved":36,"total":319,"open":283,"ref":"open-critical-semantics"},"ref":"architecture"},"target_shape":{"units_with_target":83,"units_without_target":10,"services":[{"service":"STACKIT security group","units":10},{"service":"STACKIT service account for the workload","units":10},{"service":"STACKIT network","units":7},{"service":"STACKIT security groups (no stateless NACLs)","units":7},{"service":"STACKIT Kubernetes Engine (SKE)","units":6},{"service":"STACKIT Logs","units":6},{"service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","units":5},{"service":"STACKIT Secrets Manager","units":4},{"service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","units":3},{"service":"STACKIT Logs access tokens","units":2},{"service":"STACKIT Observability alert rules","units":2},{"service":"STACKIT project networking / Network Area (SNA)","units":2},{"service":"implicit (STACKIT network default routing)","units":2},{"service":"STACKIT Application Load Balancer","units":1},{"service":"STACKIT DNS record set","units":1},{"service":"STACKIT KMS","units":1},{"service":"STACKIT Key Value Store (Valkey)","units":1},{"service":"STACKIT MariaDB","units":1},{"service":"STACKIT OpenSearch","units":1},{"service":"STACKIT PostgreSQL Flex","units":1},{"service":"STACKIT RabbitMQ","units":1},{"service":"STACKIT VPN","units":1},{"service":"STACKIT network DNS settings","units":1},{"service":"implicit (STACKIT network default gateway)","units":1},{"service":"implicit (belongs to the NAT gateway)","units":1},{"service":"implicit outbound (STACKIT network)","units":1},{"service":"none - no account guardrail to except a VPC or subnet from","units":1},{"service":"none - no account guardrail; exposure is set by security groups and by who may attach public IPs","units":1},{"service":"none - no packet-flow log: a capture on the servers whose records a log shipper sends to a STACKIT Logs instance is a design of its own","units":1},{"service":"none managed — application events over RabbitMQ","units":1}],"ref":"target-fit"},"review_split":{"to_review":323,"settings":307,"settings_conditional":25,"plan_decisions":9,"manual_actions":5,"plan_statements":2,"defaults_to_confirm":2,"confirm_only":1,"accepted_change":0,"reviewed":0,"unit":"open critical settings, and open decision records of the register"},"beyond_cap":{"groups":107,"confirm_only":1,"accepted_change":0},"next_steps":[{"code":"REVIEW_CRITICAL_SEMANTICS","text":"Review the 307 open critical settings: a person decides each (index.html, Decisions page; assurance/critical-semantics.json, critical_semantic_resolution.open). 25 of them belong to units that exist only if a plan-time input holds (critical_semantic_resolution.conditional_open). 1 more is carried by the draft already: confirm only.","ref":"open-critical-semantics"},{"code":"REVIEW_PLAN_ITEMS","text":"Review the 9 open plan decisions and 5 manual actions of the draft (index.html, Architecture, Deployment prerequisites). Confirm the 2 defaults the draft carries out (index.html, Decisions page): no step waits for the answer, a person confirms each or changes it.","ref":"deployment-prerequisites"},{"code":"REVIEW_DRAFT","text":"Review the draft in terraform/: it is a proposal, and an architect has to review it before any use.","ref":"engineering"},{"code":"OPEN_WORKSPACE","text":"Open index.html in a browser for the unit-by-unit view (offline, nothing is loaded)."}],"price_coverage":{"priced":6,"not_assessed":5}},"critical_semantic_resolution":{"resolved":36,"total":319,"units_without_contract":0,"open":{"rows_total":283,"by_disposition":{"LEDGER":12,"REVIEW":257,"UNSUPPORTED":14},"units":43}},"estate":{"files":105,"resources":282,"units":44,"instances":44,"dependencies":109,"entries":93,"presence":{"known_present":44,"conditional":8,"absent":41,"uncertain_facets":0,"conditional_by_state":{"present_on_defaults":0,"disabled_on_defaults_but_overridable":3,"runtime_data_unknown":5,"variable_unknown":0,"undecided_other_cause":0}},"by_class":[{"key":"DIRECT","count":0},{"key":"RECONFIGURE","count":34},{"key":"REPLATFORM","count":9},{"key":"CONTAINERIZE","count":0},{"key":"REDESIGN","count":1},{"key":"MANUAL_REVIEW","count":0},{"key":"BLOCKED","count":0}],"by_confidence":[{"key":"HIGH","count":0},{"key":"MEDIUM","count":35},{"key":"LOW","count":9}]},"units":[{"address":"module.dependencies.aws_mq_broker.mq","type":"aws_mq_broker","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.dependencies","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT RabbitMQ","resources":["stackit_rabbitmq_instance","stackit_rabbitmq_credential"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"catalogue":{"state":"MATCHED","capabilities":["messaging.mqtt-broker","messaging.rabbitmq-credential"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":7,"automation_eligible":false,"automation_ceiling":"ANSWERABLE","wave":4,"properties_not_carried":4,"not_carried":[{"node":"module.dependencies.aws_mq_broker.mq","property":"apply_immediately","source":"../../lib/dependencies/mq.tf:12"},{"node":"module.dependencies.aws_mq_broker.mq","property":"auto_minor_version_upgrade","source":"../../lib/dependencies/mq.tf:12"},{"node":"module.dependencies.aws_mq_broker.mq","property":"user.password","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"secret-handling","reason":"NOT CARRIED (module.dependencies.aws_mq_broker.mq): user — the broker users are not copied: the draft writes one stackit_rabbitmq_credential for the instance, a user whose username and password STACKIT generates (both computed, pinned provider) — clients get new credentials.","semantic":"tc-user--password","contract":"aws.mq_broker","source":"../../lib/dependencies/mq.tf:12"},{"node":"module.dependencies.aws_mq_broker.mq","property":"user.username","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.dependencies.aws_mq_broker.mq): user — the broker users are not copied: the draft writes one stackit_rabbitmq_credential for the instance, a user whose username and password STACKIT generates (both computed, pinned provider) — clients get new credentials.","semantic":"tc-user--username","contract":"aws.mq_broker","source":"../../lib/dependencies/mq.tf:12"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.dependencies.aws_mq_broker.mq is a resource of the source, declared in ../../lib/dependencies/mq.tf (lines 12-31). It is part of module.dependencies. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-ce970354a860"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/30","id":"module.dependencies.aws_mq_broker.mq"},"expert":{"id_refs":["TL-1011fd90cf52","TL-a222001be325","TL-8f4b0c90afc3","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-79efcb2b8ddb","TL-720e7aa8c6b2","TL-6143b5b5c8ef","TL-f7fc3a88733d","TL-e6d83acc492f","TL-c76b053585e3","TL-dd44bcb7bce4","TL-96b2b4dffee0","TL-d369de530541"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-d3eb105c9b5c","TL-8931c2124903","TL-f9afe3060cd0","TL-3a75229b86dc","TL-a6049371b3d3"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-7f623649c3bf","line_ids":["TL-8ce3e6f657a2","TL-9b340e19f00f","TL-5330ff391a83","TL-a025e2b14ef2"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/30","id":"module.dependencies.aws_mq_broker.mq"},"expert":{"id_refs":["TL-815001719671","TL-70ac65554c6c","TL-1deb9236882e","TL-af274b5a8258","TL-7625fd0f4a60","TL-c9f67b8f22fe","TL-88f9492bbb73","TL-204333615fe6","TL-2be1cd272f7e","TL-2736732baae9","TL-c878f9bc4d03","TL-726954b3c382","TL-45a01683ffd6","TL-e9ea8334f765"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-56e190234335","TL-d9c1a1f307f3"],"artefact":{"kind":"REPORT_FILE","file":"terraform/messaging.tf","id":"stackit_rabbitmq_credential.dependencies_mq"},"expert":{"id_refs":["TL-c2451757a208","TL-d4825bec16b6","TL-bdd2eb0c6912","TL-538d398e051d","TL-d63fca72026c","TL-1e06158053e5"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-203b3c44b616","line_ids":["TL-f080eee9565a","TL-f5f2bdee6019","TL-76c9cd3f4352","TL-5d4b69294c34","TL-848eafc5caa3","TL-6ce259dabf9d"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-c675628d0724","TL-4d72d8d89f61"]}}]},"refs":{"id":"unit:module.dependencies.aws_mq_broker.mq","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/30","ids":["unit:module.dependencies.aws_mq_broker.mq"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/30"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_rabbitmq_credential.dependencies_mq","target:stackit_rabbitmq_instance.dependencies_mq"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 2 open decisions, 0 manual actions","open_decisions":[{"id":"convert:module.dependencies.aws_mq_broker.mq:dependencies_mq_plan_name:SIZE_FROM_SOURCE","reasons":["the target sizes by a plan of the catalogue, and the source states a size in the terms of its own offer; the draft proposes the smallest plan that covers it, which leaves out what the source does not state (the disk of a plan, the sustained load, the headroom of a pool), so the value is a proposal and the price of the draft moves with it; unit of the memory figure: the plan table gives its RAM as \"GB\" and does not say whether a GB is 10^9 or 2^30 bytes, so the plan is chosen to hold the source's memory when a GB is 10^9 bytes, which it then also does when a GB is 2^30 bytes (it is never smaller than the source whichever way the table is read)"],"required_by_phase":"BEFORE_PILOT","question":"Confirm the plan the draft derived for module.dependencies.aws_mq_broker.mq from the size the source states: option use-the-size-derived-from-the-source (stackit-rabbitmq-8.16.50-replica, in var.dependencies_mq_plan_name) or option choose-the-size (a plan you set in var.dependencies_mq_plan_name)","subjects":["module.dependencies.aws_mq_broker.mq","stackit_rabbitmq_instance.dependencies_mq"],"default":{"option":"use-the-size-derived-from-the-source","words":"StackToIT carried out the option use-the-size-derived-from-the-source for module.dependencies.aws_mq_broker.mq by default: var.dependencies_mq_plan_name defaults to stackit-rabbitmq-8.16.50-replica (broker instance type mq.m5.large has 2 vCPU and 8 GiB (AWS price list, mq_broker_sizes.json), and the broker is a single instance: the smallest replica (three nodes, high availability) RabbitMQ plan of the eu01 catalogue (2026-10-18) that holds 2 vCPU and 8 GiB (8.59 GB at 10^9 bytes per GB) of memory (the plan table gives its RAM as \"GB\" and does not say whether a GB is 10^9 or 2^30 bytes, so the plan is chosen to hold the source's memory when a GB is 10^9 bytes, which it then also does when a GB is 2^30 bytes (it is never smaller than the source whichever way the table is read)): 8 vCPU / 16 GB RAM / 50 GB disk per node; the disk is not a figure of the source, so the smallest disk of that size is taken and the disk is open; no single-node plan of that size exists, so this replica plan adds the replicas the source does not have, and their price; this plan is larger than the one the other reading gives: reading the table's GB as a GiB, stackit-rabbitmq-4.8.50-single (4 vCPU / 8 GB RAM / 50 GB disk per node) would hold the source, and the draft is priced on the larger plan; if the table's GB is a GiB, answer choose-the-size and set stackit-rabbitmq-4.8.50-single). To change it, answer this decision in decisions.yaml with choose-the-size (and set the plan in the variable), or reject the proposal: the next run then writes the variable without a default.","answered_by":"DEFAULT"}},{"id":"convert:module.dependencies.aws_mq_broker.mq:exposure:EXPOSURE_WIDENED","reasons":["the source module.dependencies.aws_mq_broker.mq is private (the broker states publicly_accessible = false: it is reached from inside the VPC that hosts its subnets) and the STACKIT RabbitMQ instance has its own endpoint outside the project network, limited only by parameters.sgw_acl; a list the plan does not give is replaced by STACKIT's default ACL, which admits every STACKIT customer's addresses (the draft's variable has the empty list as its default, which the block replaces by the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods)); the endpoint is wider than the source's and the difference is an accepted change in exposure, not a preserved property"],"required_by_phase":"BEFORE_PILOT","question":"Accept a public RabbitMQ endpoint for stackit_rabbitmq_instance.dependencies_mq, limited only by its client list (parameters.sgw_acl), where the source module.dependencies.aws_mq_broker.mq is private, or redesign it: stackit_rabbitmq_instance has no private-network option in the pinned provider (its access is parameters.sgw_acl only)","subjects":["module.dependencies.aws_mq_broker.mq","stackit_rabbitmq_instance.dependencies_mq"],"default":{"option":"accept-the-public-endpoint","words":"StackToIT carried out the option accept-the-public-endpoint for stackit_rabbitmq_instance.dependencies_mq by default: the RabbitMQ instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.orders_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_mq_allowed_cidrs, or answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default.","answered_by":"DEFAULT"}}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"open_decisions":2,"manual_actions":0,"register":{"open":6,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-EXPOSURE-WIDENED","DEC-GEN-CONVERT-SIZE-FROM-SOURCE"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ","DEC-NET-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ","DEC-OPS-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ","DEC-SEC-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ"]}],"next_step":{"record":"DEC-GEN-CONVERT-EXPOSURE-WIDENED","source":"PLAN_DECISION","text":"Decide \"exposure widened\" (DEC-GEN-CONVERT-EXPOSURE-WIDENED): the plan of the draft leaves it open"},"blocks_automation":true}},"target_prices":[{"resource":"stackit_rabbitmq_instance.dependencies_mq","resource_type":"stackit_rabbitmq_instance","component":"plan","join_key":"plan_name = \"stackit-rabbitmq-8.16.50-replica\" (DEFAULT: priced on the draft's default \"stackit-rabbitmq-8.16.50-replica\" of var.dependencies_mq_plan_name (draft variables.tf:92); no answer or standing policy of the run chose it; decision DEC-GEN-CONVERT-SIZE-FROM-SOURCE is open: nobody confirmed the default, so another value changes the price)","state":"PRICED","sku_id":"ST-0044501","sku_name":"RabbitMQ-8.16.50-Replica-EU01","unit_price":"0.85140277778","unit":"Hours","unit_billing":"per hour","region":"eu01","metro":false,"valid_start":"2026-10-08T07:44:43Z"}]},{"address":"module.dependencies.aws_security_group.catalog_opensearch_sg","type":"aws_security_group","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.dependencies","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","resources":[],"regions":[],"catalogue":{"state":"NOT_APPLICABLE","capabilities":[],"unmatched_resources":[]}},"blocker_count":2,"finding_count":4,"evidence_count":3,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":3,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.dependencies.aws_security_group.catalog_opensearch_sg is an AWS security group, declared in ../../lib/dependencies/catalog_opensearch.tf (lines 14-18). It is part of module.dependencies. It states 1 rule.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/23","id":"module.dependencies.aws_security_group.catalog_opensearch_sg"},"expert":{"id_refs":["TL-a8f0a4cb1f58","TL-6d6d224d0414","TL-c6c4a8483f3c","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"OPEN","summary_id":"TT-6c7a4aac6c88","lines":["ingress tcp port 443 from a security group that is not resolved"],"artefact":{"kind":"SOURCE_FILE","file":"../../lib/dependencies/catalog_opensearch.tf","pointer":"lines 14-18"},"expert":{"id_refs":["TL-1b6bb75769f1","TL-e8c14af06fc7"]}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-55e837a80499","line_ids":["TL-f9c365ffe93f","TL-fc09cb714260","TL-c58757b38cbc"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.dependencies.aws_security_group.catalog_opensearch_sg"},"expert":{"id_refs":["TL-f4bdc86495d2","TL-44d09e204bbc","TL-4554971a02d4","TL-46ec0bd8733b","TL-425a537adfcb"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-87d27e00854a","line_ids":["TL-3545a21a7bd6","TL-b801052d81ab","TL-29e91686883f"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/23","id":"module.dependencies.aws_security_group.catalog_opensearch_sg"},"expert":{"id_refs":["TL-98aa55dee3f2","TL-750b3fbf1f7f","TL-93afdda91a72","TL-0e88d05b6081","TL-a9cbf5fd9753","TL-625cb7eb6db1","TL-7afdbfe6f6fb","TL-8551a479a85d"]}},{"stage":"INTENT","state":"ESTABLISHED","summary_id":"TT-f47803034718","lines":["Group module.dependencies.aws_security_group.catalog_opensearch_sg: 1 rule"],"artefact":{"kind":"IN_MEMORY","id":"security:module.dependencies.aws_security_group.catalog_opensearch_sg"},"expert":{"id_refs":["TL-a0b6743aac67","TL-cc90c346c091"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3921a774bd0d","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3"],"artefact":{"kind":"IN_MEMORY","id":"network.security-group"},"expert":{"id_refs":["TL-dbe97d4df687","TL-00a58746651a","TL-71db89378ca6","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-ffa2d19dc7f9","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-d32b21b09626","TL-899fd28c3b9c"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary_id":"TT-6a07761f0aee","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-f2eb19ea1d78","TL-d477c31ae16d","TL-5ce834a2bf21","TL-5260e0ef58bd","TL-e4d60c1731c8"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-5bd4122ee9c6","line_ids":["TL-3262cdcd6533"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-f9f2ed7fc164"]}}]},"refs":{"id":"unit:module.dependencies.aws_security_group.catalog_opensearch_sg","family":"AWS_SECURITY_GROUP","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/23","ids":["unit:module.dependencies.aws_security_group.catalog_opensearch_sg"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/23"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:security:module.dependencies.aws_security_group.catalog_opensearch_sg"]},{"hop":"plan","state":"NONE","kind":"REPORT_FILE","file":"target-plan.json","reason":"NOT_DRAFTED"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NOT_DRAFTED"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:final-artifact@module.dependencies.aws_security_group.catalog_opensearch_sg","check:plan-valid@module.dependencies.aws_security_group.catalog_opensearch_sg","check:renders@module.dependencies.aws_security_group.catalog_opensearch_sg","check:round-trip@module.dependencies.aws_security_group.catalog_opensearch_sg","check:rule-has-one-remote@module.dependencies.aws_security_group.catalog_opensearch_sg"]}],"targets":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":5,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG"]}],"next_step":{"record":"DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.dependencies.aws_security_group.catalog_opensearch_sg (DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.dependencies.aws_security_group.mq","type":"aws_security_group","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.dependencies","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","resources":[],"regions":[],"catalogue":{"state":"NOT_APPLICABLE","capabilities":[],"unmatched_resources":[]}},"blocker_count":2,"finding_count":4,"evidence_count":3,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":3,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.dependencies.aws_security_group.mq is an AWS security group, declared in ../../lib/dependencies/mq.tf (lines 33-43). It is part of module.dependencies. It states 1 rule.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/24","id":"module.dependencies.aws_security_group.mq"},"expert":{"id_refs":["TL-a8f0a4cb1f58","TL-6d6d224d0414","TL-c6c4a8483f3c","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"OPEN","summary_id":"TT-6c7a4aac6c88","lines":["ingress tcp port 5671 from a security group that is not resolved"],"artefact":{"kind":"SOURCE_FILE","file":"../../lib/dependencies/mq.tf","pointer":"lines 33-43"},"expert":{"id_refs":["TL-1b6bb75769f1","TL-d880af0f41c4"]}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-55e837a80499","line_ids":["TL-f9c365ffe93f","TL-ec07138f4b5e","TL-2768a5344a38"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.dependencies.aws_security_group.mq"},"expert":{"id_refs":["TL-f4bdc86495d2","TL-581ea56292b3","TL-a04300ee85f1","TL-46ec0bd8733b","TL-5db7a125537b"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-de6015241030","line_ids":["TL-3545a21a7bd6","TL-185c870bf3cc","TL-035c2079cbd6"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/24","id":"module.dependencies.aws_security_group.mq"},"expert":{"id_refs":["TL-98aa55dee3f2","TL-750b3fbf1f7f","TL-93afdda91a72","TL-0e88d05b6081","TL-625cb7eb6db1","TL-7afdbfe6f6fb","TL-8551a479a85d"]}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-f47803034718","line_ids":["TL-b98dc7b63973","TL-f6e48092b146"],"artefact":{"kind":"IN_MEMORY","id":"security:module.dependencies.aws_security_group.mq"},"expert":{"ids":["intent family: SECURITY_POLICY","intent: security:module.dependencies.aws_security_group.mq"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3921a774bd0d","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3"],"artefact":{"kind":"IN_MEMORY","id":"network.security-group"},"expert":{"id_refs":["TL-dbe97d4df687","TL-00a58746651a","TL-71db89378ca6","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-ffa2d19dc7f9","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-6c5a3b5b6653","TL-899fd28c3b9c"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary_id":"TT-6a07761f0aee","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-f2eb19ea1d78","TL-d477c31ae16d","TL-5ce834a2bf21","TL-5260e0ef58bd","TL-e4d60c1731c8"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-5bd4122ee9c6","lines":["module.dependencies.aws_security_group.mq: No STACKIT group is produced for this unit."],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-5824683fa834"]}}]},"refs":{"id":"unit:module.dependencies.aws_security_group.mq","family":"AWS_SECURITY_GROUP","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/24","ids":["unit:module.dependencies.aws_security_group.mq"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/24"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:security:module.dependencies.aws_security_group.mq"]},{"hop":"plan","state":"NONE","kind":"REPORT_FILE","file":"target-plan.json","reason":"NOT_DRAFTED"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NOT_DRAFTED"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:final-artifact@module.dependencies.aws_security_group.mq","check:plan-valid@module.dependencies.aws_security_group.mq","check:renders@module.dependencies.aws_security_group.mq","check:round-trip@module.dependencies.aws_security_group.mq","check:rule-has-one-remote@module.dependencies.aws_security_group.mq"]}],"targets":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":6,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ"]}],"next_step":{"record":"DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.dependencies.aws_security_group.mq (DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_group.this","type":"aws_cloudwatch_log_group","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.dependencies.module.catalog_opensearch","switched_off":{"by":"for_each = 0","candidate_class":"RECONFIGURE","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT Logs","resources":["stackit_logs_instance","stackit_logs_access_token"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["observability.logs"],"unmatched_resources":[]}},"blocker_count":1,"finding_count":4,"evidence_count":6,"automation_eligible":null,"wave":0,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_group.this is a log group (a named store of log events with a retention of its own), declared in .terraform/modules/dependencies.catalog_opensearch/main.tf (lines 405-415). It is switched off in the source. It is part of module.dependencies.module.catalog_opensearch. This trace follows the logs of the unit: where they go on STACKIT and for how long they are kept.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/44","id":"module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_group.this"},"expert":{"id_refs":["TL-cecbc297c624","TL-660fdbc25888","TL-7aaad50961f3","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"OPEN","summary_id":"TT-661d402aa522","lines":["The source states a retention that is stated"],"artefact":{"kind":"SOURCE_FILE","file":".terraform/modules/dependencies.catalog_opensearch/main.tf","pointer":"lines 405-415"},"expert":{"ids":["retention key: retention_in_days"]}},{"stage":"RESOLUTION_PROOF","state":"NONE","summary_id":"TT-63fa53d1e665","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"SEMANTIC_CLAIM","state":"NONE","summary_id":"TT-09e44fcd9ff2","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-078f3d301edb","line_ids":["TL-73d3e111d3c3","TL-4c9765f744f7","TL-89bd5732af76"],"artefact":{"kind":"IN_MEMORY","id":"logs:module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_group.this"},"expert":{"id_refs":["TL-ec3e7a0847fa","TL-fc84ee1d9bf2"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-41d8d4e38188","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-60d467065f78","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4"],"artefact":{"kind":"IN_MEMORY","id":"observability.logs"},"expert":{"ids":["capability: observability.logs","provider version: 0.121.0"]}},{"stage":"TRANSFORMATION","state":"ESTABLISHED","summary_id":"TT-c093d281e9b6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-a05a641fdcc9","TL-d821bd14334d"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary":"The draft writes nothing for this unit, so nothing was checked.","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_group.this","family":"LOG_SOURCE","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/44","ids":["unit:module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_group.this"]},{"hop":"claims","state":"NONE","kind":"IN_MEMORY","reason":"NO_CLAIM_FOR_THE_UNIT"},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":0,"accepted":0}}},{"address":"module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_resource_policy.this","type":"aws_cloudwatch_log_resource_policy","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.dependencies.module.catalog_opensearch","switched_off":{"by":"count = 0","candidate_class":"RECONFIGURE","candidate_confidence":"LOW"},"target_fit":{"service":"STACKIT Logs access tokens","resources":["stackit_logs_access_token"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["observability.logs"],"unmatched_resources":[]}},"blocker_count":1,"finding_count":1,"evidence_count":2,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_resource_policy.this","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/45","ids":["unit:module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_resource_policy.this"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","type":"aws_opensearch_domain","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.dependencies.module.catalog_opensearch","class":"REPLATFORM","confidence":"LOW","target_fit":{"service":"STACKIT OpenSearch","resources":["stackit_opensearch_instance","stackit_opensearch_credential"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"catalogue":{"state":"MATCHED","capabilities":["data.opensearch-instance"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":4,"properties_not_carried":23,"not_carried":[{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"advanced_options","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters.","semantic":"access-and-encryption-settings","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"advanced_security_options.anonymous_auth_enabled","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters.","semantic":"access-and-encryption-settings","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"advanced_security_options.enabled","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters.","semantic":"access-and-encryption-settings","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"advanced_security_options.internal_user_database_enabled","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters.","semantic":"access-and-encryption-settings","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"advanced_security_options.master_user_options.master_user_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+UNSUPPORTED","category":"identity-access","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters.","semantic":"credentials-and-keys-settings","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"advanced_security_options.master_user_options.master_user_password","property_class":"CRITICAL","gate_closure":"CLOSED:NC+UNSUPPORTED","category":"secret-handling","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters.","semantic":"credentials-and-keys-settings","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"cluster_config.dedicated_master_count","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"availability-durability","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): cluster_config — the plan (plan_name) sets the size of a stackit_opensearch_instance (pinned provider): the cluster's instance types and counts, dedicated masters and zone awareness are not carried — choose the plan for them.","semantic":"cluster-layout-settings","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"cluster_config.dedicated_master_enabled","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"availability-durability","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): cluster_config — the plan (plan_name) sets the size of a stackit_opensearch_instance (pinned provider): the cluster's instance types and counts, dedicated masters and zone awareness are not carried — choose the plan for them.","semantic":"cluster-layout-settings","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"cluster_config.dedicated_master_type","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"cluster_config.instance_count","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"availability-durability","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): cluster_config — the plan (plan_name) sets the size of a stackit_opensearch_instance (pinned provider): the cluster's instance types and counts, dedicated masters and zone awareness are not carried — choose the plan for them.","semantic":"cluster-layout-settings","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"cluster_config.instance_type","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"cluster_config.zone_awareness_enabled","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"availability-durability","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): cluster_config — the plan (plan_name) sets the size of a stackit_opensearch_instance (pinned provider): the cluster's instance types and counts, dedicated masters and zone awareness are not carried — choose the plan for them.","semantic":"cluster-layout-settings","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"domain_endpoint_options.enforce_https","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"encryption","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters.","semantic":"access-and-encryption-settings","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"domain_endpoint_options.tls_security_policy","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"encryption","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters.","semantic":"access-and-encryption-settings","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"ebs_options.ebs_enabled","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"availability-durability","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters.","semantic":"domain-settings","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"ebs_options.volume_size","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"ebs_options.volume_type","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"encrypt_at_rest.enabled","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"encryption","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters.","semantic":"access-and-encryption-settings","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"engine_version","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"availability-durability","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters.","semantic":"engine-version","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"node_to_node_encryption.enabled","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"encryption","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters.","semantic":"access-and-encryption-settings","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"vpc_options.security_group_ids","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters.","semantic":"network-settings","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","property":"vpc_options.subnet_ids","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a plan, a version and parameters (an access list of networks, TLS protocols and ciphers, syslog servers, plugins; pinned provider): the domain's storage, network placement, access policy, encryption, endpoint, login, log and engine settings are not generated — a person maps each one to the plan and the parameters.","semantic":"network-settings","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29"},{"node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain_policy.this","property":"access_policies","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain_policy.this): access_policies — the access policy of the domain: Statement[0] allows any principal es:* (with a condition or a part that is not visible statically): a stackit_opensearch_instance grants access by generated credentials (stackit_opensearch_credential) and the network ranges of parameters.sgw_acl (pinned provider) and has no resource policy, so a policy that separates principals has no counterpart — list the principals and decide how their separation is kept (one instance per trust level, or in the application).","semantic":"opensearch-domain-policy-resource","contract":"aws.opensearch","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:269"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is a resource of the source, declared in .terraform/modules/dependencies.catalog_opensearch/main.tf (lines 29-233). It is part of module.dependencies.module.catalog_opensearch. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-aa94f4bce90e"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/31","id":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this"},"expert":{"id_refs":["TL-ad851bfabb74","TL-e0e4e6c7eb18","TL-3dc8bdb9b179","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-842fac63454c","TL-4eb1fb7ecda2","TL-4827bf09e90d","TL-86e88012d122","TL-e6d83acc492f","TL-bcd2cb137506","TL-515a49648e47","TL-52ea5713b1a8","TL-df25ff4f04ac"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-ecd5e0c38318","TL-8931c2124903","TL-b4df207ee84d","TL-4bc841e93412","TL-2d5fc1411520"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-5ff6734b3839","line_ids":["TL-86bcadf10a2b","TL-5330ff391a83","TL-7c6c90552a0f"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/31","id":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this"},"expert":{"id_refs":["TL-be2e9593649f","TL-5815d2c8b7cd","TL-c0c729a47b2a","TL-7e1a16cb1615","TL-431505b338cb","TL-e578adf43042","TL-7625fd0f4a60","TL-25ab2858b6d9","TL-b6b320f1e9c7","TL-f7daa124273c","TL-e6b8e9f1d2f6","TL-2e4739c4ef16","TL-8e6bbc7e79ec","TL-c848f0501964"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-95876fd15cbf","TL-f18f2e6ae7c4"],"artefact":{"kind":"REPORT_FILE","file":"terraform/data.tf","id":"stackit_opensearch_credential.dependencies_catalog_opensearch_this"},"expert":{"id_refs":["TL-3176bb3bd560","TL-7d962b3e1941","TL-1ea84acb5dc6","TL-47ae68e37780","TL-b7d0788a9866","TL-0d1dd7ac458b"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-1154e805410e","line_ids":["TL-06924eba095a","TL-cef409da4821","TL-5cc1fbc3b2ef","TL-5d4b69294c34","TL-82f379bc48ea","TL-2617e179fc00"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-d88062febb16","TL-4d72d8d89f61","TL-6fb677204748"]}}]},"refs":{"id":"unit:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/31","ids":["unit:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/31"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_opensearch_credential.dependencies_catalog_opensearch_this","target:stackit_opensearch_instance.dependencies_catalog_opensearch_this"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 3 open decisions, 0 manual actions","open_decisions":[{"id":"convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:data:DATA_MOVEMENT","reasons":["StackToIT moves no data and writes no runbook for aws_opensearch_domain to STACKIT OpenSearch; the data-movement register lists module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the mechanism UNKNOWN, and the source states neither the size of the data nor the downtime the business tolerates nor the consistency the application needs"],"required_by_phase":"BEFORE_PILOT","question":"Choose how the data of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this moves from aws_opensearch_domain to STACKIT OpenSearch (stackit_opensearch_instance.dependencies_catalog_opensearch_this): the method, the downtime it needs and the check that the copy is complete","subjects":["module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","stackit_opensearch_instance.dependencies_catalog_opensearch_this"]},{"id":"convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:exposure:EXPOSURE_WIDENED","reasons":["the source module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is private (the domain states vpc_options: it is reached from inside its VPC) and the STACKIT OpenSearch instance has its own endpoint outside the project network, limited only by parameters.sgw_acl; a list the plan does not give is replaced by STACKIT's default ACL, which admits every STACKIT customer's addresses (the draft's variable has the empty list as its default, which the block replaces by the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods)); the endpoint is wider than the source's and the difference is an accepted change in exposure, not a preserved property"],"required_by_phase":"BEFORE_PILOT","question":"Accept a public OpenSearch endpoint for stackit_opensearch_instance.dependencies_catalog_opensearch_this, limited only by its client list (parameters.sgw_acl), where the source module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is private, or redesign it: stackit_opensearch_instance has no private-network option in the pinned provider (its access is parameters.sgw_acl only)","subjects":["module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","stackit_opensearch_instance.dependencies_catalog_opensearch_this"],"default":{"option":"accept-the-public-endpoint","words":"StackToIT carried out the option accept-the-public-endpoint for stackit_opensearch_instance.dependencies_catalog_opensearch_this by default: the OpenSearch instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.catalog_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_catalog_opensearch_this_allowed_cidrs, or answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default.","answered_by":"DEFAULT"}},{"id":"convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:version:ENGINE_VERSION_DOWNGRADE","reasons":["the source runs OpenSearch 3.3 (engine_version), newer than every version the eu01 catalogue (2026-10-18) lists for stackit_opensearch_instance (2): a snapshot of 3.3 cannot be restored into 2 (OpenSearch restores a snapshot into the same or a newer version only); reindex from the source, or write to both during the cutover (dual-write), is the path; whether the clients work against 2 is unknown"],"required_by_phase":"BEFORE_PILOT","question":"Choose how module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch 3.3) reaches STACKIT, which offers 2 in eu01: move the data into 2 by re-reading it from the source, run OpenSearch 3.3 yourself on SKE, or wait until STACKIT offers it","subjects":["module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","stackit_opensearch_instance.dependencies_catalog_opensearch_this"]}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"open_decisions":3,"manual_actions":0,"register":{"open":7,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","DEC-GEN-CONVERT-EXPOSURE-WIDENED"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E","DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E","DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E","DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E"]}],"next_step":{"record":"DEC-GEN-CONVERT-DATA-MOVEMENT","source":"PLAN_DECISION","text":"Decide \"data movement\" (DEC-GEN-CONVERT-DATA-MOVEMENT): the plan of the draft leaves it open"},"blocks_automation":true}},"target_prices":[{"resource":"stackit_opensearch_instance.dependencies_catalog_opensearch_this","resource_type":"stackit_opensearch_instance","component":"plan","state":"NOT_ASSESSED","reason_code":"KEY_NOT_IN_DRAFT","reason":"NOT_ASSESSED: the draft does not choose the plan (plan_name is var.dependencies_catalog_opensearch_this_plan_name): no SKU is named"}]},{"address":"module.dependencies.module.catalog_opensearch.aws_security_group.this","type":"aws_security_group","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.dependencies.module.catalog_opensearch","switched_off":{"by":"count = 0","candidate_class":"RECONFIGURE","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.security-group"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":3,"automation_eligible":null,"wave":0,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.dependencies.module.catalog_opensearch.aws_security_group.this is an AWS security group, declared in .terraform/modules/dependencies.catalog_opensearch/main.tf (lines 472-486). It is switched off in the source. It is part of module.dependencies.module.catalog_opensearch. It states 0 rules.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/46","id":"module.dependencies.module.catalog_opensearch.aws_security_group.this"},"expert":{"id_refs":["TL-a8f0a4cb1f58","TL-6d6d224d0414","TL-c6c4a8483f3c","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary":"The source states no rule for this unit.","artefact":{"kind":"SOURCE_FILE","file":".terraform/modules/dependencies.catalog_opensearch/main.tf","pointer":"lines 472-486"},"expert":{"id_refs":["TL-1b6bb75769f1"]}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-28cf18b349f1","line_ids":["TL-f526766584fc"],"artefact":{"kind":"IN_MEMORY","id":"module.dependencies.module.catalog_opensearch.aws_security_group.this"},"expert":{"id_refs":["TL-94c59a08ef5d","TL-ed10391cb980"]}},{"stage":"SEMANTIC_CLAIM","state":"NONE","summary_id":"TT-09e44fcd9ff2","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"INTENT","state":"ESTABLISHED","summary_id":"TT-722f9eb3a9f2","line_ids":["TL-13c01e85b33e","TL-b432c72310fd"],"artefact":{"kind":"IN_MEMORY","id":"security:module.dependencies.module.catalog_opensearch.aws_security_group.this"},"expert":{"id_refs":["TL-a0b6743aac67","TL-cc90c346c091"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3921a774bd0d","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3"],"artefact":{"kind":"IN_MEMORY","id":"network.security-group"},"expert":{"id_refs":["TL-dbe97d4df687","TL-00a58746651a","TL-71db89378ca6","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-ffa2d19dc7f9","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-d1a104cfbb3e","TL-899fd28c3b9c"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary":"The draft writes nothing for this unit, so nothing was checked.","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.dependencies.module.catalog_opensearch.aws_security_group.this","family":"AWS_SECURITY_GROUP","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/46","ids":["unit:module.dependencies.module.catalog_opensearch.aws_security_group.this"]},{"hop":"claims","state":"NONE","kind":"IN_MEMORY","reason":"NO_CLAIM_FOR_THE_UNIT"},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":0,"accepted":0}}},{"address":"module.dependencies.module.catalog_rds.aws_cloudwatch_log_group.this","type":"aws_cloudwatch_log_group","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.dependencies.module.catalog_rds","switched_off":{"by":"for_each = 0","candidate_class":"RECONFIGURE","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT Logs","resources":["stackit_logs_instance","stackit_logs_access_token"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["observability.logs"],"unmatched_resources":[]}},"blocker_count":1,"finding_count":1,"evidence_count":6,"automation_eligible":null,"wave":0,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.dependencies.module.catalog_rds.aws_cloudwatch_log_group.this is a log group (a named store of log events with a retention of its own), declared in .terraform/modules/dependencies.catalog_rds/main.tf (lines 445-453). It is switched off in the source. It is part of module.dependencies.module.catalog_rds. This trace follows the logs of the unit: where they go on STACKIT and for how long they are kept.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/47","id":"module.dependencies.module.catalog_rds.aws_cloudwatch_log_group.this"},"expert":{"id_refs":["TL-cecbc297c624","TL-660fdbc25888","TL-7aaad50961f3","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"OPEN","summary_id":"TT-661d402aa522","lines":["The source states a retention that is stated"],"artefact":{"kind":"SOURCE_FILE","file":".terraform/modules/dependencies.catalog_rds/main.tf","pointer":"lines 445-453"},"expert":{"ids":["retention key: retention_in_days"]}},{"stage":"RESOLUTION_PROOF","state":"NONE","summary_id":"TT-63fa53d1e665","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"SEMANTIC_CLAIM","state":"NONE","summary_id":"TT-09e44fcd9ff2","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-078f3d301edb","line_ids":["TL-73d3e111d3c3","TL-4c9765f744f7","TL-89bd5732af76"],"artefact":{"kind":"IN_MEMORY","id":"logs:module.dependencies.module.catalog_rds.aws_cloudwatch_log_group.this"},"expert":{"id_refs":["TL-ec3e7a0847fa","TL-fc84ee1d9bf2"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-41d8d4e38188","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-60d467065f78","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4"],"artefact":{"kind":"IN_MEMORY","id":"observability.logs"},"expert":{"ids":["capability: observability.logs","provider version: 0.121.0"]}},{"stage":"TRANSFORMATION","state":"ESTABLISHED","summary_id":"TT-c093d281e9b6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-a05a641fdcc9","TL-d821bd14334d"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary":"The draft writes nothing for this unit, so nothing was checked.","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.dependencies.module.catalog_rds.aws_cloudwatch_log_group.this","family":"LOG_SOURCE","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/47","ids":["unit:module.dependencies.module.catalog_rds.aws_cloudwatch_log_group.this"]},{"hop":"claims","state":"NONE","kind":"IN_MEMORY","reason":"NO_CLAIM_FOR_THE_UNIT"},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":0,"accepted":0}}},{"address":"module.dependencies.module.catalog_rds.aws_iam_role.rds_enhanced_monitoring","type":"aws_iam_role","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.dependencies.module.catalog_rds","switched_off":{"by":"count = 0","candidate_class":"MANUAL_REVIEW","candidate_confidence":"LOW"},"target_fit":null,"blocker_count":1,"finding_count":2,"evidence_count":2,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.dependencies.module.catalog_rds.aws_iam_role.rds_enhanced_monitoring","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/48","ids":["unit:module.dependencies.module.catalog_rds.aws_iam_role.rds_enhanced_monitoring"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","type":"aws_rds_cluster","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.dependencies.module.catalog_rds","class":"REPLATFORM","confidence":"LOW","target_fit":{"service":"STACKIT MariaDB","resources":["stackit_mariadb_instance"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"catalogue":{"state":"MATCHED","capabilities":["database.mariadb"],"unmatched_resources":[]}},"blocker_count":3,"finding_count":7,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":4,"properties_not_carried":16,"not_carried":[{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","property":"allow_major_version_upgrade","source":".terraform/modules/dependencies.catalog_rds/main.tf:61"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","property":"backup_retention_period","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"backup-retention","reason":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster.this): backup_retention_period = 7, preferred_backup_window = 02:00-03:00 — stackit_mariadb_instance has no backup setting (pinned provider).","semantic":"backup-retention","contract":"aws.rds_cluster","source":".terraform/modules/dependencies.catalog_rds/main.tf:61"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","property":"database_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"workload-compatibility","reason":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster.this): database_name = catalog — stackit_mariadb_instance has no database attribute (pinned provider): create the database after connecting.","semantic":"tc-database-name","contract":"aws.rds_cluster","source":".terraform/modules/dependencies.catalog_rds/main.tf:61"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","property":"db_cluster_parameter_group_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"encryption","reason":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster.this): preferred_maintenance_window = sun:05:00-sun:06:00, allow_major_version_upgrade = true, db_cluster_parameter_group_name — stackit_mariadb_instance has no maintenance window, version-upgrade policy, extended-support, CA-certificate, option-group or parameter-group attribute (pinned provider).","semantic":"parameter-and-option-groups","contract":"aws.rds_cluster","source":".terraform/modules/dependencies.catalog_rds/main.tf:61"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","property":"db_subnet_group_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster.this): db_subnet_group_name — stackit_mariadb_instance has no subnet, availability-zone or IP-family attribute (pinned provider): clients reach the instance at the endpoint STACKIT assigns.","semantic":"db-network-placement","contract":"aws.rds_cluster","source":".terraform/modules/dependencies.catalog_rds/main.tf:61"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","property":"master_password","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"secret-handling","reason":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster.this): master_password — the source password is not copied: stackit_mariadb_credential has no password input, STACKIT generates it (the password is computed and sensitive, pinned provider) — hand the new one to the application.","semantic":"admin-password","contract":"aws.rds_cluster","source":".terraform/modules/dependencies.catalog_rds/main.tf:61"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","property":"master_username","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster.this): master_username = root — stackit_mariadb_credential takes no username: the username and the password are computed by STACKIT (pinned provider) — clients get new credentials.","semantic":"admin-username-not-carried","contract":"aws.rds_cluster","source":".terraform/modules/dependencies.catalog_rds/main.tf:61"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","property":"port","source":".terraform/modules/dependencies.catalog_rds/main.tf:61"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","property":"preferred_backup_window","source":".terraform/modules/dependencies.catalog_rds/main.tf:61"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","property":"preferred_maintenance_window","source":".terraform/modules/dependencies.catalog_rds/main.tf:61"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","property":"skip_final_snapshot","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"backup-retention","reason":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster.this): skip_final_snapshot = true — stackit_mariadb_instance has no final-snapshot or delete-time backup-retention setting (pinned provider): the instance is deleted immediately (and its automated backups may be removed immediately) when Terraform destroys the resource — export the data first if it must survive the cut-over.","semantic":"final-snapshot","contract":"aws.rds_cluster","source":".terraform/modules/dependencies.catalog_rds/main.tf:61"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","property":"db_parameter_group_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"encryption","reason":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this): identifier = (reads a variable; its default is not printed), db_subnet_group_name, preferred_maintenance_window = sun:05:00-sun:06:00, db_parameter_group_name — cluster members are not separate STACKIT resources — the plan (plan_name) defines the nodes (pinned provider): member names, failover priority, zone, subnet, windows, upgrade policy, parameter group, CA certificate and instance profile have no attribute.","semantic":"member-settings","contract":"aws.rds_cluster","source":".terraform/modules/dependencies.catalog_rds/main.tf:175"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","property":"db_subnet_group_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this): identifier = (reads a variable; its default is not printed), db_subnet_group_name, preferred_maintenance_window = sun:05:00-sun:06:00, db_parameter_group_name — cluster members are not separate STACKIT resources — the plan (plan_name) defines the nodes (pinned provider): member names, failover priority, zone, subnet, windows, upgrade policy, parameter group, CA certificate and instance profile have no attribute.","semantic":"member-settings","contract":"aws.rds_cluster","source":".terraform/modules/dependencies.catalog_rds/main.tf:175"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","property":"identifier","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"workload-compatibility","reason":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this): identifier = (reads a variable; its default is not printed), db_subnet_group_name, preferred_maintenance_window = sun:05:00-sun:06:00, db_parameter_group_name — cluster members are not separate STACKIT resources — the plan (plan_name) defines the nodes (pinned provider): member names, failover priority, zone, subnet, windows, upgrade policy, parameter group, CA certificate and instance profile have no attribute.","semantic":"tcf-rds-cluster-instance--identifier","contract":"aws.rds_cluster","source":".terraform/modules/dependencies.catalog_rds/main.tf:175"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","property":"monitoring_role_arn","source":".terraform/modules/dependencies.catalog_rds/main.tf:175"},{"node":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","property":"preferred_maintenance_window","source":".terraform/modules/dependencies.catalog_rds/main.tf:175"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.dependencies.module.catalog_rds.aws_rds_cluster.this is a resource of the source, declared in .terraform/modules/dependencies.catalog_rds/main.tf (lines 61-169). It is part of module.dependencies.module.catalog_rds. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-a7c4401bd895"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/32","id":"module.dependencies.module.catalog_rds.aws_rds_cluster.this"},"expert":{"id_refs":["TL-86a24047dc82","TL-db1bbaf0a0a0","TL-6c237fed88b6","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-eb4d03549aa7","TL-b37cbe043e79","TL-62d0cad26635","TL-ceeebc3a4ae7","TL-76bc7ffd4655","TL-9b4918ae0f89","TL-ee96ad845f27","TL-543c0ed0a751","TL-919e17423375"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-96fb8b671269","TL-d042d4d0d608","TL-753576a9ee70","TL-260f11e31eb6","TL-3933b6fc76cc","TL-8931c2124903","TL-e0b8a3656b5d","TL-a8d8bb17db66","TL-66470f630e5e"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-12a52cf74293","line_ids":["TL-8ce3e6f657a2","TL-f847d01c9c7c","TL-fad2122c85a9","TL-f1ec41938106","TL-417d81a7b596"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/32","id":"module.dependencies.module.catalog_rds.aws_rds_cluster.this"},"expert":{"id_refs":["TL-540fb0b16884","TL-1d5e56205390","TL-b96566e5b3e4","TL-58d8a240f554","TL-2c6893b3f43c","TL-7625fd0f4a60","TL-995a8b5caea3","TL-1d2b82676a42","TL-11694f78ab8d","TL-4db86159d497","TL-bb960af062d5","TL-a5fc3b814f37","TL-d8cd2b6539da","TL-da8ab18e216a","TL-7f2b7ddbdb25","TL-af0b67ca104d","TL-0ac4a51e0129","TL-1cc52a87c19f","TL-7a8994db68f8","TL-85f323530bb2","TL-9c15f6843395","TL-2cbc6b8897fa","TL-49c8926884db","TL-15f8c4da915a"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-542e75ae1c2a","TL-24a85fb39f57"],"artefact":{"kind":"REPORT_FILE","file":"terraform/data.tf","id":"stackit_mariadb_credential.dependencies_catalog_rds_this"},"expert":{"id_refs":["TL-867ec8fe17e6","TL-8419133c155c","TL-701749b3d3d8","TL-55f2ecd48291","TL-664045145910","TL-664af43895bb"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-5ef6ab8adb80","line_ids":["TL-3d578ef6b602","TL-d05ba3641b72","TL-acde938eb848","TL-fd57920efaf7","TL-011591a42dd0","TL-f19c330ab5dd","TL-93cae41c9248","TL-ffb90f82ea67","TL-e133e8f74491","TL-2c5b33ff8558","TL-159c865b095c","TL-f3bde1d8d49f","TL-55732a0f65a8","TL-0c770e347b36","TL-369891143868","TL-7e68fa105180","TL-d067abf0fcf3","TL-6ce259dabf9d"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-d88062febb16","TL-4d72d8d89f61"]}}]},"refs":{"id":"unit:module.dependencies.module.catalog_rds.aws_rds_cluster.this","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/32","ids":["unit:module.dependencies.module.catalog_rds.aws_rds_cluster.this"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/32"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_mariadb_credential.dependencies_catalog_rds_this","target:stackit_mariadb_instance.dependencies_catalog_rds_this"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 2 open decisions, 0 manual actions","open_decisions":[{"id":"convert:module.dependencies.module.catalog_rds.aws_rds_cluster.this:data:DATA_MOVEMENT","reasons":["the plan defines the one method the STACKIT MariaDB pages document, a dump loaded with the mysql client into the empty instance, and the customer's own tool; the replication of the binary log is refused because no STACKIT page documents it; STACKIT has no managed MySQL, so a MySQL source is an engine change whose collations, DEFINER accounts, accounts and settings the checks of the plan name, and the size of the data, the downtime the business accepts and the consistency the application needs are not in the source; the steps wait for the answer"],"required_by_phase":"BEFORE_PILOT","question":"Choose how the data of module.dependencies.module.catalog_rds.aws_rds_cluster.this moves from aws_rds_cluster to STACKIT MariaDB (stackit_mariadb_instance.dependencies_catalog_rds_this): a dump loaded with the mysql client inside the write freeze, or a tool of your own","subjects":["module.dependencies.module.catalog_rds.aws_rds_cluster.this","stackit_mariadb_instance.dependencies_catalog_rds_this"]},{"id":"convert:module.dependencies.module.catalog_rds.aws_rds_cluster.this:exposure:EXPOSURE_WIDENED","reasons":["the exposure of the source module.dependencies.module.catalog_rds.aws_rds_cluster.this is not readable (it states no publicly_accessible setting, or one that a variable without a value or a default decides), so the source is not proven publicly accessible and the draft does not take it as public; the STACKIT instance has its own IPv4 endpoint outside the project network, limited by its access list, which is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods) by default, so the exposure is a decision and not a preserved property"],"required_by_phase":"BEFORE_PILOT","question":"Accept a public endpoint for stackit_mariadb_instance.dependencies_catalog_rds_this, limited only by its client list, where the exposure of the source module.dependencies.module.catalog_rds.aws_rds_cluster.this is not readable, or redesign it: stackit_mariadb_instance has no private-network option in the pinned provider","subjects":["module.dependencies.module.catalog_rds.aws_rds_cluster.this","stackit_mariadb_instance.dependencies_catalog_rds_this"],"default":{"option":"accept-the-public-endpoint","words":"StackToIT carried out the option accept-the-public-endpoint for stackit_mariadb_instance.dependencies_catalog_rds_this by default: the MariaDB instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.catalog_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_catalog_rds_this_allowed_cidrs, or answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default.","answered_by":"DEFAULT"}}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"open_decisions":2,"manual_actions":0,"register":{"open":7,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-EXPOSURE-WIDENED"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-DATA-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS"]}],"next_step":{"record":"DEC-GEN-CONVERT-DATA-MOVEMENT","source":"PLAN_DECISION","text":"Decide \"data movement\" (DEC-GEN-CONVERT-DATA-MOVEMENT): the plan of the draft leaves it open"},"blocks_automation":true}},"target_prices":[{"resource":"stackit_mariadb_instance.dependencies_catalog_rds_this","resource_type":"stackit_mariadb_instance","component":"plan","state":"NOT_ASSESSED","reason_code":"KEY_NOT_IN_DRAFT","reason":"NOT_ASSESSED: the draft does not choose the plan (plan_name is var.dependencies_catalog_rds_this_plan_name): no SKU is named"}]},{"address":"module.dependencies.module.catalog_rds.aws_security_group.this","type":"aws_security_group","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.dependencies.module.catalog_rds","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","resources":[],"regions":[],"catalogue":{"state":"NOT_APPLICABLE","capabilities":[],"unmatched_resources":[]}},"blocker_count":2,"finding_count":4,"evidence_count":3,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":3,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.dependencies.module.catalog_rds.aws_security_group.this is an AWS security group, declared in .terraform/modules/dependencies.catalog_rds/main.tf (lines 321-334). It is part of module.dependencies.module.catalog_rds. It states 1 rule.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/25","id":"module.dependencies.module.catalog_rds.aws_security_group.this"},"expert":{"id_refs":["TL-a8f0a4cb1f58","TL-6d6d224d0414","TL-c6c4a8483f3c","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"OPEN","summary_id":"TT-6c7a4aac6c88","lines":["ingress tcp port 3306 from a security group that is not resolved"],"artefact":{"kind":"SOURCE_FILE","file":".terraform/modules/dependencies.catalog_rds/main.tf","pointer":"lines 321-334"},"expert":{"id_refs":["TL-1b6bb75769f1","TL-607176ccc586"]}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-55e837a80499","line_ids":["TL-2ef5e9032fe9","TL-122d52c83478","TL-1815e9268bea"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.dependencies.module.catalog_rds.aws_security_group.this"},"expert":{"id_refs":["TL-f4bdc86495d2","TL-bef3cf429ba6","TL-c5281bb6f1f0","TL-46ec0bd8733b","TL-0ff5a208ce3d"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-87d27e00854a","line_ids":["TL-3545a21a7bd6","TL-b801052d81ab","TL-29e91686883f"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/25","id":"module.dependencies.module.catalog_rds.aws_security_group.this"},"expert":{"id_refs":["TL-98aa55dee3f2","TL-750b3fbf1f7f","TL-9f4a4663060f","TL-93afdda91a72","TL-6c9eed03f527","TL-625cb7eb6db1","TL-7afdbfe6f6fb","TL-8551a479a85d"]}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-f47803034718","line_ids":["TL-ccaeb41a7e67","TL-f6e48092b146"],"artefact":{"kind":"IN_MEMORY","id":"security:module.dependencies.module.catalog_rds.aws_security_group.this"},"expert":{"id_refs":["TL-a0b6743aac67","TL-cc90c346c091"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3921a774bd0d","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3"],"artefact":{"kind":"IN_MEMORY","id":"network.security-group"},"expert":{"id_refs":["TL-dbe97d4df687","TL-00a58746651a","TL-71db89378ca6","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-ffa2d19dc7f9","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-d45160aea2ac","TL-899fd28c3b9c"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary_id":"TT-6a07761f0aee","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-f2eb19ea1d78","TL-d477c31ae16d","TL-5ce834a2bf21","TL-5260e0ef58bd","TL-e4d60c1731c8"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-5bd4122ee9c6","line_ids":["TL-535f19d6d071"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-ccda799a3b8d"]}}]},"refs":{"id":"unit:module.dependencies.module.catalog_rds.aws_security_group.this","family":"AWS_SECURITY_GROUP","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/25","ids":["unit:module.dependencies.module.catalog_rds.aws_security_group.this"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/25"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:security:module.dependencies.module.catalog_rds.aws_security_group.this"]},{"hop":"plan","state":"NONE","kind":"REPORT_FILE","file":"target-plan.json","reason":"NOT_DRAFTED"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NOT_DRAFTED"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:final-artifact@module.dependencies.module.catalog_rds.aws_security_group.this","check:plan-valid@module.dependencies.module.catalog_rds.aws_security_group.this","check:renders@module.dependencies.module.catalog_rds.aws_security_group.this","check:round-trip@module.dependencies.module.catalog_rds.aws_security_group.this","check:rule-has-one-remote@module.dependencies.module.catalog_rds.aws_security_group.this"]}],"targets":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":6,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS"]}],"next_step":{"record":"DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.dependencies.module.catalog_rds.aws_security_group.this (DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu","type":"aws_cloudwatch_metric_alarm","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.dependencies.module.checkout_elasticache_redis","switched_off":{"by":"count = 0","candidate_class":"RECONFIGURE","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT Observability alert rules","resources":["stackit_observability_instance","stackit_observability_alertgroup"],"maturity":"ga","lifecycle":"active","regions":["eu01"],"catalogue":{"state":"MATCHED","capabilities":["observability.metrics-and-alerting"],"unmatched_resources":[]}},"blocker_count":1,"finding_count":1,"evidence_count":1,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/49","ids":["unit:module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory","type":"aws_cloudwatch_metric_alarm","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.dependencies.module.checkout_elasticache_redis","switched_off":{"by":"count = 0","candidate_class":"RECONFIGURE","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT Observability alert rules","resources":["stackit_observability_instance","stackit_observability_alertgroup"],"maturity":"ga","lifecycle":"active","regions":["eu01"],"catalogue":{"state":"MATCHED","capabilities":["observability.metrics-and-alerting"],"unmatched_resources":[]}},"blocker_count":1,"finding_count":1,"evidence_count":1,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/50","ids":["unit:module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","type":"aws_elasticache_replication_group","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.dependencies.module.checkout_elasticache_redis","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT Key Value Store (Valkey)","resources":["stackit_valkey_instance","stackit_valkey_credential"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"catalogue":{"state":"MATCHED","capabilities":["data.valkey-instance"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":5,"evidence_count":3,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":4,"properties_not_carried":10,"not_carried":[{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","property":"data_tiering_enabled","source":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf:115"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","property":"maintenance_window","source":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf:115"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","property":"notification_topic_arn","source":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf:115"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","property":"num_cache_clusters","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"availability-durability","reason":"NOT CARRIED (module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default): num_cache_clusters = 1 — the plan (plan_name) defines the nodes and replicas of a STACKIT Valkey instance (pinned provider).","semantic":"failover-off","contract":"aws.elasticache","source":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf:115"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","property":"parameter_group_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"availability-durability","reason":"NOT CARRIED (module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default): parameter_group_name — the parameter group is not translated: stackit_valkey_instance takes selected settings under parameters (maxmemory_policy, maxclients, notify_keyspace_events, …; pinned provider) — map the ones the application needs.","semantic":"parameter-group","contract":"aws.elasticache","source":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf:115"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","property":"port","source":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf:115"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","property":"security_group_ids","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default): subnet_group_name, security_group_ids — stackit_valkey_instance has no subnet, security-group, zone or IP-family attribute (pinned provider); the draft limits access with parameters.sgw_acl (CIDRs) from a variable without a default — list the clients.","semantic":"network-placement","contract":"aws.elasticache","source":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf:115"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","property":"snapshot_arns","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"backup-retention","reason":"NOT CARRIED (module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default): snapshot_arns — the instance is created empty: seeding it from an ElastiCache snapshot is not generated — migrate the data (e.g. RDB export and import, or replication).","semantic":"seed-snapshot","contract":"aws.elasticache","source":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf:115"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","property":"snapshot_window","source":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf:115"},{"node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","property":"subnet_group_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default): subnet_group_name, security_group_ids — stackit_valkey_instance has no subnet, security-group, zone or IP-family attribute (pinned provider); the draft limits access with parameters.sgw_acl (CIDRs) from a variable without a default — list the clients.","semantic":"network-placement","contract":"aws.elasticache","source":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf:115"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is a resource of the source, declared in .terraform/modules/dependencies.checkout_elasticache_redis/main.tf (lines 115-164). It is part of module.dependencies.module.checkout_elasticache_redis. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-b42f61333e6b"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/33","id":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default"},"expert":{"id_refs":["TL-999d2147fc39","TL-e07bdfe1d608","TL-9f77adebca24","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-548c946b5195","TL-8c4262af1202","TL-cc8921b42e42","TL-cd5358aba689","TL-e6d83acc492f","TL-9283d89e8cd4","TL-c639a00c46d7","TL-95c682104778","TL-df25ff4f04ac"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-d3eb105c9b5c","TL-a1347beabd08","TL-8931c2124903","TL-5b8978a2eec7","TL-6b313e133238","TL-3d2c7216b0dd"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-dcac5ec2521c","line_ids":["TL-9b340e19f00f","TL-2d12b413e08a","TL-2504dbf62e2c"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/33","id":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default"},"expert":{"id_refs":["TL-e1a7e1889f79","TL-97d60707e486","TL-7ac65d727937","TL-1004ae21f674","TL-d2f2ffe993f5","TL-e4fdae196847","TL-874b3a844f62","TL-71e86be88451","TL-1a29763879fc","TL-8a193578cd87","TL-de5037a6961b","TL-27824026467c"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-b1df1f96e3e1","TL-cad6310f071e"],"artefact":{"kind":"REPORT_FILE","file":"terraform/data.tf","id":"stackit_valkey_credential.dependencies_checkout_elasticache_redis_default"},"expert":{"id_refs":["TL-4f605cd7bcb3","TL-8bb3f12f6950","TL-e9660e7873c5","TL-6dc2d0c95747","TL-917c58adbbbf","TL-e1a889878673"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-34a576f1b514","line_ids":["TL-ab2664af5ba0","TL-cc6179d848f5","TL-3344b6e287d5","TL-1303b65c357c","TL-249e79742d0a","TL-a373afa47bdd","TL-c5d5b7d8dd53","TL-108e5cc2dfb2","TL-5d4b69294c34","TL-6e53ac82df81","TL-046334aeb37b","TL-2617e179fc00"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-d88062febb16","TL-cd4b1f2bacd5","TL-4d72d8d89f61"]}}]},"refs":{"id":"unit:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/33","ids":["unit:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/33"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_valkey_credential.dependencies_checkout_elasticache_redis_default","target:stackit_valkey_instance.dependencies_checkout_elasticache_redis_default"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 3 open decisions, 0 manual actions","open_decisions":[{"id":"convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:data:DATA_MOVEMENT","reasons":["the plan defines the one method the STACKIT pages and the ElastiCache pages allow together, a copy of the keys by a client (SCAN, DUMP, PTTL, RESTORE) inside the write freeze, and the customer's own tool; loading an exported snapshot is refused because no STACKIT page or API takes an RDB file, and following the source as a replica is refused because neither end offers it; the source does not say whether the cache holds only what the application rebuilds, the size of the data, the downtime the business accepts or the shards the keys are spread over, and the Key Value Store has no sharding; the steps wait for the answer"],"required_by_phase":"BEFORE_PILOT","question":"Choose how the keys of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default move from aws_elasticache_replication_group to STACKIT Key Value Store (stackit_valkey_instance.dependencies_checkout_elasticache_redis_default): the keys copied by a client inside the write freeze, or a tool of your own","subjects":["module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","stackit_valkey_instance.dependencies_checkout_elasticache_redis_default"]},{"id":"convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:dependencies_checkout_elasticache_redis_default_plan_name:SIZE_FROM_SOURCE","reasons":["the target sizes by a plan of the catalogue, and the source states a size in the terms of its own offer; the draft proposes the smallest plan that covers it, which leaves out what the source does not state (the disk of a plan, the sustained load, the headroom of a pool), so the value is a proposal and the price of the draft moves with it; unit of the memory figure: the plan table gives its RAM as \"GB\" and does not say whether a GB is 10^9 or 2^30 bytes, so the plan is chosen to hold the source's memory when a GB is 10^9 bytes, which it then also does when a GB is 2^30 bytes (it is never smaller than the source whichever way the table is read)"],"required_by_phase":"BEFORE_PILOT","question":"Confirm the plan the draft derived for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default from the size the source states: option use-the-size-derived-from-the-source (stackit-keyvalue-1.4.10-single, in var.dependencies_checkout_elasticache_redis_default_plan_name) or option choose-the-size (a plan you set in var.dependencies_checkout_elasticache_redis_default_plan_name)","subjects":["module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","stackit_valkey_instance.dependencies_checkout_elasticache_redis_default"],"default":{"option":"use-the-size-derived-from-the-source","words":"StackToIT carried out the option use-the-size-derived-from-the-source for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default by default: var.dependencies_checkout_elasticache_redis_default_plan_name defaults to stackit-keyvalue-1.4.10-single (node type cache.t3.micro has 2 vCPU and 0.5 GiB (AWS price list, cache_node_sizes.json), and the source is a single node: the smallest single-node Key Value Store plan of the eu01 catalogue (2026-10-18) that holds 0.5 GiB (0.5369 GB at 10^9 bytes per GB) of memory (the plan table gives its RAM as \"GB\" and does not say whether a GB is 10^9 or 2^30 bytes, so the plan is chosen to hold the source's memory when a GB is 10^9 bytes, which it then also does when a GB is 2^30 bytes (it is never smaller than the source whichever way the table is read)): 1 vCPU / 4 GB RAM / 10 GB disk per node; the disk is not a figure of the source, so the smallest disk of that size is taken and the disk is open). To change it, answer this decision in decisions.yaml with choose-the-size (and set the plan in the variable), or reject the proposal: the next run then writes the variable without a default.","answered_by":"DEFAULT"}},{"id":"convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:exposure:EXPOSURE_WIDENED","reasons":["the source module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is private (Amazon ElastiCache has no public endpoint: the cache is reached from inside its VPC through its subnet group) and the STACKIT Valkey instance has its own endpoint outside the project network, limited only by parameters.sgw_acl; a list the plan does not give is replaced by STACKIT's default ACL, which admits every STACKIT customer's addresses (the draft's variable has no default and rejects an empty list, so the list is yours); the endpoint is wider than the source's and the difference is an accepted change in exposure, not a preserved property"],"required_by_phase":"BEFORE_PILOT","question":"Accept a public Valkey endpoint for stackit_valkey_instance.dependencies_checkout_elasticache_redis_default, limited only by its client list (parameters.sgw_acl), where the source module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is private, or redesign it: stackit_valkey_instance has no private-network option in the pinned provider (its access is parameters.sgw_acl only)","subjects":["module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","stackit_valkey_instance.dependencies_checkout_elasticache_redis_default"],"default":{"option":"accept-the-public-endpoint","words":"StackToIT carried out the option accept-the-public-endpoint for stackit_valkey_instance.dependencies_checkout_elasticache_redis_default by default: the Valkey instance keeps its own public STACKIT endpoint, and only the CIDRs of var.dependencies_checkout_elasticache_redis_default_allowed_cidrs may connect; the clients of the source could not be mapped to addresses, no CIDR is invented, so the variable has no default and the step waits for the networks you list. The draft writes no default list of the clients' addresses: the rule module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed[\"in#in#sg#0\"] is no plain allow of a complete list of clients. Name the networks the clients connect from. To change it, answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default.","answered_by":"DEFAULT"}}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"open_decisions":3,"manual_actions":0,"register":{"open":7,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-EXPOSURE-WIDENED","DEC-GEN-CONVERT-SIZE-FROM-SOURCE"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-DATA-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374","DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374","DEC-OPS-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374","DEC-SEC-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374"]}],"next_step":{"record":"DEC-GEN-CONVERT-DATA-MOVEMENT","source":"PLAN_DECISION","text":"Decide \"data movement\" (DEC-GEN-CONVERT-DATA-MOVEMENT): the plan of the draft leaves it open"},"blocks_automation":true}},"target_prices":[{"resource":"stackit_valkey_instance.dependencies_checkout_elasticache_redis_default","resource_type":"stackit_valkey_instance","component":"plan","join_key":"plan_name = \"stackit-keyvalue-1.4.10-single\" (DEFAULT: priced on the draft's default \"stackit-keyvalue-1.4.10-single\" of var.dependencies_checkout_elasticache_redis_default_plan_name (draft variables.tf:71); no answer or standing policy of the run chose it; decision DEC-GEN-CONVERT-SIZE-FROM-SOURCE is open: nobody confirmed the default, so another value changes the price)","state":"PRICED","sku_id":"ST-0226701","sku_name":"KeyValue-1.4.10-Single-EU01","unit_price":"0.09995833333","unit":"Hours","unit_billing":"per hour","region":"eu01","metro":false,"valid_start":"2026-10-08T07:45:21Z"}]},{"address":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","type":"aws_security_group","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","resources":[],"regions":[],"catalogue":{"state":"NOT_APPLICABLE","capabilities":[],"unmatched_resources":[]}},"blocker_count":2,"finding_count":3,"evidence_count":3,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":3,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd is an AWS security group, declared in .terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group/main.tf (lines 81-139). It is part of module.dependencies.module.checkout_elasticache_redis.module.aws_security_group. It states 2 rules.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/26","id":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd"},"expert":{"id_refs":["TL-a8f0a4cb1f58","TL-6d6d224d0414","TL-c6c4a8483f3c","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"OPEN","summary_id":"TT-48bf2e2fcef2","line_ids":["TL-08a95b3f5942","TL-f9607b378898"],"artefact":{"kind":"SOURCE_FILE","file":".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group/main.tf","pointer":"lines 81-139"},"expert":{"id_refs":["TL-1b6bb75769f1","TL-ef35caeece4a","TL-d37fef6eaafe"]}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-307504e27a6c","line_ids":["TL-9935a1d0524d","TL-603ba3262d9b","TL-2a20977a9a0c"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd"},"expert":{"id_refs":["TL-f4bdc86495d2","TL-b041cdc5ee67","TL-46ec0bd8733b","TL-6dd055a909f4"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-6bc754902840","line_ids":["TL-3545a21a7bd6","TL-98eaf60ea4d2","TL-ec727dee66a7","TL-0df924a96f5b"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/26","id":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd"},"expert":{"id_refs":["TL-750b3fbf1f7f","TL-e879ced2a842","TL-9f4a4663060f","TL-93afdda91a72","TL-56a0803735a9","TL-732e4f980183","TL-6c9eed03f527","TL-625cb7eb6db1","TL-7afdbfe6f6fb","TL-8551a479a85d"]}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-cffaa762f020","line_ids":["TL-284959e4857a","TL-2db900f2149c"],"artefact":{"kind":"IN_MEMORY","id":"security:module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd"},"expert":{"id_refs":["TL-a0b6743aac67","TL-cc90c346c091"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3921a774bd0d","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3"],"artefact":{"kind":"IN_MEMORY","id":"network.security-group"},"expert":{"id_refs":["TL-dbe97d4df687","TL-00a58746651a","TL-71db89378ca6","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-ffa2d19dc7f9","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-9d3a7bf5fd7e","TL-899fd28c3b9c"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary_id":"TT-6a07761f0aee","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-f2eb19ea1d78","TL-d477c31ae16d","TL-5ce834a2bf21","TL-5260e0ef58bd","TL-e4d60c1731c8"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-5bd4122ee9c6","line_ids":["TL-3262cdcd6533"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-5810ce5eec15"]}}]},"refs":{"id":"unit:module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","family":"AWS_SECURITY_GROUP","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/26","ids":["unit:module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/26"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:security:module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd"]},{"hop":"plan","state":"NONE","kind":"REPORT_FILE","file":"target-plan.json","reason":"NOT_DRAFTED"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NOT_DRAFTED"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:final-artifact@module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","check:plan-valid@module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","check:renders@module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","check:round-trip@module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","check:rule-has-one-remote@module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd"]}],"targets":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":6,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0"]}],"next_step":{"record":"DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd (DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default","type":"aws_security_group","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group","switched_off":{"by":"count = 0","candidate_class":"RECONFIGURE","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.security-group"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":3,"automation_eligible":null,"wave":0,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default is an AWS security group, declared in .terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group/main.tf (lines 24-79). It is switched off in the source. It is part of module.dependencies.module.checkout_elasticache_redis.module.aws_security_group. It states 0 rules.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/51","id":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default"},"expert":{"id_refs":["TL-a8f0a4cb1f58","TL-6d6d224d0414","TL-c6c4a8483f3c","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary":"The source states no rule for this unit.","artefact":{"kind":"SOURCE_FILE","file":".terraform/modules/dependencies.checkout_elasticache_redis.aws_security_group/main.tf","pointer":"lines 24-79"},"expert":{"id_refs":["TL-1b6bb75769f1"]}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-28cf18b349f1","line_ids":["TL-f526766584fc"],"artefact":{"kind":"IN_MEMORY","id":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default"},"expert":{"id_refs":["TL-94c59a08ef5d","TL-ed10391cb980"]}},{"stage":"SEMANTIC_CLAIM","state":"NONE","summary_id":"TT-09e44fcd9ff2","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"INTENT","state":"ESTABLISHED","summary_id":"TT-722f9eb3a9f2","line_ids":["TL-13c01e85b33e","TL-b432c72310fd"],"artefact":{"kind":"IN_MEMORY","id":"security:module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default"},"expert":{"id_refs":["TL-a0b6743aac67","TL-cc90c346c091"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3921a774bd0d","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3"],"artefact":{"kind":"IN_MEMORY","id":"network.security-group"},"expert":{"id_refs":["TL-dbe97d4df687","TL-00a58746651a","TL-71db89378ca6","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-ffa2d19dc7f9","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-d1a104cfbb3e","TL-899fd28c3b9c"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary":"The draft writes nothing for this unit, so nothing was checked.","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default","family":"AWS_SECURITY_GROUP","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/51","ids":["unit:module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default"]},{"hop":"claims","state":"NONE","kind":"IN_MEMORY","reason":"NO_CLAIM_FOR_THE_UNIT"},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":0,"accepted":0}}},{"address":"module.dependencies.module.checkout_elasticache_redis.module.dns.aws_route53_record.default","type":"aws_route53_record","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.dependencies.module.checkout_elasticache_redis.module.dns","switched_off":{"by":"count = 0","candidate_class":"RECONFIGURE","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT DNS record set","resources":["stackit_dns_record_set"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED","capabilities":[],"unmatched_resources":["stackit_dns_record_set"],"unlinked_resources":["stackit_dns_record_set"]}},"blocker_count":2,"finding_count":2,"evidence_count":3,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.dependencies.module.checkout_elasticache_redis.module.dns.aws_route53_record.default","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/52","ids":["unit:module.dependencies.module.checkout_elasticache_redis.module.dns.aws_route53_record.default"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","type":"aws_dynamodb_table","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.dependencies.module.dynamodb_carts","switched_off":{"by":"count = 0","candidate_class":"REDESIGN","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","resources":["stackit_mongodbflex_instance"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"catalogue":{"state":"MATCHED","capabilities":["database.mongodb-flex"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":2,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/53","ids":["unit:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore","type":"aws_dynamodb_table","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.dependencies.module.dynamodb_carts","switched_off":{"by":"count = 0","candidate_class":"REDESIGN","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","resources":["stackit_mongodbflex_instance"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"catalogue":{"state":"MATCHED","capabilities":["database.mongodb-flex"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":2,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/54","ids":["unit:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","type":"aws_dynamodb_table","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.dependencies.module.dynamodb_carts","class":"REDESIGN","confidence":"MEDIUM","target_fit":{"service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","resources":["stackit_mongodbflex_instance"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"catalogue":{"state":"MATCHED","capabilities":["database.mongodb-flex"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":1,"properties_not_carried":2,"not_carried":[{"node":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","property":"billing_mode","source":".terraform/modules/dependencies.dynamodb_carts/main.tf:1"},{"node":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","property":"global_secondary_index.projection_type","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"data-semantics","reason":"TABLE module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (.terraform/modules/dependencies.dynamodb_carts/main.tf:1) → collection \"retail-store-ecs-carts\": key id → _id (or a unique index on id); GSI idx_global_customerId {customerId: 1} → secondary index (strongly consistent in MongoDB; the projection is not needed); GSI projections and capacities → NOT CARRIED (a MongoDB index finds whole documents; capacity is flavor sizing); billing mode PAY_PER_REQUEST → NOT CARRIED (flavor sizing).","semantic":"index-projection-and-name","contract":"aws.dynamodb_table","source":".terraform/modules/dependencies.dynamodb_carts/main.tf:1"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this is a resource of the source, declared in .terraform/modules/dependencies.dynamodb_carts/main.tf (lines 1-86). It is part of module.dependencies.module.dynamodb_carts. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/0","id":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this"},"expert":{"id_refs":["TL-d04ec02d07c2","TL-c5b8f167a62a","TL-c822f81761f0","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-1b44204222d7","TL-3b851e958629","TL-4791bf500eb0","TL-4b81265cdce8","TL-4c095a1e26f5"],"artefact":{"kind":"IN_MEMORY"},"expert":{"ids":["recorded: finding: source-provider-unpinned","recorded: trace: TR-a2c77bb1d7ef"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-980cbdfba22b","line_ids":["TL-3545a21a7bd6","TL-b801052d81ab","TL-6785e7e25823"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/0","id":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this"},"expert":{"id_refs":["TL-cf39a3da1ee6","TL-e578adf43042","TL-7c60a5045337","TL-cbaa7222643b","TL-c1a96aaec49b","TL-ec4d2aafd6c8","TL-38b853b52b93","TL-5210aff621a2"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-d130b98cad63","line_ids":["TL-30386d54dd5c"],"artefact":{"kind":"REPORT_FILE","file":"terraform/data.tf","id":"stackit_mongodbflex_instance.dynamodb_tables"},"expert":{"id_refs":["TL-ed3f5cf2ae49","TL-31639eeaae74","TL-f9f867eabdfb"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-959c48ef01bf","line_ids":["TL-e5f0797d55fa","TL-5d4b69294c34","TL-384370564772"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-d88062febb16"]}}]},"refs":{"id":"unit:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/0","ids":["unit:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/0"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_mongodbflex_instance.dynamodb_tables"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 1 open decisions, 0 manual actions","open_decisions":[{"id":"convert:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this:data:DATA_MOVEMENT","reasons":["StackToIT moves no data and writes no runbook for aws_dynamodb_table to STACKIT MongoDB Flex; the data-movement register lists module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with the mechanism UNKNOWN, and the source states neither the size of the data nor the downtime the business tolerates nor the consistency the application needs"],"required_by_phase":"BEFORE_PILOT","question":"Choose how the data of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this moves from aws_dynamodb_table to STACKIT MongoDB Flex (stackit_mongodbflex_instance.dynamodb_tables): the method, the downtime it needs and the check that the copy is complete","subjects":["module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","stackit_mongodbflex_instance.dynamodb_tables"]}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"open_decisions":1,"manual_actions":0,"register":{"open":4,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-DATA-MOVEMENT"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-DATA-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE","DEC-OPS-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE","DEC-SEC-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE"]}],"next_step":{"record":"DEC-GEN-CONVERT-DATA-MOVEMENT","source":"PLAN_DECISION","text":"Decide \"data movement\" (DEC-GEN-CONVERT-DATA-MOVEMENT): the plan of the draft leaves it open"},"blocks_automation":true}},"target_prices":[{"resource":"stackit_mongodbflex_instance.dynamodb_tables","resource_type":"stackit_mongodbflex_instance","component":"flavor","state":"NOT_ASSESSED","reason_code":"KEY_NOT_IN_DRAFT","reason":"NOT_ASSESSED: the draft does not choose the flavor (flavor is flavor.cpu = var.dynamodb_tables_cpu, flavor.ram = var.dynamodb_tables_ram): no SKU is named"}]},{"address":"module.dependencies.module.orders_rds.aws_cloudwatch_log_group.this","type":"aws_cloudwatch_log_group","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.dependencies.module.orders_rds","switched_off":{"by":"for_each = 0","candidate_class":"RECONFIGURE","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT Logs","resources":["stackit_logs_instance","stackit_logs_access_token"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["observability.logs"],"unmatched_resources":[]}},"blocker_count":1,"finding_count":1,"evidence_count":6,"automation_eligible":null,"wave":0,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.dependencies.module.orders_rds.aws_cloudwatch_log_group.this is a log group (a named store of log events with a retention of its own), declared in .terraform/modules/dependencies.orders_rds/main.tf (lines 445-453). It is switched off in the source. It is part of module.dependencies.module.orders_rds. This trace follows the logs of the unit: where they go on STACKIT and for how long they are kept.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/55","id":"module.dependencies.module.orders_rds.aws_cloudwatch_log_group.this"},"expert":{"id_refs":["TL-cecbc297c624","TL-660fdbc25888","TL-7aaad50961f3","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"OPEN","summary_id":"TT-661d402aa522","lines":["The source states a retention that is stated"],"artefact":{"kind":"SOURCE_FILE","file":".terraform/modules/dependencies.orders_rds/main.tf","pointer":"lines 445-453"},"expert":{"ids":["retention key: retention_in_days"]}},{"stage":"RESOLUTION_PROOF","state":"NONE","summary_id":"TT-63fa53d1e665","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"SEMANTIC_CLAIM","state":"NONE","summary_id":"TT-09e44fcd9ff2","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-078f3d301edb","line_ids":["TL-73d3e111d3c3","TL-4c9765f744f7","TL-89bd5732af76"],"artefact":{"kind":"IN_MEMORY","id":"logs:module.dependencies.module.orders_rds.aws_cloudwatch_log_group.this"},"expert":{"id_refs":["TL-ec3e7a0847fa","TL-fc84ee1d9bf2"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-41d8d4e38188","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-60d467065f78","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4"],"artefact":{"kind":"IN_MEMORY","id":"observability.logs"},"expert":{"ids":["capability: observability.logs","provider version: 0.121.0"]}},{"stage":"TRANSFORMATION","state":"ESTABLISHED","summary_id":"TT-c093d281e9b6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-a05a641fdcc9","TL-d821bd14334d"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary":"The draft writes nothing for this unit, so nothing was checked.","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.dependencies.module.orders_rds.aws_cloudwatch_log_group.this","family":"LOG_SOURCE","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/55","ids":["unit:module.dependencies.module.orders_rds.aws_cloudwatch_log_group.this"]},{"hop":"claims","state":"NONE","kind":"IN_MEMORY","reason":"NO_CLAIM_FOR_THE_UNIT"},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":0,"accepted":0}}},{"address":"module.dependencies.module.orders_rds.aws_iam_role.rds_enhanced_monitoring","type":"aws_iam_role","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.dependencies.module.orders_rds","switched_off":{"by":"count = 0","candidate_class":"MANUAL_REVIEW","candidate_confidence":"LOW"},"target_fit":null,"blocker_count":1,"finding_count":2,"evidence_count":2,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.dependencies.module.orders_rds.aws_iam_role.rds_enhanced_monitoring","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/56","ids":["unit:module.dependencies.module.orders_rds.aws_iam_role.rds_enhanced_monitoring"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.dependencies.module.orders_rds.aws_rds_cluster.this","type":"aws_rds_cluster","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.dependencies.module.orders_rds","class":"REPLATFORM","confidence":"MEDIUM","target_fit":{"service":"STACKIT PostgreSQL Flex","resources":["stackit_postgresflex_instance"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"catalogue":{"state":"MATCHED","capabilities":["database.postgresql-flex"],"unmatched_resources":[]}},"blocker_count":3,"finding_count":3,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":4,"properties_not_carried":12,"not_carried":[{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","property":"allow_major_version_upgrade","source":".terraform/modules/dependencies.orders_rds/main.tf:61"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","property":"db_cluster_parameter_group_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"encryption","reason":"NOT CARRIED (module.dependencies.module.orders_rds.aws_rds_cluster.this): preferred_maintenance_window = sun:05:00-sun:06:00, allow_major_version_upgrade = false, db_cluster_parameter_group_name — stackit_postgresflex_instance has no maintenance window, version-upgrade policy, extended-support, CA-certificate, option-group or parameter-group attribute (pinned provider).","semantic":"parameter-and-option-groups","contract":"aws.rds_cluster","source":".terraform/modules/dependencies.orders_rds/main.tf:61"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","property":"db_subnet_group_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.dependencies.module.orders_rds.aws_rds_cluster.this): db_subnet_group_name — stackit_postgresflex_instance has no subnet, availability-zone or IP-family attribute (pinned provider): clients reach the instance at the endpoint STACKIT assigns.","semantic":"db-network-placement","contract":"aws.rds_cluster","source":".terraform/modules/dependencies.orders_rds/main.tf:61"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","property":"master_password","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"secret-handling","reason":"NOT CARRIED (module.dependencies.module.orders_rds.aws_rds_cluster.this): master_password — the source password is not copied: stackit_postgresflex_user has no password input, STACKIT generates it (the password is computed and sensitive, pinned provider) — hand the new one to the application.","semantic":"admin-password","contract":"aws.rds_cluster","source":".terraform/modules/dependencies.orders_rds/main.tf:61"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","property":"port","source":".terraform/modules/dependencies.orders_rds/main.tf:61"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","property":"preferred_maintenance_window","source":".terraform/modules/dependencies.orders_rds/main.tf:61"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","property":"skip_final_snapshot","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"backup-retention","reason":"NOT CARRIED (module.dependencies.module.orders_rds.aws_rds_cluster.this): skip_final_snapshot = true — stackit_postgresflex_instance has no final-snapshot or delete-time backup-retention setting (pinned provider): the instance is deleted immediately (and its automated backups may be removed immediately) when Terraform destroys the resource — export the data first if it must survive the cut-over.","semantic":"final-snapshot","contract":"aws.rds_cluster","source":".terraform/modules/dependencies.orders_rds/main.tf:61"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","property":"db_parameter_group_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"encryption","reason":"NOT CARRIED (module.dependencies.module.orders_rds.aws_rds_cluster_instance.this): identifier = (reads a variable; its default is not printed), db_subnet_group_name, preferred_maintenance_window = sun:05:00-sun:06:00, db_parameter_group_name — cluster members are not separate STACKIT resources — the flavor (flavor_id: single or replica) defines the nodes (pinned provider): member names, failover priority, zone, subnet, windows, upgrade policy, parameter group, CA certificate and instance profile have no attribute.","semantic":"member-settings","contract":"aws.rds_cluster","source":".terraform/modules/dependencies.orders_rds/main.tf:175"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","property":"db_subnet_group_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.dependencies.module.orders_rds.aws_rds_cluster_instance.this): identifier = (reads a variable; its default is not printed), db_subnet_group_name, preferred_maintenance_window = sun:05:00-sun:06:00, db_parameter_group_name — cluster members are not separate STACKIT resources — the flavor (flavor_id: single or replica) defines the nodes (pinned provider): member names, failover priority, zone, subnet, windows, upgrade policy, parameter group, CA certificate and instance profile have no attribute.","semantic":"member-settings","contract":"aws.rds_cluster","source":".terraform/modules/dependencies.orders_rds/main.tf:175"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","property":"identifier","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"workload-compatibility","reason":"NOT CARRIED (module.dependencies.module.orders_rds.aws_rds_cluster_instance.this): identifier = (reads a variable; its default is not printed), db_subnet_group_name, preferred_maintenance_window = sun:05:00-sun:06:00, db_parameter_group_name — cluster members are not separate STACKIT resources — the flavor (flavor_id: single or replica) defines the nodes (pinned provider): member names, failover priority, zone, subnet, windows, upgrade policy, parameter group, CA certificate and instance profile have no attribute.","semantic":"tcf-rds-cluster-instance--identifier","contract":"aws.rds_cluster","source":".terraform/modules/dependencies.orders_rds/main.tf:175"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","property":"monitoring_role_arn","source":".terraform/modules/dependencies.orders_rds/main.tf:175"},{"node":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","property":"preferred_maintenance_window","source":".terraform/modules/dependencies.orders_rds/main.tf:175"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.dependencies.module.orders_rds.aws_rds_cluster.this is a resource of the source, declared in .terraform/modules/dependencies.orders_rds/main.tf (lines 61-169). It is part of module.dependencies.module.orders_rds. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-2ac9d38cc968"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/34","id":"module.dependencies.module.orders_rds.aws_rds_cluster.this"},"expert":{"id_refs":["TL-f8e1ea4a0f12","TL-db1bbaf0a0a0","TL-6c237fed88b6","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-f43e935c11f7","TL-f84257ef3652","TL-b657e20901a7","TL-4aac3bbd8bdb","TL-323a6cb4d367","TL-c96f77c86adc","TL-9dbb5f8333d6","TL-bb7b14f411f4","TL-fe449536e3d2"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-cc460a90eb96","TL-8931c2124903","TL-a5a67e3efe48","TL-3a5fc23a9688","TL-984149b7cd63","TL-d06bbf0a703a"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-d8ff8e19cb07","line_ids":["TL-feaba4f52477","TL-9b340e19f00f","TL-424117e74f30","TL-fad2122c85a9","TL-f1ec41938106","TL-750de73feffd"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/34","id":"module.dependencies.module.orders_rds.aws_rds_cluster.this"},"expert":{"id_refs":["TL-540fb0b16884","TL-1d5e56205390","TL-2a90f2ff934e","TL-b96566e5b3e4","TL-58d8a240f554","TL-1deb9236882e","TL-e2cba8df4bae","TL-995a8b5caea3","TL-1d2b82676a42","TL-4971b66d604a","TL-4db86159d497","TL-bb960af062d5","TL-a5fc3b814f37","TL-d8cd2b6539da","TL-da8ab18e216a","TL-7f2b7ddbdb25","TL-af0b67ca104d","TL-0ac4a51e0129","TL-1cc52a87c19f","TL-7a8994db68f8","TL-85f323530bb2","TL-9c15f6843395","TL-2cbc6b8897fa","TL-49c8926884db","TL-15f8c4da915a"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-29cd92e9c29b","line_ids":["TL-d23fd6528266","TL-9090ba3ec94f","TL-9a779b7a6b36"],"artefact":{"kind":"REPORT_FILE","file":"terraform/data.tf","id":"stackit_postgresflex_database.dependencies_orders_rds_this_orders"},"expert":{"id_refs":["TL-e9cf89058493","TL-967595b1a760","TL-5a936243c67f","TL-e01daf44bce1","TL-0ad44400508d","TL-4ddd30e71d2e","TL-22f04b52372e","TL-c22fc28b70ad","TL-5eff18d636d5"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-4d77dff3b0a8","line_ids":["TL-5d2aede31605","TL-ff9188d1ca14","TL-72253f1e960c","TL-cb90fe7d6716","TL-de87e1e59bed","TL-74483ed6528c","TL-62aebdbc63f9","TL-f86bdbb3af47","TL-4f0b4857b0ce","TL-5d4b69294c34","TL-2617e179fc00"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-d88062febb16","TL-f104f4612c00","TL-4d72d8d89f61"]}}]},"refs":{"id":"unit:module.dependencies.module.orders_rds.aws_rds_cluster.this","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/34","ids":["unit:module.dependencies.module.orders_rds.aws_rds_cluster.this"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/34"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_postgresflex_database.dependencies_orders_rds_this_orders","target:stackit_postgresflex_instance.dependencies_orders_rds_this","target:stackit_postgresflex_user.dependencies_orders_rds_this"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 3 open decisions, 0 manual actions","open_decisions":[{"id":"convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:data:DATA_MOVEMENT","reasons":["the plan defines both methods of the engine (a dump restored inside the write freeze, and a logical replication that follows the changes until the freeze) and keeps them open: which one applies depends on the size of the data, the write rate and the downtime the business accepts, and the source states none of them; the steps of the methods wait for the answer"],"required_by_phase":"BEFORE_PILOT","question":"Choose how the data of module.dependencies.module.orders_rds.aws_rds_cluster.this moves from aws_rds_cluster to PostgreSQL Flex (stackit_postgresflex_instance.dependencies_orders_rds_this): a dump restored inside the write freeze, the engine's logical replication, or a tool of your own","subjects":["module.dependencies.module.orders_rds.aws_rds_cluster.this","stackit_postgresflex_instance.dependencies_orders_rds_this"]},{"id":"convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:dependencies_orders_rds_this_flavor_id:SIZE_FROM_SOURCE","reasons":["the target sizes by a flavor of the catalogue, and the source states a size in the terms of its own offer; the draft proposes the smallest flavor that covers it, which leaves out what the source does not state (the disk of a plan, the sustained load, the headroom of a pool), so the value is a proposal and the price of the draft moves with it; unit of the memory figure: PostgreSQL Flex states the memory of a flavor in Gibibyte (API v3 spec, flavor.memory), the unit of the source's size, so no unit is assumed"],"required_by_phase":"BEFORE_PILOT","question":"Confirm the flavor the draft derived for module.dependencies.module.orders_rds.aws_rds_cluster.this from the size the source states: option use-the-size-derived-from-the-source (2.4, as flavor_id) or option choose-the-size (a flavor you set in var.dependencies_orders_rds_this_flavor_id)","subjects":["module.dependencies.module.orders_rds.aws_rds_cluster.this","stackit_postgresflex_instance.dependencies_orders_rds_this"],"default":{"option":"use-the-size-derived-from-the-source","words":"StackToIT carried out the option use-the-size-derived-from-the-source for module.dependencies.module.orders_rds.aws_rds_cluster.this by default: flavor_id = 2.4 (module.dependencies.module.orders_rds.aws_rds_cluster.this (source class db.t3.medium) has 2 vCPU and 4 GiB (AWS price list); 2.4 is the smallest single-node PostgreSQL Flex flavor of the eu01 catalogue (2026-10-18) that covers it: 2 vCPU / 4 GiB). To change it, answer this decision in decisions.yaml with choose-the-size (and set the flavor in the variable), or reject the proposal: the next run then writes flavor_id as var.dependencies_orders_rds_this_flavor_id without a default.","answered_by":"DEFAULT"}},{"id":"convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:exposure:EXPOSURE_WIDENED","reasons":["the exposure of the source module.dependencies.module.orders_rds.aws_rds_cluster.this is not readable (it states no publicly_accessible setting, or one that a variable without a value or a default decides), so the source is not proven publicly accessible and the draft does not take it as public; the STACKIT instance has its own IPv4 endpoint outside the project network, limited by its access list, which is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods) by default, so the exposure is a decision and not a preserved property"],"required_by_phase":"BEFORE_PILOT","question":"Accept a public endpoint for stackit_postgresflex_instance.dependencies_orders_rds_this, limited only by its client list, where the exposure of the source module.dependencies.module.orders_rds.aws_rds_cluster.this is not readable, or choose the network-area-only scope SNA (network.access_scope = SNA; a private preview, permitted for enabled accounts only)","subjects":["module.dependencies.module.orders_rds.aws_rds_cluster.this","stackit_postgresflex_instance.dependencies_orders_rds_this"],"default":{"option":"accept-the-public-endpoint","words":"StackToIT carried out the option accept-the-public-endpoint for stackit_postgresflex_instance.dependencies_orders_rds_this by default: the PostgreSQL Flex instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.orders_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_orders_rds_this_allowed_cidrs, or answer this decision in decisions.yaml with use-the-network-area-only-scope or redesign-the-endpoint (or reject the proposal): the next run then writes no default.","answered_by":"DEFAULT"}}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"open_decisions":3,"manual_actions":0,"register":{"open":8,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-EXPOSURE-WIDENED","DEC-GEN-CONVERT-SIZE-FROM-SOURCE"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-DATA-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","DEC-IAM-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","DEC-OPS-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","DEC-SEC-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS"]}],"next_step":{"record":"DEC-GEN-CONVERT-DATA-MOVEMENT","source":"PLAN_DECISION","text":"Decide \"data movement\" (DEC-GEN-CONVERT-DATA-MOVEMENT): the plan of the draft leaves it open"},"blocks_automation":true}},"target_prices":[{"resource":"stackit_postgresflex_instance.dependencies_orders_rds_this","resource_type":"stackit_postgresflex_instance","component":"flavor","join_key":"flavor_id = \"2.4\"","state":"PRICED","sku_id":"ST-0025701","sku_name":"PostgreSQL-Flex-2.4-Single-EU01","unit_price":"0.12598444444","unit":"Hours","unit_billing":"per hour","region":"eu01","metro":false,"valid_start":"2026-10-08T07:44:29Z"}]},{"address":"module.dependencies.module.orders_rds.aws_security_group.this","type":"aws_security_group","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.dependencies.module.orders_rds","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","resources":[],"regions":[],"catalogue":{"state":"NOT_APPLICABLE","capabilities":[],"unmatched_resources":[]}},"blocker_count":2,"finding_count":4,"evidence_count":3,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":3,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.dependencies.module.orders_rds.aws_security_group.this is an AWS security group, declared in .terraform/modules/dependencies.orders_rds/main.tf (lines 321-334). It is part of module.dependencies.module.orders_rds. It states 1 rule.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/27","id":"module.dependencies.module.orders_rds.aws_security_group.this"},"expert":{"id_refs":["TL-a8f0a4cb1f58","TL-6d6d224d0414","TL-c6c4a8483f3c","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"OPEN","summary_id":"TT-6c7a4aac6c88","lines":["ingress tcp port 5432 from a security group that is not resolved"],"artefact":{"kind":"SOURCE_FILE","file":".terraform/modules/dependencies.orders_rds/main.tf","pointer":"lines 321-334"},"expert":{"id_refs":["TL-1b6bb75769f1","TL-a1780a7183ce"]}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-55e837a80499","line_ids":["TL-2ef5e9032fe9","TL-3320850cf578","TL-94607050289f"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.dependencies.module.orders_rds.aws_security_group.this"},"expert":{"id_refs":["TL-f4bdc86495d2","TL-f9fcf89a4351","TL-3d976e9314c0","TL-46ec0bd8733b","TL-d3e99ffd8edd"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-87d27e00854a","line_ids":["TL-3545a21a7bd6","TL-b801052d81ab","TL-29e91686883f"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/27","id":"module.dependencies.module.orders_rds.aws_security_group.this"},"expert":{"id_refs":["TL-98aa55dee3f2","TL-750b3fbf1f7f","TL-9f4a4663060f","TL-93afdda91a72","TL-6c9eed03f527","TL-625cb7eb6db1","TL-7afdbfe6f6fb","TL-8551a479a85d"]}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-f47803034718","line_ids":["TL-ccaeb41a7e67","TL-f6e48092b146"],"artefact":{"kind":"IN_MEMORY","id":"security:module.dependencies.module.orders_rds.aws_security_group.this"},"expert":{"id_refs":["TL-a0b6743aac67","TL-cc90c346c091"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3921a774bd0d","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3"],"artefact":{"kind":"IN_MEMORY","id":"network.security-group"},"expert":{"id_refs":["TL-dbe97d4df687","TL-00a58746651a","TL-71db89378ca6","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-ffa2d19dc7f9","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-d77a925325c6","TL-899fd28c3b9c"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary_id":"TT-6a07761f0aee","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-f2eb19ea1d78","TL-d477c31ae16d","TL-5ce834a2bf21","TL-5260e0ef58bd","TL-e4d60c1731c8"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-5bd4122ee9c6","line_ids":["TL-535f19d6d071"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-4a40dba056a8"]}}]},"refs":{"id":"unit:module.dependencies.module.orders_rds.aws_security_group.this","family":"AWS_SECURITY_GROUP","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/27","ids":["unit:module.dependencies.module.orders_rds.aws_security_group.this"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/27"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:security:module.dependencies.module.orders_rds.aws_security_group.this"]},{"hop":"plan","state":"NONE","kind":"REPORT_FILE","file":"target-plan.json","reason":"NOT_DRAFTED"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NOT_DRAFTED"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:final-artifact@module.dependencies.module.orders_rds.aws_security_group.this","check:plan-valid@module.dependencies.module.orders_rds.aws_security_group.this","check:renders@module.dependencies.module.orders_rds.aws_security_group.this","check:round-trip@module.dependencies.module.orders_rds.aws_security_group.this","check:rule-has-one-remote@module.dependencies.module.orders_rds.aws_security_group.this"]}],"targets":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":6,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS"]}],"next_step":{"record":"DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.dependencies.module.orders_rds.aws_security_group.this (DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events","type":"aws_cloudwatch_event_rule","presence":"CONDITIONAL","in_totals":false,"module_call":"module.retail_app_ecs","conditional_state":"DISABLED_ON_DEFAULTS_BUT_OVERRIDABLE","class":"REDESIGN","confidence":"MEDIUM","target_fit":{"service":"none managed — application events over RabbitMQ","resources":[],"regions":[],"catalogue":{"state":"NOT_APPLICABLE","capabilities":[],"unmatched_resources":[]}},"blocker_count":2,"finding_count":1,"evidence_count":1,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/57","ids":["unit:module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events"]},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NO_DRAFT_BLOCK"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights","type":"aws_cloudwatch_log_group","presence":"CONDITIONAL","in_totals":false,"module_call":"module.retail_app_ecs","conditional_state":"DISABLED_ON_DEFAULTS_BUT_OVERRIDABLE","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT Logs","resources":["stackit_logs_instance","stackit_logs_access_token"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["observability.logs"],"unmatched_resources":[]}},"blocker_count":1,"finding_count":1,"evidence_count":6,"automation_eligible":null,"wave":0,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights is a log group (a named store of log events with a retention of its own), declared in ../../lib/ecs/eventbridge.tf (lines 8-16). Whether it exists is decided only when OpenTofu plans. It is part of module.retail_app_ecs. This trace follows the logs of the unit: where they go on STACKIT and for how long they are kept.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/58","id":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights"},"expert":{"id_refs":["TL-cecbc297c624","TL-660fdbc25888","TL-7aaad50961f3","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"OPEN","summary_id":"TT-4acac22c263b","line_ids":["TL-bbaa2374b7cf","TL-053254794d54","TL-85acb00d97b2","TL-d87f8408f0bf","TL-1dadc674b680","TL-1dadc674b680","TL-4d67b041df06"],"artefact":{"kind":"SOURCE_FILE","file":"../../lib/ecs/eventbridge.tf","pointer":"lines 8-16"},"expert":{"id_refs":["TL-0e431aae8253","TL-77390cf041b0","TL-33b2fef377dc","TL-e34d811b9bc3","TL-e709e41174b6","TL-b7dad88686a5","TL-d2eba4e4303f"]}},{"stage":"RESOLUTION_PROOF","state":"NONE","summary_id":"TT-63fa53d1e665","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"SEMANTIC_CLAIM","state":"NONE","summary_id":"TT-09e44fcd9ff2","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-078f3d301edb","line_ids":["TL-73d3e111d3c3","TL-9a51869d142b","TL-8e95ac518439"],"artefact":{"kind":"IN_MEMORY","id":"logs:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights"},"expert":{"id_refs":["TL-ec3e7a0847fa","TL-fc84ee1d9bf2"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-41d8d4e38188","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-60d467065f78","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4"],"artefact":{"kind":"IN_MEMORY","id":"observability.logs"},"expert":{"ids":["capability: observability.logs","provider version: 0.121.0"]}},{"stage":"TRANSFORMATION","state":"ESTABLISHED","summary_id":"TT-c093d281e9b6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-a05a641fdcc9","TL-d821bd14334d"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary":"The draft writes nothing for this unit, so nothing was checked.","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights","family":"LOG_SOURCE","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/58","ids":["unit:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights"]},{"hop":"claims","state":"NONE","kind":"IN_MEMORY","reason":"NO_CLAIM_FOR_THE_UNIT"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:logs:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights"]},{"hop":"plan","state":"NONE","kind":"REPORT_FILE","file":"target-plan.json","reason":"NOT_DRAFTED"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NOT_DRAFTED"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"NO_CHECK_FOR_THE_UNIT"}],"targets":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":0,"accepted":0}}},{"address":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","type":"aws_cloudwatch_log_group","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT Logs","resources":["stackit_logs_instance","stackit_logs_access_token"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["observability.logs"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":1,"evidence_count":6,"automation_eligible":false,"automation_ceiling":"ANSWERABLE","wave":1,"properties_not_carried":1,"not_carried":[{"node":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","property":"name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"workload-compatibility","reason":"plan: stackit_logs_instance.logs_retention_180d name of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks MANUAL_ACTION (stackitlogs:label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks)","semantic":"tc-name","contract":"aws.cloudwatch_log_group","source":"../../lib/ecs/cluster.tf:10"}],"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks is a log group (a named store of log events with a retention of its own), declared in ../../lib/ecs/cluster.tf (lines 10-12). It is part of module.retail_app_ecs. This trace follows the logs of the unit: where they go on STACKIT and for how long they are kept.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/1","id":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},"expert":{"id_refs":["TL-cecbc297c624","TL-660fdbc25888","TL-7aaad50961f3","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"OPEN","summary_id":"TT-fa16fbf56fab","line_ids":["TL-244a2016199c","TL-1dadc674b680"],"artefact":{"kind":"SOURCE_FILE","file":"../../lib/ecs/cluster.tf","pointer":"lines 10-12"},"expert":{"id_refs":["TL-0e431aae8253","TL-e709e41174b6"]}},{"stage":"RESOLUTION_PROOF","state":"NONE","summary_id":"TT-63fa53d1e665","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-1f41049665ca","lines":["1 left to a person to review","32 further statements that the source does not make (nothing to carry)"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/1","id":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},"expert":{"ids":["claim: tc-name = KNOWN, CRITICAL, REVIEW"]}},{"stage":"INTENT","state":"ESTABLISHED","summary_id":"TT-078f3d301edb","line_ids":["TL-73d3e111d3c3","TL-fae6d5a39721"],"artefact":{"kind":"IN_MEMORY","id":"logs:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},"expert":{"ids":["intent family: OBSERVABILITY","intent: logs:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-41d8d4e38188","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-60d467065f78","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-4cd2b58fcf4d","TL-4f8a4e291b3e","TL-19e2cf13ec7d"],"artefact":{"kind":"IN_MEMORY","id":"observability.logs"},"expert":{"id_refs":["TL-279a6ed89982","TL-1ade7c863b11","TL-3126679bc953","TL-9f447c7bf066","TL-43529225d4b4","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-a174ac90c814","line_ids":["TL-13504f3fe56a","TL-b0f34bc79dbc","TL-69a6a9d3838d"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans","id":"stackit_logs_instance.logs_retention_180d"},"expert":{"id_refs":["TL-68dd9e2d2f02","TL-a4029f22afff","TL-74a5f8d035ee","TL-bc04cf6aecbc","TL-c5b62e23bf42","TL-6ac0fec5b9de","TL-43dcb95461e2","TL-d821bd14334d","TL-2945a65f89ac"]}},{"stage":"RENDER","state":"ESTABLISHED","summary":"The draft writes 1 resource of this unit as active Terraform.","line_ids":["TL-7016884ea3b7"],"artefact":{"kind":"REPORT_FILE","file":"terraform/observability.tf"},"expert":{"id_refs":["TL-739be2ecda06","TL-e85816503b5e","TL-1ebe631ffe4a"]}},{"stage":"VALIDATION","state":"OPEN","summary_id":"TT-2eed2fdcdabc","line_ids":["TL-b965e925fff4","TL-7338c48d6ad3","TL-c2c0aacc31d3","TL-47e9bb2358c5","TL-39d75a5bd17b","TL-4d7f6def36b6"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-3d7fb343c06c","TL-f03ddce8b025","TL-d477c31ae16d","TL-5ce834a2bf21","TL-aff113a40e67","TL-3c9305418af2"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-bb60e90a49bc","line_ids":["TL-e5aee84c7c11","TL-107d8f9fc953"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-1886eb40d6a0","TL-7f5b55933a44"]}}]},"refs":{"id":"unit:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","family":"LOG_SOURCE","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/1","ids":["unit:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/1"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:logs:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"]},{"hop":"plan","state":"OPEN","kind":"REPORT_FILE","file":"target-plan.json"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:final-artifact@module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","check:instance-complete@module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","check:plan-valid@module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","check:renders@module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","check:round-trip@module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"]}],"targets":["target:stackit_logs_instance.logs_retention_180d"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 1 open decisions, 3 manual actions","open_decisions":[{"id":"stackitlogs:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks:retention_over_180_days","reasons":["the source keeps its logs for ever and a STACKIT Logs instance keeps at most 180 days, so the instance drafted for it (stackit_logs_instance.logs_retention_180d) holds only the last 180 days; logs older than that exist only if a person configures an archive beside it. Choose the archive if the workload needs them; reject it if the requirement is that more than 180 days stay inside STACKIT Logs with no external archive, which STACKIT Logs alone cannot meet"],"required_by_phase":"CUTOVER_PREREQUISITE","question":"Decide whether the logs of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks older than 180 days are kept in an archive outside the Logs instance","subjects":["module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"]}],"manual_actions":[{"id":"stackitlogs:archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","kind":"ARCHIVE_FLOW","phase":"CUTOVER_PREREQUISITE","what":"Configure a cold-storage log flow for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: send a copy of its logs, in parallel to the Logs instance stackit_logs_instance.logs_retention_180d, to a long-term store (for example a separate Object Storage bucket) that keeps them for the retention beyond 180 days","why":"the source keeps its logs for ever and a STACKIT Logs instance keeps at most 180 days (retention beyond 180 days is not supported by the managed service): the first 180 days are kept in the Logs instance, and the longer retention is an archive outside it, which STACKIT recommends as a cold-storage approach (a stream of the log data to a low-cost long-term store in parallel to Logs). The plan creates no archive store, configures no stream and sets no retention of the archive. The step exists only when the decision about the logs beyond 180 days chooses the archive; where the requirement is more than 180 days inside STACKIT Logs with no external archive, the archive is rejected and the migration cannot meet that requirement with STACKIT Logs alone","path":"archive-longer-retention-elsewhere"},{"id":"stackitlogs:label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","kind":"LABEL_CONVENTION","phase":"CUTOVER_PREREQUISITE","what":"Choose a static label and send the name of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (and of its streams) from its log producers as the value of that label","why":"STACKIT Logs has no log group or stream object that can hold a name, only labels the shipper sends (no-log-group-or-stream-object); the plan chooses no label key and reconfigures no producer"},{"id":"stackitlogs:token:stackit_logs_instance.logs_retention_180d","kind":"TARGET_PRECONDITION","phase":"CUTOVER_PREREQUISITE","what":"Before any log source writes to stackit_logs_instance.logs_retention_180d: create a write access token for the instance (stackit_logs_access_token with the permission write), set the access control list of the instance, and point the shipper at the instance's ingest_url (Loki API) or ingest_otlp_url (OpenTelemetry)","why":"the plan generates no access token: the token is a credential written to the state, its lifetime (unset, it never expires) and its permissions are choices the source does not state, and one token belongs to one instance; what an instance with no ACL entry allows is not established, so the plan sets no ACL and states no default"}]},"workload_readiness":{"applies":true,"dimensions":[{"id":"bootstrap_configuration","state":"NOT_APPLICABLE"},{"id":"source_artifacts","state":"NOT_APPLICABLE"},{"id":"target_preconditions","state":"READY_WITH_ACTIONS","derived_from":["workspace.json#/units/26/deployment_prerequisites/manual_actions/2"],"items":["action:stackitlogs:token:stackit_logs_instance.logs_retention_180d"]},{"id":"cutover","state":"READY_WITH_ACTIONS","derived_from":["workspace.json#/units/26/deployment_prerequisites/manual_actions/0","workspace.json#/units/26/deployment_prerequisites/manual_actions/1","workspace.json#/units/26/deployment_prerequisites/manual_actions/2"],"items":["action:stackitlogs:archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","action:stackitlogs:label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","action:stackitlogs:token:stackit_logs_instance.logs_retention_180d"]},{"id":"day2_operations","state":"NOT_APPLICABLE"}]},"coverage":"TRACED","open_work":{"open_steps":5,"open_decisions":1,"manual_actions":3,"register":{"open":5,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-CLOUDWATCH-LOG-GROUP-ECS-TASKS"]},{"source":"MANUAL_ACTION","open_records":["DEC-OPS-STACKITLOGS-ACTION-ARCHIVE-FLOW","DEC-OPS-STACKITLOGS-ACTION-LABEL-CONVENTION","DEC-OPS-STACKITLOGS-ACTION-TARGET-PRECONDITION"]}],"next_step":{"record":"DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS","source":"PLAN_DECISION","text":"Decide \"retention_over_180_days\" (DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS): the plan of the draft leaves it open"},"blocks_automation":true}},"target_prices":[{"resource":"stackit_logs_instance.logs_retention_180d","resource_type":"stackit_logs_instance","component":"log ingestion","state":"PRICED","sku_id":"ST-0171601","sku_name":"Logs-ingestion-EU01","unit_price":"1.2","unit":"Gigabyte Ingestion","unit_billing":"per GB ingest","region":"eu01","metro":false,"valid_start":"2026-10-08T07:45:12Z"}]},{"address":"module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs","type":"aws_cloudwatch_log_resource_policy","presence":"CONDITIONAL","in_totals":false,"module_call":"module.retail_app_ecs","conditional_state":"DISABLED_ON_DEFAULTS_BUT_OVERRIDABLE","class":"RECONFIGURE","confidence":"LOW","target_fit":{"service":"STACKIT Logs access tokens","resources":["stackit_logs_access_token"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["observability.logs"],"unmatched_resources":[]}},"blocker_count":1,"finding_count":1,"evidence_count":2,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/59","ids":["unit:module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs"]},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NO_DRAFT_BLOCK"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.retail_app_ecs.aws_ecs_cluster.cluster","type":"aws_ecs_cluster","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs","class":"REPLATFORM","confidence":"MEDIUM","target_fit":{"service":"STACKIT Kubernetes Engine (SKE)","resources":["stackit_ske_cluster"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"lifecycle_effects":{"state":"GA","state_reason":"the pinned provider schema has no beta, experimental or deprecated notice on the target's resources","sets":[{"capability":"compute.managed-kubernetes","subject_kind":"kubernetes_minor_version","title":"SKE Kubernetes versions","as_of":"2026-10-08","recheck_after":"2027-01-06","expiring_window_days":30,"production_suitability":"SUITABLE","day2":{"forced_update_by":"PROVIDER","forced_update_statement":"\"If the Kubernetes or OS version of a cluster has reached its expiration date, SKE starts a mandatory update to the highest available patch version of the current minor version, or to the highest patch version of the consecutive minor version that is not classified as preview version.\" and \"mandatory version updates run, even if the auto update for the Kubernetes version is deactivated\". Automatic updates otherwise \"only update to higher patch levels\" in the cluster's maintenance window.","notice":"\"As a SKE user you will get informed via release notes and via email in case you are operating a cluster with a deprecated Kubernetes version.\"","customer_action":"\"you can check the exact expiration dates for your current Kubernetes and node pool versions in the cluster.status.expiration field via the SKE API\". The page does not assign any further duty (workload readiness for the update, testing) to the customer or to STACKIT: not stated."},"versions":[{"subject":"1.36","state":"SUPPORTED","disputed":false,"released_at":{"date":"2026-08-27","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"production_suitability":"SUITABLE","upgrade_action":"NONE_PUBLISHED","migration_timing_risk":"UNKNOWN","note":"No expiry or EOL for 1.36 is stated in the pages read; the lifecycle table does not list it. An unpublished end is reported as such, not as safe."},{"subject":"1.35","state":"UNKNOWN","disputed":false,"expires_at":{"date":"2027-02-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"UNKNOWN","upgrade_action":"UNKNOWN","migration_timing_risk":"UNKNOWN","note":"The pages read give no release date for 1.35 (no release-note entry), so the state stays UNKNOWN: a future expiry date does not say that a version is offered. The 1.34 deprecation entry names 1.35 as the upgrade target."},{"subject":"1.34","state":"EXPIRING","disputed":false,"released_at":{"date":"2025-12-16","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-08-28","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-10-14","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"UPGRADE_BEFORE_EXPIRY","migration_timing_risk":"HIGH","note":"Clusters still on 1.34 are upgraded to 1.35 by the mandatory update (release note of 2026-08-28); the day it runs inside the maintenance window is not stated, so no forced-update date is recorded."},{"subject":"1.33","state":"EXPIRED","disputed":true,"released_at":{"date":"2025-07-29","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-06-09","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-06-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08","dissent":[{"date":"2026-07-08","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"}]},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"The expiry day differs between the lifecycle page (2026-06-10) and the release note (2026-07-08); the state is EXPIRED under either."},{"subject":"1.32","state":"EXPIRED","disputed":false,"deprecated_at":{"date":"2026-02-20","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-04-15","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"No release date for 1.32 appears in the pages read."}],"sources":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/operations/version-updates/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"]}]},"catalogue":{"state":"MATCHED","capabilities":["compute.managed-kubernetes"],"unmatched_resources":[]}},"blocker_count":1,"finding_count":1,"evidence_count":1,"automation_eligible":false,"automation_ceiling":"ANSWERABLE","wave":1,"properties_not_carried":2,"not_carried":[{"node":"module.retail_app_ecs.aws_ecs_cluster.cluster","property":"setting.name","source":"../../lib/ecs/cluster.tf:1"},{"node":"module.retail_app_ecs.aws_ecs_cluster.cluster","property":"setting.value","source":"../../lib/ecs/cluster.tf:1"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.aws_ecs_cluster.cluster is a resource of the source, declared in ../../lib/ecs/cluster.tf (lines 1-8). It is part of module.retail_app_ecs. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-219dad209a84"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/2","id":"module.retail_app_ecs.aws_ecs_cluster.cluster"},"expert":{"id_refs":["TL-eb6e69766287","TL-8b7cc812905b","TL-95f73fae754f","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"NONE","summary_id":"TT-48469437839e","artefact":{"kind":"IN_MEMORY"},"expert":{"ids":["recorded: trace: TR-364b2c550bbd"]}},{"stage":"SEMANTIC_CLAIM","state":"NONE","summary_id":"TT-906c4459ecba","lines":["122 further statements that the source does not make (nothing to carry)"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/2","id":"module.retail_app_ecs.aws_ecs_cluster.cluster"},"expert":{}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-d130b98cad63","line_ids":["TL-ef1c3ea92106"],"artefact":{"kind":"REPORT_FILE","file":"terraform/kubernetes.tf","id":"stackit_ske_cluster.retail_app_ecs_cluster"},"expert":{"id_refs":["TL-aa88ca128b42","TL-490515fe3ba2","TL-1bc7bbad61e6"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-16134c43658f","line_ids":["TL-30dd0797cd2d","TL-f9bd06a906cf","TL-d07896f591f6"],"artefact":{"kind":"IN_MEMORY"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.aws_ecs_cluster.cluster","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/2","ids":["unit:module.retail_app_ecs.aws_ecs_cluster.cluster"]},{"hop":"claims","state":"NONE","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/2","reason":"NO_CLAIM_FOR_THE_UNIT"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_ske_cluster.retail_app_ecs_cluster"]},"workload_readiness":{"applies":true,"dimensions":[{"id":"bootstrap_configuration","state":"NOT_ASSESSED"},{"id":"source_artifacts","state":"NOT_ASSESSED"},{"id":"target_preconditions","state":"NOT_ASSESSED"},{"id":"cutover","state":"NOT_ASSESSED"},{"id":"day2_operations","state":"NOT_ASSESSED"}]},"coverage":"TRACED","open_work":{"open_steps":1,"register":{"open":0,"accepted":0,"blocks_automation":true}},"target_prices":[{"resource":"stackit_ske_cluster.retail_app_ecs_cluster","resource_type":"stackit_ske_cluster","component":"cluster hour","state":"PRICED","sku_id":"ST-0010701","sku_name":"Kubernetes Engine-Cluster Management-EU01","unit_price":"0.09959511998","unit":"Hours","unit_billing":"per cluster/hour","region":"eu01","metro":false,"valid_start":"2026-10-08T07:44:19Z","shared_with":["module.retail_app_ecs.module.carts_service.aws_ecs_service.this","module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","module.retail_app_ecs.module.orders_service.aws_ecs_service.this","module.retail_app_ecs.module.ui_service.aws_ecs_service.this"]}]},{"address":"module.retail_app_ecs.aws_kms_key.cmk","type":"aws_kms_key","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT KMS","resources":["stackit_kms_keyring","stackit_kms_key"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["security.kms"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"ANSWERABLE","wave":1,"properties_not_carried":1,"not_carried":[{"node":"module.retail_app_ecs.aws_kms_key.cmk","property":"deletion_window_in_days","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"deletion-protection","reason":"NOT CARRIED (module.retail_app_ecs.aws_kms_key.cmk): deletion_window_in_days = 7 — STACKIT KMS deletes a key scheduled for deletion after 30 days; stackit_kms_key has no deletion window (pinned provider).","semantic":"deletion-window","contract":"aws.kms_key","source":"../../lib/ecs/common.tf:1"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.aws_kms_key.cmk is a resource of the source, declared in ../../lib/ecs/common.tf (lines 1-4). It is part of module.retail_app_ecs. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","lines":["from module.retail_app_ecs.aws_kms_key.cmk (../../lib/ecs/common.tf:1) — RECONFIGURE / MEDIUM"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/3","id":"module.retail_app_ecs.aws_kms_key.cmk"},"expert":{"id_refs":["TL-02f88fa4c485","TL-a9bc98856cd2","TL-1dc42e8e4189","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-9753196a8780","TL-b42fc8fe3628","TL-13e6d7686b1e","TL-b3decd31fd30"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-8931c2124903","TL-a8bb64db774c","TL-59a5d301688c","TL-490106a05b5a"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-a3b301ee2f73","lines":["1 left to a person to review","47 further statements that the source does not make (nothing to carry)"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/3","id":"module.retail_app_ecs.aws_kms_key.cmk"},"expert":{"ids":["claim: deletion-window = KNOWN, CRITICAL, REVIEW"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-c80e8619ea1f","TL-54df3111b41c"],"artefact":{"kind":"REPORT_FILE","file":"terraform/security.tf","id":"stackit_kms_key.retail_app_ecs_cmk"},"expert":{"id_refs":["TL-c34289edf7b8","TL-34980800dffa","TL-627a42ab209e","TL-c5c32314dcb2","TL-6141a0c90f07","TL-bfa981755ba3"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-16c262c1abf7","line_ids":["TL-a06d1105d447","TL-5d4b69294c34"],"artefact":{"kind":"IN_MEMORY"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.aws_kms_key.cmk","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/3","ids":["unit:module.retail_app_ecs.aws_kms_key.cmk"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/3"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_kms_key.retail_app_ecs_cmk","target:stackit_kms_keyring.migrated"]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-MODULE-RETAIL-APP-ECS-AWS-KMS-KEY-CMK"]}],"next_step":{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-AWS-KMS-KEY-CMK","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.retail_app_ecs.aws_kms_key.cmk (DEC-IAM-MODULE-RETAIL-APP-ECS-AWS-KMS-KEY-CMK): decide each or accept the difference"},"blocks_automation":true}},"target_prices":[{"resource":"stackit_kms_key.retail_app_ecs_cmk","resource_type":"stackit_kms_key","component":"key protection","state":"NOT_ASSESSED","reason_code":"KEY_NOT_IN_DRAFT","reason":"NOT_ASSESSED: the draft does not choose the key protection (protection is var.kms_protection): no SKU is named"}]},{"address":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","type":"aws_secretsmanager_secret","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT Secrets Manager","resources":["stackit_secretsmanager_instance","stackit_secretsmanager_user"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["security.secrets-manager"],"unmatched_resources":[]}},"blocker_count":3,"finding_count":2,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"ANSWERABLE","wave":5,"properties_not_carried":3,"not_carried":[{"node":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","property":"kms_key_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"encryption","reason":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret.catalog_db): kms_key_id — the source encrypts with a customer-managed key that the draft does not set on the Secrets Manager instance: the instance also holds module.retail_app_ecs.aws_secretsmanager_secret.mq, which states no customer-managed key (the default key encrypts it), and it would be encrypted with the key too. The instance takes one STACKIT KMS key for all its secret values (kms_key); set it once the keys of the sources are decided.","semantic":"customer-managed-key","contract":"aws.secretsmanager_secret","source":"../../lib/ecs/catalog.tf:65"},{"node":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","property":"name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"workload-compatibility","reason":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret.catalog_db): name — the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource.","semantic":"tc-secretsmanager-secret-name","contract":"aws.secretsmanager_secret","source":"../../lib/ecs/catalog.tf:65"},{"node":"module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db","property":"secret_string","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"secret-handling","reason":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db): secret_id, secret_string — a setting of module.retail_app_ecs.aws_secretsmanager_secret.catalog_db: the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource.","semantic":"secret-value","contract":"aws.secretsmanager_secret","source":"../../lib/ecs/catalog.tf:70"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db is a resource of the source, declared in ../../lib/ecs/catalog.tf (lines 65-68). It is part of module.retail_app_ecs. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/35","id":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db"},"expert":{"id_refs":["TL-5ceb916b409a","TL-98fa11e400a6","TL-ba9a92878482","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"NONE","summary_id":"TT-48469437839e","artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-8931c2124903","TL-0e0c31cd1ecb","TL-ea3f5ee8f3ba"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-0a8ebf90122f","lines":["3 left to a person to review","31 further statements that the source does not make (nothing to carry)"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/35","id":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db"},"expert":{"id_refs":["TL-58553fed50a0","TL-a291587bece7","TL-9bc15de8e8dc"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-6c72c30b6fa0","TL-b85bc2536920"],"artefact":{"kind":"REPORT_FILE","file":"terraform/security.tf","id":"stackit_secretsmanager_instance.migrated_secrets"},"expert":{"id_refs":["TL-f35035518166","TL-00a39791a5cf","TL-bab29f416c71","TL-0efaf456d064","TL-4ee006bab9e2","TL-309a55930b10"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-f02f3db4ed00","line_ids":["TL-03ccb0b69489","TL-d9f0a41cd244","TL-8868ae99392b","TL-5d4b69294c34","TL-384370564772"],"artefact":{"kind":"IN_MEMORY"},"expert":{"ids":["decision: convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN"]}}]},"refs":{"id":"unit:module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/35","ids":["unit:module.retail_app_ecs.aws_secretsmanager_secret.catalog_db"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/35"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_secretsmanager_instance.migrated_secrets","target:stackit_secretsmanager_user.migration"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 1 open decisions, 0 manual actions","open_decisions":[{"id":"convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN","reasons":["the Secrets Manager Vault-compatible API is of a maturity that is not established (its documentation states no release status and its product documentation does not establish it as generally available): the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db wait for this decision; the draft's own blocks do not"],"required_by_phase":"BEFORE_PILOT","question":"Allow calls of the Secrets Manager Vault-compatible API, whose maturity is not established, for this migration (the API may change or vanish)? Accept: the calls of the Secrets Manager Vault-compatible API (WriteSecret) are carried out for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db. Refuse: no call is made, a refusal selects no other path (the draft holds no other carrier of what the calls set), and what they set stays open for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db.","subjects":["module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","module.retail_app_ecs.aws_secretsmanager_secret.mq","module.retail_app_ecs.aws_secretsmanager_secret.orders_db"]}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"open_decisions":1,"manual_actions":0,"register":{"open":3,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-API-OPT-IN"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB","DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB"]}],"next_step":{"record":"DEC-GEN-CONVERT-API-OPT-IN","source":"PLAN_DECISION","text":"Decide \"api opt in\" (DEC-GEN-CONVERT-API-OPT-IN): the plan of the draft leaves it open"},"blocks_automation":true}},"target_prices":[{"resource":"stackit_secretsmanager_instance.migrated_secrets","resource_type":"stackit_secretsmanager_instance","component":"secret version tier","state":"NOT_ASSESSED","reason_code":"AMBIGUOUS_JOIN","reason":"NOT_ASSESSED: 5 public SKUs match the Secrets Manager version hour (Secrets Manager-100-EU01, Secrets Manager-100k-EU01, Secrets Manager-10k-EU01, Secrets Manager-1M-EU01, Secrets Manager-1k-EU01): none is picked; the tier is read as the number of secret versions of the instance, which the draft does not state, and which the price list (1.0.44, page Security) and the documentation of the service (FAQ, 2026-11-02: \"You pay per secret version\") do not define: no tier is assumed","shared_with":["module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","module.retail_app_ecs.aws_secretsmanager_secret.mq","module.retail_app_ecs.aws_secretsmanager_secret.orders_db"]}]},{"address":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","type":"aws_secretsmanager_secret","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT Secrets Manager","resources":["stackit_secretsmanager_instance","stackit_secretsmanager_user"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["security.secrets-manager"],"unmatched_resources":[]}},"blocker_count":3,"finding_count":2,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"ANSWERABLE","wave":2,"properties_not_carried":3,"not_carried":[{"node":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","property":"kms_key_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"encryption","reason":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch): kms_key_id — the source encrypts with a customer-managed key that the draft does not set on the Secrets Manager instance: the instance also holds module.retail_app_ecs.aws_secretsmanager_secret.mq, which states no customer-managed key (the default key encrypts it), and it would be encrypted with the key too. The instance takes one STACKIT KMS key for all its secret values (kms_key); set it once the keys of the sources are decided.","semantic":"customer-managed-key","contract":"aws.secretsmanager_secret","source":"../../lib/ecs/catalog.tf:82"},{"node":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","property":"name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"workload-compatibility","reason":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch): name — the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource.","semantic":"tc-secretsmanager-secret-name","contract":"aws.secretsmanager_secret","source":"../../lib/ecs/catalog.tf:82"},{"node":"module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch","property":"secret_string","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"secret-handling","reason":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch): secret_id, secret_string — a setting of module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch: the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource.","semantic":"secret-value","contract":"aws.secretsmanager_secret","source":"../../lib/ecs/catalog.tf:87"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch is a resource of the source, declared in ../../lib/ecs/catalog.tf (lines 82-85). It is part of module.retail_app_ecs. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/9","id":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch"},"expert":{"id_refs":["TL-5ceb916b409a","TL-98fa11e400a6","TL-ba9a92878482","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"NONE","summary_id":"TT-48469437839e","artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-8931c2124903","TL-0e0c31cd1ecb","TL-ea3f5ee8f3ba"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-0a8ebf90122f","lines":["3 left to a person to review","31 further statements that the source does not make (nothing to carry)"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/9","id":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch"},"expert":{"id_refs":["TL-58553fed50a0","TL-a291587bece7","TL-9bc15de8e8dc"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-6c72c30b6fa0","TL-b85bc2536920"],"artefact":{"kind":"REPORT_FILE","file":"terraform/security.tf","id":"stackit_secretsmanager_instance.migrated_secrets"},"expert":{"id_refs":["TL-f35035518166","TL-00a39791a5cf","TL-bab29f416c71","TL-0efaf456d064","TL-4ee006bab9e2","TL-309a55930b10"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-f02f3db4ed00","line_ids":["TL-03ccb0b69489","TL-daad3b0e838c","TL-417b01463a91","TL-5d4b69294c34","TL-384370564772"],"artefact":{"kind":"IN_MEMORY"},"expert":{"ids":["decision: convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN"]}}]},"refs":{"id":"unit:module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/9","ids":["unit:module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/9"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_secretsmanager_instance.migrated_secrets","target:stackit_secretsmanager_user.migration"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 1 open decisions, 0 manual actions","open_decisions":[{"id":"convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN","reasons":["the Secrets Manager Vault-compatible API is of a maturity that is not established (its documentation states no release status and its product documentation does not establish it as generally available): the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db wait for this decision; the draft's own blocks do not"],"required_by_phase":"BEFORE_PILOT","question":"Allow calls of the Secrets Manager Vault-compatible API, whose maturity is not established, for this migration (the API may change or vanish)? Accept: the calls of the Secrets Manager Vault-compatible API (WriteSecret) are carried out for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db. Refuse: no call is made, a refusal selects no other path (the draft holds no other carrier of what the calls set), and what they set stays open for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db.","subjects":["module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","module.retail_app_ecs.aws_secretsmanager_secret.mq","module.retail_app_ecs.aws_secretsmanager_secret.orders_db"]}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"open_decisions":1,"manual_actions":0,"register":{"open":3,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-API-OPT-IN"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E","DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E"]}],"next_step":{"record":"DEC-GEN-CONVERT-API-OPT-IN","source":"PLAN_DECISION","text":"Decide \"api opt in\" (DEC-GEN-CONVERT-API-OPT-IN): the plan of the draft leaves it open"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.aws_secretsmanager_secret.mq","type":"aws_secretsmanager_secret","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT Secrets Manager","resources":["stackit_secretsmanager_instance","stackit_secretsmanager_user"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["security.secrets-manager"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":1,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"ANSWERABLE","wave":5,"properties_not_carried":2,"not_carried":[{"node":"module.retail_app_ecs.aws_secretsmanager_secret.mq","property":"name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"workload-compatibility","reason":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret.mq): name — the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource.","semantic":"tc-secretsmanager-secret-name","contract":"aws.secretsmanager_secret","source":"../../lib/ecs/common.tf:11"},{"node":"module.retail_app_ecs.aws_secretsmanager_secret_version.mq","property":"secret_string","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"secret-handling","reason":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret_version.mq): secret_id, secret_string — a setting of module.retail_app_ecs.aws_secretsmanager_secret.mq: the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource.","semantic":"secret-value","contract":"aws.secretsmanager_secret","source":"../../lib/ecs/common.tf:15"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.aws_secretsmanager_secret.mq is a resource of the source, declared in ../../lib/ecs/common.tf (lines 11-13). It is part of module.retail_app_ecs. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/36","id":"module.retail_app_ecs.aws_secretsmanager_secret.mq"},"expert":{"id_refs":["TL-5ceb916b409a","TL-98fa11e400a6","TL-ba9a92878482","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"NONE","summary_id":"TT-48469437839e","artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-8931c2124903","TL-0e0c31cd1ecb","TL-ea3f5ee8f3ba"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-92cc4e7d95d8","lines":["2 left to a person to review","32 further statements that the source does not make (nothing to carry)"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/36","id":"module.retail_app_ecs.aws_secretsmanager_secret.mq"},"expert":{"id_refs":["TL-a291587bece7","TL-9bc15de8e8dc"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-6c72c30b6fa0","TL-b85bc2536920"],"artefact":{"kind":"REPORT_FILE","file":"terraform/security.tf","id":"stackit_secretsmanager_instance.migrated_secrets"},"expert":{"id_refs":["TL-f35035518166","TL-00a39791a5cf","TL-bab29f416c71","TL-0efaf456d064","TL-4ee006bab9e2","TL-309a55930b10"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-2486dd6166e3","line_ids":["TL-5ec3f2a49a68","TL-5a9d8a049920","TL-5d4b69294c34","TL-384370564772"],"artefact":{"kind":"IN_MEMORY"},"expert":{"ids":["decision: convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN"]}}]},"refs":{"id":"unit:module.retail_app_ecs.aws_secretsmanager_secret.mq","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/36","ids":["unit:module.retail_app_ecs.aws_secretsmanager_secret.mq"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/36"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_secretsmanager_instance.migrated_secrets","target:stackit_secretsmanager_user.migration"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 1 open decisions, 0 manual actions","open_decisions":[{"id":"convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN","reasons":["the Secrets Manager Vault-compatible API is of a maturity that is not established (its documentation states no release status and its product documentation does not establish it as generally available): the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db wait for this decision; the draft's own blocks do not"],"required_by_phase":"BEFORE_PILOT","question":"Allow calls of the Secrets Manager Vault-compatible API, whose maturity is not established, for this migration (the API may change or vanish)? Accept: the calls of the Secrets Manager Vault-compatible API (WriteSecret) are carried out for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db. Refuse: no call is made, a refusal selects no other path (the draft holds no other carrier of what the calls set), and what they set stays open for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db.","subjects":["module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","module.retail_app_ecs.aws_secretsmanager_secret.mq","module.retail_app_ecs.aws_secretsmanager_secret.orders_db"]}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"open_decisions":1,"manual_actions":0,"register":{"open":3,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-API-OPT-IN"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ","DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ"]}],"next_step":{"record":"DEC-GEN-CONVERT-API-OPT-IN","source":"PLAN_DECISION","text":"Decide \"api opt in\" (DEC-GEN-CONVERT-API-OPT-IN): the plan of the draft leaves it open"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","type":"aws_secretsmanager_secret","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT Secrets Manager","resources":["stackit_secretsmanager_instance","stackit_secretsmanager_user"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["security.secrets-manager"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":1,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"ANSWERABLE","wave":5,"properties_not_carried":2,"not_carried":[{"node":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","property":"name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"workload-compatibility","reason":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret.orders_db): name — the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource.","semantic":"tc-secretsmanager-secret-name","contract":"aws.secretsmanager_secret","source":"../../lib/ecs/orders.tf:68"},{"node":"module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db","property":"secret_string","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"secret-handling","reason":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db): secret_id, secret_string — a setting of module.retail_app_ecs.aws_secretsmanager_secret.orders_db: the API step API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource.","semantic":"secret-value","contract":"aws.secretsmanager_secret","source":"../../lib/ecs/orders.tf:72"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db is a resource of the source, declared in ../../lib/ecs/orders.tf (lines 68-70). It is part of module.retail_app_ecs. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/37","id":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db"},"expert":{"id_refs":["TL-5ceb916b409a","TL-98fa11e400a6","TL-ba9a92878482","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"NONE","summary_id":"TT-48469437839e","artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-8931c2124903","TL-0e0c31cd1ecb","TL-ea3f5ee8f3ba"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-92cc4e7d95d8","lines":["2 left to a person to review","32 further statements that the source does not make (nothing to carry)"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/37","id":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db"},"expert":{"id_refs":["TL-a291587bece7","TL-9bc15de8e8dc"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-6c72c30b6fa0","TL-b85bc2536920"],"artefact":{"kind":"REPORT_FILE","file":"terraform/security.tf","id":"stackit_secretsmanager_instance.migrated_secrets"},"expert":{"id_refs":["TL-f35035518166","TL-00a39791a5cf","TL-bab29f416c71","TL-0efaf456d064","TL-4ee006bab9e2","TL-309a55930b10"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-2486dd6166e3","line_ids":["TL-d9f0a41cd244","TL-a64baa4f1c90","TL-5d4b69294c34","TL-384370564772"],"artefact":{"kind":"IN_MEMORY"},"expert":{"ids":["decision: convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN"]}}]},"refs":{"id":"unit:module.retail_app_ecs.aws_secretsmanager_secret.orders_db","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/37","ids":["unit:module.retail_app_ecs.aws_secretsmanager_secret.orders_db"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/37"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_secretsmanager_instance.migrated_secrets","target:stackit_secretsmanager_user.migration"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 1 open decisions, 0 manual actions","open_decisions":[{"id":"convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN","reasons":["the Secrets Manager Vault-compatible API is of a maturity that is not established (its documentation states no release status and its product documentation does not establish it as generally available): the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db wait for this decision; the draft's own blocks do not"],"required_by_phase":"BEFORE_PILOT","question":"Allow calls of the Secrets Manager Vault-compatible API, whose maturity is not established, for this migration (the API may change or vanish)? Accept: the calls of the Secrets Manager Vault-compatible API (WriteSecret) are carried out for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db. Refuse: no call is made, a refusal selects no other path (the draft holds no other carrier of what the calls set), and what they set stays open for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db.","subjects":["module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","module.retail_app_ecs.aws_secretsmanager_secret.mq","module.retail_app_ecs.aws_secretsmanager_secret.orders_db"]}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"open_decisions":1,"manual_actions":0,"register":{"open":3,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-API-OPT-IN"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB","DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB"]}],"next_step":{"record":"DEC-GEN-CONVERT-API-OPT-IN","source":"PLAN_DECISION","text":"Decide \"api opt in\" (DEC-GEN-CONVERT-API-OPT-IN): the plan of the draft leaves it open"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.alb.aws_lambda_permission.lb","type":"aws_lambda_permission","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.retail_app_ecs.module.alb","switched_off":{"by":"for_each = 0","candidate_class":"MANUAL_REVIEW","candidate_confidence":"LOW"},"target_fit":null,"blocker_count":1,"finding_count":1,"evidence_count":0,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.retail_app_ecs.module.alb.aws_lambda_permission.lb","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/60","ids":["unit:module.retail_app_ecs.module.alb.aws_lambda_permission.lb"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.retail_app_ecs.module.alb.aws_lb.this","type":"aws_lb","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.alb","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT Application Load Balancer","resources":["stackit_application_load_balancer","stackit_alb_certificate"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"catalogue":{"state":"MATCHED","capabilities":["network.application-load-balancer"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":3,"evidence_count":3,"automation_eligible":false,"automation_ceiling":"ANSWERABLE","wave":3,"properties_not_carried":6,"not_carried":[{"node":"module.retail_app_ecs.module.alb.aws_lb.this","property":"desync_mitigation_mode","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.alb.aws_lb.this): enable_http2 = true, desync_mitigation_mode = defensive, xff_header_processing_mode = append, enable_xff_client_port = true — no attribute for it on the STACKIT load balancers (pinned provider).","semantic":"request-handling","contract":"aws.lb","source":".terraform/modules/retail_app_ecs.alb/main.tf:5"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","property":"enable_http2","source":".terraform/modules/retail_app_ecs.alb/main.tf:5"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","property":"enable_xff_client_port","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"workload-compatibility","reason":"NOT CARRIED (module.retail_app_ecs.module.alb.aws_lb.this): enable_http2 = true, desync_mitigation_mode = defensive, xff_header_processing_mode = append, enable_xff_client_port = true — no attribute for it on the STACKIT load balancers (pinned provider).","semantic":"request-header-options","contract":"aws.lb","source":".terraform/modules/retail_app_ecs.alb/main.tf:5"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","property":"idle_timeout","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"availability-durability","reason":"NOT CARRIED (module.retail_app_ecs.module.alb.aws_lb.this): idle_timeout = 60 — the STACKIT Application Load Balancer has no idle timeout; Network Load Balancer listeners take tcp.idle_timeout — not generated (pinned provider).","semantic":"lb-connection-timeouts","contract":"aws.lb","source":".terraform/modules/retail_app_ecs.alb/main.tf:5"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","property":"security_groups","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.alb.aws_lb.this): security_groups — a STACKIT Application Load Balancer is in no security group, so the attachment of module.retail_app_ecs.module.alb.aws_security_group.this, module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix is not carried (STACKIT assigns its own target security group (loadbalancer/\u003cname\u003e/backend, which admits the load balancer on the pool ports) to the pool servers unless disable_target_security_group_assignment is set); the client restriction of the group rules is public on source, public on target: no access control is written — the load balancer limits clients by options.access_control.allowed_source_ranges (pinned provider schema, resource stackit_application_load_balancer: \"Application Load Balancer is accessible only from an IP address in this range.\", one set for the whole load balancer) only.","semantic":"client-restriction","contract":"aws.lb","source":".terraform/modules/retail_app_ecs.alb/main.tf:5"},{"node":"module.retail_app_ecs.module.alb.aws_lb.this","property":"xff_header_processing_mode","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.alb.aws_lb.this): enable_http2 = true, desync_mitigation_mode = defensive, xff_header_processing_mode = append, enable_xff_client_port = true — no attribute for it on the STACKIT load balancers (pinned provider).","semantic":"request-handling","contract":"aws.lb","source":".terraform/modules/retail_app_ecs.alb/main.tf:5"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.alb.aws_lb.this is a resource of the source, declared in .terraform/modules/retail_app_ecs.alb/main.tf (lines 5-63). It is part of module.retail_app_ecs.module.alb. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-476821345c5f"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/28","id":"module.retail_app_ecs.module.alb.aws_lb.this"},"expert":{"id_refs":["TL-702e5a5ee812","TL-873d11581e43","TL-bb61208f625a","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-772b328040bb","line_ids":["TL-da1f396eaad3","TL-79e6cdf60076","TL-8e11a858712b","TL-e52d6bdf8245","TL-b00148e1eafe","TL-9e1b871ca606","TL-e2250f928144","TL-e37b2e685a4d","TL-aa70c5f93a78","TL-423fb583f3e4","TL-018d41cd4d94","TL-caa1f26656e0","TL-d5182041757a","TL-30dc9f7fd9b2"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-8931c2124903","TL-42fe756579e0","TL-220060326aaa"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-a49c64dea1a4","line_ids":["TL-feaba4f52477","TL-15a0d97ac21c","TL-3545a21a7bd6","TL-9e54e51d38bd","TL-f1ec41938106","TL-e409176b66c5"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/28","id":"module.retail_app_ecs.module.alb.aws_lb.this"},"expert":{"id_refs":["TL-15c36abcfb95","TL-302d2ee2cacd","TL-995719e6081c","TL-f859c52cd624","TL-5305e27ff93b","TL-bc046f5db37e","TL-be3743195cdc","TL-5891c8af6337","TL-27ab4b800f9c","TL-5a5733e45abc","TL-68f684ebfbac","TL-0472544a1a16","TL-b33949aaa668","TL-f1ea08c67233","TL-b76e2142be7e","TL-2b66ea1992ac","TL-5a40757f96ac","TL-350d58f88680","TL-d623ca25320b"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-d130b98cad63","line_ids":["TL-a8b80e481488"],"artefact":{"kind":"REPORT_FILE","file":"terraform/loadbalancing.tf","id":"stackit_application_load_balancer.retail_app_ecs_alb_this"},"expert":{"id_refs":["TL-539c54ebdc4c","TL-1a713e4cf1fd","TL-e358bede7239"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-3fe35cb0b112","line_ids":["TL-33b6b02be1fc","TL-d8280c94a459","TL-663204adb7b7","TL-7f107ea4b136","TL-6839053132bf","TL-5d4b69294c34","TL-8f0b8bc9c445","TL-7b680798b142","TL-acc90ceaeeaf","TL-6ce259dabf9d"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-ce71694d7554","TL-07d8d2aeaf77"]}}]},"refs":{"id":"unit:module.retail_app_ecs.module.alb.aws_lb.this","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/28","ids":["unit:module.retail_app_ecs.module.alb.aws_lb.this"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/28"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_application_load_balancer.retail_app_ecs_alb_this"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 2 open decisions, 0 manual actions","open_decisions":[{"id":"convert:module.retail_app_ecs.module.alb.aws_lb.this:network_id:AMBIGUOUS_INSTANCE_SELECTION","reasons":["the reference reaches stackit_network.vpc_vpc_public, a repeated resource (count or for_each), and nothing in the source proves which instance it means; no instance is assumed and the variable has no default"],"required_by_phase":"BEFORE_PILOT","question":"Decide which instance of stackit_network.vpc_vpc_public the networks of stackit_application_load_balancer.retail_app_ecs_alb_this means: set var.retail_app_ecs_alb_this_network_id_target to its index","subjects":["module.retail_app_ecs.module.alb.aws_lb.this","stackit_application_load_balancer.retail_app_ecs_alb_this","stackit_network.vpc_vpc_public"]},{"id":"convert:module.retail_app_ecs.module.alb.aws_lb.this:target_pools:INGRESS_EXPOSURE_PATH","reasons":["a STACKIT target pool reaches its targets by private IP and the SKE cluster exports no node address to Terraform, so a Kubernetes workload is reachable from the load balancer only through a node port at the IPs of the nodes, which change as the node pool scales and is updated, or through an Ingress controller; the source registered the tasks of the service by their own IPs (awsvpc)"],"required_by_phase":"BEFORE_PILOT","question":"Decide how the clients of module.retail_app_ecs.module.alb.aws_lb.this reach the workloads of module.retail_app_ecs.module.ui_service.aws_ecs_service.this on SKE (aws.ingress.exposure-path): option nodeport-alb-target-pool (the drafted path: a NodePort Service of each workload and the target pool on its node port at the private IPs of the cluster's nodes, an input), ingress-controller-behind-alb (an Ingress controller on the cluster, reached by the load balancer on the controller's node port, routes to the ClusterIP Services), or stackit-alb-ingress-controller (the SKE Application Load Balancer extension provisions the load balancer from an Ingress of the IngressClass stackit-alb over NodePort Services; the drafted stackit_application_load_balancer.retail_app_ecs_alb_this is not applied)","subjects":["module.retail_app_ecs.module.alb.aws_lb.this","module.retail_app_ecs.module.ui_service.aws_ecs_service.this","stackit_application_load_balancer.retail_app_ecs_alb_this"]}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"open_decisions":2,"manual_actions":0,"register":{"open":4,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS","DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS"]}],"next_step":{"record":"DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","source":"PLAN_DECISION","text":"Decide \"ambiguous instance selection\" (DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION): the plan of the draft leaves it open"},"blocks_automation":true}},"target_prices":[{"resource":"stackit_application_load_balancer.retail_app_ecs_alb_this","resource_type":"stackit_application_load_balancer","component":"plan","join_key":"plan_id = \"p10\" (DEFAULT: priced on the draft's default \"p10\" of var.retail_app_ecs_alb_this_plan_id (draft variables.tf:230); no answer or standing policy of the run chose it, so another value changes the price)","state":"PRICED","sku_id":"ST-0204801","sku_name":"Application-Load-Balancer-Dedicated-10-EU01","unit_price":"0.02627777778","unit":"Hours","unit_billing":"per hour","region":"eu01","metro":false,"valid_start":"2026-10-08T07:45:16Z"}]},{"address":"module.retail_app_ecs.module.alb.aws_security_group.this","type":"aws_security_group","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.alb","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.security-group"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":3,"evidence_count":3,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":2,"properties_not_carried":1,"not_carried":[{"node":"module.retail_app_ecs.module.alb.aws_security_group.this","property":"vpc_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+UNSUPPORTED","category":"network-exposure","reason":"plan: stackit_security_group.retail_app_ecs_alb_this vpc_id UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried","semantic":"security-group-vpc-membership","contract":"aws.security_group","source":".terraform/modules/retail_app_ecs.alb/main.tf:807"}],"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.alb.aws_security_group.this is an AWS security group, declared in .terraform/modules/retail_app_ecs.alb/main.tf (lines 807-824). It is part of module.retail_app_ecs.module.alb. It states 0 rules.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/10","id":"module.retail_app_ecs.module.alb.aws_security_group.this"},"expert":{"id_refs":["TL-a8f0a4cb1f58","TL-6d6d224d0414","TL-c6c4a8483f3c","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary":"The source states no rule for this unit.","artefact":{"kind":"SOURCE_FILE","file":".terraform/modules/retail_app_ecs.alb/main.tf","pointer":"lines 807-824"},"expert":{"id_refs":["TL-1b6bb75769f1"]}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-1110fbc911ec","line_ids":["TL-2ef5e9032fe9"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.retail_app_ecs.module.alb.aws_security_group.this"},"expert":{"id_refs":["TL-f4bdc86495d2","TL-46ec0bd8733b"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-52b420636513","line_ids":["TL-3545a21a7bd6","TL-06755e954f06","TL-6a9deb0feace"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/10","id":"module.retail_app_ecs.module.alb.aws_security_group.this"},"expert":{"id_refs":["TL-98aa55dee3f2","TL-750b3fbf1f7f","TL-93afdda91a72","TL-625cb7eb6db1"]}},{"stage":"INTENT","state":"ESTABLISHED","summary_id":"TT-722f9eb3a9f2","lines":["Group module.retail_app_ecs.module.alb.aws_security_group.this[0]: 0 rules"],"artefact":{"kind":"IN_MEMORY","id":"security:module.retail_app_ecs.module.alb.aws_security_group.this"},"expert":{"id_refs":["TL-a0b6743aac67","TL-cc90c346c091"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3921a774bd0d","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3","TL-c3708697f6d5","TL-b3c5f384d94c","TL-308bd8bc6afb","TL-d50bc41a68a5","TL-19e2cf13ec7d"],"artefact":{"kind":"IN_MEMORY","id":"network.security-group"},"expert":{"id_refs":["TL-dbe97d4df687","TL-f9c3c1e88738","TL-a4d3f937ca56","TL-e55740d24a58","TL-d70d70f815d4","TL-981f57277e1b","TL-00ce63da408d","TL-5acc71b16e18","TL-00a58746651a","TL-71db89378ca6","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-a61797f03d0d","line_ids":["TL-3d94a77c7c96","TL-74763f6fc26a","TL-cda7c6ee5f1c"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans","id":"stackit_security_group.retail_app_ecs_alb_this"},"expert":{"id_refs":["TL-2992e16dab5f","TL-94fffdc633e3","TL-2958ffb82c48","TL-5b3b5d89523a","TL-04832d479da2","TL-7d335f19f5bf","TL-bec244aa1644","TL-5a38cf8ed5a0","TL-4edd66897c94","TL-37465a3da0e4","TL-899fd28c3b9c","TL-560312b2a515"]}},{"stage":"RENDER","state":"ESTABLISHED","summary":"The draft writes 1 resource of this unit as active Terraform.","line_ids":["TL-3a933e103335"],"artefact":{"kind":"REPORT_FILE","file":"terraform/security.tf"},"expert":{"id_refs":["TL-c0c1204c2958","TL-5d6d4862b95d","TL-db04248efd43"]}},{"stage":"VALIDATION","state":"OPEN","summary_id":"TT-2eed2fdcdabc","line_ids":["TL-b965e925fff4","TL-7338c48d6ad3","TL-779e3b0f817e","TL-e6970c0aa0a5","TL-3b71b9a35b2d","TL-548a1aa887c5"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-f2eb19ea1d78","TL-d477c31ae16d","TL-5ce834a2bf21","TL-5260e0ef58bd","TL-e4d60c1731c8","TL-1935467c5b80"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-8a7c11272ea8","line_ids":["TL-1e49a0bffe90","TL-02646755b7db","TL-9829b8818e37"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-3ffd7cd0916f","TL-d44b198f7a4a","TL-7166e3a71e2a"]}}]},"refs":{"id":"unit:module.retail_app_ecs.module.alb.aws_security_group.this","family":"AWS_SECURITY_GROUP","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/10","ids":["unit:module.retail_app_ecs.module.alb.aws_security_group.this"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/10"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:security:module.retail_app_ecs.module.alb.aws_security_group.this"]},{"hop":"plan","state":"ESTABLISHED","kind":"REPORT_FILE","file":"target-plan.json"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:final-artifact@module.retail_app_ecs.module.alb.aws_security_group.this","check:plan-valid@module.retail_app_ecs.module.alb.aws_security_group.this","check:renders@module.retail_app_ecs.module.alb.aws_security_group.this","check:round-trip@module.retail_app_ecs.module.alb.aws_security_group.this","check:rule-has-one-remote@module.retail_app_ecs.module.alb.aws_security_group.this"]}],"targets":["target:stackit_security_group.retail_app_ecs_alb_this"]},"workload_readiness":{"applies":false,"dimensions":[]},"behavior_evidence":{"counts":[{"key":"OBSERVED_ON_TARGET","count":2},{"key":"OFFICIAL_DOCUMENTED","count":4},{"key":"NOT_VERIFIED_FOR_VARIANT","count":2},{"key":"CONTRADICTED","count":0}],"open":[{"address":"stackit_security_group.retail_app_ecs_alb_this","path":"default_egress.ipv4","state":"NOT_VERIFIED_FOR_VARIANT","variant":"group","rows":["cap:network.security-group/duplicate-default-egress-rule-rejected"],"constraints":[{"row":"cap:network.security-group/default-egress-rules","scope":"OBSERVED_EXACT_VARIANT","note":"tested on a STACKIT project on 2026-10-07"},{"row":"cap:network.security-group/duplicate-default-egress-rule-rejected","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]},{"address":"stackit_security_group.retail_app_ecs_alb_this","path":"default_egress.ipv6","state":"NOT_VERIFIED_FOR_VARIANT","variant":"group","rows":["cap:network.security-group/duplicate-default-egress-rule-rejected"],"constraints":[{"row":"cap:network.security-group/default-egress-rules","scope":"OBSERVED_EXACT_VARIANT","note":"tested on a STACKIT project on 2026-10-07"},{"row":"cap:network.security-group/duplicate-default-egress-rule-rejected","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]}]},"coverage":"TRACED","open_work":{"open_steps":5,"not_verified_fields":2,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS"]}],"next_step":{"record":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.retail_app_ecs.module.alb.aws_security_group.this (DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.alb.aws_wafv2_web_acl_association.this","type":"aws_wafv2_web_acl_association","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.retail_app_ecs.module.alb","switched_off":{"by":"count = 0","candidate_class":"MANUAL_REVIEW","candidate_confidence":"LOW"},"target_fit":null,"blocker_count":1,"finding_count":1,"evidence_count":0,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.retail_app_ecs.module.alb.aws_wafv2_web_acl_association.this","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/61","ids":["unit:module.retail_app_ecs.module.alb.aws_wafv2_web_acl_association.this"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.retail_app_ecs.module.alb_sg.aws_security_group.this","type":"aws_security_group","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.retail_app_ecs.module.alb_sg","switched_off":{"by":"count = 0","candidate_class":"RECONFIGURE","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.security-group"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":3,"automation_eligible":null,"wave":0,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.alb_sg.aws_security_group.this is an AWS security group, declared in .terraform/modules/retail_app_ecs.alb_sg/main.tf (lines 13-32). It is switched off in the source. It is part of module.retail_app_ecs.module.alb_sg. It states 0 rules.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/62","id":"module.retail_app_ecs.module.alb_sg.aws_security_group.this"},"expert":{"id_refs":["TL-a8f0a4cb1f58","TL-6d6d224d0414","TL-c6c4a8483f3c","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary":"The source states no rule for this unit.","artefact":{"kind":"SOURCE_FILE","file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","pointer":"lines 13-32"},"expert":{"id_refs":["TL-1b6bb75769f1"]}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-28cf18b349f1","line_ids":["TL-f526766584fc"],"artefact":{"kind":"IN_MEMORY","id":"module.retail_app_ecs.module.alb_sg.aws_security_group.this"},"expert":{"id_refs":["TL-94c59a08ef5d","TL-ed10391cb980"]}},{"stage":"SEMANTIC_CLAIM","state":"NONE","summary_id":"TT-09e44fcd9ff2","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"INTENT","state":"ESTABLISHED","summary_id":"TT-722f9eb3a9f2","lines":["Group module.retail_app_ecs.module.alb_sg.aws_security_group.this: 0 rules","  it has 0 instances"],"artefact":{"kind":"IN_MEMORY","id":"security:module.retail_app_ecs.module.alb_sg.aws_security_group.this"},"expert":{"id_refs":["TL-a0b6743aac67","TL-cc90c346c091"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3921a774bd0d","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3"],"artefact":{"kind":"IN_MEMORY","id":"network.security-group"},"expert":{"id_refs":["TL-dbe97d4df687","TL-00a58746651a","TL-71db89378ca6","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-ffa2d19dc7f9","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-d1a104cfbb3e","TL-899fd28c3b9c"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary":"The draft writes nothing for this unit, so nothing was checked.","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.module.alb_sg.aws_security_group.this","family":"AWS_SECURITY_GROUP","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/62","ids":["unit:module.retail_app_ecs.module.alb_sg.aws_security_group.this"]},{"hop":"claims","state":"NONE","kind":"IN_MEMORY","reason":"NO_CLAIM_FOR_THE_UNIT"},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":0,"accepted":0}}},{"address":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"aws_security_group","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.alb_sg","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.security-group"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":3,"evidence_count":3,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":2,"properties_not_carried":15,"not_carried":[{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","property":"vpc_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+UNSUPPORTED","category":"network-exposure","reason":"plan: stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix vpc_id UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried","semantic":"security-group-vpc-membership","contract":"aws.security_group","source":".terraform/modules/retail_app_ecs.alb_sg/main.tf:37"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","property":"cidr_blocks","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0]","semantic":"standalone-rule-values","contract":"aws.security_group","source":".terraform/modules/retail_app_ecs.alb_sg/main.tf:442"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","property":"from_port","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0]","semantic":"rule-ports","contract":"aws.security_group","source":".terraform/modules/retail_app_ecs.alb_sg/main.tf:442"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","property":"ipv6_cidr_blocks","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0]","semantic":"standalone-rule-other-sources","contract":"aws.security_group","source":".terraform/modules/retail_app_ecs.alb_sg/main.tf:442"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","property":"prefix_list_ids","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0]","semantic":"standalone-rule-other-sources","contract":"aws.security_group","source":".terraform/modules/retail_app_ecs.alb_sg/main.tf:442"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","property":"protocol","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0]","semantic":"standalone-rule-values","contract":"aws.security_group","source":".terraform/modules/retail_app_ecs.alb_sg/main.tf:442"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","property":"to_port","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0]","semantic":"rule-ports","contract":"aws.security_group","source":".terraform/modules/retail_app_ecs.alb_sg/main.tf:442"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","property":"type","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0]","semantic":"standalone-rule-values","contract":"aws.security_group","source":".terraform/modules/retail_app_ecs.alb_sg/main.tf:442"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","property":"cidr_blocks","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0]","semantic":"standalone-rule-values","contract":"aws.security_group","source":".terraform/modules/retail_app_ecs.alb_sg/main.tf:66"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","property":"from_port","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0]","semantic":"rule-ports","contract":"aws.security_group","source":".terraform/modules/retail_app_ecs.alb_sg/main.tf:66"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","property":"ipv6_cidr_blocks","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0]","semantic":"standalone-rule-empty-sources","contract":"aws.security_group","source":".terraform/modules/retail_app_ecs.alb_sg/main.tf:66"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","property":"prefix_list_ids","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0]","semantic":"standalone-rule-empty-sources","contract":"aws.security_group","source":".terraform/modules/retail_app_ecs.alb_sg/main.tf:66"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","property":"protocol","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0]","semantic":"standalone-rule-values","contract":"aws.security_group","source":".terraform/modules/retail_app_ecs.alb_sg/main.tf:66"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","property":"to_port","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0]","semantic":"rule-ports","contract":"aws.security_group","source":".terraform/modules/retail_app_ecs.alb_sg/main.tf:66"},{"node":"module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","property":"type","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"plan: awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0]","semantic":"standalone-rule-values","contract":"aws.security_group","source":".terraform/modules/retail_app_ecs.alb_sg/main.tf:66"}],"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix is an AWS security group, declared in .terraform/modules/retail_app_ecs.alb_sg/main.tf (lines 37-60). It is part of module.retail_app_ecs.module.alb_sg. It states 2 rules.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/11","id":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix"},"expert":{"id_refs":["TL-a8f0a4cb1f58","TL-6d6d224d0414","TL-c6c4a8483f3c","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"OPEN","summary_id":"TT-0263dd1d5363","line_ids":["TL-08a95b3f5942","TL-91dd162cc6fb","TL-f47e2790bbaa","TL-727c41b31ebf"],"artefact":{"kind":"SOURCE_FILE","file":".terraform/modules/retail_app_ecs.alb_sg/main.tf","pointer":"lines 37-60"},"expert":{"id_refs":["TL-1b6bb75769f1","TL-47a82709c47e","TL-0b1b15d4f38f","TL-ee1fb4388ac7","TL-c117988b793a","TL-d8484a84799b","TL-67d8eaf6c330"]}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-1110fbc911ec","line_ids":["TL-9935a1d0524d"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix"},"expert":{"id_refs":["TL-f4bdc86495d2","TL-46ec0bd8733b"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-6bc754902840","line_ids":["TL-3545a21a7bd6","TL-98eaf60ea4d2","TL-ec727dee66a7","TL-0df924a96f5b"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/11","id":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix"},"expert":{"id_refs":["TL-750b3fbf1f7f","TL-e879ced2a842","TL-9f4a4663060f","TL-93afdda91a72","TL-56a0803735a9","TL-732e4f980183","TL-6c9eed03f527","TL-625cb7eb6db1","TL-7afdbfe6f6fb","TL-8551a479a85d"]}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-cffaa762f020","line_ids":["TL-b2aac30072ef","TL-4b447cc4d595","TL-288500fdf0da"],"artefact":{"kind":"IN_MEMORY","id":"security:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix"},"expert":{"id_refs":["TL-a0b6743aac67","TL-cc90c346c091"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3921a774bd0d","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3","TL-03eaba90355e","TL-b3c5f384d94c","TL-308bd8bc6afb","TL-4f8a4e291b3e","TL-19e2cf13ec7d"],"artefact":{"kind":"IN_MEMORY","id":"network.security-group"},"expert":{"id_refs":["TL-dbe97d4df687","TL-f9c3c1e88738","TL-a4d3f937ca56","TL-3d1b0927de6c","TL-e55740d24a58","TL-d70d70f815d4","TL-981f57277e1b","TL-00ce63da408d","TL-5acc71b16e18","TL-00a58746651a","TL-71db89378ca6","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-3b5e65e15264","line_ids":["TL-66e8815b34e5","TL-9ded5f4a9b15","TL-9507b31b1f39","TL-8d5e93917570"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans","id":"stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix"},"expert":{"id_refs":["TL-22ec5635c5bb","TL-de390d10576f","TL-5dcd902e61f1","TL-8e18c3a363e3","TL-87180479e250","TL-3901c57591f8","TL-5c0e817b83e7","TL-226f0fce8177","TL-1e799fd40ce8","TL-7611bf3eaa3e","TL-f0b1dc10d313","TL-d00848cc1ab4","TL-2f55ae9bb015","TL-7dd0066f7517","TL-899fd28c3b9c","TL-560312b2a515"]}},{"stage":"RENDER","state":"ESTABLISHED","summary":"The draft writes 1 resource of this unit as active Terraform.","line_ids":["TL-d04f343580e7"],"artefact":{"kind":"REPORT_FILE","file":"terraform/security.tf"},"expert":{"id_refs":["TL-ed1bb454360c","TL-5d6d4862b95d","TL-73a30fcb289b"]}},{"stage":"VALIDATION","state":"OPEN","summary_id":"TT-2eed2fdcdabc","line_ids":["TL-b965e925fff4","TL-7338c48d6ad3","TL-779e3b0f817e","TL-e6970c0aa0a5","TL-3b71b9a35b2d","TL-548a1aa887c5"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-f2eb19ea1d78","TL-d477c31ae16d","TL-5ce834a2bf21","TL-5260e0ef58bd","TL-e4d60c1731c8","TL-1935467c5b80"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-94ce5f17da1a","line_ids":["TL-c075bc81dfd1","TL-8b79cd35ff17","TL-b2a8afa68433","TL-a28e5a16c9b6","TL-69b9fd6e3f88"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-483c7d87fb22","TL-e0e9c2cb4c62","TL-89442424e442","TL-5aa1787fe669","TL-0fd6a6d386f5","TL-9241b1f91636","TL-db91b2d63856"]}}]},"refs":{"id":"unit:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","family":"AWS_SECURITY_GROUP","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/11","ids":["unit:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/11"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:security:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix"]},{"hop":"plan","state":"OPEN","kind":"REPORT_FILE","file":"target-plan.json"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:final-artifact@module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","check:plan-valid@module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","check:renders@module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","check:round-trip@module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","check:rule-has-one-remote@module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix"]}],"targets":["target:stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 0 open decisions, 4 manual actions","open_decisions":[],"manual_actions":[{"id":"awssg:incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules","kind":"INCOMPLETE","phase":"BEFORE_PILOT","what":"Re-create the rules beyond the known set of group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0] (rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules)","why":"an unknown number of entries of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules are not visible statically (group-choice): only the known ones were produced"},{"id":"awssg:incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules","kind":"INCOMPLETE","phase":"BEFORE_PILOT","what":"Re-create the rules beyond the known set of group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0] (rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules)","why":"an unknown number of entries of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules are not visible statically (group-choice): only the known ones were produced"},{"id":"awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0]","kind":"UNPLACED","phase":"BEFORE_PILOT","what":"Place the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] on the security group it belongs to and write it","why":"the rule is attached to module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix but cannot be attributed to one of its groups (group-choice); a rule on the wrong group allows what the source did not allow there, so none was produced"},{"id":"awssg:unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0]","kind":"UNPLACED","phase":"BEFORE_PILOT","what":"Place the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] on the security group it belongs to and write it","why":"the rule is attached to module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix but cannot be attributed to one of its groups (group-choice); a rule on the wrong group allows what the source did not allow there, so none was produced"}]},"workload_readiness":{"applies":false,"dimensions":[]},"behavior_evidence":{"counts":[{"key":"OBSERVED_ON_TARGET","count":2},{"key":"OFFICIAL_DOCUMENTED","count":5},{"key":"NOT_VERIFIED_FOR_VARIANT","count":2},{"key":"CONTRADICTED","count":0}],"open":[{"address":"stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix","path":"default_egress.ipv4","state":"NOT_VERIFIED_FOR_VARIANT","variant":"group","rows":["cap:network.security-group/duplicate-default-egress-rule-rejected"],"constraints":[{"row":"cap:network.security-group/default-egress-rules","scope":"OBSERVED_EXACT_VARIANT","note":"tested on a STACKIT project on 2026-10-07"},{"row":"cap:network.security-group/duplicate-default-egress-rule-rejected","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]},{"address":"stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix","path":"default_egress.ipv6","state":"NOT_VERIFIED_FOR_VARIANT","variant":"group","rows":["cap:network.security-group/duplicate-default-egress-rule-rejected"],"constraints":[{"row":"cap:network.security-group/default-egress-rules","scope":"OBSERVED_EXACT_VARIANT","note":"tested on a STACKIT project on 2026-10-07"},{"row":"cap:network.security-group/duplicate-default-egress-rule-rejected","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]}]},"coverage":"TRACED","open_work":{"open_steps":7,"not_verified_fields":2,"open_decisions":0,"manual_actions":4,"register":{"open":3,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862"]},{"source":"MANUAL_ACTION","open_records":["DEC-SEC-STACKITSG-ACTION-INCOMPLETE","DEC-SEC-STACKITSG-ACTION-UNPLACED"]}],"next_step":{"record":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix (DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","type":"aws_ecs_service","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.carts_service","class":"REPLATFORM","confidence":"LOW","target_fit":{"service":"STACKIT Kubernetes Engine (SKE)","resources":["stackit_ske_cluster"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"lifecycle_effects":{"state":"GA","state_reason":"the pinned provider schema has no beta, experimental or deprecated notice on the target's resources","sets":[{"capability":"compute.managed-kubernetes","subject_kind":"kubernetes_minor_version","title":"SKE Kubernetes versions","as_of":"2026-10-08","recheck_after":"2027-01-06","expiring_window_days":30,"production_suitability":"SUITABLE","day2":{"forced_update_by":"PROVIDER","forced_update_statement":"\"If the Kubernetes or OS version of a cluster has reached its expiration date, SKE starts a mandatory update to the highest available patch version of the current minor version, or to the highest patch version of the consecutive minor version that is not classified as preview version.\" and \"mandatory version updates run, even if the auto update for the Kubernetes version is deactivated\". Automatic updates otherwise \"only update to higher patch levels\" in the cluster's maintenance window.","notice":"\"As a SKE user you will get informed via release notes and via email in case you are operating a cluster with a deprecated Kubernetes version.\"","customer_action":"\"you can check the exact expiration dates for your current Kubernetes and node pool versions in the cluster.status.expiration field via the SKE API\". The page does not assign any further duty (workload readiness for the update, testing) to the customer or to STACKIT: not stated."},"versions":[{"subject":"1.36","state":"SUPPORTED","disputed":false,"released_at":{"date":"2026-08-27","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"production_suitability":"SUITABLE","upgrade_action":"NONE_PUBLISHED","migration_timing_risk":"UNKNOWN","note":"No expiry or EOL for 1.36 is stated in the pages read; the lifecycle table does not list it. An unpublished end is reported as such, not as safe."},{"subject":"1.35","state":"UNKNOWN","disputed":false,"expires_at":{"date":"2027-02-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"UNKNOWN","upgrade_action":"UNKNOWN","migration_timing_risk":"UNKNOWN","note":"The pages read give no release date for 1.35 (no release-note entry), so the state stays UNKNOWN: a future expiry date does not say that a version is offered. The 1.34 deprecation entry names 1.35 as the upgrade target."},{"subject":"1.34","state":"EXPIRING","disputed":false,"released_at":{"date":"2025-12-16","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-08-28","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-10-14","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"UPGRADE_BEFORE_EXPIRY","migration_timing_risk":"HIGH","note":"Clusters still on 1.34 are upgraded to 1.35 by the mandatory update (release note of 2026-08-28); the day it runs inside the maintenance window is not stated, so no forced-update date is recorded."},{"subject":"1.33","state":"EXPIRED","disputed":true,"released_at":{"date":"2025-07-29","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-06-09","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-06-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08","dissent":[{"date":"2026-07-08","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"}]},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"The expiry day differs between the lifecycle page (2026-06-10) and the release note (2026-07-08); the state is EXPIRED under either."},{"subject":"1.32","state":"EXPIRED","disputed":false,"deprecated_at":{"date":"2026-02-20","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-04-15","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"No release date for 1.32 appears in the pages read."}],"sources":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/operations/version-updates/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"]}]},"catalogue":{"state":"MATCHED","capabilities":["compute.managed-kubernetes"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":3,"evidence_count":1,"automation_eligible":false,"automation_ceiling":"ANSWERABLE","wave":3,"properties_not_carried":14,"not_carried":[{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","property":"enable_execute_command","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): enable_execute_command = true, tags, wait_for_steady_state = true — a service setting with no counterpart in the draft manifests: Kubernetes has its own rollout (maxSurge, maxUnavailable), health, scheduling and exec behaviour, and tags are not labels here.","semantic":"service-execute-command","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","property":"launch_type","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","property":"network_configuration.assign_public_ip","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods.","semantic":"service-public-ip-setting","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","property":"network_configuration.security_groups","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods.","semantic":"service-network-placement","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","property":"network_configuration.subnets","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods.","semantic":"service-network-placement","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","property":"service_connect_configuration.enabled","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: carts:80 → container port 8080 (the Service Connect alias carts:80 of port carts-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","property":"service_connect_configuration.namespace","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: carts:80 → container port 8080 (the Service Connect alias carts:80 of port carts-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","property":"service_connect_configuration.service.client_alias.dns_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: carts:80 → container port 8080 (the Service Connect alias carts:80 of port carts-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","property":"service_connect_configuration.service.client_alias.port","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: carts:80 → container port 8080 (the Service Connect alias carts:80 of port carts-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","property":"service_connect_configuration.service.discovery_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: carts:80 → container port 8080 (the Service Connect alias carts:80 of port carts-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","property":"service_connect_configuration.service.port_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: carts:80 → container port 8080 (the Service Connect alias carts:80 of port carts-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","property":"wait_for_steady_state","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","property":"network_mode","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this): network_mode = awsvpc, requires_compatibilities — Fargate platform specifics and awsvpc network interface semantics have no Kubernetes counterpart: the pods run on the SKE node pool network and the platform's task sizing steps do not exist.","semantic":"td-network-mode","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:125"},{"node":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","property":"requires_compatibilities","source":"../../lib/ecs/service/ecs.tf:125"}],"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this is a container service (it keeps container tasks running), declared in ../../lib/ecs/service/ecs.tf (lines 136-175). It is part of module.retail_app_ecs.module.carts_service. It names 2 identities it runs as. This trace follows the identity of the workload: which identity it runs as and what the plan does with it on STACKIT.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/29","id":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-eb6e69766287","TL-8b7cc812905b","TL-d46f02e929c7","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary":"The source names 2 identities this workload runs as.","line_ids":["TL-f94aae57c6cb","TL-072f5f71f9ab"],"artefact":{"kind":"SOURCE_FILE","file":"../../lib/ecs/service/ecs.tf","pointer":"lines 136-175"},"expert":{"id_refs":["TL-8b210a68db05","TL-9dc9bf2d25bd"]}},{"stage":"RESOLUTION_PROOF","state":"ESTABLISHED","summary_id":"TT-3e49a186cd7f","line_ids":["TL-5578c4e3dabb","TL-990e3616a997"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-5dc94b642647","TL-111f9fe4f567"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-f0a8d4e9043a","line_ids":["TL-424117e74f30","TL-a1eade33c8b0"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/29","id":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-942dbe8cd334","TL-7ebdd3dd35a4","TL-5a72d657029c","TL-b5b97b9044b0","TL-2fd740bb0601","TL-9e089191f346","TL-8e4d39fcf8ec","TL-da2e68bcc2b5","TL-4d992a6cae8d","TL-1de287234081","TL-ec559f03bc2c","TL-bbc56b6870d6","TL-488012de1e76","TL-b5f13fa502d3","TL-884236b97950","TL-17bd32f2135b"]}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-0475c1513230","lines":["The unit is a container service (it keeps container tasks running)"],"artefact":{"kind":"IN_MEMORY","id":"identity:module.retail_app_ecs.module.carts_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-0b734eb4a3ea","TL-99e869fe09b9"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3ae2580b0162","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-b1bbbaec7332","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4"],"artefact":{"kind":"IN_MEMORY","id":"identity.server-service-account"},"expert":{"ids":["capability: identity.server-service-account","provider version: 0.121.0"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-fc0024522eee","lines":["2 manual actions, due before the pilot"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-1dbf3bcfa067","TL-50683c538a06","TL-8e66521ce803","TL-3f89d52abb85"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-3e30d829ac91","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary_id":"TT-7d4d2bc1d7f5","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-fed32ab36cf0","TL-9d1216c1c1c8","TL-d477c31ae16d","TL-5ce834a2bf21","TL-871d4c9b23bb"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.module.carts_service.aws_ecs_service.this","family":"AWS_IDENTITY_ATTACH","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/29","ids":["unit:module.retail_app_ecs.module.carts_service.aws_ecs_service.this"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/29"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:identity:module.retail_app_ecs.module.carts_service.aws_ecs_service.this"]},{"hop":"plan","state":"OPEN","kind":"REPORT_FILE","file":"target-plan.json"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:attach-complete@module.retail_app_ecs.module.carts_service.aws_ecs_service.this","check:final-artifact@module.retail_app_ecs.module.carts_service.aws_ecs_service.this","check:plan-valid@module.retail_app_ecs.module.carts_service.aws_ecs_service.this","check:renders@module.retail_app_ecs.module.carts_service.aws_ecs_service.this","check:round-trip@module.retail_app_ecs.module.carts_service.aws_ecs_service.this"]}],"targets":["target:stackit_ske_cluster.retail_app_ecs_cluster"]},"plan_statements":[{"id":"stackitsa:statement:module.retail_app_ecs.module.carts_service.aws_ecs_service.this","family":"stackitsa","reason":"MANUAL_REVIEW","cause":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person)","manual_actions":[{"id":"stackitsa:facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this#execution_role_arn","kind":"OTHER","phase":"BEFORE_PILOT","what":"Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach","why":"the role is the platform agent's identity, not the application's (execution_role_arn of module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role). a platform agent's identity is not an application identity and has no STACKIT counterpart; the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person"},{"id":"stackitsa:facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this#task_role_arn","kind":"OTHER","phase":"BEFORE_PILOT","what":"Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it","why":"the workload is a container service, not a server an account is attached to (task_role_arn of module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.carts_service.aws_iam_role.task_role). the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person"}]}],"workload_readiness":{"applies":true,"dimensions":[{"id":"bootstrap_configuration","state":"NOT_ASSESSED"},{"id":"source_artifacts","state":"NOT_ASSESSED"},{"id":"target_preconditions","state":"NOT_ASSESSED"},{"id":"cutover","state":"NOT_ASSESSED"},{"id":"day2_operations","state":"NOT_ASSESSED"}]},"coverage":"TRACED","open_work":{"open_steps":3,"register":{"open":6,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS"]},{"source":"PLAN_STATEMENT","open_records":["DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW"]}],"next_step":{"record":"DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","type":"aws_iam_role","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.carts_service","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["identity.role-assignment","identity.server-service-account","identity.service-account-key"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":3,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":1,"properties_not_carried":2,"not_carried":[{"node":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","property":"assume_role_policy","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.","semantic":"iam-trust-service-workload","contract":"aws.iam_role","source":"../../lib/ecs/service/iam.tf:14"},{"node":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","property":"name","source":"../../lib/ecs/service/iam.tf:14"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role is a resource of the source, declared in ../../lib/ecs/service/iam.tf (lines 14-18). It is part of module.retail_app_ecs.module.carts_service. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-812c351c2405"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/4","id":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role"},"expert":{"id_refs":["TL-98117649104a","TL-6aeddbbb224d","TL-fb283641d321","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-8e65e42312a8","TL-384871c6acaf","TL-fa1c8393519e","TL-9f241609c525"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-8931c2124903","TL-7d2073800c6a","TL-562ea286a100","TL-9d3a00290cfc"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-d43161aa7b39","line_ids":["TL-b8dcaad7eb2a","TL-ec727dee66a7","TL-9f0e74bef300"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/4","id":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role"},"expert":{"id_refs":["TL-fb91e685e455","TL-df6e1c6ce7f0","TL-7d3b1fce19f9","TL-49f4d75dbc78","TL-60baf7ccd117","TL-89b9a0e2d5e4"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-871f6e06a31c","TL-1f7c1f6e2dd7"],"artefact":{"kind":"REPORT_FILE","file":"terraform/identity.tf","id":"stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role"},"expert":{"id_refs":["TL-2eaf6e2e22e3","TL-971ca5e62f2e","TL-69bb6515283d","TL-a79af3172fe3","TL-5b0f2a762b02","TL-914c9777aa95"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-1d5e6f67637a","line_ids":["TL-5b70db005647","TL-5d4b69294c34","TL-a0b0b1aba9a4"],"artefact":{"kind":"IN_MEMORY"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/4","ids":["unit:module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/4"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_execution_role","target:stackit_service_account.retail_app_ecs_carts_service_task_execution_role"]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885"]}],"next_step":{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role (DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","type":"aws_iam_role","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.carts_service","class":"RECONFIGURE","confidence":"LOW","target_fit":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["identity.role-assignment","identity.server-service-account","identity.service-account-key"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":6,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":2,"properties_not_carried":2,"not_carried":[{"node":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","property":"assume_role_policy","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.retail_app_ecs.module.carts_service.aws_iam_role.task_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.","semantic":"iam-trust-service-workload","contract":"aws.iam_role","source":"../../lib/ecs/service/iam.tf:31"},{"node":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","property":"name","source":"../../lib/ecs/service/iam.tf:31"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role is a resource of the source, declared in ../../lib/ecs/service/iam.tf (lines 31-35). It is part of module.retail_app_ecs.module.carts_service. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-d016b4d54504"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/12","id":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role"},"expert":{"id_refs":["TL-98117649104a","TL-6aeddbbb224d","TL-fb283641d321","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-8e65e42312a8","TL-384871c6acaf","TL-fa1c8393519e","TL-9f241609c525"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-87c82dac6d26","TL-8931c2124903","TL-7d2073800c6a","TL-926d91287f39","TL-787da01c5236"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-ae8e73203e01","line_ids":["TL-185c870bf3cc","TL-ec727dee66a7","TL-9f0e74bef300"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/12","id":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role"},"expert":{"id_refs":["TL-fb91e685e455","TL-4abbfc31b2d4","TL-7d3b1fce19f9","TL-942dbe8cd334","TL-9dcbf713776e","TL-60baf7ccd117","TL-89b9a0e2d5e4"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-75300c338213","TL-13b1e42def63"],"artefact":{"kind":"REPORT_FILE","file":"terraform/identity.tf","id":"stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role"},"expert":{"id_refs":["TL-2eaf6e2e22e3","TL-971ca5e62f2e","TL-882768799a16","TL-93878f6ca4f3","TL-fc0ec3bf809b","TL-ad298e461c90"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-497b799e87f5","line_ids":["TL-b11d4184ae32","TL-5d4b69294c34","TL-a434bc9a56e0","TL-ca7ff57c86cf"],"artefact":{"kind":"IN_MEMORY"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/12","ids":["unit:module.retail_app_ecs.module.carts_service.aws_iam_role.task_role"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/12"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_task_role","target:stackit_service_account.retail_app_ecs_carts_service_task_role"]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA"]}],"next_step":{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role (DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.carts_service.aws_security_group.this","type":"aws_security_group","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.carts_service","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.security-group"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":3,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":2,"properties_not_carried":2,"not_carried":[{"node":"module.retail_app_ecs.module.carts_service.aws_security_group.this","property":"name","source":"../../lib/ecs/service/sg.tf:1"},{"node":"module.retail_app_ecs.module.carts_service.aws_security_group.this","property":"vpc_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+UNSUPPORTED","category":"network-exposure","reason":"plan: stackit_security_group.retail_app_ecs_carts_service_this vpc_id UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried","semantic":"security-group-vpc-membership","contract":"aws.security_group","source":"../../lib/ecs/service/sg.tf:1"}],"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.carts_service.aws_security_group.this is an AWS security group, declared in ../../lib/ecs/service/sg.tf (lines 1-18). It is part of module.retail_app_ecs.module.carts_service. It states 2 rules.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/13","id":"module.retail_app_ecs.module.carts_service.aws_security_group.this"},"expert":{"id_refs":["TL-a8f0a4cb1f58","TL-6d6d224d0414","TL-c6c4a8483f3c","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-0263dd1d5363","lines":["ingress tcp port 8080 from 0.0.0.0/0","egress any protocol to 0.0.0.0/0"],"artefact":{"kind":"SOURCE_FILE","file":"../../lib/ecs/service/sg.tf","pointer":"lines 1-18"},"expert":{"id_refs":["TL-1b6bb75769f1","TL-d3a23909d906","TL-b43036bd87a0"]}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-1110fbc911ec","line_ids":["TL-91644b931b8d"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.retail_app_ecs.module.carts_service.aws_security_group.this"},"expert":{"id_refs":["TL-f4bdc86495d2","TL-46ec0bd8733b"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-de6015241030","line_ids":["TL-3545a21a7bd6","TL-7a9d5c59572e","TL-1646e3f29bb9","TL-035c2079cbd6"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/13","id":"module.retail_app_ecs.module.carts_service.aws_security_group.this"},"expert":{"id_refs":["TL-ebd04774484c","TL-bff1dfa5e357","TL-603724baa087","TL-750b3fbf1f7f","TL-d6ac55ef30e3","TL-93afdda91a72","TL-625cb7eb6db1"]}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-cffaa762f020","line_ids":["TL-f1f07e52ad07","TL-f6e48092b146"],"artefact":{"kind":"IN_MEMORY","id":"security:module.retail_app_ecs.module.carts_service.aws_security_group.this"},"expert":{"id_refs":["TL-a0b6743aac67","TL-cc90c346c091"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3921a774bd0d","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3","TL-a6e80c38069e","TL-2c414d177d91","TL-6d7438fd76fa","TL-a9898b1d90e1","TL-26417faaa574"],"artefact":{"kind":"IN_MEMORY","id":"network.security-group"},"expert":{"id_refs":["TL-dbe97d4df687","TL-f9c3c1e88738","TL-a4d3f937ca56","TL-11c73f76534f","TL-e55740d24a58","TL-d70d70f815d4","TL-981f57277e1b","TL-090a4fa98fb4","TL-91ac87ca3a51","TL-fffcb79b3f06","TL-ce1f9d88a1e0","TL-39506feb1c20","TL-993a90249cdf","TL-00ce63da408d","TL-5acc71b16e18","TL-00a58746651a","TL-71db89378ca6","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-6f83b385fe74","line_ids":["TL-c87b59f72fe8","TL-72f338f2bbfc","TL-bcd1629bac49"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans","id":"stackit_security_group.retail_app_ecs_carts_service_this"},"expert":{"id_refs":["TL-bdfca9295228","TL-53b7d4603887","TL-39e14a8dce13","TL-df95e598be34","TL-5a268f66d0ef","TL-21d9d0ea3c79","TL-036fb02331b3","TL-1d93a4f94ae4","TL-4780a99f6a42","TL-633fcf9fd15d","TL-575bf4f58d76","TL-ef7556a3d3e2","TL-22bb8c0bf3aa","TL-899fd28c3b9c","TL-560312b2a515","TL-3d810afe81f5"]}},{"stage":"RENDER","state":"ESTABLISHED","summary":"The draft writes 2 resources of this unit as active Terraform.","line_ids":["TL-9935e773c8b2","TL-39be9bf3a654"],"artefact":{"kind":"REPORT_FILE","file":"terraform/security.tf"},"expert":{"id_refs":["TL-e5277af9f12c","TL-e6e0237bf142","TL-5d6d4862b95d","TL-c8b47bfd43e9","TL-ccdd0432dac5"]}},{"stage":"VALIDATION","state":"OPEN","summary_id":"TT-2eed2fdcdabc","line_ids":["TL-b965e925fff4","TL-7338c48d6ad3","TL-779e3b0f817e","TL-e6970c0aa0a5","TL-3b71b9a35b2d","TL-548a1aa887c5"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-f2eb19ea1d78","TL-d477c31ae16d","TL-5ce834a2bf21","TL-5260e0ef58bd","TL-363d3ec284eb","TL-1935467c5b80"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-bb60e90a49bc","line_ids":["TL-2bef4b9999eb","TL-f55858fd4118"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-b6a7ab14d50b","TL-99e29c8aa0dc"]}}]},"refs":{"id":"unit:module.retail_app_ecs.module.carts_service.aws_security_group.this","family":"AWS_SECURITY_GROUP","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/13","ids":["unit:module.retail_app_ecs.module.carts_service.aws_security_group.this"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/13"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:security:module.retail_app_ecs.module.carts_service.aws_security_group.this"]},{"hop":"plan","state":"OPEN","kind":"REPORT_FILE","file":"target-plan.json"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:final-artifact@module.retail_app_ecs.module.carts_service.aws_security_group.this","check:plan-valid@module.retail_app_ecs.module.carts_service.aws_security_group.this","check:renders@module.retail_app_ecs.module.carts_service.aws_security_group.this","check:round-trip@module.retail_app_ecs.module.carts_service.aws_security_group.this","check:rule-has-one-remote@module.retail_app_ecs.module.carts_service.aws_security_group.this"]}],"targets":["target:stackit_security_group.retail_app_ecs_carts_service_this","target:stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 1 open decisions, 0 manual actions","open_decisions":[{"id":"convert:module.retail_app_ecs.module.carts_service.aws_security_group.this:security-group:POD_SEGMENTATION","reasons":["the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision)"],"required_by_phase":"BEFORE_PILOT","question":"Decide how the segmentation that the security group module.retail_app_ecs.module.carts_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.carts_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_carts_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it)","subjects":["module.retail_app_ecs.module.carts_service.aws_ecs_service.this","module.retail_app_ecs.module.carts_service.aws_security_group.this","stackit_security_group.retail_app_ecs_carts_service_this"]}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"behavior_evidence":{"counts":[{"key":"OBSERVED_ON_TARGET","count":2},{"key":"OFFICIAL_DOCUMENTED","count":6},{"key":"NOT_VERIFIED_FOR_VARIANT","count":6},{"key":"CONTRADICTED","count":0}],"open":[{"address":"stackit_security_group.retail_app_ecs_carts_service_this","path":"default_egress.ipv4","state":"NOT_VERIFIED_FOR_VARIANT","variant":"group","rows":["cap:network.security-group/duplicate-default-egress-rule-rejected"],"constraints":[{"row":"cap:network.security-group/default-egress-rules","scope":"OBSERVED_EXACT_VARIANT","note":"tested on a STACKIT project on 2026-10-07"},{"row":"cap:network.security-group/duplicate-default-egress-rule-rejected","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]},{"address":"stackit_security_group.retail_app_ecs_carts_service_this","path":"default_egress.ipv6","state":"NOT_VERIFIED_FOR_VARIANT","variant":"group","rows":["cap:network.security-group/duplicate-default-egress-rule-rejected"],"constraints":[{"row":"cap:network.security-group/default-egress-rules","scope":"OBSERVED_EXACT_VARIANT","note":"tested on a STACKIT project on 2026-10-07"},{"row":"cap:network.security-group/duplicate-default-egress-rule-rejected","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]},{"address":"stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1","path":"ether_type","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/ip-range-family-must-match-ether-type"],"constraints":[{"row":"cap:network.security-group/ether-type-default-ipv4","scope":"OFFICIAL_DOCUMENTED"},{"row":"cap:network.security-group/ip-range-family-must-match-ether-type","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]},{"address":"stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1","path":"ip_range","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/ip-range-family-must-match-ether-type"],"constraints":[{"row":"cap:network.security-group/ip-range-family-must-match-ether-type","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"},{"row":"cap:network.security-group/remote-security-group-by-id","scope":"OFFICIAL_DOCUMENTED"}]},{"address":"stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1","path":"port_range.max","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/port-range-is-destination-port"],"constraints":[{"row":"cap:network.security-group/port-range-bounds","scope":"OFFICIAL_DOCUMENTED"},{"row":"cap:network.security-group/port-range-is-destination-port","scope":"OBSERVED_RELATED_VARIANT","note":"a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)"}]},{"address":"stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1","path":"port_range.min","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/port-range-is-destination-port"],"constraints":[{"row":"cap:network.security-group/port-range-bounds","scope":"OFFICIAL_DOCUMENTED"},{"row":"cap:network.security-group/port-range-is-destination-port","scope":"OBSERVED_RELATED_VARIANT","note":"a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)"}]}]},"coverage":"TRACED","open_work":{"open_steps":6,"not_verified_fields":6,"open_decisions":1,"manual_actions":0,"register":{"open":2,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-POD-SEGMENTATION"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF"]}],"next_step":{"record":"DEC-GEN-CONVERT-POD-SEGMENTATION","source":"PLAN_DECISION","text":"Decide \"pod segmentation\" (DEC-GEN-CONVERT-POD-SEGMENTATION): the plan of the draft leaves it open"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","type":"aws_ecs_service","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.catalog_service","class":"REPLATFORM","confidence":"LOW","target_fit":{"service":"STACKIT Kubernetes Engine (SKE)","resources":["stackit_ske_cluster"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"lifecycle_effects":{"state":"GA","state_reason":"the pinned provider schema has no beta, experimental or deprecated notice on the target's resources","sets":[{"capability":"compute.managed-kubernetes","subject_kind":"kubernetes_minor_version","title":"SKE Kubernetes versions","as_of":"2026-10-08","recheck_after":"2027-01-06","expiring_window_days":30,"production_suitability":"SUITABLE","day2":{"forced_update_by":"PROVIDER","forced_update_statement":"\"If the Kubernetes or OS version of a cluster has reached its expiration date, SKE starts a mandatory update to the highest available patch version of the current minor version, or to the highest patch version of the consecutive minor version that is not classified as preview version.\" and \"mandatory version updates run, even if the auto update for the Kubernetes version is deactivated\". Automatic updates otherwise \"only update to higher patch levels\" in the cluster's maintenance window.","notice":"\"As a SKE user you will get informed via release notes and via email in case you are operating a cluster with a deprecated Kubernetes version.\"","customer_action":"\"you can check the exact expiration dates for your current Kubernetes and node pool versions in the cluster.status.expiration field via the SKE API\". The page does not assign any further duty (workload readiness for the update, testing) to the customer or to STACKIT: not stated."},"versions":[{"subject":"1.36","state":"SUPPORTED","disputed":false,"released_at":{"date":"2026-08-27","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"production_suitability":"SUITABLE","upgrade_action":"NONE_PUBLISHED","migration_timing_risk":"UNKNOWN","note":"No expiry or EOL for 1.36 is stated in the pages read; the lifecycle table does not list it. An unpublished end is reported as such, not as safe."},{"subject":"1.35","state":"UNKNOWN","disputed":false,"expires_at":{"date":"2027-02-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"UNKNOWN","upgrade_action":"UNKNOWN","migration_timing_risk":"UNKNOWN","note":"The pages read give no release date for 1.35 (no release-note entry), so the state stays UNKNOWN: a future expiry date does not say that a version is offered. The 1.34 deprecation entry names 1.35 as the upgrade target."},{"subject":"1.34","state":"EXPIRING","disputed":false,"released_at":{"date":"2025-12-16","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-08-28","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-10-14","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"UPGRADE_BEFORE_EXPIRY","migration_timing_risk":"HIGH","note":"Clusters still on 1.34 are upgraded to 1.35 by the mandatory update (release note of 2026-08-28); the day it runs inside the maintenance window is not stated, so no forced-update date is recorded."},{"subject":"1.33","state":"EXPIRED","disputed":true,"released_at":{"date":"2025-07-29","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-06-09","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-06-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08","dissent":[{"date":"2026-07-08","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"}]},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"The expiry day differs between the lifecycle page (2026-06-10) and the release note (2026-07-08); the state is EXPIRED under either."},{"subject":"1.32","state":"EXPIRED","disputed":false,"deprecated_at":{"date":"2026-02-20","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-04-15","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"No release date for 1.32 appears in the pages read."}],"sources":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/operations/version-updates/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"]}]},"catalogue":{"state":"MATCHED","capabilities":["compute.managed-kubernetes"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":4,"evidence_count":1,"automation_eligible":false,"automation_ceiling":"ANSWERABLE","wave":7,"properties_not_carried":14,"not_carried":[{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","property":"enable_execute_command","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): enable_execute_command = true, tags, wait_for_steady_state = true — a service setting with no counterpart in the draft manifests: Kubernetes has its own rollout (maxSurge, maxUnavailable), health, scheduling and exec behaviour, and tags are not labels here.","semantic":"service-execute-command","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","property":"launch_type","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","property":"network_configuration.assign_public_ip","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods.","semantic":"service-public-ip-setting","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","property":"network_configuration.security_groups","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods.","semantic":"service-network-placement","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","property":"network_configuration.subnets","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods.","semantic":"service-network-placement","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","property":"service_connect_configuration.enabled","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: catalog:80 → container port 8080 (the Service Connect alias catalog:80 of port catalog-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","property":"service_connect_configuration.namespace","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: catalog:80 → container port 8080 (the Service Connect alias catalog:80 of port catalog-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","property":"service_connect_configuration.service.client_alias.dns_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: catalog:80 → container port 8080 (the Service Connect alias catalog:80 of port catalog-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","property":"service_connect_configuration.service.client_alias.port","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: catalog:80 → container port 8080 (the Service Connect alias catalog:80 of port catalog-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","property":"service_connect_configuration.service.discovery_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: catalog:80 → container port 8080 (the Service Connect alias catalog:80 of port catalog-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","property":"service_connect_configuration.service.port_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: catalog:80 → container port 8080 (the Service Connect alias catalog:80 of port catalog-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","property":"wait_for_steady_state","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","property":"network_mode","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this): network_mode = awsvpc, requires_compatibilities — Fargate platform specifics and awsvpc network interface semantics have no Kubernetes counterpart: the pods run on the SKE node pool network and the platform's task sizing steps do not exist.","semantic":"td-network-mode","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:125"},{"node":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","property":"requires_compatibilities","source":"../../lib/ecs/service/ecs.tf:125"}],"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this is a container service (it keeps container tasks running), declared in ../../lib/ecs/service/ecs.tf (lines 136-175). It is part of module.retail_app_ecs.module.catalog_service. It names 2 identities it runs as. This trace follows the identity of the workload: which identity it runs as and what the plan does with it on STACKIT.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/40","id":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-eb6e69766287","TL-8b7cc812905b","TL-d46f02e929c7","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary":"The source names 2 identities this workload runs as.","line_ids":["TL-11dd3a15924a","TL-61c36de98f97"],"artefact":{"kind":"SOURCE_FILE","file":"../../lib/ecs/service/ecs.tf","pointer":"lines 136-175"},"expert":{"id_refs":["TL-30a6fc555da6","TL-64cdc3fd9c4d"]}},{"stage":"RESOLUTION_PROOF","state":"ESTABLISHED","summary_id":"TT-3e49a186cd7f","line_ids":["TL-4b1903a35141","TL-06223ef1858b"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-191d3affeeb5","TL-ec3313ecf936"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-f0a8d4e9043a","line_ids":["TL-424117e74f30","TL-a1eade33c8b0"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/40","id":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-e205ee2ade59","TL-7ebdd3dd35a4","TL-5a72d657029c","TL-b5b97b9044b0","TL-2fd740bb0601","TL-9e089191f346","TL-8e4d39fcf8ec","TL-da2e68bcc2b5","TL-4d992a6cae8d","TL-1de287234081","TL-ec559f03bc2c","TL-bbc56b6870d6","TL-488012de1e76","TL-b5f13fa502d3","TL-884236b97950","TL-17bd32f2135b"]}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-0475c1513230","lines":["The unit is a container service (it keeps container tasks running)"],"artefact":{"kind":"IN_MEMORY","id":"identity:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-0b734eb4a3ea","TL-99e869fe09b9"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3ae2580b0162","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-b1bbbaec7332","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4"],"artefact":{"kind":"IN_MEMORY","id":"identity.server-service-account"},"expert":{"ids":["capability: identity.server-service-account","provider version: 0.121.0"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-fc0024522eee","lines":["2 manual actions, due before the pilot"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-cd5b2a69446f","TL-44e42ceaf736","TL-8e66521ce803","TL-3f89d52abb85"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-3e30d829ac91","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary_id":"TT-7d4d2bc1d7f5","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-fed32ab36cf0","TL-9d1216c1c1c8","TL-d477c31ae16d","TL-5ce834a2bf21","TL-871d4c9b23bb"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","family":"AWS_IDENTITY_ATTACH","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/40","ids":["unit:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/40"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:identity:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this"]},{"hop":"plan","state":"OPEN","kind":"REPORT_FILE","file":"target-plan.json"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:attach-complete@module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","check:final-artifact@module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","check:plan-valid@module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","check:renders@module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","check:round-trip@module.retail_app_ecs.module.catalog_service.aws_ecs_service.this"]}],"targets":["target:stackit_ske_cluster.retail_app_ecs_cluster"]},"plan_statements":[{"id":"stackitsa:statement:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","family":"stackitsa","reason":"MANUAL_REVIEW","cause":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person)","manual_actions":[{"id":"stackitsa:facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this#execution_role_arn","kind":"OTHER","phase":"BEFORE_PILOT","what":"Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach","why":"the role is the platform agent's identity, not the application's (execution_role_arn of module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role). a platform agent's identity is not an application identity and has no STACKIT counterpart; the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person"},{"id":"stackitsa:facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this#task_role_arn","kind":"OTHER","phase":"BEFORE_PILOT","what":"Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it","why":"the workload is a container service, not a server an account is attached to (task_role_arn of module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role). the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person"}]}],"workload_readiness":{"applies":true,"dimensions":[{"id":"bootstrap_configuration","state":"NOT_ASSESSED"},{"id":"source_artifacts","state":"NOT_ASSESSED"},{"id":"target_preconditions","state":"NOT_ASSESSED"},{"id":"cutover","state":"NOT_ASSESSED"},{"id":"day2_operations","state":"NOT_ASSESSED"}]},"coverage":"TRACED","open_work":{"open_steps":3,"register":{"open":6,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883"]},{"source":"PLAN_STATEMENT","open_records":["DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW"]}],"next_step":{"record":"DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","type":"aws_iam_role","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.catalog_service","class":"RECONFIGURE","confidence":"LOW","target_fit":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["identity.role-assignment","identity.server-service-account","identity.service-account-key"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":7,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":6,"properties_not_carried":2,"not_carried":[{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","property":"assume_role_policy","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.","semantic":"iam-trust-service-workload","contract":"aws.iam_role","source":"../../lib/ecs/service/iam.tf:14"},{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","property":"name","source":"../../lib/ecs/service/iam.tf:14"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role is a resource of the source, declared in ../../lib/ecs/service/iam.tf (lines 14-18). It is part of module.retail_app_ecs.module.catalog_service. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-bdf43443dac8"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/38","id":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role"},"expert":{"id_refs":["TL-98117649104a","TL-6aeddbbb224d","TL-fb283641d321","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-6e1051723f2f","TL-8065d96ddfaf","TL-fa1c8393519e","TL-9f241609c525"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-87c82dac6d26","TL-8931c2124903","TL-7d2073800c6a","TL-bf1127382e01","TL-0fb430301b58"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-ae8e73203e01","line_ids":["TL-185c870bf3cc","TL-ec727dee66a7","TL-9f0e74bef300"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/38","id":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role"},"expert":{"id_refs":["TL-fb91e685e455","TL-df6e1c6ce7f0","TL-7d3b1fce19f9","TL-0c0c72bb0310","TL-49f4d75dbc78","TL-60baf7ccd117","TL-89b9a0e2d5e4"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-2b91fa380a69","TL-3c9de85de43c"],"artefact":{"kind":"REPORT_FILE","file":"terraform/identity.tf","id":"stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role"},"expert":{"id_refs":["TL-212502079f8a","TL-c93fbdc19c96","TL-716797b6aba6","TL-0bdd23c293a2","TL-0c599a894c69","TL-c59ff702359b"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-e72b9c31a2bd","line_ids":["TL-5b70db005647","TL-5d4b69294c34","TL-942a3220b1ea","TL-27e760ebc57b","TL-e3d9704fb87f"],"artefact":{"kind":"IN_MEMORY"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/38","ids":["unit:module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/38"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_execution_role","target:stackit_service_account.retail_app_ecs_catalog_service_task_execution_role"]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913"]}],"next_step":{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role (DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","type":"aws_iam_role","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.catalog_service","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["identity.role-assignment","identity.server-service-account","identity.service-account-key"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":4,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":2,"properties_not_carried":2,"not_carried":[{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","property":"assume_role_policy","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.","semantic":"iam-trust-service-workload","contract":"aws.iam_role","source":"../../lib/ecs/service/iam.tf:31"},{"node":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","property":"name","source":"../../lib/ecs/service/iam.tf:31"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role is a resource of the source, declared in ../../lib/ecs/service/iam.tf (lines 31-35). It is part of module.retail_app_ecs.module.catalog_service. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-e497ce17d5ae"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/14","id":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role"},"expert":{"id_refs":["TL-98117649104a","TL-6aeddbbb224d","TL-fb283641d321","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-6e1051723f2f","TL-8065d96ddfaf","TL-fa1c8393519e","TL-9f241609c525"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-8931c2124903","TL-7d2073800c6a","TL-1d4ef35ce684","TL-fd3d4c0f86ad"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-d43161aa7b39","line_ids":["TL-b8dcaad7eb2a","TL-ec727dee66a7","TL-9f0e74bef300"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/14","id":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role"},"expert":{"id_refs":["TL-fb91e685e455","TL-4abbfc31b2d4","TL-7d3b1fce19f9","TL-49f4d75dbc78","TL-60baf7ccd117","TL-89b9a0e2d5e4"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-751981886de9","TL-c3f18e26eaee"],"artefact":{"kind":"REPORT_FILE","file":"terraform/identity.tf","id":"stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role"},"expert":{"id_refs":["TL-212502079f8a","TL-c93fbdc19c96","TL-c38f5d7fd7ea","TL-a8b04486f7f0","TL-b449e06df0f6","TL-017ff5f204a8"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-1d5e6f67637a","line_ids":["TL-b0725865d4c2","TL-5d4b69294c34","TL-87a2bfc89a83"],"artefact":{"kind":"IN_MEMORY"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/14","ids":["unit:module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/14"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_task_role","target:stackit_service_account.retail_app_ecs_catalog_service_task_role"]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1"]}],"next_step":{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role (DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","type":"aws_security_group","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.catalog_service","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.security-group"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":3,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":2,"properties_not_carried":2,"not_carried":[{"node":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","property":"name","source":"../../lib/ecs/service/sg.tf:1"},{"node":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","property":"vpc_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+UNSUPPORTED","category":"network-exposure","reason":"plan: stackit_security_group.retail_app_ecs_catalog_service_this vpc_id UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried","semantic":"security-group-vpc-membership","contract":"aws.security_group","source":"../../lib/ecs/service/sg.tf:1"}],"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.catalog_service.aws_security_group.this is an AWS security group, declared in ../../lib/ecs/service/sg.tf (lines 1-18). It is part of module.retail_app_ecs.module.catalog_service. It states 2 rules.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/15","id":"module.retail_app_ecs.module.catalog_service.aws_security_group.this"},"expert":{"id_refs":["TL-a8f0a4cb1f58","TL-6d6d224d0414","TL-c6c4a8483f3c","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-0263dd1d5363","lines":["ingress tcp port 8080 from 0.0.0.0/0","egress any protocol to 0.0.0.0/0"],"artefact":{"kind":"SOURCE_FILE","file":"../../lib/ecs/service/sg.tf","pointer":"lines 1-18"},"expert":{"id_refs":["TL-1b6bb75769f1","TL-d3a23909d906","TL-b43036bd87a0"]}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-1110fbc911ec","line_ids":["TL-91644b931b8d"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.retail_app_ecs.module.catalog_service.aws_security_group.this"},"expert":{"id_refs":["TL-f4bdc86495d2","TL-46ec0bd8733b"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-de6015241030","line_ids":["TL-3545a21a7bd6","TL-7a9d5c59572e","TL-1646e3f29bb9","TL-035c2079cbd6"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/15","id":"module.retail_app_ecs.module.catalog_service.aws_security_group.this"},"expert":{"id_refs":["TL-ebd04774484c","TL-bff1dfa5e357","TL-603724baa087","TL-750b3fbf1f7f","TL-d6ac55ef30e3","TL-93afdda91a72","TL-625cb7eb6db1"]}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-cffaa762f020","line_ids":["TL-f1f07e52ad07","TL-f6e48092b146"],"artefact":{"kind":"IN_MEMORY","id":"security:module.retail_app_ecs.module.catalog_service.aws_security_group.this"},"expert":{"id_refs":["TL-a0b6743aac67","TL-cc90c346c091"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3921a774bd0d","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3","TL-a6e80c38069e","TL-2c414d177d91","TL-6d7438fd76fa","TL-a9898b1d90e1","TL-26417faaa574"],"artefact":{"kind":"IN_MEMORY","id":"network.security-group"},"expert":{"id_refs":["TL-dbe97d4df687","TL-f9c3c1e88738","TL-a4d3f937ca56","TL-11c73f76534f","TL-e55740d24a58","TL-d70d70f815d4","TL-981f57277e1b","TL-090a4fa98fb4","TL-91ac87ca3a51","TL-fffcb79b3f06","TL-ce1f9d88a1e0","TL-39506feb1c20","TL-993a90249cdf","TL-00ce63da408d","TL-5acc71b16e18","TL-00a58746651a","TL-71db89378ca6","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-6f83b385fe74","line_ids":["TL-e796886b33ed","TL-16c8035e9a6a","TL-bcd1629bac49"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans","id":"stackit_security_group.retail_app_ecs_catalog_service_this"},"expert":{"id_refs":["TL-bdfca9295228","TL-b30766a80738","TL-f51db642f584","TL-938a72d0233d","TL-a5d9a92f75cd","TL-89c646ac815b","TL-983bffe35aec","TL-8caf9748ba72","TL-ffea000e11cd","TL-5a2c075c134f","TL-67a43548b632","TL-cf0a695af244","TL-d295ba2b301a","TL-899fd28c3b9c","TL-560312b2a515","TL-3d810afe81f5"]}},{"stage":"RENDER","state":"ESTABLISHED","summary":"The draft writes 2 resources of this unit as active Terraform.","line_ids":["TL-d948417c6b00","TL-880aed537304"],"artefact":{"kind":"REPORT_FILE","file":"terraform/security.tf"},"expert":{"id_refs":["TL-896e11b91680","TL-d6b53adc609a","TL-5d6d4862b95d","TL-b3c7984e8072","TL-4ba2ebd49fc9"]}},{"stage":"VALIDATION","state":"OPEN","summary_id":"TT-2eed2fdcdabc","line_ids":["TL-b965e925fff4","TL-7338c48d6ad3","TL-779e3b0f817e","TL-e6970c0aa0a5","TL-3b71b9a35b2d","TL-548a1aa887c5"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-f2eb19ea1d78","TL-d477c31ae16d","TL-5ce834a2bf21","TL-5260e0ef58bd","TL-363d3ec284eb","TL-1935467c5b80"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-bb60e90a49bc","line_ids":["TL-6adaaf0952ec","TL-d155c07d75d6"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-7c3ef89c8f99","TL-0b1eb5e49e49"]}}]},"refs":{"id":"unit:module.retail_app_ecs.module.catalog_service.aws_security_group.this","family":"AWS_SECURITY_GROUP","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/15","ids":["unit:module.retail_app_ecs.module.catalog_service.aws_security_group.this"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/15"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:security:module.retail_app_ecs.module.catalog_service.aws_security_group.this"]},{"hop":"plan","state":"OPEN","kind":"REPORT_FILE","file":"target-plan.json"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:final-artifact@module.retail_app_ecs.module.catalog_service.aws_security_group.this","check:plan-valid@module.retail_app_ecs.module.catalog_service.aws_security_group.this","check:renders@module.retail_app_ecs.module.catalog_service.aws_security_group.this","check:round-trip@module.retail_app_ecs.module.catalog_service.aws_security_group.this","check:rule-has-one-remote@module.retail_app_ecs.module.catalog_service.aws_security_group.this"]}],"targets":["target:stackit_security_group.retail_app_ecs_catalog_service_this","target:stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 1 open decisions, 0 manual actions","open_decisions":[{"id":"convert:module.retail_app_ecs.module.catalog_service.aws_security_group.this:security-group:POD_SEGMENTATION","reasons":["the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision)"],"required_by_phase":"BEFORE_PILOT","question":"Decide how the segmentation that the security group module.retail_app_ecs.module.catalog_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_catalog_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it)","subjects":["module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","module.retail_app_ecs.module.catalog_service.aws_security_group.this","stackit_security_group.retail_app_ecs_catalog_service_this"]}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"behavior_evidence":{"counts":[{"key":"OBSERVED_ON_TARGET","count":2},{"key":"OFFICIAL_DOCUMENTED","count":6},{"key":"NOT_VERIFIED_FOR_VARIANT","count":6},{"key":"CONTRADICTED","count":0}],"open":[{"address":"stackit_security_group.retail_app_ecs_catalog_service_this","path":"default_egress.ipv4","state":"NOT_VERIFIED_FOR_VARIANT","variant":"group","rows":["cap:network.security-group/duplicate-default-egress-rule-rejected"],"constraints":[{"row":"cap:network.security-group/default-egress-rules","scope":"OBSERVED_EXACT_VARIANT","note":"tested on a STACKIT project on 2026-10-07"},{"row":"cap:network.security-group/duplicate-default-egress-rule-rejected","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]},{"address":"stackit_security_group.retail_app_ecs_catalog_service_this","path":"default_egress.ipv6","state":"NOT_VERIFIED_FOR_VARIANT","variant":"group","rows":["cap:network.security-group/duplicate-default-egress-rule-rejected"],"constraints":[{"row":"cap:network.security-group/default-egress-rules","scope":"OBSERVED_EXACT_VARIANT","note":"tested on a STACKIT project on 2026-10-07"},{"row":"cap:network.security-group/duplicate-default-egress-rule-rejected","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]},{"address":"stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1","path":"ether_type","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/ip-range-family-must-match-ether-type"],"constraints":[{"row":"cap:network.security-group/ether-type-default-ipv4","scope":"OFFICIAL_DOCUMENTED"},{"row":"cap:network.security-group/ip-range-family-must-match-ether-type","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]},{"address":"stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1","path":"ip_range","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/ip-range-family-must-match-ether-type"],"constraints":[{"row":"cap:network.security-group/ip-range-family-must-match-ether-type","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"},{"row":"cap:network.security-group/remote-security-group-by-id","scope":"OFFICIAL_DOCUMENTED"}]},{"address":"stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1","path":"port_range.max","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/port-range-is-destination-port"],"constraints":[{"row":"cap:network.security-group/port-range-bounds","scope":"OFFICIAL_DOCUMENTED"},{"row":"cap:network.security-group/port-range-is-destination-port","scope":"OBSERVED_RELATED_VARIANT","note":"a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)"}]},{"address":"stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1","path":"port_range.min","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/port-range-is-destination-port"],"constraints":[{"row":"cap:network.security-group/port-range-bounds","scope":"OFFICIAL_DOCUMENTED"},{"row":"cap:network.security-group/port-range-is-destination-port","scope":"OBSERVED_RELATED_VARIANT","note":"a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)"}]}]},"coverage":"TRACED","open_work":{"open_steps":6,"not_verified_fields":6,"open_decisions":1,"manual_actions":0,"register":{"open":2,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-POD-SEGMENTATION"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F"]}],"next_step":{"record":"DEC-GEN-CONVERT-POD-SEGMENTATION","source":"PLAN_DECISION","text":"Decide \"pod segmentation\" (DEC-GEN-CONVERT-POD-SEGMENTATION): the plan of the draft leaves it open"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","type":"aws_ecs_service","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.checkout_service","class":"REPLATFORM","confidence":"MEDIUM","target_fit":{"service":"STACKIT Kubernetes Engine (SKE)","resources":["stackit_ske_cluster"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"lifecycle_effects":{"state":"GA","state_reason":"the pinned provider schema has no beta, experimental or deprecated notice on the target's resources","sets":[{"capability":"compute.managed-kubernetes","subject_kind":"kubernetes_minor_version","title":"SKE Kubernetes versions","as_of":"2026-10-08","recheck_after":"2027-01-06","expiring_window_days":30,"production_suitability":"SUITABLE","day2":{"forced_update_by":"PROVIDER","forced_update_statement":"\"If the Kubernetes or OS version of a cluster has reached its expiration date, SKE starts a mandatory update to the highest available patch version of the current minor version, or to the highest patch version of the consecutive minor version that is not classified as preview version.\" and \"mandatory version updates run, even if the auto update for the Kubernetes version is deactivated\". Automatic updates otherwise \"only update to higher patch levels\" in the cluster's maintenance window.","notice":"\"As a SKE user you will get informed via release notes and via email in case you are operating a cluster with a deprecated Kubernetes version.\"","customer_action":"\"you can check the exact expiration dates for your current Kubernetes and node pool versions in the cluster.status.expiration field via the SKE API\". The page does not assign any further duty (workload readiness for the update, testing) to the customer or to STACKIT: not stated."},"versions":[{"subject":"1.36","state":"SUPPORTED","disputed":false,"released_at":{"date":"2026-08-27","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"production_suitability":"SUITABLE","upgrade_action":"NONE_PUBLISHED","migration_timing_risk":"UNKNOWN","note":"No expiry or EOL for 1.36 is stated in the pages read; the lifecycle table does not list it. An unpublished end is reported as such, not as safe."},{"subject":"1.35","state":"UNKNOWN","disputed":false,"expires_at":{"date":"2027-02-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"UNKNOWN","upgrade_action":"UNKNOWN","migration_timing_risk":"UNKNOWN","note":"The pages read give no release date for 1.35 (no release-note entry), so the state stays UNKNOWN: a future expiry date does not say that a version is offered. The 1.34 deprecation entry names 1.35 as the upgrade target."},{"subject":"1.34","state":"EXPIRING","disputed":false,"released_at":{"date":"2025-12-16","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-08-28","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-10-14","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"UPGRADE_BEFORE_EXPIRY","migration_timing_risk":"HIGH","note":"Clusters still on 1.34 are upgraded to 1.35 by the mandatory update (release note of 2026-08-28); the day it runs inside the maintenance window is not stated, so no forced-update date is recorded."},{"subject":"1.33","state":"EXPIRED","disputed":true,"released_at":{"date":"2025-07-29","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-06-09","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-06-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08","dissent":[{"date":"2026-07-08","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"}]},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"The expiry day differs between the lifecycle page (2026-06-10) and the release note (2026-07-08); the state is EXPIRED under either."},{"subject":"1.32","state":"EXPIRED","disputed":false,"deprecated_at":{"date":"2026-02-20","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-04-15","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"No release date for 1.32 appears in the pages read."}],"sources":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/operations/version-updates/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"]}]},"catalogue":{"state":"MATCHED","capabilities":["compute.managed-kubernetes"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":1,"automation_eligible":false,"automation_ceiling":"ANSWERABLE","wave":8,"properties_not_carried":14,"not_carried":[{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","property":"enable_execute_command","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): enable_execute_command = true, tags, wait_for_steady_state = true — a service setting with no counterpart in the draft manifests: Kubernetes has its own rollout (maxSurge, maxUnavailable), health, scheduling and exec behaviour, and tags are not labels here.","semantic":"service-execute-command","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","property":"launch_type","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","property":"network_configuration.assign_public_ip","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods.","semantic":"service-public-ip-setting","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","property":"network_configuration.security_groups","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods.","semantic":"service-network-placement","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","property":"network_configuration.subnets","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods.","semantic":"service-network-placement","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","property":"service_connect_configuration.enabled","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: checkout:80 → container port 8080 (the Service Connect alias checkout:80 of port checkout-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","property":"service_connect_configuration.namespace","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: checkout:80 → container port 8080 (the Service Connect alias checkout:80 of port checkout-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","property":"service_connect_configuration.service.client_alias.dns_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: checkout:80 → container port 8080 (the Service Connect alias checkout:80 of port checkout-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","property":"service_connect_configuration.service.client_alias.port","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: checkout:80 → container port 8080 (the Service Connect alias checkout:80 of port checkout-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","property":"service_connect_configuration.service.discovery_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: checkout:80 → container port 8080 (the Service Connect alias checkout:80 of port checkout-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","property":"service_connect_configuration.service.port_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: checkout:80 → container port 8080 (the Service Connect alias checkout:80 of port checkout-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","property":"wait_for_steady_state","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","property":"network_mode","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this): network_mode = awsvpc, requires_compatibilities — Fargate platform specifics and awsvpc network interface semantics have no Kubernetes counterpart: the pods run on the SKE node pool network and the platform's task sizing steps do not exist.","semantic":"td-network-mode","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:125"},{"node":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","property":"requires_compatibilities","source":"../../lib/ecs/service/ecs.tf:125"}],"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this is a container service (it keeps container tasks running), declared in ../../lib/ecs/service/ecs.tf (lines 136-175). It is part of module.retail_app_ecs.module.checkout_service. It names 2 identities it runs as. This trace follows the identity of the workload: which identity it runs as and what the plan does with it on STACKIT.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/42","id":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-eb6e69766287","TL-8b7cc812905b","TL-d46f02e929c7","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary":"The source names 2 identities this workload runs as.","line_ids":["TL-9972c13728dd","TL-1b1968a516f2"],"artefact":{"kind":"SOURCE_FILE","file":"../../lib/ecs/service/ecs.tf","pointer":"lines 136-175"},"expert":{"id_refs":["TL-00e5e7b98a35","TL-3ba0e93eaca8"]}},{"stage":"RESOLUTION_PROOF","state":"ESTABLISHED","summary_id":"TT-3e49a186cd7f","line_ids":["TL-d2221d61a7c7","TL-e40deead9910"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-84b27480518b","TL-abaced7ba3ec"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-5cd8347618b1","line_ids":["TL-c6c0b60e18ad","TL-a1eade33c8b0"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/42","id":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-7ebdd3dd35a4","TL-5a72d657029c","TL-b5b97b9044b0","TL-2fd740bb0601","TL-9e089191f346","TL-8e4d39fcf8ec","TL-da2e68bcc2b5","TL-4d992a6cae8d","TL-1de287234081","TL-ec559f03bc2c","TL-bbc56b6870d6","TL-488012de1e76","TL-b5f13fa502d3","TL-884236b97950","TL-17bd32f2135b"]}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-0475c1513230","lines":["The unit is a container service (it keeps container tasks running)"],"artefact":{"kind":"IN_MEMORY","id":"identity:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-0b734eb4a3ea","TL-99e869fe09b9"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3ae2580b0162","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-b1bbbaec7332","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4"],"artefact":{"kind":"IN_MEMORY","id":"identity.server-service-account"},"expert":{"ids":["capability: identity.server-service-account","provider version: 0.121.0"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-fc0024522eee","lines":["2 manual actions, due before the pilot"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-b1c1e9b968e8","TL-2e7d45151ab9","TL-8e66521ce803","TL-3f89d52abb85"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-3e30d829ac91","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary_id":"TT-7d4d2bc1d7f5","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-fed32ab36cf0","TL-9d1216c1c1c8","TL-d477c31ae16d","TL-5ce834a2bf21","TL-871d4c9b23bb"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","family":"AWS_IDENTITY_ATTACH","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/42","ids":["unit:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/42"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:identity:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this"]},{"hop":"plan","state":"OPEN","kind":"REPORT_FILE","file":"target-plan.json"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:attach-complete@module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","check:final-artifact@module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","check:plan-valid@module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","check:renders@module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","check:round-trip@module.retail_app_ecs.module.checkout_service.aws_ecs_service.this"]}],"targets":["target:stackit_ske_cluster.retail_app_ecs_cluster"]},"plan_statements":[{"id":"stackitsa:statement:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","family":"stackitsa","reason":"MANUAL_REVIEW","cause":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person)","manual_actions":[{"id":"stackitsa:facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this#execution_role_arn","kind":"OTHER","phase":"BEFORE_PILOT","what":"Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach","why":"the role is the platform agent's identity, not the application's (execution_role_arn of module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role). a platform agent's identity is not an application identity and has no STACKIT counterpart; the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person"},{"id":"stackitsa:facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this#task_role_arn","kind":"OTHER","phase":"BEFORE_PILOT","what":"Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it","why":"the workload is a container service, not a server an account is attached to (task_role_arn of module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role). the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person"}]}],"workload_readiness":{"applies":true,"dimensions":[{"id":"bootstrap_configuration","state":"NOT_ASSESSED"},{"id":"source_artifacts","state":"NOT_ASSESSED"},{"id":"target_preconditions","state":"NOT_ASSESSED"},{"id":"cutover","state":"NOT_ASSESSED"},{"id":"day2_operations","state":"NOT_ASSESSED"}]},"coverage":"TRACED","open_work":{"open_steps":3,"register":{"open":6,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6"]},{"source":"PLAN_STATEMENT","open_records":["DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW"]}],"next_step":{"record":"DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","type":"aws_iam_role","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.checkout_service","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["identity.role-assignment","identity.server-service-account","identity.service-account-key"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":3,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":1,"properties_not_carried":2,"not_carried":[{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","property":"assume_role_policy","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.","semantic":"iam-trust-service-workload","contract":"aws.iam_role","source":"../../lib/ecs/service/iam.tf:14"},{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","property":"name","source":"../../lib/ecs/service/iam.tf:14"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role is a resource of the source, declared in ../../lib/ecs/service/iam.tf (lines 14-18). It is part of module.retail_app_ecs.module.checkout_service. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-812c351c2405"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/5","id":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role"},"expert":{"id_refs":["TL-98117649104a","TL-6aeddbbb224d","TL-fb283641d321","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-86b5045bb7aa","TL-8dbb73faf140","TL-fa1c8393519e","TL-9f241609c525"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-8931c2124903","TL-7d2073800c6a","TL-4f39a4e019f1","TL-9861dc42113c"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-d43161aa7b39","line_ids":["TL-b8dcaad7eb2a","TL-ec727dee66a7","TL-9f0e74bef300"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/5","id":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role"},"expert":{"id_refs":["TL-fb91e685e455","TL-df6e1c6ce7f0","TL-7d3b1fce19f9","TL-49f4d75dbc78","TL-60baf7ccd117","TL-89b9a0e2d5e4"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-738e770415b4","TL-a6d7abc53432"],"artefact":{"kind":"REPORT_FILE","file":"terraform/identity.tf","id":"stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role"},"expert":{"id_refs":["TL-dc6bfa12fa59","TL-6d5dc8740566","TL-697ef16383d0","TL-6f72f0cb39aa","TL-5e69f4e67a61","TL-14a22cd3a75b"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-1d5e6f67637a","line_ids":["TL-5b70db005647","TL-5d4b69294c34","TL-1af7965085f7"],"artefact":{"kind":"IN_MEMORY"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/5","ids":["unit:module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/5"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_execution_role","target:stackit_service_account.retail_app_ecs_checkout_service_task_execution_role"]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673"]}],"next_step":{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role (DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","type":"aws_iam_role","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.checkout_service","class":"RECONFIGURE","confidence":"LOW","target_fit":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["identity.role-assignment","identity.server-service-account","identity.service-account-key"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":6,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":2,"properties_not_carried":2,"not_carried":[{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","property":"assume_role_policy","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.","semantic":"iam-trust-service-workload","contract":"aws.iam_role","source":"../../lib/ecs/service/iam.tf:31"},{"node":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","property":"name","source":"../../lib/ecs/service/iam.tf:31"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role is a resource of the source, declared in ../../lib/ecs/service/iam.tf (lines 31-35). It is part of module.retail_app_ecs.module.checkout_service. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-d016b4d54504"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/16","id":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role"},"expert":{"id_refs":["TL-98117649104a","TL-6aeddbbb224d","TL-fb283641d321","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-86b5045bb7aa","TL-8dbb73faf140","TL-fa1c8393519e","TL-9f241609c525"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-87c82dac6d26","TL-8931c2124903","TL-7d2073800c6a","TL-f5563745ba53","TL-6cf2ec48891a"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-ae8e73203e01","line_ids":["TL-185c870bf3cc","TL-ec727dee66a7","TL-9f0e74bef300"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/16","id":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role"},"expert":{"id_refs":["TL-fb91e685e455","TL-4abbfc31b2d4","TL-7d3b1fce19f9","TL-942dbe8cd334","TL-9dcbf713776e","TL-60baf7ccd117","TL-89b9a0e2d5e4"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-eb51d0f2f615","TL-fc76211e5aa7"],"artefact":{"kind":"REPORT_FILE","file":"terraform/identity.tf","id":"stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role"},"expert":{"id_refs":["TL-dc6bfa12fa59","TL-6d5dc8740566","TL-068bb51be77b","TL-463c00929f65","TL-ed3a90932174","TL-0bea6969aa69"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-497b799e87f5","line_ids":["TL-b0725865d4c2","TL-5d4b69294c34","TL-a434bc9a56e0","TL-a630e5a2d1f6"],"artefact":{"kind":"IN_MEMORY"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/16","ids":["unit:module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/16"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_task_role","target:stackit_service_account.retail_app_ecs_checkout_service_task_role"]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6"]}],"next_step":{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role (DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","type":"aws_security_group","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.checkout_service","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.security-group"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":3,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":2,"properties_not_carried":2,"not_carried":[{"node":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","property":"name","source":"../../lib/ecs/service/sg.tf:1"},{"node":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","property":"vpc_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+UNSUPPORTED","category":"network-exposure","reason":"plan: stackit_security_group.retail_app_ecs_checkout_service_this vpc_id UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried","semantic":"security-group-vpc-membership","contract":"aws.security_group","source":"../../lib/ecs/service/sg.tf:1"}],"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.checkout_service.aws_security_group.this is an AWS security group, declared in ../../lib/ecs/service/sg.tf (lines 1-18). It is part of module.retail_app_ecs.module.checkout_service. It states 2 rules.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/17","id":"module.retail_app_ecs.module.checkout_service.aws_security_group.this"},"expert":{"id_refs":["TL-a8f0a4cb1f58","TL-6d6d224d0414","TL-c6c4a8483f3c","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-0263dd1d5363","lines":["ingress tcp port 8080 from 0.0.0.0/0","egress any protocol to 0.0.0.0/0"],"artefact":{"kind":"SOURCE_FILE","file":"../../lib/ecs/service/sg.tf","pointer":"lines 1-18"},"expert":{"id_refs":["TL-1b6bb75769f1","TL-d3a23909d906","TL-b43036bd87a0"]}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-1110fbc911ec","line_ids":["TL-91644b931b8d"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.retail_app_ecs.module.checkout_service.aws_security_group.this"},"expert":{"id_refs":["TL-f4bdc86495d2","TL-46ec0bd8733b"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-de6015241030","line_ids":["TL-3545a21a7bd6","TL-7a9d5c59572e","TL-1646e3f29bb9","TL-035c2079cbd6"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/17","id":"module.retail_app_ecs.module.checkout_service.aws_security_group.this"},"expert":{"id_refs":["TL-ebd04774484c","TL-bff1dfa5e357","TL-603724baa087","TL-750b3fbf1f7f","TL-d6ac55ef30e3","TL-93afdda91a72","TL-625cb7eb6db1"]}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-cffaa762f020","line_ids":["TL-f1f07e52ad07","TL-f6e48092b146"],"artefact":{"kind":"IN_MEMORY","id":"security:module.retail_app_ecs.module.checkout_service.aws_security_group.this"},"expert":{"id_refs":["TL-a0b6743aac67","TL-cc90c346c091"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3921a774bd0d","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3","TL-a6e80c38069e","TL-2c414d177d91","TL-6d7438fd76fa","TL-a9898b1d90e1","TL-26417faaa574"],"artefact":{"kind":"IN_MEMORY","id":"network.security-group"},"expert":{"id_refs":["TL-dbe97d4df687","TL-f9c3c1e88738","TL-a4d3f937ca56","TL-11c73f76534f","TL-e55740d24a58","TL-d70d70f815d4","TL-981f57277e1b","TL-090a4fa98fb4","TL-91ac87ca3a51","TL-fffcb79b3f06","TL-ce1f9d88a1e0","TL-39506feb1c20","TL-993a90249cdf","TL-00ce63da408d","TL-5acc71b16e18","TL-00a58746651a","TL-71db89378ca6","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-6f83b385fe74","line_ids":["TL-eb6969879f57","TL-0b45138271ec","TL-bcd1629bac49"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans","id":"stackit_security_group.retail_app_ecs_checkout_service_this"},"expert":{"id_refs":["TL-bdfca9295228","TL-720e0ca96a1b","TL-d3824da0a207","TL-b9a1cc50acd4","TL-695bfb19cce8","TL-d41311b8b67f","TL-05a460adc0a6","TL-a808280131f4","TL-1265c3a92ae8","TL-0b15254327de","TL-a67bc5ed2fae","TL-5d3fd7a7ba83","TL-bcabc81573ee","TL-899fd28c3b9c","TL-560312b2a515","TL-3d810afe81f5"]}},{"stage":"RENDER","state":"ESTABLISHED","summary":"The draft writes 2 resources of this unit as active Terraform.","line_ids":["TL-7049d986efc2","TL-db488a755ee8"],"artefact":{"kind":"REPORT_FILE","file":"terraform/security.tf"},"expert":{"id_refs":["TL-d3b74bb7bd2a","TL-e2beab721b43","TL-5d6d4862b95d","TL-52099c14b2e9","TL-e2561ba5bd07"]}},{"stage":"VALIDATION","state":"OPEN","summary_id":"TT-2eed2fdcdabc","line_ids":["TL-b965e925fff4","TL-7338c48d6ad3","TL-779e3b0f817e","TL-e6970c0aa0a5","TL-3b71b9a35b2d","TL-548a1aa887c5"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-f2eb19ea1d78","TL-d477c31ae16d","TL-5ce834a2bf21","TL-5260e0ef58bd","TL-363d3ec284eb","TL-1935467c5b80"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-bb60e90a49bc","line_ids":["TL-5a32e51c72e5","TL-72d48d3c8867"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-cd3dd578f82e","TL-7b7164bbe060"]}}]},"refs":{"id":"unit:module.retail_app_ecs.module.checkout_service.aws_security_group.this","family":"AWS_SECURITY_GROUP","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/17","ids":["unit:module.retail_app_ecs.module.checkout_service.aws_security_group.this"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/17"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:security:module.retail_app_ecs.module.checkout_service.aws_security_group.this"]},{"hop":"plan","state":"OPEN","kind":"REPORT_FILE","file":"target-plan.json"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:final-artifact@module.retail_app_ecs.module.checkout_service.aws_security_group.this","check:plan-valid@module.retail_app_ecs.module.checkout_service.aws_security_group.this","check:renders@module.retail_app_ecs.module.checkout_service.aws_security_group.this","check:round-trip@module.retail_app_ecs.module.checkout_service.aws_security_group.this","check:rule-has-one-remote@module.retail_app_ecs.module.checkout_service.aws_security_group.this"]}],"targets":["target:stackit_security_group.retail_app_ecs_checkout_service_this","target:stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 1 open decisions, 0 manual actions","open_decisions":[{"id":"convert:module.retail_app_ecs.module.checkout_service.aws_security_group.this:security-group:POD_SEGMENTATION","reasons":["the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision)"],"required_by_phase":"BEFORE_PILOT","question":"Decide how the segmentation that the security group module.retail_app_ecs.module.checkout_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_checkout_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it)","subjects":["module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","module.retail_app_ecs.module.checkout_service.aws_security_group.this","stackit_security_group.retail_app_ecs_checkout_service_this"]}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"behavior_evidence":{"counts":[{"key":"OBSERVED_ON_TARGET","count":2},{"key":"OFFICIAL_DOCUMENTED","count":6},{"key":"NOT_VERIFIED_FOR_VARIANT","count":6},{"key":"CONTRADICTED","count":0}],"open":[{"address":"stackit_security_group.retail_app_ecs_checkout_service_this","path":"default_egress.ipv4","state":"NOT_VERIFIED_FOR_VARIANT","variant":"group","rows":["cap:network.security-group/duplicate-default-egress-rule-rejected"],"constraints":[{"row":"cap:network.security-group/default-egress-rules","scope":"OBSERVED_EXACT_VARIANT","note":"tested on a STACKIT project on 2026-10-07"},{"row":"cap:network.security-group/duplicate-default-egress-rule-rejected","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]},{"address":"stackit_security_group.retail_app_ecs_checkout_service_this","path":"default_egress.ipv6","state":"NOT_VERIFIED_FOR_VARIANT","variant":"group","rows":["cap:network.security-group/duplicate-default-egress-rule-rejected"],"constraints":[{"row":"cap:network.security-group/default-egress-rules","scope":"OBSERVED_EXACT_VARIANT","note":"tested on a STACKIT project on 2026-10-07"},{"row":"cap:network.security-group/duplicate-default-egress-rule-rejected","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]},{"address":"stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1","path":"ether_type","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/ip-range-family-must-match-ether-type"],"constraints":[{"row":"cap:network.security-group/ether-type-default-ipv4","scope":"OFFICIAL_DOCUMENTED"},{"row":"cap:network.security-group/ip-range-family-must-match-ether-type","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]},{"address":"stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1","path":"ip_range","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/ip-range-family-must-match-ether-type"],"constraints":[{"row":"cap:network.security-group/ip-range-family-must-match-ether-type","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"},{"row":"cap:network.security-group/remote-security-group-by-id","scope":"OFFICIAL_DOCUMENTED"}]},{"address":"stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1","path":"port_range.max","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/port-range-is-destination-port"],"constraints":[{"row":"cap:network.security-group/port-range-bounds","scope":"OFFICIAL_DOCUMENTED"},{"row":"cap:network.security-group/port-range-is-destination-port","scope":"OBSERVED_RELATED_VARIANT","note":"a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)"}]},{"address":"stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1","path":"port_range.min","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/port-range-is-destination-port"],"constraints":[{"row":"cap:network.security-group/port-range-bounds","scope":"OFFICIAL_DOCUMENTED"},{"row":"cap:network.security-group/port-range-is-destination-port","scope":"OBSERVED_RELATED_VARIANT","note":"a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)"}]}]},"coverage":"TRACED","open_work":{"open_steps":6,"not_verified_fields":6,"open_decisions":1,"manual_actions":0,"register":{"open":2,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-POD-SEGMENTATION"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F"]}],"next_step":{"record":"DEC-GEN-CONVERT-POD-SEGMENTATION","source":"PLAN_DECISION","text":"Decide \"pod segmentation\" (DEC-GEN-CONVERT-POD-SEGMENTATION): the plan of the draft leaves it open"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","type":"aws_ecs_service","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.orders_service","class":"REPLATFORM","confidence":"LOW","target_fit":{"service":"STACKIT Kubernetes Engine (SKE)","resources":["stackit_ske_cluster"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"lifecycle_effects":{"state":"GA","state_reason":"the pinned provider schema has no beta, experimental or deprecated notice on the target's resources","sets":[{"capability":"compute.managed-kubernetes","subject_kind":"kubernetes_minor_version","title":"SKE Kubernetes versions","as_of":"2026-10-08","recheck_after":"2027-01-06","expiring_window_days":30,"production_suitability":"SUITABLE","day2":{"forced_update_by":"PROVIDER","forced_update_statement":"\"If the Kubernetes or OS version of a cluster has reached its expiration date, SKE starts a mandatory update to the highest available patch version of the current minor version, or to the highest patch version of the consecutive minor version that is not classified as preview version.\" and \"mandatory version updates run, even if the auto update for the Kubernetes version is deactivated\". Automatic updates otherwise \"only update to higher patch levels\" in the cluster's maintenance window.","notice":"\"As a SKE user you will get informed via release notes and via email in case you are operating a cluster with a deprecated Kubernetes version.\"","customer_action":"\"you can check the exact expiration dates for your current Kubernetes and node pool versions in the cluster.status.expiration field via the SKE API\". The page does not assign any further duty (workload readiness for the update, testing) to the customer or to STACKIT: not stated."},"versions":[{"subject":"1.36","state":"SUPPORTED","disputed":false,"released_at":{"date":"2026-08-27","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"production_suitability":"SUITABLE","upgrade_action":"NONE_PUBLISHED","migration_timing_risk":"UNKNOWN","note":"No expiry or EOL for 1.36 is stated in the pages read; the lifecycle table does not list it. An unpublished end is reported as such, not as safe."},{"subject":"1.35","state":"UNKNOWN","disputed":false,"expires_at":{"date":"2027-02-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"UNKNOWN","upgrade_action":"UNKNOWN","migration_timing_risk":"UNKNOWN","note":"The pages read give no release date for 1.35 (no release-note entry), so the state stays UNKNOWN: a future expiry date does not say that a version is offered. The 1.34 deprecation entry names 1.35 as the upgrade target."},{"subject":"1.34","state":"EXPIRING","disputed":false,"released_at":{"date":"2025-12-16","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-08-28","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-10-14","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"UPGRADE_BEFORE_EXPIRY","migration_timing_risk":"HIGH","note":"Clusters still on 1.34 are upgraded to 1.35 by the mandatory update (release note of 2026-08-28); the day it runs inside the maintenance window is not stated, so no forced-update date is recorded."},{"subject":"1.33","state":"EXPIRED","disputed":true,"released_at":{"date":"2025-07-29","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-06-09","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-06-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08","dissent":[{"date":"2026-07-08","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"}]},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"The expiry day differs between the lifecycle page (2026-06-10) and the release note (2026-07-08); the state is EXPIRED under either."},{"subject":"1.32","state":"EXPIRED","disputed":false,"deprecated_at":{"date":"2026-02-20","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-04-15","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"No release date for 1.32 appears in the pages read."}],"sources":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/operations/version-updates/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"]}]},"catalogue":{"state":"MATCHED","capabilities":["compute.managed-kubernetes"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":4,"evidence_count":1,"automation_eligible":false,"automation_ceiling":"ANSWERABLE","wave":7,"properties_not_carried":14,"not_carried":[{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","property":"enable_execute_command","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): enable_execute_command = true, tags, wait_for_steady_state = true — a service setting with no counterpart in the draft manifests: Kubernetes has its own rollout (maxSurge, maxUnavailable), health, scheduling and exec behaviour, and tags are not labels here.","semantic":"service-execute-command","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","property":"launch_type","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","property":"network_configuration.assign_public_ip","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods.","semantic":"service-public-ip-setting","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","property":"network_configuration.security_groups","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods.","semantic":"service-network-placement","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","property":"network_configuration.subnets","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods.","semantic":"service-network-placement","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","property":"service_connect_configuration.enabled","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: orders:80 → container port 8080 (the Service Connect alias orders:80 of port orders-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","property":"service_connect_configuration.namespace","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: orders:80 → container port 8080 (the Service Connect alias orders:80 of port orders-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","property":"service_connect_configuration.service.client_alias.dns_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: orders:80 → container port 8080 (the Service Connect alias orders:80 of port orders-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","property":"service_connect_configuration.service.client_alias.port","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: orders:80 → container port 8080 (the Service Connect alias orders:80 of port orders-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","property":"service_connect_configuration.service.discovery_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: orders:80 → container port 8080 (the Service Connect alias orders:80 of port orders-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","property":"service_connect_configuration.service.port_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: orders:80 → container port 8080 (the Service Connect alias orders:80 of port orders-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","property":"wait_for_steady_state","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","property":"network_mode","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this): network_mode = awsvpc, requires_compatibilities — Fargate platform specifics and awsvpc network interface semantics have no Kubernetes counterpart: the pods run on the SKE node pool network and the platform's task sizing steps do not exist.","semantic":"td-network-mode","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:125"},{"node":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","property":"requires_compatibilities","source":"../../lib/ecs/service/ecs.tf:125"}],"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this is a container service (it keeps container tasks running), declared in ../../lib/ecs/service/ecs.tf (lines 136-175). It is part of module.retail_app_ecs.module.orders_service. It names 2 identities it runs as. This trace follows the identity of the workload: which identity it runs as and what the plan does with it on STACKIT.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/41","id":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-eb6e69766287","TL-8b7cc812905b","TL-d46f02e929c7","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary":"The source names 2 identities this workload runs as.","line_ids":["TL-4b2d107e499a","TL-a57737aba736"],"artefact":{"kind":"SOURCE_FILE","file":"../../lib/ecs/service/ecs.tf","pointer":"lines 136-175"},"expert":{"id_refs":["TL-94a5a7b9f318","TL-6582443e588c"]}},{"stage":"RESOLUTION_PROOF","state":"ESTABLISHED","summary_id":"TT-3e49a186cd7f","line_ids":["TL-facb23e1471b","TL-34658b5f706f"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-4336899ace7d","TL-34b5974f0ddc"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-f0a8d4e9043a","line_ids":["TL-424117e74f30","TL-a1eade33c8b0"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/41","id":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-e205ee2ade59","TL-7ebdd3dd35a4","TL-5a72d657029c","TL-b5b97b9044b0","TL-2fd740bb0601","TL-9e089191f346","TL-8e4d39fcf8ec","TL-da2e68bcc2b5","TL-4d992a6cae8d","TL-1de287234081","TL-ec559f03bc2c","TL-bbc56b6870d6","TL-488012de1e76","TL-b5f13fa502d3","TL-884236b97950","TL-17bd32f2135b"]}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-0475c1513230","lines":["The unit is a container service (it keeps container tasks running)"],"artefact":{"kind":"IN_MEMORY","id":"identity:module.retail_app_ecs.module.orders_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-0b734eb4a3ea","TL-99e869fe09b9"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3ae2580b0162","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-b1bbbaec7332","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4"],"artefact":{"kind":"IN_MEMORY","id":"identity.server-service-account"},"expert":{"ids":["capability: identity.server-service-account","provider version: 0.121.0"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-fc0024522eee","lines":["2 manual actions, due before the pilot"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-064e616475f0","TL-f3099aace307","TL-8e66521ce803","TL-3f89d52abb85"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-3e30d829ac91","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary_id":"TT-7d4d2bc1d7f5","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-fed32ab36cf0","TL-9d1216c1c1c8","TL-d477c31ae16d","TL-5ce834a2bf21","TL-871d4c9b23bb"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.module.orders_service.aws_ecs_service.this","family":"AWS_IDENTITY_ATTACH","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/41","ids":["unit:module.retail_app_ecs.module.orders_service.aws_ecs_service.this"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/41"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:identity:module.retail_app_ecs.module.orders_service.aws_ecs_service.this"]},{"hop":"plan","state":"OPEN","kind":"REPORT_FILE","file":"target-plan.json"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:attach-complete@module.retail_app_ecs.module.orders_service.aws_ecs_service.this","check:final-artifact@module.retail_app_ecs.module.orders_service.aws_ecs_service.this","check:plan-valid@module.retail_app_ecs.module.orders_service.aws_ecs_service.this","check:renders@module.retail_app_ecs.module.orders_service.aws_ecs_service.this","check:round-trip@module.retail_app_ecs.module.orders_service.aws_ecs_service.this"]}],"targets":["target:stackit_ske_cluster.retail_app_ecs_cluster"]},"plan_statements":[{"id":"stackitsa:statement:module.retail_app_ecs.module.orders_service.aws_ecs_service.this","family":"stackitsa","reason":"MANUAL_REVIEW","cause":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person)","manual_actions":[{"id":"stackitsa:facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this#execution_role_arn","kind":"OTHER","phase":"BEFORE_PILOT","what":"Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach","why":"the role is the platform agent's identity, not the application's (execution_role_arn of module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role). a platform agent's identity is not an application identity and has no STACKIT counterpart; the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person"},{"id":"stackitsa:facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this#task_role_arn","kind":"OTHER","phase":"BEFORE_PILOT","what":"Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it","why":"the workload is a container service, not a server an account is attached to (task_role_arn of module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.orders_service.aws_iam_role.task_role). the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person"}]}],"workload_readiness":{"applies":true,"dimensions":[{"id":"bootstrap_configuration","state":"NOT_ASSESSED"},{"id":"source_artifacts","state":"NOT_ASSESSED"},{"id":"target_preconditions","state":"NOT_ASSESSED"},{"id":"cutover","state":"NOT_ASSESSED"},{"id":"day2_operations","state":"NOT_ASSESSED"}]},"coverage":"TRACED","open_work":{"open_steps":3,"register":{"open":6,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS"]},{"source":"PLAN_STATEMENT","open_records":["DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW"]}],"next_step":{"record":"DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","type":"aws_iam_role","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.orders_service","class":"RECONFIGURE","confidence":"LOW","target_fit":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["identity.role-assignment","identity.server-service-account","identity.service-account-key"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":7,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":6,"properties_not_carried":2,"not_carried":[{"node":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","property":"assume_role_policy","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.","semantic":"iam-trust-service-workload","contract":"aws.iam_role","source":"../../lib/ecs/service/iam.tf:14"},{"node":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","property":"name","source":"../../lib/ecs/service/iam.tf:14"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role is a resource of the source, declared in ../../lib/ecs/service/iam.tf (lines 14-18). It is part of module.retail_app_ecs.module.orders_service. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-bdf43443dac8"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/39","id":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role"},"expert":{"id_refs":["TL-98117649104a","TL-6aeddbbb224d","TL-fb283641d321","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-f8b0a06c08cf","TL-2027e9b9e261","TL-fa1c8393519e","TL-9f241609c525"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-87c82dac6d26","TL-8931c2124903","TL-7d2073800c6a","TL-4083d70dae3e","TL-8befe47c267a"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-ae8e73203e01","line_ids":["TL-185c870bf3cc","TL-ec727dee66a7","TL-9f0e74bef300"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/39","id":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role"},"expert":{"id_refs":["TL-fb91e685e455","TL-df6e1c6ce7f0","TL-7d3b1fce19f9","TL-0c0c72bb0310","TL-49f4d75dbc78","TL-60baf7ccd117","TL-89b9a0e2d5e4"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-243b72c99df8","TL-b3cae517f600"],"artefact":{"kind":"REPORT_FILE","file":"terraform/identity.tf","id":"stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role"},"expert":{"id_refs":["TL-47da26c08725","TL-1e21f64ac66b","TL-44d209aec5a7","TL-f5814e14d85c","TL-4562bafbaee7","TL-8874f9dd9484"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-e72b9c31a2bd","line_ids":["TL-5b70db005647","TL-5d4b69294c34","TL-af7d2497cec2","TL-baa0729dab6a","TL-3c249da4e020"],"artefact":{"kind":"IN_MEMORY"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/39","ids":["unit:module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/39"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_execution_role","target:stackit_service_account.retail_app_ecs_orders_service_task_execution_role"]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202"]}],"next_step":{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role (DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","type":"aws_iam_role","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.orders_service","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["identity.role-assignment","identity.server-service-account","identity.service-account-key"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":4,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":2,"properties_not_carried":2,"not_carried":[{"node":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","property":"assume_role_policy","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.retail_app_ecs.module.orders_service.aws_iam_role.task_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.","semantic":"iam-trust-service-workload","contract":"aws.iam_role","source":"../../lib/ecs/service/iam.tf:31"},{"node":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","property":"name","source":"../../lib/ecs/service/iam.tf:31"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role is a resource of the source, declared in ../../lib/ecs/service/iam.tf (lines 31-35). It is part of module.retail_app_ecs.module.orders_service. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-e497ce17d5ae"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/18","id":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role"},"expert":{"id_refs":["TL-98117649104a","TL-6aeddbbb224d","TL-fb283641d321","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-f8b0a06c08cf","TL-2027e9b9e261","TL-fa1c8393519e","TL-9f241609c525"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-8931c2124903","TL-7d2073800c6a","TL-c04695a5e2b9","TL-b06270d4bcd5"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-d43161aa7b39","line_ids":["TL-b8dcaad7eb2a","TL-ec727dee66a7","TL-9f0e74bef300"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/18","id":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role"},"expert":{"id_refs":["TL-fb91e685e455","TL-4abbfc31b2d4","TL-7d3b1fce19f9","TL-49f4d75dbc78","TL-60baf7ccd117","TL-89b9a0e2d5e4"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-cae700457220","TL-20634673194c"],"artefact":{"kind":"REPORT_FILE","file":"terraform/identity.tf","id":"stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role"},"expert":{"id_refs":["TL-47da26c08725","TL-1e21f64ac66b","TL-f90eecd227ee","TL-d0b5284a5f5a","TL-096a5d5a224f","TL-0abd27847217"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-1d5e6f67637a","line_ids":["TL-b11d4184ae32","TL-5d4b69294c34","TL-17125e854394"],"artefact":{"kind":"IN_MEMORY"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/18","ids":["unit:module.retail_app_ecs.module.orders_service.aws_iam_role.task_role"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/18"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_task_role","target:stackit_service_account.retail_app_ecs_orders_service_task_role"]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65"]}],"next_step":{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role (DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.orders_service.aws_security_group.this","type":"aws_security_group","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.orders_service","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.security-group"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":3,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":2,"properties_not_carried":2,"not_carried":[{"node":"module.retail_app_ecs.module.orders_service.aws_security_group.this","property":"name","source":"../../lib/ecs/service/sg.tf:1"},{"node":"module.retail_app_ecs.module.orders_service.aws_security_group.this","property":"vpc_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+UNSUPPORTED","category":"network-exposure","reason":"plan: stackit_security_group.retail_app_ecs_orders_service_this vpc_id UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried","semantic":"security-group-vpc-membership","contract":"aws.security_group","source":"../../lib/ecs/service/sg.tf:1"}],"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.orders_service.aws_security_group.this is an AWS security group, declared in ../../lib/ecs/service/sg.tf (lines 1-18). It is part of module.retail_app_ecs.module.orders_service. It states 2 rules.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/19","id":"module.retail_app_ecs.module.orders_service.aws_security_group.this"},"expert":{"id_refs":["TL-a8f0a4cb1f58","TL-6d6d224d0414","TL-c6c4a8483f3c","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-0263dd1d5363","lines":["ingress tcp port 8080 from 0.0.0.0/0","egress any protocol to 0.0.0.0/0"],"artefact":{"kind":"SOURCE_FILE","file":"../../lib/ecs/service/sg.tf","pointer":"lines 1-18"},"expert":{"id_refs":["TL-1b6bb75769f1","TL-d3a23909d906","TL-b43036bd87a0"]}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-1110fbc911ec","line_ids":["TL-91644b931b8d"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.retail_app_ecs.module.orders_service.aws_security_group.this"},"expert":{"id_refs":["TL-f4bdc86495d2","TL-46ec0bd8733b"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-de6015241030","line_ids":["TL-3545a21a7bd6","TL-7a9d5c59572e","TL-1646e3f29bb9","TL-035c2079cbd6"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/19","id":"module.retail_app_ecs.module.orders_service.aws_security_group.this"},"expert":{"id_refs":["TL-ebd04774484c","TL-bff1dfa5e357","TL-603724baa087","TL-750b3fbf1f7f","TL-d6ac55ef30e3","TL-93afdda91a72","TL-625cb7eb6db1"]}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-cffaa762f020","line_ids":["TL-f1f07e52ad07","TL-f6e48092b146"],"artefact":{"kind":"IN_MEMORY","id":"security:module.retail_app_ecs.module.orders_service.aws_security_group.this"},"expert":{"id_refs":["TL-a0b6743aac67","TL-cc90c346c091"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3921a774bd0d","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3","TL-a6e80c38069e","TL-2c414d177d91","TL-6d7438fd76fa","TL-a9898b1d90e1","TL-26417faaa574"],"artefact":{"kind":"IN_MEMORY","id":"network.security-group"},"expert":{"id_refs":["TL-dbe97d4df687","TL-f9c3c1e88738","TL-a4d3f937ca56","TL-11c73f76534f","TL-e55740d24a58","TL-d70d70f815d4","TL-981f57277e1b","TL-090a4fa98fb4","TL-91ac87ca3a51","TL-fffcb79b3f06","TL-ce1f9d88a1e0","TL-39506feb1c20","TL-993a90249cdf","TL-00ce63da408d","TL-5acc71b16e18","TL-00a58746651a","TL-71db89378ca6","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-6f83b385fe74","line_ids":["TL-834c58fa0764","TL-85af714214c1","TL-bcd1629bac49"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans","id":"stackit_security_group.retail_app_ecs_orders_service_this"},"expert":{"id_refs":["TL-bdfca9295228","TL-5be43e20e944","TL-ee9a578f3cec","TL-7c5773385279","TL-b50dcb9af871","TL-ff878e7837d7","TL-7a16dfa621a3","TL-e71977ad9aed","TL-985bcd360e90","TL-c747e769619f","TL-15c3b8f244cb","TL-1195d0701687","TL-1034cce06dc5","TL-899fd28c3b9c","TL-560312b2a515","TL-3d810afe81f5"]}},{"stage":"RENDER","state":"ESTABLISHED","summary":"The draft writes 2 resources of this unit as active Terraform.","line_ids":["TL-875a1ea82642","TL-3c2c6e9b3b4d"],"artefact":{"kind":"REPORT_FILE","file":"terraform/security.tf"},"expert":{"id_refs":["TL-934b89757ef9","TL-8c5983e0bf8a","TL-5d6d4862b95d","TL-e092da48ce26","TL-58b6204ed6fb"]}},{"stage":"VALIDATION","state":"OPEN","summary_id":"TT-2eed2fdcdabc","line_ids":["TL-b965e925fff4","TL-7338c48d6ad3","TL-779e3b0f817e","TL-e6970c0aa0a5","TL-3b71b9a35b2d","TL-548a1aa887c5"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-f2eb19ea1d78","TL-d477c31ae16d","TL-5ce834a2bf21","TL-5260e0ef58bd","TL-363d3ec284eb","TL-1935467c5b80"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-bb60e90a49bc","line_ids":["TL-caa1c3eef1d4","TL-8392c7fc96fc"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-deff206ee5a4","TL-df96e33983ac"]}}]},"refs":{"id":"unit:module.retail_app_ecs.module.orders_service.aws_security_group.this","family":"AWS_SECURITY_GROUP","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/19","ids":["unit:module.retail_app_ecs.module.orders_service.aws_security_group.this"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/19"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:security:module.retail_app_ecs.module.orders_service.aws_security_group.this"]},{"hop":"plan","state":"OPEN","kind":"REPORT_FILE","file":"target-plan.json"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:final-artifact@module.retail_app_ecs.module.orders_service.aws_security_group.this","check:plan-valid@module.retail_app_ecs.module.orders_service.aws_security_group.this","check:renders@module.retail_app_ecs.module.orders_service.aws_security_group.this","check:round-trip@module.retail_app_ecs.module.orders_service.aws_security_group.this","check:rule-has-one-remote@module.retail_app_ecs.module.orders_service.aws_security_group.this"]}],"targets":["target:stackit_security_group.retail_app_ecs_orders_service_this","target:stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 1 open decisions, 0 manual actions","open_decisions":[{"id":"convert:module.retail_app_ecs.module.orders_service.aws_security_group.this:security-group:POD_SEGMENTATION","reasons":["the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision)"],"required_by_phase":"BEFORE_PILOT","question":"Decide how the segmentation that the security group module.retail_app_ecs.module.orders_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.orders_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_orders_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it)","subjects":["module.retail_app_ecs.module.orders_service.aws_ecs_service.this","module.retail_app_ecs.module.orders_service.aws_security_group.this","stackit_security_group.retail_app_ecs_orders_service_this"]}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"behavior_evidence":{"counts":[{"key":"OBSERVED_ON_TARGET","count":2},{"key":"OFFICIAL_DOCUMENTED","count":6},{"key":"NOT_VERIFIED_FOR_VARIANT","count":6},{"key":"CONTRADICTED","count":0}],"open":[{"address":"stackit_security_group.retail_app_ecs_orders_service_this","path":"default_egress.ipv4","state":"NOT_VERIFIED_FOR_VARIANT","variant":"group","rows":["cap:network.security-group/duplicate-default-egress-rule-rejected"],"constraints":[{"row":"cap:network.security-group/default-egress-rules","scope":"OBSERVED_EXACT_VARIANT","note":"tested on a STACKIT project on 2026-10-07"},{"row":"cap:network.security-group/duplicate-default-egress-rule-rejected","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]},{"address":"stackit_security_group.retail_app_ecs_orders_service_this","path":"default_egress.ipv6","state":"NOT_VERIFIED_FOR_VARIANT","variant":"group","rows":["cap:network.security-group/duplicate-default-egress-rule-rejected"],"constraints":[{"row":"cap:network.security-group/default-egress-rules","scope":"OBSERVED_EXACT_VARIANT","note":"tested on a STACKIT project on 2026-10-07"},{"row":"cap:network.security-group/duplicate-default-egress-rule-rejected","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]},{"address":"stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1","path":"ether_type","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/ip-range-family-must-match-ether-type"],"constraints":[{"row":"cap:network.security-group/ether-type-default-ipv4","scope":"OFFICIAL_DOCUMENTED"},{"row":"cap:network.security-group/ip-range-family-must-match-ether-type","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]},{"address":"stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1","path":"ip_range","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/ip-range-family-must-match-ether-type"],"constraints":[{"row":"cap:network.security-group/ip-range-family-must-match-ether-type","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"},{"row":"cap:network.security-group/remote-security-group-by-id","scope":"OFFICIAL_DOCUMENTED"}]},{"address":"stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1","path":"port_range.max","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/port-range-is-destination-port"],"constraints":[{"row":"cap:network.security-group/port-range-bounds","scope":"OFFICIAL_DOCUMENTED"},{"row":"cap:network.security-group/port-range-is-destination-port","scope":"OBSERVED_RELATED_VARIANT","note":"a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)"}]},{"address":"stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1","path":"port_range.min","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/port-range-is-destination-port"],"constraints":[{"row":"cap:network.security-group/port-range-bounds","scope":"OFFICIAL_DOCUMENTED"},{"row":"cap:network.security-group/port-range-is-destination-port","scope":"OBSERVED_RELATED_VARIANT","note":"a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)"}]}]},"coverage":"TRACED","open_work":{"open_steps":6,"not_verified_fields":6,"open_decisions":1,"manual_actions":0,"register":{"open":2,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-POD-SEGMENTATION"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3"]}],"next_step":{"record":"DEC-GEN-CONVERT-POD-SEGMENTATION","source":"PLAN_DECISION","text":"Decide \"pod segmentation\" (DEC-GEN-CONVERT-POD-SEGMENTATION): the plan of the draft leaves it open"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","type":"aws_ecs_service","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.ui_service","class":"REPLATFORM","confidence":"MEDIUM","target_fit":{"service":"STACKIT Kubernetes Engine (SKE)","resources":["stackit_ske_cluster"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"lifecycle_effects":{"state":"GA","state_reason":"the pinned provider schema has no beta, experimental or deprecated notice on the target's resources","sets":[{"capability":"compute.managed-kubernetes","subject_kind":"kubernetes_minor_version","title":"SKE Kubernetes versions","as_of":"2026-10-08","recheck_after":"2027-01-06","expiring_window_days":30,"production_suitability":"SUITABLE","day2":{"forced_update_by":"PROVIDER","forced_update_statement":"\"If the Kubernetes or OS version of a cluster has reached its expiration date, SKE starts a mandatory update to the highest available patch version of the current minor version, or to the highest patch version of the consecutive minor version that is not classified as preview version.\" and \"mandatory version updates run, even if the auto update for the Kubernetes version is deactivated\". Automatic updates otherwise \"only update to higher patch levels\" in the cluster's maintenance window.","notice":"\"As a SKE user you will get informed via release notes and via email in case you are operating a cluster with a deprecated Kubernetes version.\"","customer_action":"\"you can check the exact expiration dates for your current Kubernetes and node pool versions in the cluster.status.expiration field via the SKE API\". The page does not assign any further duty (workload readiness for the update, testing) to the customer or to STACKIT: not stated."},"versions":[{"subject":"1.36","state":"SUPPORTED","disputed":false,"released_at":{"date":"2026-08-27","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"production_suitability":"SUITABLE","upgrade_action":"NONE_PUBLISHED","migration_timing_risk":"UNKNOWN","note":"No expiry or EOL for 1.36 is stated in the pages read; the lifecycle table does not list it. An unpublished end is reported as such, not as safe."},{"subject":"1.35","state":"UNKNOWN","disputed":false,"expires_at":{"date":"2027-02-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"UNKNOWN","upgrade_action":"UNKNOWN","migration_timing_risk":"UNKNOWN","note":"The pages read give no release date for 1.35 (no release-note entry), so the state stays UNKNOWN: a future expiry date does not say that a version is offered. The 1.34 deprecation entry names 1.35 as the upgrade target."},{"subject":"1.34","state":"EXPIRING","disputed":false,"released_at":{"date":"2025-12-16","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-08-28","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-10-14","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"UPGRADE_BEFORE_EXPIRY","migration_timing_risk":"HIGH","note":"Clusters still on 1.34 are upgraded to 1.35 by the mandatory update (release note of 2026-08-28); the day it runs inside the maintenance window is not stated, so no forced-update date is recorded."},{"subject":"1.33","state":"EXPIRED","disputed":true,"released_at":{"date":"2025-07-29","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-06-09","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-06-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08","dissent":[{"date":"2026-07-08","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"}]},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"The expiry day differs between the lifecycle page (2026-06-10) and the release note (2026-07-08); the state is EXPIRED under either."},{"subject":"1.32","state":"EXPIRED","disputed":false,"deprecated_at":{"date":"2026-02-20","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-04-15","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"No release date for 1.32 appears in the pages read."}],"sources":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/operations/version-updates/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"]}]},"catalogue":{"state":"MATCHED","capabilities":["compute.managed-kubernetes"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":1,"automation_eligible":false,"automation_ceiling":"ANSWERABLE","wave":9,"properties_not_carried":14,"not_carried":[{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","property":"enable_execute_command","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): enable_execute_command = true, tags, wait_for_steady_state = true — a service setting with no counterpart in the draft manifests: Kubernetes has its own rollout (maxSurge, maxUnavailable), health, scheduling and exec behaviour, and tags are not labels here.","semantic":"service-execute-command","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","property":"launch_type","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","property":"network_configuration.assign_public_ip","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods.","semantic":"service-public-ip-setting","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","property":"network_configuration.security_groups","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods.","semantic":"service-network-placement","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","property":"network_configuration.subnets","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): network_configuration — the tasks have their own network interface in the subnets and security groups of this block (awsvpc); pods use the cluster network and the security group rules are not translated into network policies — decide the network policy of the pods.","semantic":"service-network-placement","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","property":"service_connect_configuration.enabled","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: ui:80 → container port 8080 (the Service Connect alias ui:80 of port ui-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","property":"service_connect_configuration.namespace","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: ui:80 → container port 8080 (the Service Connect alias ui:80 of port ui-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","property":"service_connect_configuration.service.client_alias.dns_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: ui:80 → container port 8080 (the Service Connect alias ui:80 of port ui-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","property":"service_connect_configuration.service.client_alias.port","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: ui:80 → container port 8080 (the Service Connect alias ui:80 of port ui-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","property":"service_connect_configuration.service.discovery_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: ui:80 → container port 8080 (the Service Connect alias ui:80 of port ui-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","property":"service_connect_configuration.service.port_name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_service.this): service_connect_configuration — Cloud Map service discovery and the Service Connect proxy (its retries, timeouts, TLS and metrics) are not carried; other workloads reach this service through the Kubernetes Services below, in the namespace the manifests are applied into: ui:80 → container port 8080 (the Service Connect alias ui:80 of port ui-service).","semantic":"service-connect-values","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","property":"wait_for_steady_state","source":"../../lib/ecs/service/ecs.tf:136"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","property":"network_mode","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this): network_mode = awsvpc, requires_compatibilities — Fargate platform specifics and awsvpc network interface semantics have no Kubernetes counterpart: the pods run on the SKE node pool network and the platform's task sizing steps do not exist.","semantic":"td-network-mode","contract":"aws.ecs","source":"../../lib/ecs/service/ecs.tf:125"},{"node":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","property":"requires_compatibilities","source":"../../lib/ecs/service/ecs.tf:125"}],"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this is a container service (it keeps container tasks running), declared in ../../lib/ecs/service/ecs.tf (lines 136-175). It is part of module.retail_app_ecs.module.ui_service. It names 2 identities it runs as. This trace follows the identity of the workload: which identity it runs as and what the plan does with it on STACKIT.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/43","id":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-eb6e69766287","TL-8b7cc812905b","TL-d46f02e929c7","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary":"The source names 2 identities this workload runs as.","line_ids":["TL-381830e6019f","TL-1c94866fbc17"],"artefact":{"kind":"SOURCE_FILE","file":"../../lib/ecs/service/ecs.tf","pointer":"lines 136-175"},"expert":{"id_refs":["TL-83166b265daa","TL-7564588e5e07"]}},{"stage":"RESOLUTION_PROOF","state":"ESTABLISHED","summary_id":"TT-3e49a186cd7f","line_ids":["TL-fdd97dbd2829","TL-5c8a3fa7ad0e"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-a6813d1e4e1d","TL-6f93e8cdd442"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-f0a8d4e9043a","line_ids":["TL-424117e74f30","TL-0df924a96f5b"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/43","id":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-7ebdd3dd35a4","TL-5a72d657029c","TL-b5b97b9044b0","TL-2fd740bb0601","TL-123f10a121d2","TL-9e089191f346","TL-8e4d39fcf8ec","TL-da2e68bcc2b5","TL-4d992a6cae8d","TL-1de287234081","TL-ec559f03bc2c","TL-bbc56b6870d6","TL-488012de1e76","TL-b5f13fa502d3","TL-884236b97950","TL-17bd32f2135b"]}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-0475c1513230","lines":["The unit is a container service (it keeps container tasks running)"],"artefact":{"kind":"IN_MEMORY","id":"identity:module.retail_app_ecs.module.ui_service.aws_ecs_service.this"},"expert":{"id_refs":["TL-0b734eb4a3ea","TL-99e869fe09b9"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3ae2580b0162","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-b1bbbaec7332","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4"],"artefact":{"kind":"IN_MEMORY","id":"identity.server-service-account"},"expert":{"ids":["capability: identity.server-service-account","provider version: 0.121.0"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-fc0024522eee","lines":["2 manual actions, due before the pilot"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-ba5176ad4315","TL-99ae9a67bdc8","TL-8e66521ce803","TL-3f89d52abb85"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-3e30d829ac91","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary_id":"TT-7d4d2bc1d7f5","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-fed32ab36cf0","TL-9d1216c1c1c8","TL-d477c31ae16d","TL-5ce834a2bf21","TL-871d4c9b23bb"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.module.ui_service.aws_ecs_service.this","family":"AWS_IDENTITY_ATTACH","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/43","ids":["unit:module.retail_app_ecs.module.ui_service.aws_ecs_service.this"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/43"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:identity:module.retail_app_ecs.module.ui_service.aws_ecs_service.this"]},{"hop":"plan","state":"OPEN","kind":"REPORT_FILE","file":"target-plan.json"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:attach-complete@module.retail_app_ecs.module.ui_service.aws_ecs_service.this","check:final-artifact@module.retail_app_ecs.module.ui_service.aws_ecs_service.this","check:plan-valid@module.retail_app_ecs.module.ui_service.aws_ecs_service.this","check:renders@module.retail_app_ecs.module.ui_service.aws_ecs_service.this","check:round-trip@module.retail_app_ecs.module.ui_service.aws_ecs_service.this"]}],"targets":["target:stackit_ske_cluster.retail_app_ecs_cluster"]},"plan_statements":[{"id":"stackitsa:statement:module.retail_app_ecs.module.ui_service.aws_ecs_service.this","family":"stackitsa","reason":"MANUAL_REVIEW","cause":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person)","manual_actions":[{"id":"stackitsa:facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this#execution_role_arn","kind":"OTHER","phase":"BEFORE_PILOT","what":"Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach","why":"the role is the platform agent's identity, not the application's (execution_role_arn of module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role). a platform agent's identity is not an application identity and has no STACKIT counterpart; the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person"},{"id":"stackitsa:facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this#task_role_arn","kind":"OTHER","phase":"BEFORE_PILOT","what":"Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it","why":"the workload is a container service, not a server an account is attached to (task_role_arn of module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.ui_service.aws_iam_role.task_role). the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person"}]}],"workload_readiness":{"applies":true,"dimensions":[{"id":"bootstrap_configuration","state":"NOT_ASSESSED"},{"id":"source_artifacts","state":"NOT_ASSESSED"},{"id":"target_preconditions","state":"NOT_ASSESSED"},{"id":"cutover","state":"NOT_ASSESSED"},{"id":"day2_operations","state":"NOT_ASSESSED"}]},"coverage":"TRACED","open_work":{"open_steps":3,"register":{"open":6,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS"]},{"source":"PLAN_STATEMENT","open_records":["DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW"]}],"next_step":{"record":"DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","type":"aws_iam_role","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.ui_service","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["identity.role-assignment","identity.server-service-account","identity.service-account-key"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":3,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":1,"properties_not_carried":2,"not_carried":[{"node":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","property":"assume_role_policy","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.","semantic":"iam-trust-service-workload","contract":"aws.iam_role","source":"../../lib/ecs/service/iam.tf:14"},{"node":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","property":"name","source":"../../lib/ecs/service/iam.tf:14"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role is a resource of the source, declared in ../../lib/ecs/service/iam.tf (lines 14-18). It is part of module.retail_app_ecs.module.ui_service. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-812c351c2405"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/6","id":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role"},"expert":{"id_refs":["TL-98117649104a","TL-6aeddbbb224d","TL-fb283641d321","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-bc257d3dfa83","TL-8b0b3c50a6e9","TL-fa1c8393519e","TL-9f241609c525"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-8931c2124903","TL-7d2073800c6a","TL-827b61da25f3","TL-39b6fdb8ce76"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-d43161aa7b39","line_ids":["TL-b8dcaad7eb2a","TL-ec727dee66a7","TL-9f0e74bef300"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/6","id":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role"},"expert":{"id_refs":["TL-fb91e685e455","TL-df6e1c6ce7f0","TL-7d3b1fce19f9","TL-49f4d75dbc78","TL-60baf7ccd117","TL-89b9a0e2d5e4"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-8764278834b7","TL-ea57cd0cb4cd"],"artefact":{"kind":"REPORT_FILE","file":"terraform/identity.tf","id":"stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role"},"expert":{"id_refs":["TL-fd7f761fd278","TL-cde32939042c","TL-532e1d43ad0e","TL-204a56dd2cc7","TL-be94f74dd70b","TL-4b553da908fe"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-1d5e6f67637a","line_ids":["TL-5b70db005647","TL-5d4b69294c34","TL-458d6f17bb3f"],"artefact":{"kind":"IN_MEMORY"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/6","ids":["unit:module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/6"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_execution_role","target:stackit_service_account.retail_app_ecs_ui_service_task_execution_role"]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0"]}],"next_step":{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role (DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","type":"aws_iam_role","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.ui_service","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT service account for the workload","resources":["stackit_service_account","stackit_service_account_key","stackit_authorization_project_role_assignment"],"maturity":"experimental","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["identity.role-assignment","identity.server-service-account","identity.service-account-key"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":4,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":2,"properties_not_carried":2,"not_carried":[{"node":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","property":"assume_role_policy","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (module.retail_app_ecs.module.ui_service.aws_iam_role.task_role): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The account is named after the source address; who may use it is decided by its keys (stackit_service_account_key) or a federated identity provider; references to the role's ARN must be updated.","semantic":"iam-trust-service-workload","contract":"aws.iam_role","source":"../../lib/ecs/service/iam.tf:31"},{"node":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","property":"name","source":"../../lib/ecs/service/iam.tf:31"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role is a resource of the source, declared in ../../lib/ecs/service/iam.tf (lines 31-35). It is part of module.retail_app_ecs.module.ui_service. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-e497ce17d5ae"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/20","id":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role"},"expert":{"id_refs":["TL-98117649104a","TL-6aeddbbb224d","TL-fb283641d321","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-bc257d3dfa83","TL-8b0b3c50a6e9","TL-fa1c8393519e","TL-9f241609c525"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-8931c2124903","TL-7d2073800c6a","TL-541cb2d8d0af","TL-22b025834358"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-d43161aa7b39","line_ids":["TL-b8dcaad7eb2a","TL-ec727dee66a7","TL-9f0e74bef300"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/20","id":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role"},"expert":{"id_refs":["TL-fb91e685e455","TL-4abbfc31b2d4","TL-7d3b1fce19f9","TL-49f4d75dbc78","TL-60baf7ccd117","TL-89b9a0e2d5e4"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-843857e1d8c5","TL-c54bd24a1d5a"],"artefact":{"kind":"REPORT_FILE","file":"terraform/identity.tf","id":"stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role"},"expert":{"id_refs":["TL-fd7f761fd278","TL-cde32939042c","TL-bab1a734312c","TL-2cca75e8282d","TL-91032e216128","TL-8497a148ba31"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-1d5e6f67637a","line_ids":["TL-b11d4184ae32","TL-5d4b69294c34","TL-968a5b34c942"],"artefact":{"kind":"IN_MEMORY"},"expert":{}}]},"refs":{"id":"unit:module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/20","ids":["unit:module.retail_app_ecs.module.ui_service.aws_iam_role.task_role"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/20"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_task_role","target:stackit_service_account.retail_app_ecs_ui_service_task_role"]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE"]}],"next_step":{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role (DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.retail_app_ecs.module.ui_service.aws_security_group.this","type":"aws_security_group","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.retail_app_ecs.module.ui_service","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT security group","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.security-group"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":3,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":2,"properties_not_carried":2,"not_carried":[{"node":"module.retail_app_ecs.module.ui_service.aws_security_group.this","property":"name","source":"../../lib/ecs/service/sg.tf:1"},{"node":"module.retail_app_ecs.module.ui_service.aws_security_group.this","property":"vpc_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+UNSUPPORTED","category":"network-exposure","reason":"plan: stackit_security_group.retail_app_ecs_ui_service_this vpc_id UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried","semantic":"security-group-vpc-membership","contract":"aws.security_group","source":"../../lib/ecs/service/sg.tf:1"}],"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.retail_app_ecs.module.ui_service.aws_security_group.this is an AWS security group, declared in ../../lib/ecs/service/sg.tf (lines 1-18). It is part of module.retail_app_ecs.module.ui_service. It states 2 rules.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/21","id":"module.retail_app_ecs.module.ui_service.aws_security_group.this"},"expert":{"id_refs":["TL-a8f0a4cb1f58","TL-6d6d224d0414","TL-c6c4a8483f3c","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-0263dd1d5363","lines":["ingress tcp port 8080 from 0.0.0.0/0","egress any protocol to 0.0.0.0/0"],"artefact":{"kind":"SOURCE_FILE","file":"../../lib/ecs/service/sg.tf","pointer":"lines 1-18"},"expert":{"id_refs":["TL-1b6bb75769f1","TL-d3a23909d906","TL-b43036bd87a0"]}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-1110fbc911ec","line_ids":["TL-91644b931b8d"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.retail_app_ecs.module.ui_service.aws_security_group.this"},"expert":{"id_refs":["TL-f4bdc86495d2","TL-46ec0bd8733b"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-de6015241030","line_ids":["TL-3545a21a7bd6","TL-7a9d5c59572e","TL-1646e3f29bb9","TL-035c2079cbd6"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/21","id":"module.retail_app_ecs.module.ui_service.aws_security_group.this"},"expert":{"id_refs":["TL-ebd04774484c","TL-bff1dfa5e357","TL-603724baa087","TL-750b3fbf1f7f","TL-d6ac55ef30e3","TL-93afdda91a72","TL-625cb7eb6db1"]}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-cffaa762f020","line_ids":["TL-f1f07e52ad07","TL-f6e48092b146"],"artefact":{"kind":"IN_MEMORY","id":"security:module.retail_app_ecs.module.ui_service.aws_security_group.this"},"expert":{"id_refs":["TL-a0b6743aac67","TL-cc90c346c091"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-3921a774bd0d","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3","TL-a6e80c38069e","TL-2c414d177d91","TL-6d7438fd76fa","TL-a9898b1d90e1","TL-26417faaa574"],"artefact":{"kind":"IN_MEMORY","id":"network.security-group"},"expert":{"id_refs":["TL-dbe97d4df687","TL-f9c3c1e88738","TL-a4d3f937ca56","TL-11c73f76534f","TL-e55740d24a58","TL-d70d70f815d4","TL-981f57277e1b","TL-090a4fa98fb4","TL-91ac87ca3a51","TL-fffcb79b3f06","TL-ce1f9d88a1e0","TL-39506feb1c20","TL-993a90249cdf","TL-00ce63da408d","TL-5acc71b16e18","TL-00a58746651a","TL-71db89378ca6","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-6f83b385fe74","line_ids":["TL-0bdd0466eac4","TL-52c6f7761b44","TL-bcd1629bac49"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans","id":"stackit_security_group.retail_app_ecs_ui_service_this"},"expert":{"id_refs":["TL-bdfca9295228","TL-47cc6580450d","TL-8b9d06ef3e68","TL-0953fa1a9317","TL-458b5639e0da","TL-63b013143929","TL-d738a1efaa39","TL-2301444bea61","TL-779f2ac8c04a","TL-49e5e7afd23c","TL-e6d0fb6f80e7","TL-fa52c624b02d","TL-b953ad72b045","TL-899fd28c3b9c","TL-560312b2a515","TL-3d810afe81f5"]}},{"stage":"RENDER","state":"ESTABLISHED","summary":"The draft writes 2 resources of this unit as active Terraform.","line_ids":["TL-d689a7f8f4f9","TL-b9c4dbea1c42"],"artefact":{"kind":"REPORT_FILE","file":"terraform/security.tf"},"expert":{"id_refs":["TL-f9bb8b42afc0","TL-384df1309576","TL-5d6d4862b95d","TL-69b55dc1db18","TL-a8ffeaa88e16"]}},{"stage":"VALIDATION","state":"OPEN","summary_id":"TT-2eed2fdcdabc","line_ids":["TL-b965e925fff4","TL-7338c48d6ad3","TL-779e3b0f817e","TL-e6970c0aa0a5","TL-3b71b9a35b2d","TL-548a1aa887c5"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-f2eb19ea1d78","TL-d477c31ae16d","TL-5ce834a2bf21","TL-5260e0ef58bd","TL-363d3ec284eb","TL-1935467c5b80"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-bb60e90a49bc","line_ids":["TL-a42c63da1a36","TL-2a851b837f05"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-9f6fb4dc741d","TL-9e63551bc994"]}}]},"refs":{"id":"unit:module.retail_app_ecs.module.ui_service.aws_security_group.this","family":"AWS_SECURITY_GROUP","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/21","ids":["unit:module.retail_app_ecs.module.ui_service.aws_security_group.this"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/21"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:security:module.retail_app_ecs.module.ui_service.aws_security_group.this"]},{"hop":"plan","state":"OPEN","kind":"REPORT_FILE","file":"target-plan.json"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:final-artifact@module.retail_app_ecs.module.ui_service.aws_security_group.this","check:plan-valid@module.retail_app_ecs.module.ui_service.aws_security_group.this","check:renders@module.retail_app_ecs.module.ui_service.aws_security_group.this","check:round-trip@module.retail_app_ecs.module.ui_service.aws_security_group.this","check:rule-has-one-remote@module.retail_app_ecs.module.ui_service.aws_security_group.this"]}],"targets":["target:stackit_security_group.retail_app_ecs_ui_service_this","target:stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 1 open decisions, 0 manual actions","open_decisions":[{"id":"convert:module.retail_app_ecs.module.ui_service.aws_security_group.this:security-group:POD_SEGMENTATION","reasons":["the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision)"],"required_by_phase":"BEFORE_PILOT","question":"Decide how the segmentation that the security group module.retail_app_ecs.module.ui_service.aws_security_group.this gave the tasks of module.retail_app_ecs.module.ui_service.aws_ecs_service.this is carried on STACKIT: the tasks become pods of the cluster, and no block of the draft attaches the drafted group stackit_security_group.retail_app_ecs_ui_service_this to anything — option generate-networkpolicy-from-the-group-rules (a Kubernetes NetworkPolicy written from the rules of the group), security-group-on-the-nodes (coarser: the group acts on the interface of a node, so on every pod of it), or accept-no-segmentation (the loss of the restriction is accepted, with who accepted it)","subjects":["module.retail_app_ecs.module.ui_service.aws_ecs_service.this","module.retail_app_ecs.module.ui_service.aws_security_group.this","stackit_security_group.retail_app_ecs_ui_service_this"]}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"behavior_evidence":{"counts":[{"key":"OBSERVED_ON_TARGET","count":2},{"key":"OFFICIAL_DOCUMENTED","count":6},{"key":"NOT_VERIFIED_FOR_VARIANT","count":6},{"key":"CONTRADICTED","count":0}],"open":[{"address":"stackit_security_group.retail_app_ecs_ui_service_this","path":"default_egress.ipv4","state":"NOT_VERIFIED_FOR_VARIANT","variant":"group","rows":["cap:network.security-group/duplicate-default-egress-rule-rejected"],"constraints":[{"row":"cap:network.security-group/default-egress-rules","scope":"OBSERVED_EXACT_VARIANT","note":"tested on a STACKIT project on 2026-10-07"},{"row":"cap:network.security-group/duplicate-default-egress-rule-rejected","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]},{"address":"stackit_security_group.retail_app_ecs_ui_service_this","path":"default_egress.ipv6","state":"NOT_VERIFIED_FOR_VARIANT","variant":"group","rows":["cap:network.security-group/duplicate-default-egress-rule-rejected"],"constraints":[{"row":"cap:network.security-group/default-egress-rules","scope":"OBSERVED_EXACT_VARIANT","note":"tested on a STACKIT project on 2026-10-07"},{"row":"cap:network.security-group/duplicate-default-egress-rule-rejected","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]},{"address":"stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1","path":"ether_type","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/ip-range-family-must-match-ether-type"],"constraints":[{"row":"cap:network.security-group/ether-type-default-ipv4","scope":"OFFICIAL_DOCUMENTED"},{"row":"cap:network.security-group/ip-range-family-must-match-ether-type","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"}]},{"address":"stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1","path":"ip_range","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/ip-range-family-must-match-ether-type"],"constraints":[{"row":"cap:network.security-group/ip-range-family-must-match-ether-type","scope":"NOT_VERIFIED_FOR_VARIANT","note":"its probes state no scope"},{"row":"cap:network.security-group/remote-security-group-by-id","scope":"OFFICIAL_DOCUMENTED"}]},{"address":"stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1","path":"port_range.max","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/port-range-is-destination-port"],"constraints":[{"row":"cap:network.security-group/port-range-bounds","scope":"OFFICIAL_DOCUMENTED"},{"row":"cap:network.security-group/port-range-is-destination-port","scope":"OBSERVED_RELATED_VARIANT","note":"a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)"}]},{"address":"stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1","path":"port_range.min","state":"NOT_VERIFIED_FOR_VARIANT","variant":"rule tcp ingress IPv4 public_cidr any","rows":["cap:network.security-group/port-range-is-destination-port"],"constraints":[{"row":"cap:network.security-group/port-range-bounds","scope":"OFFICIAL_DOCUMENTED"},{"row":"cap:network.security-group/port-range-is-destination-port","scope":"OBSERVED_RELATED_VARIANT","note":"a related variant was observed in a test on a STACKIT project on 2026-10-08 (not this variant)"}]}]},"coverage":"TRACED","open_work":{"open_steps":6,"not_verified_fields":6,"open_decisions":1,"manual_actions":0,"register":{"open":2,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-POD-SEGMENTATION"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS"]}],"next_step":{"record":"DEC-GEN-CONVERT-POD-SEGMENTATION","source":"PLAN_DECISION","text":"Decide \"pod segmentation\" (DEC-GEN-CONVERT-POD-SEGMENTATION): the plan of the draft leaves it open"},"blocks_automation":true}}},{"address":"module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log","type":"aws_cloudwatch_log_group","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"RECONFIGURE","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT Logs","resources":["stackit_logs_instance","stackit_logs_access_token"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["observability.logs"],"unmatched_resources":[]}},"blocker_count":1,"finding_count":1,"evidence_count":6,"automation_eligible":null,"wave":0,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log is a log group (a named store of log events with a retention of its own), declared in .terraform/modules/vpc.vpc/vpc-flow-logs.tf (lines 65-75). It is switched off in the source. It is part of module.vpc.module.vpc. This trace follows the logs of the unit: where they go on STACKIT and for how long they are kept.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/63","id":"module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log"},"expert":{"id_refs":["TL-cecbc297c624","TL-660fdbc25888","TL-7aaad50961f3","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"OPEN","summary_id":"TT-661d402aa522","lines":["The source states a retention that is stated"],"artefact":{"kind":"SOURCE_FILE","file":".terraform/modules/vpc.vpc/vpc-flow-logs.tf","pointer":"lines 65-75"},"expert":{"ids":["retention key: retention_in_days"]}},{"stage":"RESOLUTION_PROOF","state":"NONE","summary_id":"TT-63fa53d1e665","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"SEMANTIC_CLAIM","state":"NONE","summary_id":"TT-09e44fcd9ff2","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-078f3d301edb","line_ids":["TL-73d3e111d3c3","TL-4c9765f744f7","TL-89bd5732af76"],"artefact":{"kind":"IN_MEMORY","id":"logs:module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log"},"expert":{"ids":["intent family: OBSERVABILITY","intent: logs:module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-41d8d4e38188","line_ids":["TL-3d74093c6a04","TL-8a4bf5123640","TL-d7009cd177d9","TL-60d467065f78","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4"],"artefact":{"kind":"IN_MEMORY","id":"observability.logs"},"expert":{"ids":["capability: observability.logs","provider version: 0.121.0"]}},{"stage":"TRANSFORMATION","state":"ESTABLISHED","summary_id":"TT-c093d281e9b6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-a05a641fdcc9","TL-d821bd14334d"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary":"The draft writes nothing for this unit, so nothing was checked.","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log","family":"LOG_SOURCE","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/63","ids":["unit:module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log"]},{"hop":"claims","state":"NONE","kind":"IN_MEMORY","reason":"NO_CLAIM_FOR_THE_UNIT"},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_default_vpc.this","type":"aws_default_vpc","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"RECONFIGURE","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT project networking / Network Area (SNA)","resources":["stackit_network_area","stackit_network"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.network"],"unmatched_resources":[]}},"blocker_count":1,"finding_count":2,"evidence_count":2,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_default_vpc.this","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/64","ids":["unit:module.vpc.module.vpc.aws_default_vpc.this"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_eip.nat","type":"aws_eip","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.vpc.module.vpc","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"implicit (belongs to the NAT gateway)","resources":[],"regions":[],"catalogue":{"state":"NOT_APPLICABLE","capabilities":[],"unmatched_resources":[]}},"blocker_count":2,"finding_count":1,"evidence_count":1,"automation_eligible":false,"automation_ceiling":"ANSWERABLE","wave":1,"refs":{"id":"unit:module.vpc.module.vpc.aws_eip.nat","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/7","ids":["unit:module.vpc.module.vpc.aws_eip.nat"]},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NO_DRAFT_BLOCK"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-VPC-MODULE-VPC-AWS-EIP-NAT"]}],"next_step":{"record":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-EIP-NAT","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.vpc.module.vpc.aws_eip.nat (DEC-NET-MODULE-VPC-MODULE-VPC-AWS-EIP-NAT): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.vpc.module.vpc.aws_flow_log.this","type":"aws_flow_log","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"REDESIGN","candidate_confidence":"LOW"},"target_fit":{"service":"none - no packet-flow log: a capture on the servers whose records a log shipper sends to a STACKIT Logs instance is a design of its own","resources":[],"regions":[],"catalogue":{"state":"NOT_APPLICABLE","capabilities":[],"unmatched_resources":[]}},"blocker_count":2,"finding_count":1,"evidence_count":6,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_flow_log.this","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/65","ids":["unit:module.vpc.module.vpc.aws_flow_log.this"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_iam_role.vpc_flow_log_cloudwatch","type":"aws_iam_role","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"MANUAL_REVIEW","candidate_confidence":"LOW"},"target_fit":null,"blocker_count":1,"finding_count":3,"evidence_count":2,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_iam_role.vpc_flow_log_cloudwatch","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/66","ids":["unit:module.vpc.module.vpc.aws_iam_role.vpc_flow_log_cloudwatch"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_internet_gateway.this","type":"aws_internet_gateway","presence":"CONDITIONAL","in_totals":false,"module_call":"module.vpc.module.vpc","conditional_state":"RUNTIME_DATA_UNKNOWN","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"implicit (STACKIT network default gateway)","resources":[],"regions":[],"catalogue":{"state":"NOT_APPLICABLE","capabilities":[],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":1,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_internet_gateway.this","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/67","ids":["unit:module.vpc.module.vpc.aws_internet_gateway.this"]},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NO_DRAFT_BLOCK"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-VPC-MODULE-VPC-AWS-INTERNET-GATEWAY-THIS"]}],"next_step":{"record":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-INTERNET-GATEWAY-THIS","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.vpc.module.vpc.aws_internet_gateway.this (DEC-NET-MODULE-VPC-MODULE-VPC-AWS-INTERNET-GATEWAY-THIS): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.vpc.module.vpc.aws_nat_gateway.this","type":"aws_nat_gateway","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.vpc.module.vpc","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"implicit outbound (STACKIT network)","resources":[],"regions":[],"catalogue":{"state":"NOT_APPLICABLE","capabilities":[],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":1,"automation_eligible":false,"automation_ceiling":"ANSWERABLE","wave":2,"refs":{"id":"unit:module.vpc.module.vpc.aws_nat_gateway.this","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/22","ids":["unit:module.vpc.module.vpc.aws_nat_gateway.this"]},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NO_DRAFT_BLOCK"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-VPC-MODULE-VPC-AWS-NAT-GATEWAY-THIS"]}],"next_step":{"record":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-NAT-GATEWAY-THIS","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.vpc.module.vpc.aws_nat_gateway.this (DEC-NET-MODULE-VPC-MODULE-VPC-AWS-NAT-GATEWAY-THIS): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.vpc.module.vpc.aws_network_acl.database","type":"aws_network_acl","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"REDESIGN","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT security groups (no stateless NACLs)","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.security-group"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":1,"evidence_count":11,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_network_acl.database","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/68","ids":["unit:module.vpc.module.vpc.aws_network_acl.database"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_network_acl.elasticache","type":"aws_network_acl","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"REDESIGN","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT security groups (no stateless NACLs)","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.security-group"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":1,"evidence_count":11,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_network_acl.elasticache","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/69","ids":["unit:module.vpc.module.vpc.aws_network_acl.elasticache"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_network_acl.intra","type":"aws_network_acl","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"REDESIGN","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT security groups (no stateless NACLs)","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.security-group"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":1,"evidence_count":11,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_network_acl.intra","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/70","ids":["unit:module.vpc.module.vpc.aws_network_acl.intra"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_network_acl.outpost","type":"aws_network_acl","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"REDESIGN","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT security groups (no stateless NACLs)","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.security-group"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":1,"evidence_count":11,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_network_acl.outpost","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/71","ids":["unit:module.vpc.module.vpc.aws_network_acl.outpost"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_network_acl.private","type":"aws_network_acl","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"REDESIGN","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT security groups (no stateless NACLs)","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.security-group"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":1,"evidence_count":11,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_network_acl.private","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/72","ids":["unit:module.vpc.module.vpc.aws_network_acl.private"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_network_acl.public","type":"aws_network_acl","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"REDESIGN","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT security groups (no stateless NACLs)","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.security-group"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":1,"evidence_count":11,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_network_acl.public","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/73","ids":["unit:module.vpc.module.vpc.aws_network_acl.public"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_network_acl.redshift","type":"aws_network_acl","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"REDESIGN","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT security groups (no stateless NACLs)","resources":["stackit_security_group","stackit_security_group_rule"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.security-group"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":1,"evidence_count":11,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_network_acl.redshift","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/74","ids":["unit:module.vpc.module.vpc.aws_network_acl.redshift"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_route_table.database","type":"aws_route_table","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"MANUAL_REVIEW","candidate_confidence":"LOW"},"target_fit":null,"blocker_count":1,"finding_count":1,"evidence_count":18,"automation_eligible":null,"wave":0,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.vpc.module.vpc.aws_route_table.database is an AWS route table, declared in .terraform/modules/vpc.vpc/main.tf (lines 430-445). It is switched off in the source. It is part of module.vpc.module.vpc. It states 0 static routes.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/75","id":"module.vpc.module.vpc.aws_route_table.database"},"expert":{"id_refs":["TL-0a4640271be1","TL-01bef12d20ec","TL-84daded010e4","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary":"The source states no static route for this unit.","line_ids":["TL-c0a43bf32f50","TL-3fe644d9705b"],"artefact":{"kind":"SOURCE_FILE","file":".terraform/modules/vpc.vpc/main.tf","pointer":"lines 430-445"},"expert":{}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-28cf18b349f1","lines":["the network of the table: no resource could be named, so the reference is not resolved"],"artefact":{"kind":"IN_MEMORY","id":"module.vpc.module.vpc.aws_route_table.database"},"expert":{"id_refs":["TL-94c59a08ef5d","TL-ed10391cb980"]}},{"stage":"SEMANTIC_CLAIM","state":"NONE","summary_id":"TT-09e44fcd9ff2","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-5cb9f071fb3a","line_ids":["TL-cffc21fa1051","TL-37d10d9f6067","TL-2445c6df2977","TL-c3094c377b8f","TL-02276117e89a"],"artefact":{"kind":"IN_MEMORY","id":"route:module.vpc.module.vpc.aws_route_table.database"},"expert":{"ids":["intent family: ROUTE","intent: route:module.vpc.module.vpc.aws_route_table.database"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-1600f1039cd4","line_ids":["TL-0f6d1239a13d","TL-e5fa9372b1a5","TL-da1f8992cf91","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3"],"artefact":{"kind":"IN_MEMORY","id":"network.routing"},"expert":{"id_refs":["TL-f575989be228","TL-2e2145f25c54","TL-a64ef62aaef3","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-dcf856f90df6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-c623eeb96ddb","TL-ddd75ed5ef6e"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary":"The draft writes nothing for this unit, so nothing was checked.","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.vpc.module.vpc.aws_route_table.database","family":"AWS_ROUTING","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/75","ids":["unit:module.vpc.module.vpc.aws_route_table.database"]},{"hop":"claims","state":"NONE","kind":"IN_MEMORY","reason":"NO_CLAIM_FOR_THE_UNIT"},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"TRACED","open_work":{"open_steps":3,"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_route_table.elasticache","type":"aws_route_table","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"MANUAL_REVIEW","candidate_confidence":"LOW"},"target_fit":null,"blocker_count":1,"finding_count":1,"evidence_count":18,"automation_eligible":null,"wave":0,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.vpc.module.vpc.aws_route_table.elasticache is an AWS route table, declared in .terraform/modules/vpc.vpc/main.tf (lines 747-757). It is switched off in the source. It is part of module.vpc.module.vpc. It states 0 static routes.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/76","id":"module.vpc.module.vpc.aws_route_table.elasticache"},"expert":{"id_refs":["TL-0a4640271be1","TL-01bef12d20ec","TL-84daded010e4","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary":"The source states no static route for this unit.","line_ids":["TL-c0a43bf32f50","TL-3fe644d9705b"],"artefact":{"kind":"SOURCE_FILE","file":".terraform/modules/vpc.vpc/main.tf","pointer":"lines 747-757"},"expert":{}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-28cf18b349f1","lines":["the network of the table: no resource could be named, so the reference is not resolved"],"artefact":{"kind":"IN_MEMORY","id":"module.vpc.module.vpc.aws_route_table.elasticache"},"expert":{"id_refs":["TL-94c59a08ef5d","TL-ed10391cb980"]}},{"stage":"SEMANTIC_CLAIM","state":"NONE","summary_id":"TT-09e44fcd9ff2","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-5cb9f071fb3a","line_ids":["TL-cffc21fa1051","TL-37d10d9f6067","TL-2445c6df2977","TL-c3094c377b8f","TL-02276117e89a"],"artefact":{"kind":"IN_MEMORY","id":"route:module.vpc.module.vpc.aws_route_table.elasticache"},"expert":{"ids":["intent family: ROUTE","intent: route:module.vpc.module.vpc.aws_route_table.elasticache"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-1600f1039cd4","line_ids":["TL-0f6d1239a13d","TL-e5fa9372b1a5","TL-da1f8992cf91","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3"],"artefact":{"kind":"IN_MEMORY","id":"network.routing"},"expert":{"id_refs":["TL-f575989be228","TL-2e2145f25c54","TL-a64ef62aaef3","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-dcf856f90df6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-c623eeb96ddb","TL-ddd75ed5ef6e"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary":"The draft writes nothing for this unit, so nothing was checked.","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.vpc.module.vpc.aws_route_table.elasticache","family":"AWS_ROUTING","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/76","ids":["unit:module.vpc.module.vpc.aws_route_table.elasticache"]},{"hop":"claims","state":"NONE","kind":"IN_MEMORY","reason":"NO_CLAIM_FOR_THE_UNIT"},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"TRACED","open_work":{"open_steps":3,"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_route_table.intra","type":"aws_route_table","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"MANUAL_REVIEW","candidate_confidence":"LOW"},"target_fit":null,"blocker_count":1,"finding_count":1,"evidence_count":18,"automation_eligible":null,"wave":0,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.vpc.module.vpc.aws_route_table.intra is an AWS route table, declared in .terraform/modules/vpc.vpc/main.tf (lines 866-881). It is switched off in the source. It is part of module.vpc.module.vpc. It states 0 static routes.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/77","id":"module.vpc.module.vpc.aws_route_table.intra"},"expert":{"id_refs":["TL-0a4640271be1","TL-01bef12d20ec","TL-84daded010e4","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary":"The source states no static route for this unit.","line_ids":["TL-c0a43bf32f50","TL-3fe644d9705b"],"artefact":{"kind":"SOURCE_FILE","file":".terraform/modules/vpc.vpc/main.tf","pointer":"lines 866-881"},"expert":{}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-28cf18b349f1","lines":["the network of the table: no resource could be named, so the reference is not resolved"],"artefact":{"kind":"IN_MEMORY","id":"module.vpc.module.vpc.aws_route_table.intra"},"expert":{"id_refs":["TL-94c59a08ef5d","TL-ed10391cb980"]}},{"stage":"SEMANTIC_CLAIM","state":"NONE","summary_id":"TT-09e44fcd9ff2","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-5cb9f071fb3a","line_ids":["TL-cffc21fa1051","TL-37d10d9f6067","TL-2445c6df2977","TL-c3094c377b8f","TL-02276117e89a"],"artefact":{"kind":"IN_MEMORY","id":"route:module.vpc.module.vpc.aws_route_table.intra"},"expert":{"ids":["intent family: ROUTE","intent: route:module.vpc.module.vpc.aws_route_table.intra"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-1600f1039cd4","line_ids":["TL-0f6d1239a13d","TL-e5fa9372b1a5","TL-da1f8992cf91","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3"],"artefact":{"kind":"IN_MEMORY","id":"network.routing"},"expert":{"id_refs":["TL-f575989be228","TL-2e2145f25c54","TL-a64ef62aaef3","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-dcf856f90df6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-c623eeb96ddb","TL-ddd75ed5ef6e"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary":"The draft writes nothing for this unit, so nothing was checked.","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.vpc.module.vpc.aws_route_table.intra","family":"AWS_ROUTING","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/77","ids":["unit:module.vpc.module.vpc.aws_route_table.intra"]},{"hop":"claims","state":"NONE","kind":"IN_MEMORY","reason":"NO_CLAIM_FOR_THE_UNIT"},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"TRACED","open_work":{"open_steps":3,"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_route_table.private","type":"aws_route_table","presence":"CONDITIONAL","in_totals":false,"module_call":"module.vpc.module.vpc","conditional_state":"RUNTIME_DATA_UNKNOWN","class":"RECONFIGURE","confidence":"LOW","target_fit":{"service":"implicit (STACKIT network default routing)","resources":[],"regions":[],"catalogue":{"state":"NOT_APPLICABLE","capabilities":[],"unmatched_resources":[]}},"blocker_count":2,"finding_count":4,"evidence_count":15,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":0,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.vpc.module.vpc.aws_route_table.private is an AWS route table, declared in .terraform/modules/vpc.vpc/main.tf (lines 296-311). Whether it exists is decided only when OpenTofu plans. It is part of module.vpc.module.vpc. It states 1 static route.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/78","id":"module.vpc.module.vpc.aws_route_table.private"},"expert":{"id_refs":["TL-1a5ce4b43e91","TL-01bef12d20ec","TL-84daded010e4","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-e7ee3a947433","line_ids":["TL-0af72abf060e","TL-c0a43bf32f50","TL-3fe644d9705b"],"artefact":{"kind":"SOURCE_FILE","file":".terraform/modules/vpc.vpc/main.tf","pointer":"lines 296-311"},"expert":{"ids":["source route: module.vpc.module.vpc.aws_route.private_nat_gateway[0]"]}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-2c6efe20f724","line_ids":["TL-d821186c5899","TL-e6082d3e0453","TL-b1b9b940f39d","TL-f7605a58cf76","TL-5fe7de8e49d0"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.vpc.module.vpc.aws_route_table.private"},"expert":{"id_refs":["TL-f4bdc86495d2","TL-5fcc73b473a9","TL-c9e9a6fa4297","TL-d1154369b0c7","TL-13aa992cabfa","TL-46ec0bd8733b","TL-4da6daaadabc","TL-7ed9b4f5c253","TL-af1b6af93bf9"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-f6447023ae07","line_ids":["TL-27f3a4627dfd","TL-af41f8705c3a","TL-f61ceb9cfdbd"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/48","id":"module.vpc.module.vpc.aws_route_table.private"},"expert":{"id_refs":["TL-387d940bc647","TL-98aa55dee3f2","TL-444d4e87e36c","TL-32293da86636","TL-750b3fbf1f7f","TL-a9008b2e818b","TL-b624e4e24859","TL-bad803821ffc","TL-4cf4d335bf4e","TL-32d8108ffe03","TL-d325015c1bfd"]}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-557f00fb0718","line_ids":["TL-cffc21fa1051","TL-da92f5545dab","TL-2445c6df2977","TL-c3094c377b8f","TL-287f714a8ff5","TL-d7ec1cee7472"],"artefact":{"kind":"IN_MEMORY","id":"route:module.vpc.module.vpc.aws_route_table.private"},"expert":{"ids":["intent family: ROUTE","intent: route:module.vpc.module.vpc.aws_route_table.private"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-1600f1039cd4","line_ids":["TL-0f6d1239a13d","TL-e5fa9372b1a5","TL-da1f8992cf91","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3"],"artefact":{"kind":"IN_MEMORY","id":"network.routing"},"expert":{"id_refs":["TL-f575989be228","TL-2e2145f25c54","TL-a64ef62aaef3","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-9dcba97134cc","lines":["1 manual action, due before the pilot"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-73c168cf3773","TL-88567a96060b","TL-a39cdd3e9206","TL-ddd75ed5ef6e"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary_id":"TT-6a07761f0aee","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-f0225bd35ccc","TL-d477c31ae16d","TL-5ce834a2bf21","TL-871d4c9b23bb","TL-677f2c309663"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.vpc.module.vpc.aws_route_table.private","family":"AWS_ROUTING","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/78","ids":["unit:module.vpc.module.vpc.aws_route_table.private"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/48"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:route:module.vpc.module.vpc.aws_route_table.private"]},{"hop":"plan","state":"NONE","kind":"REPORT_FILE","file":"target-plan.json","reason":"NOT_DRAFTED"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NOT_DRAFTED"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:final-artifact@module.vpc.module.vpc.aws_route_table.private","check:plan-valid@module.vpc.module.vpc.aws_route_table.private","check:renders@module.vpc.module.vpc.aws_route_table.private","check:round-trip@module.vpc.module.vpc.aws_route_table.private","check:route-complete@module.vpc.module.vpc.aws_route_table.private"]}],"targets":[]},"plan_statements":[{"id":"stackitroute:statement:module.vpc.module.vpc.aws_route_table.private","family":"stackitroute","reason":"NOT_DRAFTED","cause":"STACKIT's default routing replaces the table, with a loss: a route of the table sends traffic to a NAT gateway (the others, if any, to an internet gateway), and the reachability is observed on the target for a project outside a Network Area, which this draft does not write. Observed in one sandbox project outside a Network Area (tested on a STACKIT project on 2026-10-10; routing tables are refused there): a routed network reaches the internet with no route and no routing table configured, a server without a public IP through the network's shared SNAT address and a server with a public IP through its own; nothing initiated from the internet reached a server behind the network address; egress is restricted by the egress rules of security groups, not by a route; routed networks reach each other with no table. No stackit_routing_table is drafted. A NAT gateway adds what an internet route does not. Its fixed egress address is LOST (observed): the address a routed STACKIT network leaves by is the network's publicIp, one address for every routed network of the project, not fixed (it changed twice when every network of the project was deleted) and not settable (a PATCH of it answers 202 and is ignored), so a third party's allow-list on the NAT gateway's address does not survive; a STACKIT public IP per server keeps its address, the only one the probe saw stay fixed. The egress restriction (the gateway as the only way out of a private subnet) is carried by the egress rules of security groups, not by a route (observed); whether the source restricts egress that way is for the architect. The absence of inbound paths of a private subnet is observed for a server without a public IP (tcp 22, 80 and 8080 on the network address). Not observed: a Network Area and its default routing table. The outbound address of the servers an allow-list names is the architect's choice: keep the changing address, or give each server that an allow-list names a STACKIT public IP","manual_actions":[{"id":"stackitroute:precondition-outside-area:module.vpc.module.vpc.aws_route_table.private","kind":"TARGET_PRECONDITION","phase":"BEFORE_PILOT","what":"Create the target project outside a Network Area: module.vpc.module.vpc.aws_route_table.private is replaced by STACKIT's default routing, which was observed to give a routed network the same reachability only in a project outside a Network Area","why":"STACKIT's default routing was observed to give a routed network the same reachability only in a project outside a Network Area (tested on a STACKIT project in eu01 on 2026-10-10); the default routing table of an area was never read (the organisation read answered 403), so a project created inside an existing area (var.project_id naming one) is not covered by this replacement and the table needs the architect's decision there"}],"open_decisions":[{"id":"stackitroute:module.vpc.module.vpc.aws_route_table.private:NAT_FIXED_EGRESS_ADDRESS_LOST","reasons":["a NAT gateway's fixed egress address is lost on STACKIT: the address a routed network leaves by is the network's own, shared by every routed network of the project, not fixed and not settable"],"required_by_phase":"BEFORE_PILOT","question":"Decide the egress address of module.vpc.module.vpc.aws_route_table.private: keep the changing address of the STACKIT network, or give each server that an allow-list names a STACKIT public IP","subjects":["module.vpc.module.vpc.aws_route_table.private"]}]}],"coverage":"TRACED","open_work":{"open_steps":4,"register":{"open":3,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE"]},{"source":"PLAN_STATEMENT","open_records":["DEC-NET-STACKITROUTE-STATEMENT-NOT-DRAFTED"]}],"next_step":{"record":"DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST","source":"PLAN_DECISION","text":"Decide \"nat fixed egress address lost\" (DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST): the plan of the draft leaves it open"},"blocks_automation":true}}},{"address":"module.vpc.module.vpc.aws_route_table.public","type":"aws_route_table","presence":"CONDITIONAL","in_totals":false,"module_call":"module.vpc.module.vpc","conditional_state":"RUNTIME_DATA_UNKNOWN","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"implicit (STACKIT network default routing)","resources":[],"regions":[],"catalogue":{"state":"NOT_APPLICABLE","capabilities":[],"unmatched_resources":[]}},"blocker_count":2,"finding_count":3,"evidence_count":18,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":0,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.vpc.module.vpc.aws_route_table.public is an AWS route table, declared in .terraform/modules/vpc.vpc/main.tf (lines 164-179). Whether it exists is decided only when OpenTofu plans. It is part of module.vpc.module.vpc. It states 1 static route.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/79","id":"module.vpc.module.vpc.aws_route_table.public"},"expert":{"id_refs":["TL-14a4f258dd05","TL-01bef12d20ec","TL-84daded010e4","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-e7ee3a947433","line_ids":["TL-cc043135a6e3","TL-c0a43bf32f50","TL-3fe644d9705b"],"artefact":{"kind":"SOURCE_FILE","file":".terraform/modules/vpc.vpc/main.tf","pointer":"lines 164-179"},"expert":{"ids":["source route: module.vpc.module.vpc.aws_route.public_internet_gateway"]}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-057cd0075aff","line_ids":["TL-d821186c5899","TL-603b3243b53e","TL-31d59c4e066e","TL-f7605a58cf76","TL-5fe7de8e49d0"],"artefact":{"kind":"REPORT_FILE","file":"engineering/review-edges.csv","id":"module.vpc.module.vpc.aws_route_table.public"},"expert":{"id_refs":["TL-f4bdc86495d2","TL-c9e9a6fa4297","TL-d1154369b0c7","TL-9ba58f23da6a","TL-726673a98119","TL-55e3b8c3d3c7","TL-4ad56580aeaa","TL-46ec0bd8733b","TL-7ed9b4f5c253","TL-af1b6af93bf9"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-af554fedc610","line_ids":["TL-8ce3e6f657a2","TL-b8dcaad7eb2a","TL-765f2c8e4b62","TL-924a6e48f42e"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/49","id":"module.vpc.module.vpc.aws_route_table.public"},"expert":{"id_refs":["TL-e8c434043da6","TL-750b3fbf1f7f","TL-a9008b2e818b","TL-b624e4e24859","TL-bad803821ffc","TL-4cf4d335bf4e","TL-ad77bfd2606b","TL-d325015c1bfd"]}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-557f00fb0718","line_ids":["TL-cffc21fa1051","TL-da92f5545dab","TL-2445c6df2977","TL-c3094c377b8f","TL-287f714a8ff5","TL-d7ec1cee7472"],"artefact":{"kind":"IN_MEMORY","id":"route:module.vpc.module.vpc.aws_route_table.public"},"expert":{"ids":["intent family: ROUTE","intent: route:module.vpc.module.vpc.aws_route_table.public"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-1600f1039cd4","line_ids":["TL-0f6d1239a13d","TL-e5fa9372b1a5","TL-da1f8992cf91","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3"],"artefact":{"kind":"IN_MEMORY","id":"network.routing"},"expert":{"id_refs":["TL-f575989be228","TL-2e2145f25c54","TL-a64ef62aaef3","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-dcf856f90df6","lines":["1 manual action, due before the pilot"],"artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-88567a96060b","TL-e5065cc37a7a","TL-ddd75ed5ef6e"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary_id":"TT-6a07761f0aee","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-f0225bd35ccc","TL-d477c31ae16d","TL-5ce834a2bf21","TL-871d4c9b23bb","TL-677f2c309663"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.vpc.module.vpc.aws_route_table.public","family":"AWS_ROUTING","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/79","ids":["unit:module.vpc.module.vpc.aws_route_table.public"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/49"},{"hop":"intent","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["intent:route:module.vpc.module.vpc.aws_route_table.public"]},{"hop":"plan","state":"NONE","kind":"REPORT_FILE","file":"target-plan.json","reason":"NOT_DRAFTED"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NOT_DRAFTED"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:final-artifact@module.vpc.module.vpc.aws_route_table.public","check:plan-valid@module.vpc.module.vpc.aws_route_table.public","check:renders@module.vpc.module.vpc.aws_route_table.public","check:round-trip@module.vpc.module.vpc.aws_route_table.public","check:route-complete@module.vpc.module.vpc.aws_route_table.public"]}],"targets":[]},"plan_statements":[{"id":"stackitroute:statement:module.vpc.module.vpc.aws_route_table.public","family":"stackitroute","reason":"NOT_DRAFTED","cause":"STACKIT's default routing replaces the table: every route of the table sends traffic to an internet gateway, and the equivalence is observed on the target for a project outside a Network Area, which this draft does not write. Observed in one sandbox project outside a Network Area (tested on a STACKIT project on 2026-10-10; routing tables are refused there): a routed network reaches the internet with no route and no routing table configured, a server without a public IP through the network's shared SNAT address and a server with a public IP through its own; nothing initiated from the internet reached a server behind the network address; egress is restricted by the egress rules of security groups, not by a route; routed networks reach each other with no table. No stackit_routing_table is drafted. Observed in one project of one region on one day, so not HIGH; not observed: a Network Area and its default routing table, where this would be open again","manual_actions":[{"id":"stackitroute:precondition-outside-area:module.vpc.module.vpc.aws_route_table.public","kind":"TARGET_PRECONDITION","phase":"BEFORE_PILOT","what":"Create the target project outside a Network Area: module.vpc.module.vpc.aws_route_table.public is replaced by STACKIT's default routing, which was observed to give a routed network the same reachability only in a project outside a Network Area","why":"STACKIT's default routing was observed to give a routed network the same reachability only in a project outside a Network Area (tested on a STACKIT project in eu01 on 2026-10-10); the default routing table of an area was never read (the organisation read answered 403), so a project created inside an existing area (var.project_id naming one) is not covered by this replacement and the table needs the architect's decision there. Also not equivalent for a server WITHOUT a public IP: the source's internet gateway serves only an instance with a public IPv4 or Elastic IP address, so such a server had no internet path, while on STACKIT it leaves through the network's shared SNAT address (the test of 2026-10-10): that egress is new, the table does not carry it, and it is decided on the subnet (subnet-egress-ipv4-unproven)"}]}],"coverage":"TRACED","open_work":{"open_steps":4,"register":{"open":2,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC"]},{"source":"PLAN_STATEMENT","open_records":["DEC-NET-STACKITROUTE-STATEMENT-NOT-DRAFTED"]}],"next_step":{"record":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.vpc.module.vpc.aws_route_table.public (DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.vpc.module.vpc.aws_route_table.redshift","type":"aws_route_table","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"MANUAL_REVIEW","candidate_confidence":"LOW"},"target_fit":null,"blocker_count":1,"finding_count":1,"evidence_count":18,"automation_eligible":null,"wave":0,"trace":{"outcome":"COMPLETE","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.vpc.module.vpc.aws_route_table.redshift is an AWS route table, declared in .terraform/modules/vpc.vpc/main.tf (lines 610-620). It is switched off in the source. It is part of module.vpc.module.vpc. It states 0 static routes.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/80","id":"module.vpc.module.vpc.aws_route_table.redshift"},"expert":{"id_refs":["TL-0a4640271be1","TL-01bef12d20ec","TL-84daded010e4","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary":"The source states no static route for this unit.","line_ids":["TL-c0a43bf32f50","TL-3fe644d9705b"],"artefact":{"kind":"SOURCE_FILE","file":".terraform/modules/vpc.vpc/main.tf","pointer":"lines 610-620"},"expert":{}},{"stage":"RESOLUTION_PROOF","state":"OPEN","summary_id":"TT-28cf18b349f1","lines":["the network of the table: no resource could be named, so the reference is not resolved"],"artefact":{"kind":"IN_MEMORY","id":"module.vpc.module.vpc.aws_route_table.redshift"},"expert":{"id_refs":["TL-94c59a08ef5d","TL-ed10391cb980"]}},{"stage":"SEMANTIC_CLAIM","state":"NONE","summary_id":"TT-09e44fcd9ff2","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"INTENT","state":"OPEN","summary_id":"TT-5cb9f071fb3a","line_ids":["TL-cffc21fa1051","TL-37d10d9f6067","TL-2445c6df2977","TL-c3094c377b8f","TL-02276117e89a"],"artefact":{"kind":"IN_MEMORY","id":"route:module.vpc.module.vpc.aws_route_table.redshift"},"expert":{"ids":["intent family: ROUTE","intent: route:module.vpc.module.vpc.aws_route_table.redshift"]}},{"stage":"TARGET_CAPABILITY","state":"ESTABLISHED","summary_id":"TT-1600f1039cd4","line_ids":["TL-0f6d1239a13d","TL-e5fa9372b1a5","TL-da1f8992cf91","TL-b460c9a12f81","TL-b42f1855452e","TL-5c63eab97a64","TL-3f1231158ad4","TL-a7fb71a085e3"],"artefact":{"kind":"IN_MEMORY","id":"network.routing"},"expert":{"id_refs":["TL-f575989be228","TL-2e2145f25c54","TL-a64ef62aaef3","TL-3aeaea77c5b3"]}},{"stage":"TRANSFORMATION","state":"OPEN","summary_id":"TT-dcf856f90df6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{"id_refs":["TL-c623eeb96ddb","TL-ddd75ed5ef6e"]}},{"stage":"RENDER","state":"NONE","summary_id":"TT-d654b6ebf000","artefact":{"kind":"IN_MEMORY"},"expert":{}},{"stage":"VALIDATION","state":"NONE","summary":"The draft writes nothing for this unit, so nothing was checked.","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}},{"stage":"RESIDUAL_DIFFERENCE","state":"NONE","summary_id":"TT-7128875253f6","artefact":{"kind":"REPORT_FILE","file":"target-plan.json","pointer":"/plans"},"expert":{}}]},"refs":{"id":"unit:module.vpc.module.vpc.aws_route_table.redshift","family":"AWS_ROUTING","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/80","ids":["unit:module.vpc.module.vpc.aws_route_table.redshift"]},{"hop":"claims","state":"NONE","kind":"IN_MEMORY","reason":"NO_CLAIM_FOR_THE_UNIT"},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"TRACED","open_work":{"open_steps":3,"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_subnet.database","type":"aws_subnet","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"RECONFIGURE","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT network","resources":["stackit_network"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.network"],"unmatched_resources":[]}},"blocker_count":1,"finding_count":1,"evidence_count":1,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_subnet.database","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/81","ids":["unit:module.vpc.module.vpc.aws_subnet.database"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_subnet.elasticache","type":"aws_subnet","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"RECONFIGURE","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT network","resources":["stackit_network"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.network"],"unmatched_resources":[]}},"blocker_count":1,"finding_count":1,"evidence_count":1,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_subnet.elasticache","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/82","ids":["unit:module.vpc.module.vpc.aws_subnet.elasticache"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_subnet.intra","type":"aws_subnet","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"RECONFIGURE","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT network","resources":["stackit_network"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.network"],"unmatched_resources":[]}},"blocker_count":1,"finding_count":1,"evidence_count":1,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_subnet.intra","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/83","ids":["unit:module.vpc.module.vpc.aws_subnet.intra"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_subnet.outpost","type":"aws_subnet","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"RECONFIGURE","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT network","resources":["stackit_network"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.network"],"unmatched_resources":[]}},"blocker_count":1,"finding_count":1,"evidence_count":1,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_subnet.outpost","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/84","ids":["unit:module.vpc.module.vpc.aws_subnet.outpost"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_subnet.private","type":"aws_subnet","presence":"CONDITIONAL","in_totals":false,"module_call":"module.vpc.module.vpc","conditional_state":"RUNTIME_DATA_UNKNOWN","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT network","resources":["stackit_network"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.network"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":3,"evidence_count":1,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":0,"properties_not_carried":3,"not_carried":[{"node":"module.vpc.module.vpc.aws_subnet.private","property":"availability_zone","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"availability-durability","reason":"NOT CARRIED (module.vpc.module.vpc.aws_subnet.private): availability_zone, availability_zone_id — stackit_network has no availability zone (pinned provider): the network serves the region; servers and volumes choose their zone.","semantic":"availability-zone","contract":"aws.subnet","source":".terraform/modules/vpc.vpc/main.tf:267"},{"node":"module.vpc.module.vpc.aws_subnet.private","property":"availability_zone_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"availability-durability","reason":"NOT CARRIED (module.vpc.module.vpc.aws_subnet.private): availability_zone, availability_zone_id — stackit_network has no availability zone (pinned provider): the network serves the region; servers and volumes choose their zone.","semantic":"availability-zone","contract":"aws.subnet","source":".terraform/modules/vpc.vpc/main.tf:267"},{"node":"module.vpc.module.vpc.aws_subnet.private","property":"vpc_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.vpc.module.vpc.aws_subnet.private): vpc_id — the source VPC is not generated: the network is created in the project (stackit_network also takes a vpc_id of the experimental STACKIT VPC feature, pinned provider — not used by this draft).","semantic":"subnet-vpc-membership","contract":"aws.subnet","source":".terraform/modules/vpc.vpc/main.tf:267"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.vpc.module.vpc.aws_subnet.private is a resource of the source, declared in .terraform/modules/vpc.vpc/main.tf (lines 267-293). Whether it exists is decided only when OpenTofu plans. It is part of module.vpc.module.vpc. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-2f5f781a3aac"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/85","id":"module.vpc.module.vpc.aws_subnet.private"},"expert":{"id_refs":["TL-d197300eb63b","TL-3431d6c38ce9","TL-a37fa27cada2","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-34f7834374a1","TL-dbae16bc1236","TL-401a230315b0","TL-cd465a05b885"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-8931c2124903","TL-efa1fc4dca0a","TL-3fe12d970b09","TL-01522a3dfc24","TL-164b373d0ac3"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-ab5aa9dd429f","line_ids":["TL-feaba4f52477","TL-b8dcaad7eb2a","TL-5570bfbb8c05"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/50","id":"module.vpc.module.vpc.aws_subnet.private"},"expert":{"id_refs":["TL-6e5d2f0ca383","TL-f836b0fdd546","TL-d3cadd9abc4a","TL-750b3fbf1f7f","TL-37407e100e63","TL-63913ce1cf74","TL-a124fb19fe25","TL-fc8533223ee0","TL-d2696a4e7bf2"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-d130b98cad63","line_ids":["TL-cf281cc11bb2"],"artefact":{"kind":"REPORT_FILE","file":"terraform/network.tf","id":"stackit_network.vpc_vpc_private"},"expert":{"id_refs":["TL-4ade1f323433","TL-3df646002eb3","TL-aceb91f4c363"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-9e42df036afd","line_ids":["TL-0e001b3993f2","TL-aa92cf1fd974","TL-6364d1a93c94","TL-d50841142838","TL-5d4b69294c34","TL-05f865868127","TL-0b7af830628b","TL-2ada6ff8b4b4","TL-384370564772"],"artefact":{"kind":"IN_MEMORY"},"expert":{"ids":["decision: convert:module.vpc.module.vpc.aws_subnet.private:network:WORKLOAD_PLACEMENT"]}}]},"refs":{"id":"unit:module.vpc.module.vpc.aws_subnet.private","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/85","ids":["unit:module.vpc.module.vpc.aws_subnet.private"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/50"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_network.vpc_vpc_private"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 1 open decisions, 0 manual actions","open_decisions":[{"id":"convert:module.vpc.module.vpc.aws_subnet.private:network:WORKLOAD_PLACEMENT","reasons":["the source splits these workloads over subnets, and STACKIT places them differently: an SKE cluster is deployed into one network (network.id) and its node pools state no network, a managed database, cache or broker takes an access list and no network id; no one-to-one placement of the consumers in stackit_network.vpc_vpc_private follows from the source, so the network's step waits for the decision"],"required_by_phase":"BEFORE_PILOT","question":"Decide where the source consumers of module.vpc.module.vpc.aws_subnet.private are placed on STACKIT: the source places module.dependencies.aws_mq_broker.mq, module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, module.dependencies.module.catalog_rds.aws_rds_cluster.this, module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, module.dependencies.module.orders_rds.aws_rds_cluster.this, module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, module.retail_app_ecs.module.orders_service.aws_ecs_service.this and module.retail_app_ecs.module.ui_service.aws_ecs_service.this in it, and the draft places none of them in stackit_network.vpc_vpc_private (the target networks the draft generates for the subnets of the same VPC: stackit_network.vpc_vpc_private and stackit_network.vpc_vpc_public); the drafted Kubernetes cluster stackit_ske_cluster.retail_app_ecs_cluster of these consumers sets no network.id — option one-network-for-the-cluster-and-services (the cluster and the servers in one network, the managed services reached by access lists naming its range), keep-the-networks-and-place-by-tier, redesign-the-network-placement, or accept-the-consumers-outside-the-network (the network as drafted, holding none of them)","subjects":["module.dependencies.aws_mq_broker.mq","module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","module.dependencies.module.catalog_rds.aws_rds_cluster.this","module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","module.dependencies.module.orders_rds.aws_rds_cluster.this","module.retail_app_ecs.module.carts_service.aws_ecs_service.this","module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","module.retail_app_ecs.module.orders_service.aws_ecs_service.this","module.retail_app_ecs.module.ui_service.aws_ecs_service.this","module.vpc.module.vpc.aws_subnet.private","stackit_network.vpc_vpc_private","stackit_network.vpc_vpc_public"]}],"manual_actions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"open_decisions":1,"manual_actions":0,"register":{"open":3,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-WORKLOAD-PLACEMENT"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE","DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE"]}],"next_step":{"record":"DEC-GEN-CONVERT-WORKLOAD-PLACEMENT","source":"PLAN_DECISION","text":"Decide \"workload placement\" (DEC-GEN-CONVERT-WORKLOAD-PLACEMENT): the plan of the draft leaves it open"},"blocks_automation":true}}},{"address":"module.vpc.module.vpc.aws_subnet.public","type":"aws_subnet","presence":"CONDITIONAL","in_totals":false,"module_call":"module.vpc.module.vpc","conditional_state":"RUNTIME_DATA_UNKNOWN","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT network","resources":["stackit_network"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.network"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":4,"evidence_count":1,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":0,"properties_not_carried":3,"not_carried":[{"node":"module.vpc.module.vpc.aws_subnet.public","property":"availability_zone","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"availability-durability","reason":"NOT CARRIED (module.vpc.module.vpc.aws_subnet.public): availability_zone, availability_zone_id — stackit_network has no availability zone (pinned provider): the network serves the region; servers and volumes choose their zone.","semantic":"availability-zone","contract":"aws.subnet","source":".terraform/modules/vpc.vpc/main.tf:131"},{"node":"module.vpc.module.vpc.aws_subnet.public","property":"availability_zone_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"availability-durability","reason":"NOT CARRIED (module.vpc.module.vpc.aws_subnet.public): availability_zone, availability_zone_id — stackit_network has no availability zone (pinned provider): the network serves the region; servers and volumes choose their zone.","semantic":"availability-zone","contract":"aws.subnet","source":".terraform/modules/vpc.vpc/main.tf:131"},{"node":"module.vpc.module.vpc.aws_subnet.public","property":"vpc_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (module.vpc.module.vpc.aws_subnet.public): vpc_id — the source VPC is not generated: the network is created in the project (stackit_network also takes a vpc_id of the experimental STACKIT VPC feature, pinned provider — not used by this draft).","semantic":"subnet-vpc-membership","contract":"aws.subnet","source":".terraform/modules/vpc.vpc/main.tf:131"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"module.vpc.module.vpc.aws_subnet.public is a resource of the source, declared in .terraform/modules/vpc.vpc/main.tf (lines 131-158). Whether it exists is decided only when OpenTofu plans. It is part of module.vpc.module.vpc. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","line_ids":["TL-0b62c421a92a"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/86","id":"module.vpc.module.vpc.aws_subnet.public"},"expert":{"id_refs":["TL-d197300eb63b","TL-3431d6c38ce9","TL-a37fa27cada2","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-9d66b9ddceaa","TL-349c21e22eb4","TL-401a230315b0"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-8931c2124903","TL-efa1fc4dca0a","TL-97ccea328e8c","TL-3fe12d970b09","TL-01522a3dfc24","TL-464dbe55e0dd"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-86e01f7c90fe","line_ids":["TL-014cbc99261a","TL-185c870bf3cc","TL-ed4cf778c0f2"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/51","id":"module.vpc.module.vpc.aws_subnet.public"},"expert":{"id_refs":["TL-6e5d2f0ca383","TL-f836b0fdd546","TL-e719f7a8dede","TL-d3cadd9abc4a","TL-750b3fbf1f7f","TL-37407e100e63","TL-f6130d78ba30","TL-ad1065332d19","TL-a124fb19fe25","TL-fc8533223ee0","TL-d2696a4e7bf2"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-d130b98cad63","line_ids":["TL-4578a99565f4"],"artefact":{"kind":"REPORT_FILE","file":"terraform/network.tf","id":"stackit_network.vpc_vpc_public"},"expert":{"id_refs":["TL-4ade1f323433","TL-d1167884884b","TL-7c5b8dee254e"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-6ee5af4c829c","line_ids":["TL-0e001b3993f2","TL-aa92cf1fd974","TL-6364d1a93c94","TL-d50841142838","TL-e4511b0b541c","TL-5d4b69294c34","TL-05f865868127","TL-62c42524fb55","TL-2ada6ff8b4b4"],"artefact":{"kind":"IN_MEMORY"},"expert":{}}]},"refs":{"id":"unit:module.vpc.module.vpc.aws_subnet.public","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/86","ids":["unit:module.vpc.module.vpc.aws_subnet.public"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/51"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_network.vpc_vpc_public"]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":2,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC","DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC"]}],"next_step":{"record":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.vpc.module.vpc.aws_subnet.public (DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.vpc.module.vpc.aws_subnet.redshift","type":"aws_subnet","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"RECONFIGURE","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT network","resources":["stackit_network"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.network"],"unmatched_resources":[]}},"blocker_count":1,"finding_count":1,"evidence_count":1,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_subnet.redshift","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/87","ids":["unit:module.vpc.module.vpc.aws_subnet.redshift"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_vpc.this","type":"aws_vpc","presence":"KNOWN_PRESENT","in_totals":true,"module_call":"module.vpc.module.vpc","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT project networking / Network Area (SNA)","resources":["stackit_network_area","stackit_network"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.network"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":5,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"ANSWERABLE","wave":1,"refs":{"id":"unit:module.vpc.module.vpc.aws_vpc.this","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/8","ids":["unit:module.vpc.module.vpc.aws_vpc.this"]},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NO_DRAFT_BLOCK"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":2,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS","DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS"]}],"next_step":{"record":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of module.vpc.module.vpc.aws_vpc.this (DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS): decide each or accept the difference"},"blocks_automation":true}}},{"address":"module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this","type":"aws_vpc_block_public_access_exclusion","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"for_each = 0","candidate_class":"REDESIGN","candidate_confidence":"MEDIUM"},"target_fit":{"service":"none - no account guardrail to except a VPC or subnet from","resources":[],"regions":[],"catalogue":{"state":"NOT_APPLICABLE","capabilities":[],"unmatched_resources":[]}},"blocker_count":2,"finding_count":1,"evidence_count":6,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/88","ids":["unit:module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_vpc_block_public_access_options.this","type":"aws_vpc_block_public_access_options","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"REDESIGN","candidate_confidence":"MEDIUM"},"target_fit":{"service":"none - no account guardrail; exposure is set by security groups and by who may attach public IPs","resources":[],"regions":[],"catalogue":{"state":"NOT_APPLICABLE","capabilities":[],"unmatched_resources":[]}},"blocker_count":2,"finding_count":1,"evidence_count":6,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_vpc_block_public_access_options.this","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/89","ids":["unit:module.vpc.module.vpc.aws_vpc_block_public_access_options.this"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_vpc_dhcp_options.this","type":"aws_vpc_dhcp_options","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"RECONFIGURE","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT network DNS settings","resources":["stackit_network"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["network.network"],"unmatched_resources":[]}},"blocker_count":1,"finding_count":1,"evidence_count":1,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_vpc_dhcp_options.this","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/90","ids":["unit:module.vpc.module.vpc.aws_vpc_dhcp_options.this"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_vpn_gateway.this","type":"aws_vpn_gateway","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"RECONFIGURE","candidate_confidence":"MEDIUM"},"target_fit":{"service":"STACKIT VPN","resources":["stackit_vpn_gateway","stackit_vpn_connection"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED","capabilities":[],"unmatched_resources":["stackit_vpn_connection","stackit_vpn_gateway"],"unlinked_resources":["stackit_vpn_connection","stackit_vpn_gateway"]}},"blocker_count":1,"finding_count":1,"evidence_count":3,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_vpn_gateway.this","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/91","ids":["unit:module.vpc.module.vpc.aws_vpn_gateway.this"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}},{"address":"module.vpc.module.vpc.aws_vpn_gateway_attachment.this","type":"aws_vpn_gateway_attachment","presence":"KNOWN_ABSENT","in_totals":false,"module_call":"module.vpc.module.vpc","switched_off":{"by":"count = 0","candidate_class":"MANUAL_REVIEW","candidate_confidence":"LOW"},"target_fit":null,"blocker_count":1,"finding_count":1,"evidence_count":0,"automation_eligible":null,"wave":0,"refs":{"id":"unit:module.vpc.module.vpc.aws_vpn_gateway_attachment.this","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/92","ids":["unit:module.vpc.module.vpc.aws_vpn_gateway_attachment.this"]},{"hop":"intent","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"plan","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"},{"hop":"validation","state":"NONE","kind":"NOT_AVAILABLE","reason":"UNIT_SWITCHED_OFF"}],"targets":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":0,"accepted":0}}}],"shared_instances":[],"evidence":{"units":93,"units_with_evidence":90,"evidence_references":376,"findings":213,"findings_by_severity":[{"key":"critical","count":1},{"key":"warning","count":115},{"key":"info","count":42}],"switched_off_findings":55,"switched_off_findings_by_severity":[{"key":"warning","count":45},{"key":"info","count":10}],"units_with_region_evidence":17,"property_accounting":{"units":38,"units_not_generated":11,"meaningful":404,"unaccounted":0,"not_carried":209,"units_with_unaccounted":0}},"decision_register":{"state":"BUILT","basis":"Records group four lists: the open decisions of the TargetPlans of the draft this run wrote, by the family of the producer (security group, routing, identity, logs, server) and the kind of the decision (plan decisions); the open critical semantics of the units, by the contract family and the semantic (critical semantics); the manual actions of the plans, by the family of the producer and the kind of the action (manual actions); and the open statements of the plans about units they write no resource for (a redesign, a review, a block, a failed model, or a step beside a unit whose draft a converter writes), by the family of the producer and the reason (plan statements). Plan decisions and manual actions cover only drafted units whose draft passed StackToIT's own checks, and only the families whose draft this run wrote from a plan: a family with no plan has none to list. A plan statement covers a unit the plan writes nothing for, whether or not a draft check ran over it; a statement that leaves nothing to a person (a unit the plan does not draft and no manual action of it names) is counted (closed_statements) and is no record. A record shows the review of an overlay beside the open state the engine reached; a review closes no critical semantic and changes no draft, target plan, gate, class, confidence or eligibility. An accepted plan decision frees the steps of the execution plan that wait for it only when the answer's effect acknowledges the current draft; an option that changes the draft keeps them held until the draft is regenerated with it. Records of the family \"convert\" are decisions of the converter's own generators, outside every plan: a CONSTRAINT_CONFLICT (a variable whose consumers' STACKIT bounds exclude one another keeps the source default) and an AMBIGUOUS_* selection (the source does not prove which instance, interface, key pair, gateway, peer, subnet, proxy, URL map or health check it means, so the draft holds a required variable without a default); the unit that owns one is not automation-eligible. They are listed for a drafted unit whose plan checks did not fail.","plan_read":true,"groups":[{"id":"GRP-PLAN-DECISION-convert","source":"PLAN_DECISION","family":"convert","title":"Plan decisions · convert","record_ids":["DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","DEC-GEN-CONVERT-API-OPT-IN","DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","DEC-GEN-CONVERT-EXPOSURE-WIDENED","DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH","DEC-GEN-CONVERT-POD-SEGMENTATION","DEC-GEN-CONVERT-SIZE-FROM-SOURCE","DEC-GEN-CONVERT-WORKLOAD-PLACEMENT"],"records":9,"status":"OPEN","open_items":24,"accepted_items":0,"units":17,"by_status":[{"key":"OPEN","count":9},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Data Architect","Network Architect","Platform Architect","Security Architect"],"earliest_phase":"BEFORE_PILOT","conditional":0},{"id":"GRP-PLAN-DECISION-stackitlogs","source":"PLAN_DECISION","family":"stackitlogs","title":"Plan decisions · stackitlogs","record_ids":["DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS"],"records":1,"status":"OPEN","open_items":1,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":1},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Platform Architect"],"earliest_phase":"CUTOVER_PREREQUISITE","conditional":0},{"id":"GRP-PLAN-DECISION-stackitroute","source":"PLAN_DECISION","family":"stackitroute","title":"Plan decisions · stackitroute","record_ids":["DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST"],"records":1,"status":"OPEN","open_items":1,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":1},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Network Architect"],"earliest_phase":"BEFORE_PILOT","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-aws.cloudwatch_log_group","source":"CRITICAL_SEMANTIC","family":"aws.cloudwatch_log_group","title":"Critical semantics · aws.cloudwatch_log_group","record_ids":["DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-CLOUDWATCH-LOG-GROUP-ECS-TASKS"],"records":1,"status":"OPEN","open_items":1,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":1},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Platform Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-aws.dynamodb_table","source":"CRITICAL_SEMANTIC","family":"aws.dynamodb_table","title":"Critical semantics · aws.dynamodb_table","record_ids":["DEC-DATA-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE","DEC-OPS-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE","DEC-SEC-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE"],"records":3,"status":"OPEN","open_items":6,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":3},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Data Architect","Platform Architect","Security Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-aws.ecs","source":"CRITICAL_SEMANTIC","family":"aws.ecs","title":"Critical semantics · aws.ecs","record_ids":["DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS"],"records":25,"status":"OPEN","open_items":76,"accepted_items":0,"units":5,"by_status":[{"key":"OPEN","count":25},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Identity Architect","NOT_STATED","Network Architect","Platform Architect","Security Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-aws.eip","source":"CRITICAL_SEMANTIC","family":"aws.eip","title":"Critical semantics · aws.eip","record_ids":["DEC-NET-MODULE-VPC-MODULE-VPC-AWS-EIP-NAT"],"records":1,"status":"OPEN","open_items":1,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":1},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Network Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-aws.elasticache","source":"CRITICAL_SEMANTIC","family":"aws.elasticache","title":"Critical semantics · aws.elasticache","record_ids":["DEC-DATA-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374","DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374","DEC-OPS-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374","DEC-SEC-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374"],"records":4,"status":"OPEN","open_items":9,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":4},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Data Architect","Network Architect","Platform Architect","Security Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-aws.iam_role","source":"CRITICAL_SEMANTIC","family":"aws.iam_role","title":"Critical semantics · aws.iam_role","record_ids":["DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0","DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE"],"records":10,"status":"OPEN","open_items":40,"accepted_items":0,"units":10,"by_status":[{"key":"OPEN","count":10},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Identity Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-aws.internet_gateway","source":"CRITICAL_SEMANTIC","family":"aws.internet_gateway","title":"Critical semantics · aws.internet_gateway","record_ids":["DEC-NET-MODULE-VPC-MODULE-VPC-AWS-INTERNET-GATEWAY-THIS"],"records":1,"status":"OPEN","open_items":1,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":1},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Network Architect"],"earliest_phase":"NOT_STATED","conditional":1},{"id":"GRP-CRITICAL-SEMANTIC-aws.kms_key","source":"CRITICAL_SEMANTIC","family":"aws.kms_key","title":"Critical semantics · aws.kms_key","record_ids":["DEC-IAM-MODULE-RETAIL-APP-ECS-AWS-KMS-KEY-CMK"],"records":1,"status":"OPEN","open_items":1,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":1},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Identity Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-aws.lb","source":"CRITICAL_SEMANTIC","family":"aws.lb","title":"Critical semantics · aws.lb","record_ids":["DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS","DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS"],"records":2,"status":"OPEN","open_items":8,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":2},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Network Architect","Platform Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-aws.mq_broker","source":"CRITICAL_SEMANTIC","family":"aws.mq_broker","title":"Critical semantics · aws.mq_broker","record_ids":["DEC-IAM-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ","DEC-NET-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ","DEC-OPS-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ","DEC-SEC-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ"],"records":4,"status":"OPEN","open_items":7,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":4},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Identity Architect","Network Architect","Platform Architect","Security Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-aws.nat_gateway","source":"CRITICAL_SEMANTIC","family":"aws.nat_gateway","title":"Critical semantics · aws.nat_gateway","record_ids":["DEC-NET-MODULE-VPC-MODULE-VPC-AWS-NAT-GATEWAY-THIS"],"records":1,"status":"OPEN","open_items":3,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":1},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Network Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-aws.opensearch","source":"CRITICAL_SEMANTIC","family":"aws.opensearch","title":"Critical semantics · aws.opensearch","record_ids":["DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E","DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E","DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E","DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E"],"records":4,"status":"OPEN","open_items":14,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":4},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Identity Architect","Network Architect","Platform Architect","Security Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-aws.rds_cluster","source":"CRITICAL_SEMANTIC","family":"aws.rds_cluster","title":"Critical semantics · aws.rds_cluster","record_ids":["DEC-DATA-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","DEC-DATA-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","DEC-IAM-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","DEC-OPS-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","DEC-SEC-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS"],"records":10,"status":"OPEN","open_items":24,"accepted_items":0,"units":2,"by_status":[{"key":"OPEN","count":10},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Data Architect","Identity Architect","Network Architect","Platform Architect","Security Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-aws.route_table","source":"CRITICAL_SEMANTIC","family":"aws.route_table","title":"Critical semantics · aws.route_table","record_ids":["DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE","DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC"],"records":2,"status":"OPEN","open_items":13,"accepted_items":0,"units":2,"by_status":[{"key":"OPEN","count":2},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Network Architect"],"earliest_phase":"NOT_STATED","conditional":13},{"id":"GRP-CRITICAL-SEMANTIC-aws.secretsmanager_secret","source":"CRITICAL_SEMANTIC","family":"aws.secretsmanager_secret","title":"Critical semantics · aws.secretsmanager_secret","record_ids":["DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB","DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB","DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E","DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E","DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ","DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ","DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB","DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB"],"records":8,"status":"OPEN","open_items":10,"accepted_items":0,"units":4,"by_status":[{"key":"OPEN","count":8},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Platform Architect","Security Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-aws.security_group","source":"CRITICAL_SEMANTIC","family":"aws.security_group","title":"Critical semantics · aws.security_group","record_ids":["DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG","DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ","DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS","DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0","DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS","DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS","DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862","DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF","DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F","DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F","DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3","DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS"],"records":12,"status":"OPEN","open_items":76,"accepted_items":0,"units":12,"by_status":[{"key":"OPEN","count":12},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Network Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-aws.subnet","source":"CRITICAL_SEMANTIC","family":"aws.subnet","title":"Critical semantics · aws.subnet","record_ids":["DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE","DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE","DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC","DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC"],"records":4,"status":"OPEN","open_items":11,"accepted_items":0,"units":2,"by_status":[{"key":"OPEN","count":4},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Network Architect","Platform Architect"],"earliest_phase":"NOT_STATED","conditional":11},{"id":"GRP-CRITICAL-SEMANTIC-aws.vpc","source":"CRITICAL_SEMANTIC","family":"aws.vpc","title":"Critical semantics · aws.vpc","record_ids":["DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS","DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS"],"records":2,"status":"OPEN","open_items":6,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":2},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Network Architect","Platform Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-MANUAL-ACTION-stackitlogs","source":"MANUAL_ACTION","family":"stackitlogs","title":"Manual actions · stackitlogs","record_ids":["DEC-OPS-STACKITLOGS-ACTION-ARCHIVE-FLOW","DEC-OPS-STACKITLOGS-ACTION-LABEL-CONVENTION","DEC-OPS-STACKITLOGS-ACTION-TARGET-PRECONDITION"],"records":3,"status":"OPEN","open_items":3,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":3},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Platform Architect"],"earliest_phase":"CUTOVER_PREREQUISITE","conditional":0},{"id":"GRP-MANUAL-ACTION-stackitsg","source":"MANUAL_ACTION","family":"stackitsg","title":"Manual actions · stackitsg","record_ids":["DEC-SEC-STACKITSG-ACTION-INCOMPLETE","DEC-SEC-STACKITSG-ACTION-UNPLACED"],"records":2,"status":"OPEN","open_items":4,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":2},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Security Architect"],"earliest_phase":"BEFORE_PILOT","conditional":0},{"id":"GRP-PLAN-STATEMENT-stackitroute","source":"PLAN_STATEMENT","family":"stackitroute","title":"Plan statements · stackitroute","record_ids":["DEC-NET-STACKITROUTE-STATEMENT-NOT-DRAFTED"],"records":1,"status":"OPEN","open_items":2,"accepted_items":0,"units":2,"by_status":[{"key":"OPEN","count":1},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Network Architect"],"earliest_phase":"BEFORE_PILOT","conditional":0},{"id":"GRP-PLAN-STATEMENT-stackitsa","source":"PLAN_STATEMENT","family":"stackitsa","title":"Plan statements · stackitsa","record_ids":["DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW"],"records":1,"status":"OPEN","open_items":5,"accepted_items":0,"units":5,"by_status":[{"key":"OPEN","count":1},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Identity Architect"],"earliest_phase":"BEFORE_PILOT","conditional":0}],"id_grammar":"DEC-\u003cAREA\u003e-\u003cKEY\u003e; AREA one of NET, IAM, DATA, SEC, OPS, CMP, GEN; KEY 5 to 64 characters A-Z, 0-9, - (first A-Z or 0-9); built here as DEC-\u003cAREA\u003e-\u003cFAMILY\u003e-\u003cKIND\u003e","counts":{"records":113,"plan_records":11,"plan_decisions":25,"plan_decision_states":{"pending":25,"accepted_awaiting_verification":0,"rejected":0,"stale":0},"semantic_records":95,"open_critical_semantics":308,"conditional_semantics":25,"action_records":5,"manual_actions":7,"statement_records":2,"plan_statements":7,"closed_statements":17,"units":48,"by_status":[{"key":"OPEN","count":113},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"by_source":[{"source":"PLAN_DECISION","records":11,"open_items":25,"accepted_items":0,"units":19,"conditional":0,"open_records":11,"open_units":19,"open_default_records":2,"open_draft_default_records":2},{"source":"CRITICAL_SEMANTIC","records":95,"open_items":308,"accepted_items":0,"units":48,"conditional":25,"open_records":95,"open_units":48,"open_confirm_only_items":1},{"source":"MANUAL_ACTION","records":5,"open_items":7,"accepted_items":0,"units":2,"conditional":0,"open_records":5,"open_units":2},{"source":"PLAN_STATEMENT","records":2,"open_items":7,"accepted_items":0,"units":7,"conditional":0,"open_records":2,"open_units":7}],"by_cause":[{"key":"CUSTOMER_INPUT","count":12},{"key":"TARGET_LIMIT","count":8},{"key":"EVIDENCE_GAP","count":0},{"key":"IMPLEMENTATION_GAP","count":22},{"key":"APPLY_TIME","count":0},{"key":"DEPENDS_ON_UNIT","count":12},{"key":"NOT_CLASSIFIED","count":6},{"key":"MIXED","count":53}],"root_causes":1,"dependent_units":0,"by_blocker_class":[{"class":"ROOT_BLOCKER","records":1,"items":1},{"class":"GENUINELY_UNACCOUNTED","records":102,"items":317},{"class":"OPTIONAL_CONDITIONAL","records":10,"items":29},{"class":"PROPAGATED_IMPACT","records":0,"items":0}]},"review_input":{"state":"NOT_PROVIDED","entries":0},"unmatched_reviews":[],"state_definitions":{"review_state":"ARCHITECT_REVIEWED: a review of the decisions file, bound to this run (source digest, knowledge base and members all hold), covers every member of the record and accepts or rejects it; the outcome is the status and the review of the record. UNREVIEWED: none was given, it covers only some members, or its binding no longer holds. A review never closes a plan decision, a critical semantic or a manual action.","design_state":"OPEN: this run's plan or draft still carries the item. DESIGN_RESOLVED: stated only for an entry of the decisions file that this run's register does not hold, written for another source digest and the same knowledge base, in a run that read the plans of a generated draft without a degraded reading: the item is gone from the plan or draft of the later source. It is inferred from the absent id, so an id misspelled in the file reads the same way; a review never sets it.","validation_state":"TECHNICAL_VALIDATION_PASSED: this run ran tofu validate on the draft, it passed, and the record belongs to a family of the draft (security group, routing, identity or logs) that the validation covered. NOT_VALIDATED: tofu validate was not asked for, did not run, or the record is a critical semantic of the source, which a schema check of the draft does not cover. FAILED: tofu validate rejected the draft that holds the family. It is a static check against the pinned provider schema, not target behaviour and not approval."},"root_causes":[{"id":"DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","why":"The source runs an engine version newer than every version STACKIT offers in the region (1 converter decision): a snapshot of the newer engine is not restored into the older one, so the step that creates the instance waits until a person chooses how the data reaches the offered version (re-read from the source), runs the engine self-managed on SKE, or waits for the version; the unit that owns one is not automation-eligible until then.","records":["DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE"],"dependent_units":[],"dependent_records":[],"dependent_items":0,"next_step":"Decide engine version downgrade for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: choose one of the 3 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","next_record":"DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE"}],"decisions":[{"id":"DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","kind":"AMBIGUOUS_INSTANCE_SELECTION","family":"convert","source":"PLAN_DECISION","group":"GRP-PLAN-DECISION-convert","block":"AMBIGUOUS_INSTANCE_SELECTION","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"options":[{"id":"set-the-selector-to-one-instance","title":"Set the selector variable to the index of the instance the source means","effect":"The attribute takes one id, so one instance is meant; a person sets the selector variable the draft declares to the index of that instance, and the step is applied as the draft writes it (it needs the variable as an input). No other instance is referenced.","execution_effect":"ACK_CURRENT_ARTIFACT","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-23","quote":"network_id (String) The network ID to which the network interface is associated."}]},{"id":"reference-another-resource","title":"Reference another resource than the candidates","effect":"None of the instances of the repeated resource is what the source means; the reference is changed in the draft (to another block, or a block of its own) before the step is applied.","execution_effect":"REGENERATE_REQUIRED","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-23","quote":"network_id (String) The network ID to which the network interface is associated."}]}],"recommended_option":null,"blocking_effect":"TARGET_DESIGN_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"The converter could not prove which instance of a repeated resource the source means (1 converter decision): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides.","required_evidence":["the reference reaches stackit_network.vpc_vpc_public, a repeated resource (count or for_each), and nothing in the source proves which instance it means; no instance is assumed and the variable has no default","which instance of the repeated resource the source means (its index among the candidates the selector variable's description lists)"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:7d4ce9ee9ce1f3acbba48c88c829f6eb66a62259ada1ad27007786228edd5d9d","artifact_sha256":"sha256:d657345b9c347c9f67a71d34532dd9b788bb6c142734877e5b4a3580c976dd9a","kb_dependencies_sha256":"sha256:3cff130385543c2c208d88b90edeb0c1f0fe7d19da8e60e6420d1f8dfd5b3f07"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","source_family":"convert","source_semantic":"AMBIGUOUS_INSTANCE_SELECTION","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"TARGET_DESIGN_OPEN","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[{"id":"set-the-selector-to-one-instance","title":"Set the selector variable to the index of the instance the source means","prerequisites":[],"effects":["The attribute takes one id, so one instance is meant; a person sets the selector variable the draft declares to the index of that instance, and the step is applied as the draft writes it (it needs the variable as an input). No other instance is referenced."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29"],"regeneration_required":false},{"id":"reference-another-resource","title":"Reference another resource than the candidates","prerequisites":[],"effects":["None of the instances of the repeated resource is what the source means; the reference is changed in the draft (to another block, or a block of its own) before the step is applied."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29"],"regeneration_required":true}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29"],"state_reason":"a person's decision or input is still open","source_observation":"The plan leaves this decision open on module.retail_app_ecs.module.alb.aws_lb.this.","generated_target_behavior":"The draft holds TF/stackit_application_load_balancer.retail_app_ecs_alb_this until this decision is answered by an answer that frees it.","residual_difference":"the target design is open until the decision is answered","execution_effect":"1 step waits for it until it is answered: TF/stackit_application_load_balancer.retail_app_ecs_alb_this.","next_action":"Name the instance of a repeated resource a reference means for module.retail_app_ecs.module.alb.aws_lb.this: choose one of the 2 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["The converter could not prove which instance of a repeated resource the source means (1 converter decision): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides."],"closes_when":["an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option"],"required_inputs":["the reference reaches stackit_network.vpc_vpc_public, a repeated resource (count or for_each), and nothing in the source proves which instance it means; no instance is assumed and the variable has no default","which instance of the repeated resource the source means (its index among the candidates the selector variable's description lists)"]},"unblocks":{"holds":66,"stuck":63,"alone":0,"shared":3,"best_option":"set-the-selector-to-one-instance","options":[{"option":"set-the-selector-to-one-instance","effects":["ACK_CURRENT_ARTIFACT"],"alone":0,"shared":3},{"option":"reference-another-resource","effects":["REGENERATE_REQUIRED"],"alone":0,"shared":0}]}},{"id":"DEC-GEN-CONVERT-API-OPT-IN","kind":"API_OPT_IN","family":"convert","source":"PLAN_DECISION","group":"GRP-PLAN-DECISION-convert","block":"API_OPT_IN","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"options":[{"id":"allow-calls-of-the-api","title":"Allow the calls of the API for this migration","effect":"The calls of the API the plan states are made as the plan writes them (the request documents of the execution package), and the steps of their path are taken; the migration then depends on an API that may change or vanish.","execution_effect":"ACK_CURRENT_ARTIFACT","evidence":[{"url":"https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/functions/v1alpha/functions.json#L767-L771","class":"SOURCE_CODE_VERIFIED","checked_at":"2026-10-23","quote":"\"info\": {\"description\": \"This API provides endpoints for managing STACKIT Functions.\", \"title\": \"STACKIT Functions Core API\", \"version\": \"1alpha\"}"}]}],"recommended_option":null,"blocking_effect":"TARGET_DESIGN_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"The plan calls a STACKIT API that is not generally available (alpha, beta, or a release status its documentation does not state), which may change or be withdrawn, so it makes those calls only after you allow them (1 API): until you answer, the calls and the steps of their path wait. Allowing carries them out; refusing keeps the draft's own path where the API's path is an alternative beside it, and leaves the question open where the API is the only carrier of what its call sets. No block of the draft waits for it, and no unit's eligibility rests on it.","required_evidence":["the Secrets Manager Vault-compatible API is of a maturity that is not established (its documentation states no release status and its product documentation does not establish it as generally available): the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db wait for this decision; the draft's own blocks do not","the platform's consent to depend on an API that may change or vanish (alpha, beta, or a maturity the documentation does not establish)"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:e38398c0e3d250ba5bc2f41d119954b6cca973ef84267dcb555af7fa66082039","artifact_sha256":"sha256:8f448648a56ee601d5c9aeef0b5a933cd2aabe601c1db6a7695df6b7315e6bef","kb_dependencies_sha256":"sha256:03735a47b22c84235c95ed16b33e929eb21e905431c7a1c2103a67e6c13f9395"},"member_count":1,"affected_unit_count":4,"evidence_ref_count":4,"resolution":{"decision_id":"DEC-GEN-CONVERT-API-OPT-IN","source_family":"convert","source_semantic":"API_OPT_IN","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"TARGET_DESIGN_OPEN","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":4,"resolution_paths":[{"id":"allow-calls-of-the-api","title":"Allow the calls of the API for this migration","prerequisites":[],"effects":["The calls of the API the plan states are made as the plan writes them (the request documents of the execution package), and the steps of their path are taken; the migration then depends on an API that may change or vanish."],"risk":[],"evidence":["https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/functions/v1alpha/functions.json#L767-L771"],"regeneration_required":false}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":["https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/functions/v1alpha/functions.json#L767-L771"],"state_reason":"a person's decision or input is still open","source_observation":"The plan leaves this decision open on module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq and module.retail_app_ecs.aws_secretsmanager_secret.orders_db.","generated_target_behavior":"The draft holds API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq and API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db until this decision is answered by an answer that frees it.","residual_difference":"the target design is open until the decision is answered","execution_effect":"4 steps wait for it until it is answered: API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq and API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db.","next_action":"Allow STACKIT's pre-release API, which may change or be withdrawn: Secrets Manager v1 (release status not stated). 4 steps wait for this answer; allowing the calls lets the plan carry them out and makes the migration depend on that API. If you say no (record a rejection), the calls are not made: the steps of Secrets Manager stay open. Record the answer in the decisions file given with --decisions (decisions-template.yaml).","why_open":["The plan calls a STACKIT API that is not generally available (alpha, beta, or a release status its documentation does not state), which may change or be withdrawn, so it makes those calls only after you allow them (1 API): until you answer, the calls and the steps of their path wait. Allowing carries them out; refusing keeps the draft's own path where the API's path is an alternative beside it, and leaves the question open where the API is the only carrier of what its call sets. No block of the draft waits for it, and no unit's eligibility rests on it."],"closes_when":["Every API the record lists is answered in the decisions file: allowed, or refused."],"required_inputs":["the Secrets Manager Vault-compatible API is of a maturity that is not established (its documentation states no release status and its product documentation does not establish it as generally available): the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db wait for this decision; the draft's own blocks do not","the platform's consent to depend on an API that may change or vanish (alpha, beta, or a maturity the documentation does not establish)"]},"unblocks":{"holds":74,"stuck":64,"alone":4,"shared":6,"best_option":"allow-calls-of-the-api","options":[{"option":"allow-calls-of-the-api","effects":["ACK_CURRENT_ARTIFACT"],"alone":4,"shared":6},{"option":"","effects":["ACK_CURRENT_ARTIFACT"],"alone":4,"shared":6}]}},{"id":"DEC-GEN-CONVERT-DATA-MOVEMENT","kind":"DATA_MOVEMENT","family":"convert","source":"PLAN_DECISION","group":"GRP-PLAN-DECISION-convert","block":"DATA_MOVEMENT","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Data Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"options":[{"id":"export-and-import-with-the-engine-clients","title":"Export the data from the source and import it with the clients of the target engine","effect":"A person exports the data from the source and imports it into the STACKIT instance with the clients of its engine during a window the business accepts, then checks that the copy is complete; the clients reach the instance at the host and port its credential states. The source and the target engine may differ (DynamoDB to MongoDB Flex), so the export is converted where they do. The plan holds the steps of this option as typed steps: for a PostgreSQL database, for a MySQL, MariaDB or Aurora MySQL database moving to MariaDB and for an RDS for SQL Server database moving to SQLServer Flex (the native backup, its copy to a STACKIT S3 bucket and the import_database call) the preflight, the rehearsal, the write freeze, the dump or backup and the restore or import inside it, the reconcile and the cleanup; for an ElastiCache, MemoryDB or ElastiCache serverless cache moving to a Key Value Store the preflight, the rehearsal, the write freeze, the copy by a client, the reconcile and the cleanup; for an Amazon Aurora DSQL cluster moving to PostgreSQL Flex the preflight, the rehearsal, the write freeze, the copy of the tables by a client (the schema from the catalogs of the cluster, or from pg_dump --schema-only where the preflight shows that it works, and the rows through the PostgreSQL protocol: no AWS page read documents a dump of a cluster), the reconcile and the cleanup; for an OpenSearch store the write freeze, the copy and the reconcile. The decision offers this option only for a store whose STACKIT service documents a way in with such clients: PostgreSQL Flex (for an Aurora DSQL cluster, which has no change stream, this option and the tool of the customer's own are the only ones; the replication of the engine is not offered), MariaDB (the mysql client loads a dump into an empty instance), SQLServer Flex (a .bak file imported with import_database), Key Value Store (the tutorial migrates a Redis instance by the MIGRATE command; for an ElastiCache source, where AWS lists migrate among the commands unavailable for caches running Redis OSS, the copy is a client that iterates the keys with SCAN and copies each with DUMP, PTTL and RESTORE; for a MemoryDB source, where AWS lists migrate, sync, psync, bgsave, save and config among the unavailable commands and the cluster mode is always on, the same client copy runs against every shard primary found with CLUSTER NODES or CLUSTER SLOTS, with TLS where the source has it and an ACL user that reaches every key; whether DUMP, RESTORE and PTTL run on a standard MemoryDB cluster is not stated by AWS, and for a member of a multi-Region cluster, whose page lists PTTL as unsupported, the step says the TTLs are not carried) and OpenSearch (the reindex operation). For a store without a documented way in (MongoDB Flex, a memcached cache) it is not offered and the decision offers the tool of the customer's own alone.","execution_effect":"MANUAL_ALTERNATIVE","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-23","quote":"Read-Only: host (String), hosts (List of String), ..., port (Number), uri (String, Sensitive)"},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_user.md#L59-L63","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-23","quote":"Read-Only: host (String), ..., port (Number), uri (String, Sensitive)"},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_credential.md#L51-L57","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-23","quote":"Read-Only: host (String), hosts (List of String), ..., port (Number), ..., uri (String, Sensitive)"},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_credential.md#L51-L57","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-23","quote":"Read-Only: host (String), hosts (List of String), load_balanced_host (String), ..., port (Number), uri (String, Sensitive) Connection URI."},{"url":"https://docs.stackit.cloud/products/databases/mariadb/how-tos/backup-and-restore/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"Connect to the database and import the backup."},{"url":"https://docs.stackit.cloud/products/databases/sqlserver-flex/how-tos/import-database-backup-from-stackit-s3-into-sqlserver-flex/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"You have uploaded the database to be imported as .bak file(s) to the STACKIT S3 bucket"},{"url":"https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"The main strategy to migrate the whole dataset from the source to the target is based on the MIGRATE command."},{"url":"https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/SupportedCommands.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"For caches running Redis OSS, the following commands are unavailable:"},{"url":"https://docs.aws.amazon.com/memorydb/latest/devguide/restrictedcommands.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"To deliver a managed service experience, MemoryDB restricts access to certain commands that require advanced privileges. The following commands are unavailable:"},{"url":"https://docs.stackit.cloud/products/databases/opensearch/how-tos/migrate-elasticsearch-data-to-an-opensearch2-service-instance/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"to use the `reindex` Data Operation"}]},{"id":"replicate-with-the-engine-replication","title":"Replicate the data with the replication of the source engine until the cutover","effect":"A person sets up the replication of the source engine so that the STACKIT instance follows the source while the application keeps writing to the source (for PostgreSQL, logical replication: the schema is copied first with pg_dump --schema-only, a publication on the source and a subscription on the target copy the existing rows and then the changes, and the sequences are copied inside the write freeze because they are not replicated). The source needs a change and a reboot to turn replication on, and the target must be able to reach the source. Inside the write freeze the person waits until the target has caught up, compares both sides and switches the clients, then removes the replication. For a PostgreSQL database the plan holds the steps of this option (the initial copy, the watch of the lag, the freeze, the final copy, the reconcile and the cleanup); for an S3 bucket this option is not available, because S3 Replication copies between Amazon S3 buckets and no STACKIT bucket is documented as a destination (the plan holds the two copy tools instead); for any other engine this option is not offered, because no STACKIT service other than PostgreSQL Flex documents the replication of a source engine into it (MariaDB, Key Value Store, OpenSearch and MongoDB Flex document none, and the SQLServer Flex page on transactional replication describes an on-premises publisher and does not name Amazon RDS as one), so the decision of such a store offers the export and the import with the engine clients where its service documents them, and the tool of the customer's own.","execution_effect":"MANUAL_ALTERNATIVE","evidence":[{"url":"https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"You can use replication to enable automatic, asynchronous copying of objects across Amazon S3 buckets."},{"url":"https://www.postgresql.org/docs/current/logical-replication-restrictions.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-29","quote":"The database schema and DDL commands are not replicated. The initial schema can be copied by hand using pg_dump --schema-only."},{"url":"https://www.postgresql.org/docs/current/logical-replication-restrictions.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-29","quote":"Sequence data is not replicated."},{"url":"https://www.postgresql.org/docs/current/sql-createsubscription.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-29","quote":"To be able to create a subscription, you must have the privileges of the pg_create_subscription role, as well as CREATE privileges on the current database."},{"url":"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-29","quote":"Set the rds.logical_replication static parameter to 1."},{"url":"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-29","quote":"Reboot the DB instance for the static rds.logical_replication parameter to take effect."}]},{"id":"migrate-with-a-tool-of-my-own","title":"Move the data with a migration tool or a replication of the owner's own","effect":"A person moves the data with a tool or a replication they run (for example a change-data-capture replication that keeps the copy in step until the cutover), writes its steps, the checks before the move, the cutover window and the way back, and carries them out. The STACKIT instance is reached at the host and port its credential states. The plan holds that work as typed steps: the write freeze of the source, the copy as one step whose commands the person writes, and the reconcile that compares both sides; the source stays the way back until the reconcile records GO, which a person checks, since the plan cannot know that the tool leaves the source unchanged. A memcached cache holds a confirmation instead of a copy. A bucket repeated by count or for_each has neither a reconcile nor any other option: its instances and the buckets they move to are not named, so the plan holds the one manual step, which the person writes for each instance after naming them.","execution_effect":"MANUAL_ALTERNATIVE","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-23","quote":"Read-Only: host (String), hosts (List of String), ..., port (Number), uri (String, Sensitive)"}]}],"recommended_option":null,"blocking_effect":"TARGET_DESIGN_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":5}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"The method that moves the data of a store (a database, a cache, a search domain, or the objects of a bucket) to its STACKIT service is a person's choice (5 converter decisions): the steps of each method are in the plan where the planner covers the store (a PostgreSQL database and an S3 bucket, each with the runbook of the move), and the plan holds one manual step the person writes where it does not; the steps of the move wait for the choice. The choice decides how the data is moved, not whether it is: every method is work a person does by hand, so the unit that owns one keeps a manual data-migration step, and answering it does not make the unit automation-eligible.","required_evidence":["StackToIT moves no data and writes no runbook for aws_dynamodb_table to STACKIT MongoDB Flex; the data-movement register lists module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with the mechanism UNKNOWN, and the source states neither the size of the data nor the downtime the business tolerates nor the consistency the application needs","StackToIT moves no data and writes no runbook for aws_opensearch_domain to STACKIT OpenSearch; the data-movement register lists module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the mechanism UNKNOWN, and the source states neither the size of the data nor the downtime the business tolerates nor the consistency the application needs","the plan defines both methods of the engine (a dump restored inside the write freeze, and a logical replication that follows the changes until the freeze) and keeps them open: which one applies depends on the size of the data, the write rate and the downtime the business accepts, and the source states none of them; the steps of the methods wait for the answer","the plan defines the one method the STACKIT MariaDB pages document, a dump loaded with the mysql client into the empty instance, and the customer's own tool; the replication of the binary log is refused because no STACKIT page documents it; STACKIT has no managed MySQL, so a MySQL source is an engine change whose collations, DEFINER accounts, accounts and settings the checks of the plan name, and the size of the data, the downtime the business accepts and the consistency the application needs are not in the source; the steps wait for the answer","the plan defines the one method the STACKIT pages and the ElastiCache pages allow together, a copy of the keys by a client (SCAN, DUMP, PTTL, RESTORE) inside the write freeze, and the customer's own tool; loading an exported snapshot is refused because no STACKIT page or API takes an RDB file, and following the source as a replica is refused because neither end offers it; the source does not say whether the cache holds only what the application rebuilds, the size of the data, the downtime the business accepts or the shards the keys are spread over, and the Key Value Store has no sharding; the steps wait for the answer","the size of the data, the downtime the business tolerates and the consistency the application needs, to choose the method and the cutover window"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:bd6dc33bd3777ba67c03a89361624334a25a61983906190c138fe87904c08a32","artifact_sha256":"sha256:15bd4a976759c2e9e78fcac08a2e4bb165e943ae8006503f5b7e166f2e075a97","kb_dependencies_sha256":"sha256:610870c4321b580122859ef332af5301a6bd3a8973057240bd04c7d631e03a41"},"member_count":5,"affected_unit_count":5,"evidence_ref_count":5,"resolution":{"decision_id":"DEC-GEN-CONVERT-DATA-MOVEMENT","source_family":"convert","source_semantic":"DATA_MOVEMENT","affected_application":[],"action_type":"BLOCKED_OR_UNSUPPORTED","work_package":"NOT_STATED","owner_role":"Data Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"TARGET_DESIGN_OPEN","review_status":"OPEN","customer_action_status":"BLOCKED","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":38,"resolution_paths":[{"id":"export-and-import-with-the-engine-clients","title":"Export the data from the source and import it with the clients of the target engine","prerequisites":[],"effects":["A person exports the data from the source and imports it into the STACKIT instance with the clients of its engine during a window the business accepts, then checks that the copy is complete; the clients reach the instance at the host and port its credential states. The source and the target engine may differ (DynamoDB to MongoDB Flex), so the export is converted where they do. The plan holds the steps of this option as typed steps: for a PostgreSQL database, for a MySQL, MariaDB or Aurora MySQL database moving to MariaDB and for an RDS for SQL Server database moving to SQLServer Flex (the native backup, its copy to a STACKIT S3 bucket and the import_database call) the preflight, the rehearsal, the write freeze, the dump or backup and the restore or import inside it, the reconcile and the cleanup; for an ElastiCache, MemoryDB or ElastiCache serverless cache moving to a Key Value Store the preflight, the rehearsal, the write freeze, the copy by a client, the reconcile and the cleanup; for an Amazon Aurora DSQL cluster moving to PostgreSQL Flex the preflight, the rehearsal, the write freeze, the copy of the tables by a client (the schema from the catalogs of the cluster, or from pg_dump --schema-only where the preflight shows that it works, and the rows through the PostgreSQL protocol: no AWS page read documents a dump of a cluster), the reconcile and the cleanup; for an OpenSearch store the write freeze, the copy and the reconcile. The decision offers this option only for a store whose STACKIT service documents a way in with such clients: PostgreSQL Flex (for an Aurora DSQL cluster, which has no change stream, this option and the tool of the customer's own are the only ones; the replication of the engine is not offered), MariaDB (the mysql client loads a dump into an empty instance), SQLServer Flex (a .bak file imported with import_database), Key Value Store (the tutorial migrates a Redis instance by the MIGRATE command; for an ElastiCache source, where AWS lists migrate among the commands unavailable for caches running Redis OSS, the copy is a client that iterates the keys with SCAN and copies each with DUMP, PTTL and RESTORE; for a MemoryDB source, where AWS lists migrate, sync, psync, bgsave, save and config among the unavailable commands and the cluster mode is always on, the same client copy runs against every shard primary found with CLUSTER NODES or CLUSTER SLOTS, with TLS where the source has it and an ACL user that reaches every key; whether DUMP, RESTORE and PTTL run on a standard MemoryDB cluster is not stated by AWS, and for a member of a multi-Region cluster, whose page lists PTTL as unsupported, the step says the TTLs are not carried) and OpenSearch (the reindex operation). For a store without a documented way in (MongoDB Flex, a memcached cache) it is not offered and the decision offers the tool of the customer's own alone."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_user.md#L59-L63","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_credential.md#L51-L57","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_credential.md#L51-L57","https://docs.stackit.cloud/products/databases/mariadb/how-tos/backup-and-restore/","https://docs.stackit.cloud/products/databases/sqlserver-flex/how-tos/import-database-backup-from-stackit-s3-into-sqlserver-flex/","https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/","https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/SupportedCommands.html","https://docs.aws.amazon.com/memorydb/latest/devguide/restrictedcommands.html","https://docs.stackit.cloud/products/databases/opensearch/how-tos/migrate-elasticsearch-data-to-an-opensearch2-service-instance/"],"regeneration_required":false},{"id":"replicate-with-the-engine-replication","title":"Replicate the data with the replication of the source engine until the cutover","prerequisites":[],"effects":["A person sets up the replication of the source engine so that the STACKIT instance follows the source while the application keeps writing to the source (for PostgreSQL, logical replication: the schema is copied first with pg_dump --schema-only, a publication on the source and a subscription on the target copy the existing rows and then the changes, and the sequences are copied inside the write freeze because they are not replicated). The source needs a change and a reboot to turn replication on, and the target must be able to reach the source. Inside the write freeze the person waits until the target has caught up, compares both sides and switches the clients, then removes the replication. For a PostgreSQL database the plan holds the steps of this option (the initial copy, the watch of the lag, the freeze, the final copy, the reconcile and the cleanup); for an S3 bucket this option is not available, because S3 Replication copies between Amazon S3 buckets and no STACKIT bucket is documented as a destination (the plan holds the two copy tools instead); for any other engine this option is not offered, because no STACKIT service other than PostgreSQL Flex documents the replication of a source engine into it (MariaDB, Key Value Store, OpenSearch and MongoDB Flex document none, and the SQLServer Flex page on transactional replication describes an on-premises publisher and does not name Amazon RDS as one), so the decision of such a store offers the export and the import with the engine clients where its service documents them, and the tool of the customer's own."],"risk":[],"evidence":["https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html","https://www.postgresql.org/docs/current/logical-replication-restrictions.html","https://www.postgresql.org/docs/current/logical-replication-restrictions.html","https://www.postgresql.org/docs/current/sql-createsubscription.html","https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html","https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html"],"regeneration_required":false},{"id":"migrate-with-a-tool-of-my-own","title":"Move the data with a migration tool or a replication of the owner's own","prerequisites":[],"effects":["A person moves the data with a tool or a replication they run (for example a change-data-capture replication that keeps the copy in step until the cutover), writes its steps, the checks before the move, the cutover window and the way back, and carries them out. The STACKIT instance is reached at the host and port its credential states. The plan holds that work as typed steps: the write freeze of the source, the copy as one step whose commands the person writes, and the reconcile that compares both sides; the source stays the way back until the reconcile records GO, which a person checks, since the plan cannot know that the tool leaves the source unchanged. A memcached cache holds a confirmation instead of a copy. A bucket repeated by count or for_each has neither a reconcile nor any other option: its instances and the buckets they move to are not named, so the plan holds the one manual step, which the person writes for each instance after naming them."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57"],"regeneration_required":false}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_user.md#L59-L63","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_credential.md#L51-L57","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_credential.md#L51-L57","https://docs.stackit.cloud/products/databases/mariadb/how-tos/backup-and-restore/","https://docs.stackit.cloud/products/databases/sqlserver-flex/how-tos/import-database-backup-from-stackit-s3-into-sqlserver-flex/","https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/","https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/SupportedCommands.html","https://docs.aws.amazon.com/memorydb/latest/devguide/restrictedcommands.html","https://docs.stackit.cloud/products/databases/opensearch/how-tos/migrate-elasticsearch-data-to-an-opensearch2-service-instance/","https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html","https://www.postgresql.org/docs/current/logical-replication-restrictions.html","https://www.postgresql.org/docs/current/sql-createsubscription.html","https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html"],"state_reason":"the execution plan states that no answer makes MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/cleanup/dump-restore, MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/cleanup/client-import, MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/dump-restore and MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/logical-replication executable","source_observation":"The plan leaves this decision open on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, module.dependencies.module.catalog_rds.aws_rds_cluster.this, module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this and 1 more.","generated_target_behavior":"The draft holds MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/client-import, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/client-import, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/client-import, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/own-tool, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/own-tool, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/own-tool, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/dump-restore, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/dump-restore, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/dump-restore, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/own-tool and 28 more until this decision is answered by an answer that frees it.","residual_difference":"the target design is open until the decision is answered","execution_effect":"38 steps wait for it until it is answered: MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/client-import, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/client-import, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/client-import, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/write-freeze/own-tool, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/final-sync/own-tool, MAN/data/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/reconcile/own-tool, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/dump-restore, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/final-sync/dump-restore, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/reconcile/dump-restore, MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/write-freeze/own-tool and 28 more.","next_action":"The plan states that no answer makes MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/cleanup/dump-restore, MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/cleanup/client-import, MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/dump-restore and MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/cleanup/logical-replication executable for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, module.dependencies.module.catalog_rds.aws_rds_cluster.this, module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this and 1 more: change the draft or the source that holds it before anything rests on this record.","why_open":["The method that moves the data of a store (a database, a cache, a search domain, or the objects of a bucket) to its STACKIT service is a person's choice (5 converter decisions): the steps of each method are in the plan where the planner covers the store (a PostgreSQL database and an S3 bucket, each with the runbook of the move), and the plan holds one manual step the person writes where it does not; the steps of the move wait for the choice. The choice decides how the data is moved, not whether it is: every method is work a person does by hand, so the unit that owns one keeps a manual data-migration step, and answering it does not make the unit automation-eligible."],"closes_when":["an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option"],"required_inputs":["StackToIT moves no data and writes no runbook for aws_dynamodb_table to STACKIT MongoDB Flex; the data-movement register lists module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this with the mechanism UNKNOWN, and the source states neither the size of the data nor the downtime the business tolerates nor the consistency the application needs","StackToIT moves no data and writes no runbook for aws_opensearch_domain to STACKIT OpenSearch; the data-movement register lists module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this with the mechanism UNKNOWN, and the source states neither the size of the data nor the downtime the business tolerates nor the consistency the application needs","the plan defines both methods of the engine (a dump restored inside the write freeze, and a logical replication that follows the changes until the freeze) and keeps them open: which one applies depends on the size of the data, the write rate and the downtime the business accepts, and the source states none of them; the steps of the methods wait for the answer","the plan defines the one method the STACKIT MariaDB pages document, a dump loaded with the mysql client into the empty instance, and the customer's own tool; the replication of the binary log is refused because no STACKIT page documents it; STACKIT has no managed MySQL, so a MySQL source is an engine change whose collations, DEFINER accounts, accounts and settings the checks of the plan name, and the size of the data, the downtime the business accepts and the consistency the application needs are not in the source; the steps wait for the answer","the plan defines the one method the STACKIT pages and the ElastiCache pages allow together, a copy of the keys by a client (SCAN, DUMP, PTTL, RESTORE) inside the write freeze, and the customer's own tool; loading an exported snapshot is refused because no STACKIT page or API takes an RDB file, and following the source as a replica is refused because neither end offers it; the source does not say whether the cache holds only what the application rebuilds, the size of the data, the downtime the business accepts or the shards the keys are spread over, and the Key Value Store has no sharding; the steps wait for the answer","the size of the data, the downtime the business tolerates and the consistency the application needs, to choose the method and the cutover window"]},"unblocks":{"holds":114,"stuck":65,"alone":18,"shared":14,"best_option":"migrate-with-a-tool-of-my-own","options":[{"option":"export-and-import-with-the-engine-clients","effects":["MANUAL_ALTERNATIVE","NOT_STATED"],"alone":12,"shared":3},{"option":"replicate-with-the-engine-replication","effects":["MANUAL_ALTERNATIVE","NOT_STATED"],"alone":6,"shared":0},{"option":"migrate-with-a-tool-of-my-own","effects":["MANUAL_ALTERNATIVE"],"alone":18,"shared":14}]}},{"id":"DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","kind":"ENGINE_VERSION_DOWNGRADE","family":"convert","source":"PLAN_DECISION","group":"GRP-PLAN-DECISION-convert","block":"ENGINE_VERSION_DOWNGRADE","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Data Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"options":[{"id":"move-the-data-into-the-offered-version","title":"Move the data into the version STACKIT offers, by re-reading it from the source","effect":"The instance is created with the version STACKIT offers (the draft's version variable is set to it, e.g. 2 for OpenSearch), and the data is re-read from the source rather than restored from a snapshot: an OpenSearch index is reindexed from the source (or the application writes to both during the cutover), a database is exported and imported with the clients of the engine. A snapshot of the newer engine is not restored into the older one. The applications are tested against the older version first; whether they work is not known from the source.","execution_effect":"ACK_CURRENT_ARTIFACT","evidence":[{"url":"https://docs.opensearch.org/latest/tuning-your-cluster/availability-and-recovery/snapshots/snapshot-restore/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"Restoring a snapshot to an older version of OpenSearch is not supported. Snapshots are only forward compatible by one major version."},{"url":"https://www.postgresql.org/docs/current/app-pgdump.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"Also, it is not guaranteed that pg_dump's output can be loaded into a server of an older major version — not even if the dump was taken from a server of that version."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_instance.md#L35","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"version (String) The service version."}]},{"id":"run-the-engine-self-managed-on-ske","title":"Run the source's engine version yourself on SKE (self-managed)","effect":"The managed STACKIT instance is not used: the customer runs the engine at the source's version on a STACKIT Kubernetes Engine cluster (an operator or a chart of its own) and operates it (upgrades, backups, monitoring). The draft does not write that workload, so it is changed (the managed instance removed, the workload added) before the step is applied.","execution_effect":"REGENERATE_REQUIRED","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L55","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"node_pools (Attributes List) One or more node_pool block as defined below."}]},{"id":"wait-for-the-version","title":"Wait until STACKIT offers the source's version","effect":"The unit stays where it is until the region's catalogue lists the source's version; the draft is then regenerated against the new catalogue (the version check compares again), and the step stays blocked until then. STACKIT announces new service versions in the release notes of the service (OpenSearch: \"STACKIT OpenSearch2 is now available\", May 15, 2023); no date for a newer version is stated.","execution_effect":"REGENERATE_REQUIRED","evidence":[{"url":"https://docs.stackit.cloud/products/databases/opensearch/release-notes/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"May 15, 2023 We are happy to announce our new service releases for STACKIT OpenSearch2 The Service are offered with completely new Service Plans."}]}],"recommended_option":null,"blocking_effect":"TARGET_DESIGN_OPEN","causes":[{"cause":"TARGET_LIMIT","members":1}],"blocker_class":"ROOT_BLOCKER","why":"The source runs an engine version newer than every version STACKIT offers in the region (1 converter decision): a snapshot of the newer engine is not restored into the older one, so the step that creates the instance waits until a person chooses how the data reaches the offered version (re-read from the source), runs the engine self-managed on SKE, or waits for the version; the unit that owns one is not automation-eligible until then.","required_evidence":["the source runs OpenSearch 3.3 (engine_version), newer than every version the eu01 catalogue (2026-10-18) lists for stackit_opensearch_instance (2): a snapshot of 3.3 cannot be restored into 2 (OpenSearch restores a snapshot into the same or a newer version only); reindex from the source, or write to both during the cutover (dual-write), is the path; whether the clients work against 2 is unknown","whether the applications and their client libraries work against the older engine version STACKIT offers (queries, mappings, plugins, protocol features)","the size of the data and the downtime the business tolerates, to choose between re-reading the data from the source and writing to both during the cutover"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:da0e0583e3f086831a47b05396b1d30756583e8d7f3d4dd2b89e37050a55f030","artifact_sha256":"sha256:dc1e43b17cf02fc8aa65d7e26ca697d4699550aa5046f8552e15968db7b53c64","kb_dependencies_sha256":"sha256:df6451f6350a2b971c09bbf5ecf6ab18b5750dd81cbfa67f5af0282c74b4283b"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","source_family":"convert","source_semantic":"ENGINE_VERSION_DOWNGRADE","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"NOT_STATED","owner_role":"Data Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"TARGET_DESIGN_OPEN","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[{"id":"move-the-data-into-the-offered-version","title":"Move the data into the version STACKIT offers, by re-reading it from the source","prerequisites":[],"effects":["The instance is created with the version STACKIT offers (the draft's version variable is set to it, e.g. 2 for OpenSearch), and the data is re-read from the source rather than restored from a snapshot: an OpenSearch index is reindexed from the source (or the application writes to both during the cutover), a database is exported and imported with the clients of the engine. A snapshot of the newer engine is not restored into the older one. The applications are tested against the older version first; whether they work is not known from the source."],"risk":[],"evidence":["https://docs.opensearch.org/latest/tuning-your-cluster/availability-and-recovery/snapshots/snapshot-restore/","https://www.postgresql.org/docs/current/app-pgdump.html","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_instance.md#L35"],"regeneration_required":false},{"id":"run-the-engine-self-managed-on-ske","title":"Run the source's engine version yourself on SKE (self-managed)","prerequisites":[],"effects":["The managed STACKIT instance is not used: the customer runs the engine at the source's version on a STACKIT Kubernetes Engine cluster (an operator or a chart of its own) and operates it (upgrades, backups, monitoring). The draft does not write that workload, so it is changed (the managed instance removed, the workload added) before the step is applied."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L55"],"regeneration_required":true},{"id":"wait-for-the-version","title":"Wait until STACKIT offers the source's version","prerequisites":[],"effects":["The unit stays where it is until the region's catalogue lists the source's version; the draft is then regenerated against the new catalogue (the version check compares again), and the step stays blocked until then. STACKIT announces new service versions in the release notes of the service (OpenSearch: \"STACKIT OpenSearch2 is now available\", May 15, 2023); no date for a newer version is stated."],"risk":[],"evidence":["https://docs.stackit.cloud/products/databases/opensearch/release-notes/"],"regeneration_required":true}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":["https://docs.opensearch.org/latest/tuning-your-cluster/availability-and-recovery/snapshots/snapshot-restore/","https://www.postgresql.org/docs/current/app-pgdump.html","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_instance.md#L35","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L55","https://docs.stackit.cloud/products/databases/opensearch/release-notes/"],"state_reason":"a person's decision or input is still open","source_observation":"The plan leaves this decision open on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this.","generated_target_behavior":"The draft holds TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this until this decision is answered by an answer that frees it.","residual_difference":"the target design is open until the decision is answered","execution_effect":"1 step waits for it until it is answered: TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this.","next_action":"Decide engine version downgrade for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: choose one of the 3 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["The source runs an engine version newer than every version STACKIT offers in the region (1 converter decision): a snapshot of the newer engine is not restored into the older one, so the step that creates the instance waits until a person chooses how the data reaches the offered version (re-read from the source), runs the engine self-managed on SKE, or waits for the version; the unit that owns one is not automation-eligible until then."],"closes_when":["an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option"],"required_inputs":["the source runs OpenSearch 3.3 (engine_version), newer than every version the eu01 catalogue (2026-10-18) lists for stackit_opensearch_instance (2): a snapshot of 3.3 cannot be restored into 2 (OpenSearch restores a snapshot into the same or a newer version only); reindex from the source, or write to both during the cutover (dual-write), is the path; whether the clients work against 2 is unknown","whether the applications and their client libraries work against the older engine version STACKIT offers (queries, mappings, plugins, protocol features)","the size of the data and the downtime the business tolerates, to choose between re-reading the data from the source and writing to both during the cutover"]},"unblocks":{"holds":84,"stuck":65,"alone":2,"shared":17,"best_option":"move-the-data-into-the-offered-version","options":[{"option":"move-the-data-into-the-offered-version","effects":["ACK_CURRENT_ARTIFACT"],"alone":2,"shared":17},{"option":"run-the-engine-self-managed-on-ske","effects":["REGENERATE_REQUIRED"],"alone":0,"shared":0},{"option":"wait-for-the-version","effects":["REGENERATE_REQUIRED"],"alone":0,"shared":0}]}},{"id":"DEC-GEN-CONVERT-EXPOSURE-WIDENED","kind":"EXPOSURE_WIDENED","family":"convert","source":"PLAN_DECISION","group":"GRP-PLAN-DECISION-convert","block":"EXPOSURE_WIDENED","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"sources":["PLAN_DECISION","CRITICAL_SEMANTIC"],"blocking_effects":["TARGET_DESIGN_OPEN","CRITICAL_SEMANTIC_OPEN"],"options":[{"id":"accept-the-public-endpoint","title":"Accept the public endpoint, limited by its access list","effect":"The endpoint the draft writes is applied as written: the instance (or the Kubernetes API) is reached at its public address, and only the IP networks of its access list may connect (acl of stackit_postgresflex_instance and stackit_sqlserverflex_instance, sgw_acl of stackit_mariadb_instance, extensions.acl.allowed_cidrs of stackit_ske_cluster; parameters.sgw_acl of stackit_valkey_instance (Key Value Store), stackit_opensearch_instance, stackit_rabbitmq_instance and stackit_redis_instance, a comma-separated list of IP networks in CIDR notation, left to the default when the draft states none). The exposure is wider than the source's and the difference is accepted. Maturity: for stackit_ske_cluster this is the ACL-restricted public control plane: GA, not the source's private endpoint (the ACL how-to, last updated Aug 19, 2026, carries no Private Preview or beta notice, and says ACLs only control access to the API of the public control plane); the provider documents acl and sgw_acl of the data services without a preview notice. For an Application Load Balancer: it is created with the access control the draft writes, options.access_control.allowed_source_ranges, one set of source ranges for the whole load balancer (or none, where the draft can prove no range), so it admits more clients than the source's security groups; the restriction the set cannot express is the client-access manual step of the plan behind this decision, which follows the load balancer. The draft carries this option out BY DEFAULT for the Kubernetes API of a cluster whose source endpoint is private (stackit_ske_cluster, extensions.acl): of the three options it is the only one that is production grade (the ACL-restricted public control plane is GA, the network-area-only control plane is a Private Preview on request, not recommended for production, and cannot be combined with the ACL extension) and it is fail-closed, because only the CIDRs of the access list may connect. The decision stays OPEN with this option marked DEFAULT; the access list stays a required variable with no default (no CIDR is invented, and neither the cluster's own egress addresses nor a STACKIT range is a fallback, because the source's private clients are the admin and CI networks only the customer knows) that refuses an empty list, so the step of the cluster waits for the networks the person lists and not for the decision. The draft carries it out by default for a managed data service (stackit_postgresflex_instance, stackit_sqlserverflex_instance, stackit_mariadb_instance, stackit_mongodbflex_instance, stackit_valkey_instance, stackit_opensearch_instance, stackit_rabbitmq_instance, stackit_redis_instance) as well, on the same grounds and only when all of these hold: the decision is open and no review declines it; the access list the block writes (acl, sgw_acl) is one variable the draft wrote, of type list(string), with no default, that refuses an empty list, an empty entry and null; and the draft could not derive the clients' addresses (where every client is a drafted cluster or a drafted server with a public address the access list already has those addresses as its default, and the decision stands on that default). Of the options, accept-the-public-endpoint is the only one that is generally available for every data service (the network-area-only scope is a Private Preview for enabled accounts and exists for PostgreSQL Flex and SQL Server Flex only), and with a required, non-empty list it is fail-closed: only the CIDRs the person lists may connect. No CIDR is invented, and STACKIT's documented service ranges are no fallback. The default applies to a source that is private and to one whose exposure cannot be read, because the draft writes the same fail-closed endpoint for both. The access-scope variable of PostgreSQL Flex and SQL Server Flex keeps no default, and the critical network exposure of the unit stays open for the assurance until a review that chooses this option also states an exposure_acceptance (its statement and scope), which records the public endpoint as an accepted design change naming the reviewer, never as an equivalent. A review that names another option for the record, or rejects the proposal, declines the default. A cluster whose source endpoint is public gets no decision: its public_access_cidrs are the access list.","execution_effect":"ACK_CURRENT_ARTIFACT","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_instance.md#L105","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-22","quote":"acl (List of String) The Access Control List (ACL) for the PostgresFlex instance."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/sqlserverflex_instance.md#L93","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-22","quote":"acl (List of String) List of IPV4 cidr."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_instance.md#L64","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-22","quote":"sgw_acl (String) Comma separated list of IP networks in CIDR notation which are allowed to access this instance."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L162","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-22","quote":"Nested Schema for extensions.acl — Required: allowed_cidrs (List of String) Specify a list of CIDRs to whitelist. enabled (Boolean) Is ACL enabled?"},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_instance.md#L79","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"sgw_acl (String) Comma separated list of IP networks in CIDR notation which are allowed to access this instance."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_instance.md#L68","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"sgw_acl (String) Comma separated list of IP networks in CIDR notation which are allowed to access this instance."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/rabbitmq_instance.md#L70","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"sgw_acl (String) Comma separated list of IP networks in CIDR notation which are allowed to access this instance."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/redis_instance.md#L82","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"sgw_acl (String) Comma separated list of IP networks in CIDR notation which are allowed to access this instance."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L469","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"access_control (Attributes) Use this option to limit the IP ranges that can use the Application Load Balancer. ... allowed_source_ranges (Set of String) Application Load Balancer is accessible only from an IP address in this range."},{"url":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/how-tos/configure-access-control-for-your-cluster/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"ACLs only control access to the API of the public control plane. You cannot combine ACLs with a private control plane (accessScope: \"SNA\"), because the two features are mutually exclusive. You can use ACLs with a public cluster, or use a private cluster without ACLs. (page last updated on Aug 19, 2026; the page carries no Private Preview or beta notice)"},{"url":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/how-tos/enable-private-clusters/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-29","quote":"This feature is currently in Private Preview and available only upon request. It is under active development, subject to breaking changes without prior notice, and not recommended for production use. ... Private clusters (accessScope: \"SNA\") and the ACL extension (extensions.acl.enabled = true) are mutually exclusive and cannot be combined. (page last updated on Oct 1, 2026; the default for the Kubernetes API of a private EKS endpoint is the ACL-restricted public control plane because it is the only option of the decision that is GA)"}],"default":true},{"id":"use-the-network-area-only-scope","title":"Use the network-area-only scope (SNA) instead of the public endpoint (Private Preview, on request)","effect":"Maturity by target. stackit_ske_cluster: SNA private control plane: Private Preview, on request, not for production, no ACL extension (private preview; the documentation says the feature is available only upon request, is under active development, subject to breaking changes without prior notice, and not recommended for production use, and that a private cluster and the ACL extension are mutually exclusive: the GA way to restrict the Kubernetes API is the ACL-restricted public control plane, which is not the source's private endpoint). stackit_postgresflex_instance and stackit_sqlserverflex_instance: private preview (the provider documents access_scope as a private preview for enabled accounts). stackit_mariadb_instance, stackit_valkey_instance, stackit_opensearch_instance, stackit_rabbitmq_instance, stackit_redis_instance and stackit_application_load_balancer: not offered (no access scope; the redesign option applies). What the option means: The endpoint is reachable only inside a STACKIT Network Area: access_scope = SNA of stackit_postgresflex_instance and stackit_sqlserverflex_instance, network.control_plane.access_scope = SNA of stackit_ske_cluster (immutable). The scope is a private preview, permitted for enabled accounts only (a request of another account is rejected). The draft does not write it, so the draft is regenerated (or changed) with the scope before the step is applied. The pinned provider documents no access scope for stackit_mariadb_instance: there it is a redesign. Neither does it for stackit_valkey_instance (Key Value Store), stackit_opensearch_instance, stackit_rabbitmq_instance or stackit_redis_instance, whose access is set by parameters.sgw_acl only (the pinned STACKIT provider schema): for a private cache, search domain or broker there is no network-area-only option: the way out is a redesign, so the draft is changed before the step is applied. Neither does it for stackit_application_load_balancer, whose options are access_control, ephemeral_address, observability and private_network_only (accessible only via a private network address, not changeable after creation): there the way out is a redesign (a private load balancer, or the restriction in front of it), so the draft is regenerated or changed before the step is applied.","execution_effect":"REGENERATE_REQUIRED","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_instance.md#L104","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-22","quote":"access_scope (String) The network access scope of the instance. This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected. Possible values are: PUBLIC, SNA."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/sqlserverflex_instance.md#L92","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-22","quote":"access_scope (String) The network access scope of the instance. This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected. Possible values are: PUBLIC, SNA."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L249","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-22","quote":"access_scope (String) Access scope of the control plane. It defines if the Kubernetes control plane is public or only available inside a STACKIT Network Area. This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected.Possible values are: PUBLIC, SNA. The field is immutable!"},{"url":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/how-tos/enable-private-clusters/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"This feature is currently in Private Preview and available only upon request. It is under active development, subject to breaking changes without prior notice, and not recommended for production use. Private Preview products and features are available “as is” and might have limited support. ... Private clusters (accessScope: \"SNA\") and the ACL extension (extensions.acl.enabled = true) are mutually exclusive and cannot be combined. (page last updated on Oct 1, 2026)"},{"url":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/networking/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"By default, your Kubernetes control plane is exposed to the public internet. This is equivalent to setting accessScope: \"PUBLIC\". If you set accessScope: \"SNA\" instead, your Kubernetes control plane will only be exposed within the SNA. This is called a private SKE cluster. ... Private clusters (\"accessScope\": \"SNA\") and the ACL extension (\"acl\": { \"enabled\": true }) are mutually exclusive. If you need the ACL extension, you can’t use a private cluster. (page last updated on Oct 14, 2026)"},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_instance.md","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-22","quote":"searched mariadb_instance.md for access_scope, SNA and private: no match; its access is set by parameters.sgw_acl only"},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L469","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"access_control (Attributes) Use this option to limit the IP ranges that can use the Application Load Balancer. ... allowed_source_ranges (Set of String) Application Load Balancer is accessible only from an IP address in this range."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_instance.md","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"searched valkey_instance.md for access_scope, SNA and private: no match; its access is set by parameters.sgw_acl only"},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_instance.md","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"searched opensearch_instance.md for access_scope, SNA and private: no match; its access is set by parameters.sgw_acl only"},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/rabbitmq_instance.md","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"searched rabbitmq_instance.md for access_scope, SNA and private: no match; its access is set by parameters.sgw_acl only"},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/redis_instance.md","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"searched redis_instance.md for access_scope, SNA and private: no match; its access is set by parameters.sgw_acl only"},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L472","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"searched application_load_balancer.md for access_scope and SNA: no match; Nested Schema for options lists access_control, ephemeral_address, observability and private_network_only (Boolean) Application Load Balancer is accessible only via a private network ip address. Not changeable after creation."}]},{"id":"redesign-the-endpoint","title":"Redesign how the clients reach the endpoint (no private option offered or not usable)","effect":"Neither the GA option (a public endpoint limited by an access list, wider than the source's) nor the Private Preview option (SNA: on request, not for production, and for stackit_ske_cluster not together with the ACL extension) is taken: a person designs how the clients reach the endpoint and carries it out, and the drafted step stays held until the design is recorded. Not offered: stackit_mariadb_instance, stackit_valkey_instance, stackit_opensearch_instance, stackit_rabbitmq_instance, stackit_redis_instance and stackit_application_load_balancer offer no network-area-only scope, so a redesign is the only way to a private endpoint there. For the Kubernetes API of stackit_ske_cluster the documentation names the source addresses an ACL has to allow (corporate NAT gateways, VPN egress addresses, bastion hosts, CI/CD pipeline egress addresses); a private cluster is a design only after STACKIT enabled the Private Preview for the project and the owner has accepted its maturity and the loss of the ACL extension.","execution_effect":"MANUAL_ALTERNATIVE","evidence":[{"url":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/how-tos/configure-access-control-for-your-cluster/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"Make sure to allow the source IPs that actually reach the Kubernetes API server. This includes corporate NAT gateways, VPN egress addresses, bastion hosts, and CI/CD pipeline egress addresses."},{"url":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/how-tos/enable-private-clusters/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"Open a ticket with STACKIT Support to request access for your organization or project."}]}],"recommended_option":null,"defaults":[{"member":"convert:module.dependencies.aws_mq_broker.mq:exposure:EXPOSURE_WIDENED","option":"accept-the-public-endpoint","words":"StackToIT carried out the option accept-the-public-endpoint for stackit_rabbitmq_instance.dependencies_mq by default: the RabbitMQ instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.orders_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_mq_allowed_cidrs, or answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default.","answered_by":"DEFAULT"},{"member":"convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:exposure:EXPOSURE_WIDENED","option":"accept-the-public-endpoint","words":"StackToIT carried out the option accept-the-public-endpoint for stackit_opensearch_instance.dependencies_catalog_opensearch_this by default: the OpenSearch instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.catalog_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_catalog_opensearch_this_allowed_cidrs, or answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default.","answered_by":"DEFAULT"},{"member":"convert:module.dependencies.module.catalog_rds.aws_rds_cluster.this:exposure:EXPOSURE_WIDENED","option":"accept-the-public-endpoint","words":"StackToIT carried out the option accept-the-public-endpoint for stackit_mariadb_instance.dependencies_catalog_rds_this by default: the MariaDB instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.catalog_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_catalog_rds_this_allowed_cidrs, or answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default.","answered_by":"DEFAULT"},{"member":"convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:exposure:EXPOSURE_WIDENED","option":"accept-the-public-endpoint","words":"StackToIT carried out the option accept-the-public-endpoint for stackit_valkey_instance.dependencies_checkout_elasticache_redis_default by default: the Valkey instance keeps its own public STACKIT endpoint, and only the CIDRs of var.dependencies_checkout_elasticache_redis_default_allowed_cidrs may connect; the clients of the source could not be mapped to addresses, no CIDR is invented, so the variable has no default and the step waits for the networks you list. The draft writes no default list of the clients' addresses: the rule module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed[\"in#in#sg#0\"] is no plain allow of a complete list of clients. Name the networks the clients connect from. To change it, answer this decision in decisions.yaml with redesign-the-endpoint (or reject the proposal): the next run then writes no default.","answered_by":"DEFAULT"},{"member":"convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:exposure:EXPOSURE_WIDENED","option":"accept-the-public-endpoint","words":"StackToIT carried out the option accept-the-public-endpoint for stackit_postgresflex_instance.dependencies_orders_rds_this by default: the PostgreSQL Flex instance keeps its own STACKIT endpoint and its access list is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients the source's security group(s) module.retail_app_ecs.module.orders_service.aws_security_group.this admit; no other address is admitted. To change it, give another list in var.dependencies_orders_rds_this_allowed_cidrs, or answer this decision in decisions.yaml with use-the-network-area-only-scope or redesign-the-endpoint (or reject the proposal): the next run then writes no default.","answered_by":"DEFAULT"}],"blocking_effect":"TARGET_DESIGN_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":5},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"The draft turns an endpoint that is private in the source into a public one on STACKIT (5 converter decisions): the step that creates it is not executable until a person accepts the exposure or chooses what the target offers instead, and the unit that owns one is not automation-eligible until then. It also holds the open critical semantic that the knowledge base leaves open for the same question of the same unit (the same ledger row): an answer to this record answers both, and the semantic stays open in assurance/critical-semantics.json, where a review closes nothing.","required_evidence":["the exposure of the source module.dependencies.module.catalog_rds.aws_rds_cluster.this is not readable (it states no publicly_accessible setting, or one that a variable without a value or a default decides), so the source is not proven publicly accessible and the draft does not take it as public; the STACKIT instance has its own IPv4 endpoint outside the project network, limited by its access list, which is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods) by default, so the exposure is a decision and not a preserved property","the exposure of the source module.dependencies.module.orders_rds.aws_rds_cluster.this is not readable (it states no publicly_accessible setting, or one that a variable without a value or a default decides), so the source is not proven publicly accessible and the draft does not take it as public; the STACKIT instance has its own IPv4 endpoint outside the project network, limited by its access list, which is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods) by default, so the exposure is a decision and not a preserved property","the source module.dependencies.aws_mq_broker.mq is private (the broker states publicly_accessible = false: it is reached from inside the VPC that hosts its subnets) and the STACKIT RabbitMQ instance has its own endpoint outside the project network, limited only by parameters.sgw_acl; a list the plan does not give is replaced by STACKIT's default ACL, which admits every STACKIT customer's addresses (the draft's variable has the empty list as its default, which the block replaces by the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods)); the endpoint is wider than the source's and the difference is an accepted change in exposure, not a preserved property","the source module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is private (the domain states vpc_options: it is reached from inside its VPC) and the STACKIT OpenSearch instance has its own endpoint outside the project network, limited only by parameters.sgw_acl; a list the plan does not give is replaced by STACKIT's default ACL, which admits every STACKIT customer's addresses (the draft's variable has the empty list as its default, which the block replaces by the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods)); the endpoint is wider than the source's and the difference is an accepted change in exposure, not a preserved property","the source module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is private (Amazon ElastiCache has no public endpoint: the cache is reached from inside its VPC through its subnet group) and the STACKIT Valkey instance has its own endpoint outside the project network, limited only by parameters.sgw_acl; a list the plan does not give is replaced by STACKIT's default ACL, which admits every STACKIT customer's addresses (the draft's variable has no default and rejects an empty list, so the list is yours); the endpoint is wider than the source's and the difference is an accepted change in exposure, not a preserved property","whether the clients of the source endpoint can reach a public address limited by an access list, or need the endpoint inside the network (and, for the network-area-only scope, that the STACKIT account is enabled for the private preview)","for an Application Load Balancer: the client ranges the source security groups admit on each listener port, and the addresses of the clients they name by a group reference or a prefix list"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:423e4ba2d45f712b067c92f5838a736429f1ad4d536c2a73854bfed78e11de19","artifact_sha256":"sha256:6a3930f51ec64054caff9296506c7e1d98a191a1b856d8742e3f58fb75e37071","kb_dependencies_sha256":"sha256:54db0cb3f0a546a487cbbf2ad23a0bc21bc2410cb91089a25cec295baf9709b2"},"member_count":6,"affected_unit_count":5,"evidence_ref_count":5,"resolution":{"decision_id":"DEC-GEN-CONVERT-EXPOSURE-WIDENED","source_family":"convert","source_semantic":"EXPOSURE_WIDENED","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"network-security","owner_role":"Security Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","guidance_ref":"convert-exposure-widened-public-endpoint/EXPOSURE_WIDENED:exposure","related_execution_step_count":6,"state_reason":"a person's decision or input is still open","source_observation":"The source states the setting on module.dependencies.aws_mq_broker.mq. The plan leaves this decision open on module.dependencies.aws_mq_broker.mq, module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, module.dependencies.module.catalog_rds.aws_rds_cluster.this, module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default and 1 more. A database, a cache (Key Value Store), a search domain (OpenSearch), a message broker (RabbitMQ) or a Kubernetes API that is not public on the source gets a public STACKIT endpoint, limited by an access list of IP networks. PostgreSQL Flex, SQL Server Flex and the Kubernetes control plane also offer a network-area-only scope, a private preview for enabled accounts only; the provider read documents no such scope for MariaDB, Key Value Store, OpenSearch or RabbitMQ, whose access is set by the access list only. Maturity of the ways out for the Kubernetes API: the ACL-restricted public control plane is GA and is not the source's private endpoint; the SNA private control plane is Private Preview, on request, not for production, and cannot be combined with the ACL extension.","generated_target_behavior":"The draft does not carry the setting on module.dependencies.aws_mq_broker.mq. The draft carries the default accept-the-public-endpoint out (answered by DEFAULT: nobody answered the decision), and the decision stays open. The database, cache, search domain, message broker or Kubernetes API is written with its public endpoint and its access list. The step that creates the endpoint waits for this decision.","residual_difference":"That only the clients the source admitted reach the endpoint on the target.","execution_effect":"No step waits for it. The plan can start TF/stackit_rabbitmq_instance.dependencies_mq, TF/stackit_mariadb_instance.dependencies_catalog_rds_this, TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default, TF/stackit_postgresflex_instance.dependencies_orders_rds_this and MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-security-architect now. Held by something else first: TF/stackit_opensearch_instance.dependencies_catalog_opensearch_this.","next_action":"Decide how the clients reach an endpoint the draft exposes more widely for module.dependencies.aws_mq_broker.mq, module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, module.dependencies.module.catalog_rds.aws_rds_cluster.this, module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default and 1 more: choose one of the 3 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The broker is either reachable from the public internet or only from private networks."],"closes_when":["The knowledge base states no closing condition for a decision of the plan; it is done when an answer in the decisions file accepts the public endpoint with its access list, or when the regenerated draft carries the network-area-only scope or the redesign and the step that creates the endpoint is free.","A person sets which networks may reach the STACKIT RabbitMQ instance with its access list (a list of CIDR networks); the draft sets none."],"required_inputs":["the exposure of the source module.dependencies.module.catalog_rds.aws_rds_cluster.this is not readable (it states no publicly_accessible setting, or one that a variable without a value or a default decides), so the source is not proven publicly accessible and the draft does not take it as public; the STACKIT instance has its own IPv4 endpoint outside the project network, limited by its access list, which is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods) by default, so the exposure is a decision and not a preserved property","the exposure of the source module.dependencies.module.orders_rds.aws_rds_cluster.this is not readable (it states no publicly_accessible setting, or one that a variable without a value or a default decides), so the source is not proven publicly accessible and the draft does not take it as public; the STACKIT instance has its own IPv4 endpoint outside the project network, limited by its access list, which is the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods) by default, so the exposure is a decision and not a preserved property","the source module.dependencies.aws_mq_broker.mq is private (the broker states publicly_accessible = false: it is reached from inside the VPC that hosts its subnets) and the STACKIT RabbitMQ instance has its own endpoint outside the project network, limited only by parameters.sgw_acl; a list the plan does not give is replaced by STACKIT's default ACL, which admits every STACKIT customer's addresses (the draft's variable has the empty list as its default, which the block replaces by the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods)); the endpoint is wider than the source's and the difference is an accepted change in exposure, not a preserved property","the source module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this is private (the domain states vpc_options: it is reached from inside its VPC) and the STACKIT OpenSearch instance has its own endpoint outside the project network, limited only by parameters.sgw_acl; a list the plan does not give is replaced by STACKIT's default ACL, which admits every STACKIT customer's addresses (the draft's variable has the empty list as its default, which the block replaces by the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods)); the endpoint is wider than the source's and the difference is an accepted change in exposure, not a preserved property","the source module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default is private (Amazon ElastiCache has no public endpoint: the cache is reached from inside its VPC through its subnet group) and the STACKIT Valkey instance has its own endpoint outside the project network, limited only by parameters.sgw_acl; a list the plan does not give is replaced by STACKIT's default ACL, which admits every STACKIT customer's addresses (the draft's variable has no default and rejects an empty list, so the list is yours); the endpoint is wider than the source's and the difference is an accepted change in exposure, not a preserved property","whether the clients of the source endpoint can reach a public address limited by an access list, or need the endpoint inside the network (and, for the network-area-only scope, that the STACKIT account is enabled for the private preview)","for an Application Load Balancer: the client ranges the source security groups admit on each listener port, and the addresses of the clients they name by a group reference or a prefix list"]}},{"id":"DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH","kind":"INGRESS_EXPOSURE_PATH","family":"convert","source":"PLAN_DECISION","group":"GRP-PLAN-DECISION-convert","block":"INGRESS_EXPOSURE_PATH","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"options":[{"id":"nodeport-alb-target-pool","title":"Keep the draft: a NodePort Service of each workload and the target pool on its node port at the private IPs of the cluster's nodes","effect":"The manifest of each workload writes a Service of type NodePort with the node port the target pool of the drafted Application Load Balancer listens on, and the pool's targets are the private IPs of the nodes of the SKE cluster, which a person sets and keeps current: the nodes change as the node pool scales and is updated, and a node missing from the list receives no traffic. The health check of the pool reaches the pods through the same node port. The draft applies as written once the IPs are set.","execution_effect":"ACK_CURRENT_ARTIFACT","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L420","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-23","quote":"ip (String) Private target IP, which must by unique within a target pool."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L70-L76","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"Read-Only: egress_address_ranges, id, kubernetes_version_used, pod_address_ranges, service_account_issuer (searched the resource documentation: no attribute holds the addresses of the nodes)"},{"url":"https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L88","class":"SOURCE_CODE_VERIFIED","checked_at":"2026-10-26","quote":"type = \"NodePort\" (the Service of the workload a STACKIT Application Load Balancer reaches on SKE)"}],"default":true},{"id":"ingress-controller-behind-alb","title":"Run an Ingress controller on the cluster and put the load balancer in front of it","effect":"An Ingress controller (for example ingress-nginx, installed by a Helm release) runs on the SKE cluster and routes the requests by Ingress rules to the ClusterIP Services of the workloads; the load balancer reaches the controller, on the controller's node port at the private IPs of the nodes (the target pool of the draft changed to that port) or through the controller's own Service of type LoadBalancer. The draft writes neither the controller nor the Ingress rules: a person carries it out, and the load balancer's step stays held.","execution_effect":"MANUAL_ALTERNATIVE","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L420","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-23","quote":"ip (String) Private target IP, which must by unique within a target pool."},{"url":"https://github.com/stackitcloud/professional-service/blob/main/examples/ske-nginx-rate-limit/070-helm.tf#L15-L18","class":"SOURCE_CODE_VERIFIED","checked_at":"2026-10-26","quote":"resource \"helm_release\" \"ingress_nginx\" { name = \"ingress-nginx\" repository = \"https://kubernetes.github.io/ingress-nginx\" chart = \"ingress-nginx\""}]},{"id":"stackit-alb-ingress-controller","title":"Use the STACKIT ALB as the Ingress: the SKE Application Load Balancer extension","effect":"The Application Load Balancer extension of the SKE cluster is enabled (extensions.application_load_balancer.enabled of stackit_ske_cluster; in private preview, only for enabled accounts) and each workload gets an Ingress of an IngressClass of the controller stackit.cloud/alb-ingress over a Service of type NodePort, the only network mode the controller supports; the controller provisions the Application Load Balancer through the STACKIT API, so the stackit_application_load_balancer block of the draft is not applied. The draft writes neither the extension nor the Ingress: a person carries it out, and the load balancer's step stays held.","execution_effect":"MANUAL_ALTERNATIVE","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L171","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"`enabled` (Boolean) Enables the application load balancer extension. Note: This feature is in private preview. Enabling application load balancer extension is only possible for enabled accounts. Otherwise the request will be rejected."},{"url":"https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/ARCHITECTURE.md#L5","class":"SOURCE_CODE_VERIFIED","checked_at":"2026-10-26","quote":"The STACKIT ALB Controller implements the standard Kubernetes Ingress controller pattern: it watches `IngressClass` and `Ingress` objects and translates them into a fully managed STACKIT Application Load Balancer."},{"url":"https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L25-L33","class":"SOURCE_CODE_VERIFIED","checked_at":"2026-10-26","quote":"# Mandatory; NodePort is currently the only supported network mode. \"alb.stackit.cloud/network-mode\" = \"NodePort\" ... controller = \"stackit.cloud/alb-ingress\""},{"url":"https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L88","class":"SOURCE_CODE_VERIFIED","checked_at":"2026-10-26","quote":"type = \"NodePort\" (the Service of the workload a STACKIT Application Load Balancer reaches on SKE)"}]}],"recommended_option":"nodeport-alb-target-pool","blocking_effect":"TARGET_DESIGN_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"The converter could not prove what the source means by the ingress exposure path (1 converter decision): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides.","required_evidence":["a STACKIT target pool reaches its targets by private IP and the SKE cluster exports no node address to Terraform, so a Kubernetes workload is reachable from the load balancer only through a node port at the IPs of the nodes, which change as the node pool scales and is updated, or through an Ingress controller; the source registered the tasks of the service by their own IPs (awsvpc)","for the drafted path: the private IPs of the nodes of the SKE cluster the target pool lists, and who keeps them current as the node pool scales and is updated","for an Ingress controller: the controller, how the load balancer reaches it (its node port at the node IPs, or its own Service of type LoadBalancer) and the Ingress rules of each workload","for the STACKIT ALB as the Ingress: that the account may enable the Application Load Balancer extension of SKE (private preview), and the IngressClass and Ingress of each workload"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:d7bf04a14592c56905fb4aaaf64310c4a399ab5a50cefaace7cdb6f7435abf4a","artifact_sha256":"sha256:f4d05a27ee3dc30c9802a025a3ba2390b8efe68eba7027ef1a0a9d29bc87a4d0","kb_dependencies_sha256":"sha256:9a087b808a89168f09e6e245d0b89524c03ac3e758f07e554c71661a6068b367"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH","source_family":"convert","source_semantic":"INGRESS_EXPOSURE_PATH","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"TARGET_DESIGN_OPEN","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":"nodeport-alb-target-pool","guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[{"id":"nodeport-alb-target-pool","title":"Keep the draft: a NodePort Service of each workload and the target pool on its node port at the private IPs of the cluster's nodes","prerequisites":[],"effects":["The manifest of each workload writes a Service of type NodePort with the node port the target pool of the drafted Application Load Balancer listens on, and the pool's targets are the private IPs of the nodes of the SKE cluster, which a person sets and keeps current: the nodes change as the node pool scales and is updated, and a node missing from the list receives no traffic. The health check of the pool reaches the pods through the same node port. The draft applies as written once the IPs are set."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L420","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L70-L76","https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L88"],"regeneration_required":false},{"id":"ingress-controller-behind-alb","title":"Run an Ingress controller on the cluster and put the load balancer in front of it","prerequisites":[],"effects":["An Ingress controller (for example ingress-nginx, installed by a Helm release) runs on the SKE cluster and routes the requests by Ingress rules to the ClusterIP Services of the workloads; the load balancer reaches the controller, on the controller's node port at the private IPs of the nodes (the target pool of the draft changed to that port) or through the controller's own Service of type LoadBalancer. The draft writes neither the controller nor the Ingress rules: a person carries it out, and the load balancer's step stays held."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L420","https://github.com/stackitcloud/professional-service/blob/main/examples/ske-nginx-rate-limit/070-helm.tf#L15-L18"],"regeneration_required":false},{"id":"stackit-alb-ingress-controller","title":"Use the STACKIT ALB as the Ingress: the SKE Application Load Balancer extension","prerequisites":[],"effects":["The Application Load Balancer extension of the SKE cluster is enabled (extensions.application_load_balancer.enabled of stackit_ske_cluster; in private preview, only for enabled accounts) and each workload gets an Ingress of an IngressClass of the controller stackit.cloud/alb-ingress over a Service of type NodePort, the only network mode the controller supports; the controller provisions the Application Load Balancer through the STACKIT API, so the stackit_application_load_balancer block of the draft is not applied. The draft writes neither the extension nor the Ingress: a person carries it out, and the load balancer's step stays held."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L171","https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/ARCHITECTURE.md#L5","https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L25-L33","https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L88"],"regeneration_required":false}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L420","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L70-L76","https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L88","https://github.com/stackitcloud/professional-service/blob/main/examples/ske-nginx-rate-limit/070-helm.tf#L15-L18","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L171","https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/ARCHITECTURE.md#L5","https://github.com/stackitcloud/professional-service/blob/main/examples/ske-alb-controller-waf-extension/060-test-workload.tf#L25-L33"],"state_reason":"a person's decision or input is still open","source_observation":"The plan leaves this decision open on module.retail_app_ecs.module.alb.aws_lb.this.","generated_target_behavior":"The draft holds TF/stackit_application_load_balancer.retail_app_ecs_alb_this until this decision is answered by an answer that frees it.","residual_difference":"the target design is open until the decision is answered","execution_effect":"1 step waits for it until it is answered: TF/stackit_application_load_balancer.retail_app_ecs_alb_this.","next_action":"Decide how a load balancer reaches a workload on SKE for module.retail_app_ecs.module.alb.aws_lb.this: choose one of the 3 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["The converter could not prove what the source means by the ingress exposure path (1 converter decision): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides."],"closes_when":["an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option"],"required_inputs":["a STACKIT target pool reaches its targets by private IP and the SKE cluster exports no node address to Terraform, so a Kubernetes workload is reachable from the load balancer only through a node port at the IPs of the nodes, which change as the node pool scales and is updated, or through an Ingress controller; the source registered the tasks of the service by their own IPs (awsvpc)","for the drafted path: the private IPs of the nodes of the SKE cluster the target pool lists, and who keeps them current as the node pool scales and is updated","for an Ingress controller: the controller, how the load balancer reaches it (its node port at the node IPs, or its own Service of type LoadBalancer) and the Ingress rules of each workload","for the STACKIT ALB as the Ingress: that the account may enable the Application Load Balancer extension of SKE (private preview), and the IngressClass and Ingress of each workload"]},"unblocks":{"holds":66,"stuck":63,"alone":0,"shared":3,"best_option":"nodeport-alb-target-pool","options":[{"option":"nodeport-alb-target-pool","effects":["ACK_CURRENT_ARTIFACT"],"alone":0,"shared":3},{"option":"ingress-controller-behind-alb","effects":["NOT_STATED"],"alone":0,"shared":0},{"option":"stackit-alb-ingress-controller","effects":["NOT_STATED"],"alone":0,"shared":0}]}},{"id":"DEC-GEN-CONVERT-POD-SEGMENTATION","kind":"POD_SEGMENTATION","family":"convert","source":"PLAN_DECISION","group":"GRP-PLAN-DECISION-convert","block":"POD_SEGMENTATION","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"options":[{"id":"generate-networkpolicy-from-the-group-rules","title":"Carry the segmentation as a Kubernetes NetworkPolicy written from the rules of the source group","effect":"A NetworkPolicy per workload admits the traffic the rules of the source group allowed and nothing else, so the segmentation moves from the interface of the task to the pod. The sources read state that SKE applies NetworkPolicy objects (a default-deny policy of its own in kube-system, and a request to add policies for custom workloads) and give no statement about the policy engine in a workload's namespace, which is checked on the cluster. The draft does not write the NetworkPolicy in this build: a person writes it from the rules of the drafted group, and the group stays a record of what the source allowed.","execution_effect":"MANUAL_ALTERNATIVE","evidence":[{"url":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"With Kubernetes 1.33 there will be a new deny-all NetworkPolicy introduced, which blocks Network Traffic in the namespace kube-system. If there is custom workload in the namespace, please apply additional NetworkPolicies for Ingress and Egress."},{"url":"https://github.com/stackitcloud/professional-service/blob/main/examples/ske-s3-csi-juicefs/README.md#L59","class":"SOURCE_CODE_VERIFIED","checked_at":"2026-10-26","quote":"SKE (Gardener) enforces a default-deny `NetworkPolicy` in `kube-system`."}]},{"id":"security-group-on-the-nodes","title":"Carry the segmentation as a STACKIT security group on the nodes (coarser than the source)","effect":"A security group acts on the network interface that lists it, so on a node and on every pod of it, not on one workload: it is coarser than the source group, which acted on the interface of each task. The provider resource of the cluster has no security group attribute, on the cluster or on a node pool, so the draft cannot write it, and whether the interfaces of the nodes can list a group by another route is not stated by the sources read: a person establishes that with STACKIT before choosing it.","execution_effect":"MANUAL_ALTERNATIVE","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L40","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"`security_group_ids` (List of String) The list of security group UUIDs. If security is set to false, setting this field will lead to an error."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"(searched the resource documentation of stackit_ske_cluster, its node_pools nested schema included, and the pinned provider schema 0.120.0: no security group attribute)"}]},{"id":"accept-no-segmentation","title":"Accept that the pods run without the segmentation the source group gave the tasks","effect":"The group is created as the draft writes it and is attached to nothing; no policy of the draft restricts the traffic to or from the pods, so what the cluster admits to them is its own default, which the sources read do not state for a workload namespace. The loss of the source's restriction is a difference, recorded as accepted with who accepted it and why, never as equivalent.","execution_effect":"ACK_CURRENT_ARTIFACT","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L40","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"`security_group_ids` (List of String) The list of security group UUIDs. If security is set to false, setting this field will lead to an error."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"(searched the resource documentation of stackit_ske_cluster, its node_pools nested schema included, and the pinned provider schema 0.120.0: no security group attribute)"}]}],"recommended_option":null,"blocking_effect":"TARGET_DESIGN_OPEN","causes":[{"cause":"TARGET_LIMIT","members":5}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"The converter could not prove what the source means by the pod segmentation (5 converter decisions): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides.","required_evidence":["the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision)","for each workload the record names: the traffic the source group allowed to and from its tasks (the rules of the drafted group) and which of those rules the target still needs","for a NetworkPolicy: that the cluster enforces NetworkPolicy objects in the workload's namespace, and the labels of the pods the policy selects","for a security group on the nodes: whether the network interfaces of the nodes of the cluster can list a STACKIT security group at all (the provider resource of the cluster has no attribute for it), and that its rules then act on every pod of a node"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:29854ad7b6a2cfd7733fbf071811c930e5023b74bc53cbea83bece2408c8973d","artifact_sha256":"sha256:4e0ef236960deac4d2b2ebae29798e224cb78827e6fa6fbb95b47aa06542708b","kb_dependencies_sha256":"sha256:0ab49a10e7889d96d2724e04ceb59d86dea0c9e7505705506b10ad00b58faa14"},"member_count":5,"affected_unit_count":5,"evidence_ref_count":5,"resolution":{"decision_id":"DEC-GEN-CONVERT-POD-SEGMENTATION","source_family":"convert","source_semantic":"POD_SEGMENTATION","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"NOT_STATED","owner_role":"Security Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"TARGET_DESIGN_OPEN","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":5,"resolution_paths":[{"id":"generate-networkpolicy-from-the-group-rules","title":"Carry the segmentation as a Kubernetes NetworkPolicy written from the rules of the source group","prerequisites":[],"effects":["A NetworkPolicy per workload admits the traffic the rules of the source group allowed and nothing else, so the segmentation moves from the interface of the task to the pod. The sources read state that SKE applies NetworkPolicy objects (a default-deny policy of its own in kube-system, and a request to add policies for custom workloads) and give no statement about the policy engine in a workload's namespace, which is checked on the cluster. The draft does not write the NetworkPolicy in this build: a person writes it from the rules of the drafted group, and the group stays a record of what the source allowed."],"risk":[],"evidence":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","https://github.com/stackitcloud/professional-service/blob/main/examples/ske-s3-csi-juicefs/README.md#L59"],"regeneration_required":false},{"id":"security-group-on-the-nodes","title":"Carry the segmentation as a STACKIT security group on the nodes (coarser than the source)","prerequisites":[],"effects":["A security group acts on the network interface that lists it, so on a node and on every pod of it, not on one workload: it is coarser than the source group, which acted on the interface of each task. The provider resource of the cluster has no security group attribute, on the cluster or on a node pool, so the draft cannot write it, and whether the interfaces of the nodes can list a group by another route is not stated by the sources read: a person establishes that with STACKIT before choosing it."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L40","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md"],"regeneration_required":false},{"id":"accept-no-segmentation","title":"Accept that the pods run without the segmentation the source group gave the tasks","prerequisites":[],"effects":["The group is created as the draft writes it and is attached to nothing; no policy of the draft restricts the traffic to or from the pods, so what the cluster admits to them is its own default, which the sources read do not state for a workload namespace. The loss of the source's restriction is a difference, recorded as accepted with who accepted it and why, never as equivalent."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L40","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md"],"regeneration_required":false}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","https://github.com/stackitcloud/professional-service/blob/main/examples/ske-s3-csi-juicefs/README.md#L59","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L40","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md"],"state_reason":"a person's decision or input is still open","source_observation":"The plan leaves this decision open on module.retail_app_ecs.module.carts_service.aws_security_group.this, module.retail_app_ecs.module.catalog_service.aws_security_group.this, module.retail_app_ecs.module.checkout_service.aws_security_group.this, module.retail_app_ecs.module.orders_service.aws_security_group.this and 1 more.","generated_target_behavior":"The draft holds MAN/security/attachment-design:module.retail_app_ecs.module.carts_service.aws_security_group.this, MAN/security/attachment-design:module.retail_app_ecs.module.catalog_service.aws_security_group.this, MAN/security/attachment-design:module.retail_app_ecs.module.checkout_service.aws_security_group.this, MAN/security/attachment-design:module.retail_app_ecs.module.orders_service.aws_security_group.this and MAN/security/attachment-design:module.retail_app_ecs.module.ui_service.aws_security_group.this until this decision is answered by an answer that frees it.","residual_difference":"the target design is open until the decision is answered","execution_effect":"5 steps wait for it until it is answered: MAN/security/attachment-design:module.retail_app_ecs.module.carts_service.aws_security_group.this, MAN/security/attachment-design:module.retail_app_ecs.module.catalog_service.aws_security_group.this, MAN/security/attachment-design:module.retail_app_ecs.module.checkout_service.aws_security_group.this, MAN/security/attachment-design:module.retail_app_ecs.module.orders_service.aws_security_group.this and MAN/security/attachment-design:module.retail_app_ecs.module.ui_service.aws_security_group.this.","next_action":"Decide how the segmentation of ECS tasks that become pods is carried for module.retail_app_ecs.module.carts_service.aws_security_group.this, module.retail_app_ecs.module.catalog_service.aws_security_group.this, module.retail_app_ecs.module.checkout_service.aws_security_group.this, module.retail_app_ecs.module.orders_service.aws_security_group.this and 1 more: choose one of the 3 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["The converter could not prove what the source means by the pod segmentation (5 converter decisions): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides."],"closes_when":["an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option"],"required_inputs":["the source restricts the traffic to and from the tasks with this group; a STACKIT security group acts on the network interface of a server and cannot restrict a pod, and the draft attaches the group to nothing, so the tasks would run without the segmentation the source had unless a person decides how it is carried (never equivalent without that decision)","for each workload the record names: the traffic the source group allowed to and from its tasks (the rules of the drafted group) and which of those rules the target still needs","for a NetworkPolicy: that the cluster enforces NetworkPolicy objects in the workload's namespace, and the labels of the pods the policy selects","for a security group on the nodes: whether the network interfaces of the nodes of the cluster can list a STACKIT security group at all (the provider resource of the cluster has no attribute for it), and that its rules then act on every pod of a node"]},"unblocks":{"holds":96,"stuck":65,"alone":20,"shared":11,"best_option":"generate-networkpolicy-from-the-group-rules","options":[{"option":"generate-networkpolicy-from-the-group-rules","effects":["MANUAL_ALTERNATIVE"],"alone":20,"shared":11},{"option":"security-group-on-the-nodes","effects":["MANUAL_ALTERNATIVE"],"alone":20,"shared":11},{"option":"accept-no-segmentation","effects":["ACK_CURRENT_ARTIFACT"],"alone":20,"shared":11}]}},{"id":"DEC-GEN-CONVERT-SIZE-FROM-SOURCE","kind":"SIZE_FROM_SOURCE","family":"convert","source":"PLAN_DECISION","group":"GRP-PLAN-DECISION-convert","block":"SIZE_FROM_SOURCE","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"options":[{"id":"use-the-size-derived-from-the-source","title":"Keep the plan or machine type the draft derived from the size of the source","effect":"The draft already writes the derived plan, flavor or machine type (as the default of the variable for a plan or a machine type, as the literal of the block for a database flavor), said as DEFAULT on the block: the instance or the pool is created with it and the cost page prices it. Confirming it accepts the proposal as the starting size of the target; it does not say that the size carries the load, which the source does not state, and the disk of a plan is the smallest of that size. The memory was compared in bytes: the API states the memory of a PostgreSQL Flex and a SQL Server Flex flavor in Gibibyte, the unit of the source; the plan tables of Key Value Store and RabbitMQ and the MongoDB Flex flavors state their RAM as GB without defining it, so the draft took the plan or flavor that holds the source's memory when a GB is 10^9 bytes (it then holds it when a GB is 2^30 bytes as well) and says where that made it larger than the reading of a GB as a GiB; a machine type's memory is the catalogue's ram_mb read as MiB, an inference the API does not state. The next run writes the same default.","execution_effect":"ACK_CURRENT_ARTIFACT","evidence":[{"url":"https://docs.stackit.cloud/products/databases/key-value-store/reference/service-plans/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-11-02","quote":"Single-node service plans do not provide this grade of high availability. Therefore, we strongly advise against using them in production environments."},{"url":"https://docs.stackit.cloud/products/databases/key-value-store/reference/service-plans/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-11-02","quote":"Service Plan | High availability | Number of nodes | vCPU per node | RAM (GB) per node | Disk (GB) per node; keyvalue-1.2.10-Replica | yes | 3 | 1 | 2 | 10; keyvalue-2.8.250-Replica-HiPerf | yes | 3 | 2 (dedicated) | 8 | 250; keyvalue-1.4.10-Single | no | 1 | 1 | 4 | 10 (the cells of the table, joined with ' | ')"},{"url":"https://docs.stackit.cloud/products/messaging/rabbitmq/reference/service-plans/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-11-02","quote":"Service Plan | High availability | Number of nodes | vCPU per node | RAM (GB) per node | Disk per node; RabbitMQ-1.2.10-Replica | yes | 3 | 1 | 2 | 10; RabbitMQ-2.4.10-Single | no | 1 | 2 | 4 | 10; RabbitMQ-8.16.100-replica-HiPerf | yes | 3 | 8¹ | 16 | 100; ^1dedicated CPU for highest performance (the cells of the table, joined with ' | ')"},{"url":"https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/ske/v2/ske.json#L2048","class":"SOURCE_CODE_VERIFIED","checked_at":"2026-11-02","quote":"Machine.type: \"For valid types please take a look at [provider-options](#tag/ProviderOptions/operation/SkeService_GetProviderOptions) `machineTypes`.\" (provider options: machineTypes, \"List of available machine types\", each with architecture, cpu, gpu, memory and name)"},{"url":"https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L1408","class":"SOURCE_CODE_VERIFIED","checked_at":"2026-11-02","quote":"flavor.memory: \"The memory of the instance in Gibibyte.\""},{"url":"https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/sqlserverflex/v3/sqlserverflex.json#L1455","class":"SOURCE_CODE_VERIFIED","checked_at":"2026-11-02","quote":"flavor.memory: \"The memory of the instance in Gibibyte.\""},{"url":"https://docs.stackit.cloud/products/databases/mongodb-flex/reference/flavors-and-performance-classes/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-11-02","quote":"Replica set: Description | ID | CPU | RAM (GB); Tiny, Compute optimized | 1.2 | 1 | 2; Tiny, Database optimized | 1.4 | 1 | 4 (the cells of the table, joined with ' | '; the page defines GB nowhere and the mongodb-flex v2 spec types `memory` as an int32 without a description)"},{"url":"https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/iaas/v2/iaas.json#L3660","class":"SOURCE_CODE_VERIFIED","checked_at":"2026-11-02","quote":"SizeInMB: \"Size in Megabyte.\" (the ram of a MachineType); project quota ram: \"Amount of server RAM in MiB.\"; the provider data source machine_type: \"ram (Number) RAM size in MB\" with the filter example \"vcpus \u003e= 2 \u0026\u0026 ram \u003e= 2048\""}],"default":true},{"id":"choose-the-size","title":"Set the plan or machine type yourself","effect":"The next run leaves the variable a required one the owner sets (a plan or a flavor of the catalogue, or a machine type the SKE API lists); the derived default and its DEFAULT line leave the draft, and the step that reads the variable waits for the value. Where the unit of the target's memory is not stated (the GB of a plan table or of a MongoDB Flex flavor), the person who sets the value reads the table in the unit that holds: a plan whose GB is a GiB can be smaller than the one the draft proposed.","execution_effect":"REGENERATE_REQUIRED","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_instance.md#L36","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-11-02","quote":"`plan_name` (String) The selected plan name."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/rabbitmq_instance.md#L36","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-11-02","quote":"`plan_name` (String) The selected plan name."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L84","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-11-02","quote":"`machine_type` (String) The machine type."}]}],"recommended_option":null,"defaults":[{"member":"convert:module.dependencies.aws_mq_broker.mq:dependencies_mq_plan_name:SIZE_FROM_SOURCE","option":"use-the-size-derived-from-the-source","words":"StackToIT carried out the option use-the-size-derived-from-the-source for module.dependencies.aws_mq_broker.mq by default: var.dependencies_mq_plan_name defaults to stackit-rabbitmq-8.16.50-replica (broker instance type mq.m5.large has 2 vCPU and 8 GiB (AWS price list, mq_broker_sizes.json), and the broker is a single instance: the smallest replica (three nodes, high availability) RabbitMQ plan of the eu01 catalogue (2026-10-18) that holds 2 vCPU and 8 GiB (8.59 GB at 10^9 bytes per GB) of memory (the plan table gives its RAM as \"GB\" and does not say whether a GB is 10^9 or 2^30 bytes, so the plan is chosen to hold the source's memory when a GB is 10^9 bytes, which it then also does when a GB is 2^30 bytes (it is never smaller than the source whichever way the table is read)): 8 vCPU / 16 GB RAM / 50 GB disk per node; the disk is not a figure of the source, so the smallest disk of that size is taken and the disk is open; no single-node plan of that size exists, so this replica plan adds the replicas the source does not have, and their price; this plan is larger than the one the other reading gives: reading the table's GB as a GiB, stackit-rabbitmq-4.8.50-single (4 vCPU / 8 GB RAM / 50 GB disk per node) would hold the source, and the draft is priced on the larger plan; if the table's GB is a GiB, answer choose-the-size and set stackit-rabbitmq-4.8.50-single). To change it, answer this decision in decisions.yaml with choose-the-size (and set the plan in the variable), or reject the proposal: the next run then writes the variable without a default.","answered_by":"DEFAULT"},{"member":"convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:dependencies_checkout_elasticache_redis_default_plan_name:SIZE_FROM_SOURCE","option":"use-the-size-derived-from-the-source","words":"StackToIT carried out the option use-the-size-derived-from-the-source for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default by default: var.dependencies_checkout_elasticache_redis_default_plan_name defaults to stackit-keyvalue-1.4.10-single (node type cache.t3.micro has 2 vCPU and 0.5 GiB (AWS price list, cache_node_sizes.json), and the source is a single node: the smallest single-node Key Value Store plan of the eu01 catalogue (2026-10-18) that holds 0.5 GiB (0.5369 GB at 10^9 bytes per GB) of memory (the plan table gives its RAM as \"GB\" and does not say whether a GB is 10^9 or 2^30 bytes, so the plan is chosen to hold the source's memory when a GB is 10^9 bytes, which it then also does when a GB is 2^30 bytes (it is never smaller than the source whichever way the table is read)): 1 vCPU / 4 GB RAM / 10 GB disk per node; the disk is not a figure of the source, so the smallest disk of that size is taken and the disk is open). To change it, answer this decision in decisions.yaml with choose-the-size (and set the plan in the variable), or reject the proposal: the next run then writes the variable without a default.","answered_by":"DEFAULT"},{"member":"convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:dependencies_orders_rds_this_flavor_id:SIZE_FROM_SOURCE","option":"use-the-size-derived-from-the-source","words":"StackToIT carried out the option use-the-size-derived-from-the-source for module.dependencies.module.orders_rds.aws_rds_cluster.this by default: flavor_id = 2.4 (module.dependencies.module.orders_rds.aws_rds_cluster.this (source class db.t3.medium) has 2 vCPU and 4 GiB (AWS price list); 2.4 is the smallest single-node PostgreSQL Flex flavor of the eu01 catalogue (2026-10-18) that covers it: 2 vCPU / 4 GiB). To change it, answer this decision in decisions.yaml with choose-the-size (and set the flavor in the variable), or reject the proposal: the next run then writes flavor_id as var.dependencies_orders_rds_this_flavor_id without a default.","answered_by":"DEFAULT"}],"blocking_effect":"TARGET_DESIGN_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":3}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"The draft derives a plan or a machine type from the size the source states and writes it as the default of a variable (3 converter decisions): the steps that read the variable run on that default until a person confirms it or sets another size, and the price on the cost page is the price of the default. The source states the size of its own offer, not the load, so the size is a proposal.","required_evidence":["the target sizes by a flavor of the catalogue, and the source states a size in the terms of its own offer; the draft proposes the smallest flavor that covers it, which leaves out what the source does not state (the disk of a plan, the sustained load, the headroom of a pool), so the value is a proposal and the price of the draft moves with it; unit of the memory figure: PostgreSQL Flex states the memory of a flavor in Gibibyte (API v3 spec, flavor.memory), the unit of the source's size, so no unit is assumed","the target sizes by a plan of the catalogue, and the source states a size in the terms of its own offer; the draft proposes the smallest plan that covers it, which leaves out what the source does not state (the disk of a plan, the sustained load, the headroom of a pool), so the value is a proposal and the price of the draft moves with it; unit of the memory figure: the plan table gives its RAM as \"GB\" and does not say whether a GB is 10^9 or 2^30 bytes, so the plan is chosen to hold the source's memory when a GB is 10^9 bytes, which it then also does when a GB is 2^30 bytes (it is never smaller than the source whichever way the table is read)","the load the instance or the pool has to carry on STACKIT: memory in use, connections or messages per second, and the headroom the owner wants (the source states the size of its offer, not the load)","for a plan: whether the availability of the source (replicas, automatic failover, a cluster of brokers) is kept, and the disk the data needs (the disk is not a figure of the source)","for a pool: the requests of the workloads that run on it, and the minimum and maximum of the pool"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:68bd3fec47f2c8f8025a99a3b80707342357b42589bda9f46be69f7182fb9730","artifact_sha256":"sha256:47d23376f79ef8f3b2f4b11187b1b9a723301f6aa27bae31bad3b3205556514b","kb_dependencies_sha256":"sha256:4aefcdb4f8cff3c728aa8535ac7777fa49c3c4576077a04da8978b2e25bb606e"},"member_count":3,"affected_unit_count":3,"evidence_ref_count":3,"resolution":{"decision_id":"DEC-GEN-CONVERT-SIZE-FROM-SOURCE","source_family":"convert","source_semantic":"SIZE_FROM_SOURCE","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"TARGET_DESIGN_OPEN","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":3,"resolution_paths":[{"id":"use-the-size-derived-from-the-source","title":"Keep the plan or machine type the draft derived from the size of the source","prerequisites":[],"effects":["The draft already writes the derived plan, flavor or machine type (as the default of the variable for a plan or a machine type, as the literal of the block for a database flavor), said as DEFAULT on the block: the instance or the pool is created with it and the cost page prices it. Confirming it accepts the proposal as the starting size of the target; it does not say that the size carries the load, which the source does not state, and the disk of a plan is the smallest of that size. The memory was compared in bytes: the API states the memory of a PostgreSQL Flex and a SQL Server Flex flavor in Gibibyte, the unit of the source; the plan tables of Key Value Store and RabbitMQ and the MongoDB Flex flavors state their RAM as GB without defining it, so the draft took the plan or flavor that holds the source's memory when a GB is 10^9 bytes (it then holds it when a GB is 2^30 bytes as well) and says where that made it larger than the reading of a GB as a GiB; a machine type's memory is the catalogue's ram_mb read as MiB, an inference the API does not state. The next run writes the same default."],"risk":[],"evidence":["https://docs.stackit.cloud/products/databases/key-value-store/reference/service-plans/","https://docs.stackit.cloud/products/databases/key-value-store/reference/service-plans/","https://docs.stackit.cloud/products/messaging/rabbitmq/reference/service-plans/","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/ske/v2/ske.json#L2048","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L1408","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/sqlserverflex/v3/sqlserverflex.json#L1455","https://docs.stackit.cloud/products/databases/mongodb-flex/reference/flavors-and-performance-classes/","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/iaas/v2/iaas.json#L3660"],"regeneration_required":false},{"id":"choose-the-size","title":"Set the plan or machine type yourself","prerequisites":[],"effects":["The next run leaves the variable a required one the owner sets (a plan or a flavor of the catalogue, or a machine type the SKE API lists); the derived default and its DEFAULT line leave the draft, and the step that reads the variable waits for the value. Where the unit of the target's memory is not stated (the GB of a plan table or of a MongoDB Flex flavor), the person who sets the value reads the table in the unit that holds: a plan whose GB is a GiB can be smaller than the one the draft proposed."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_instance.md#L36","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/rabbitmq_instance.md#L36","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L84"],"regeneration_required":true}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":["https://docs.stackit.cloud/products/databases/key-value-store/reference/service-plans/","https://docs.stackit.cloud/products/messaging/rabbitmq/reference/service-plans/","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/ske/v2/ske.json#L2048","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L1408","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/sqlserverflex/v3/sqlserverflex.json#L1455","https://docs.stackit.cloud/products/databases/mongodb-flex/reference/flavors-and-performance-classes/","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/iaas/v2/iaas.json#L3660","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_instance.md#L36","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/rabbitmq_instance.md#L36","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L84"],"state_reason":"a person's decision or input is still open","source_observation":"The plan leaves this decision open on module.dependencies.aws_mq_broker.mq, module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default and module.dependencies.module.orders_rds.aws_rds_cluster.this.","generated_target_behavior":"The draft carries the default use-the-size-derived-from-the-source out (answered by DEFAULT: nobody answered the decision), and the decision stays open.","residual_difference":"the target design stands on a default that nobody answered: StackToIT chose it, and a person confirms it or changes it in the decisions file","execution_effect":"No step waits for it. The plan can start TF/stackit_rabbitmq_instance.dependencies_mq, TF/stackit_valkey_instance.dependencies_checkout_elasticache_redis_default and TF/stackit_postgresflex_instance.dependencies_orders_rds_this now.","next_action":"Confirm the plan or machine type StackToIT derived from the size of the source for module.dependencies.aws_mq_broker.mq, module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default and module.dependencies.module.orders_rds.aws_rds_cluster.this: choose one of the 2 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["The draft derives a plan or a machine type from the size the source states and writes it as the default of a variable (3 converter decisions): the steps that read the variable run on that default until a person confirms it or sets another size, and the price on the cost page is the price of the default. The source states the size of its own offer, not the load, so the size is a proposal."],"closes_when":["an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option"],"required_inputs":["the target sizes by a flavor of the catalogue, and the source states a size in the terms of its own offer; the draft proposes the smallest flavor that covers it, which leaves out what the source does not state (the disk of a plan, the sustained load, the headroom of a pool), so the value is a proposal and the price of the draft moves with it; unit of the memory figure: PostgreSQL Flex states the memory of a flavor in Gibibyte (API v3 spec, flavor.memory), the unit of the source's size, so no unit is assumed","the target sizes by a plan of the catalogue, and the source states a size in the terms of its own offer; the draft proposes the smallest plan that covers it, which leaves out what the source does not state (the disk of a plan, the sustained load, the headroom of a pool), so the value is a proposal and the price of the draft moves with it; unit of the memory figure: the plan table gives its RAM as \"GB\" and does not say whether a GB is 10^9 or 2^30 bytes, so the plan is chosen to hold the source's memory when a GB is 10^9 bytes, which it then also does when a GB is 2^30 bytes (it is never smaller than the source whichever way the table is read)","the load the instance or the pool has to carry on STACKIT: memory in use, connections or messages per second, and the headroom the owner wants (the source states the size of its offer, not the load)","for a plan: whether the availability of the source (replicas, automatic failover, a cluster of brokers) is kept, and the disk the data needs (the disk is not a figure of the source)","for a pool: the requests of the workloads that run on it, and the minimum and maximum of the pool"]}},{"id":"DEC-GEN-CONVERT-WORKLOAD-PLACEMENT","kind":"WORKLOAD_PLACEMENT","family":"convert","source":"PLAN_DECISION","group":"GRP-PLAN-DECISION-convert","block":"WORKLOAD_PLACEMENT","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"options":[{"id":"one-network-for-the-cluster-and-services","title":"Place the cluster and the servers in one STACKIT network, and admit the clients of the managed services by access lists naming its range","effect":"The Kubernetes cluster is deployed into one network (network.id of stackit_ske_cluster names a STACKIT Network Area network; a node pool states no network, so the tasks the source spread over several subnets share it), the servers are placed in it by their network interfaces (network_id of stackit_network_interface), and a managed database or cache is not placed in a network: its access list (acl of stackit_postgresflex_instance and stackit_mongodbflex_instance) names the range of that network. The other drafted networks of the subnets hold none of these consumers. The draft writes the cluster half of this option by default (network = { id = ... } on the drafted stackit_ske_cluster, marked DEFAULT) where the target project is not stated to be outside a Network Area, the draft asks for no such project, the cluster serves workloads of exactly one drafted network, and every other consumer of that network has a decision of its own; where one of these does not hold it writes no network.id and a person carries the cluster half out. The access lists of the managed services are a separate default of the draft and not written by this option: a person (or that default) carries the services half out, and the network's step stays held until the decision is answered where the draft binds nothing.","execution_effect":"MANUAL_ALTERNATIVE","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"`id` (String) ID of the STACKIT Network Area (SNA) network into which the cluster will be deployed."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L79-L101","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"Nested Schema for `node_pools` — Required: availability_zones, machine_type, maximum, minimum, name; Optional: allow_system_components, cri, labels, max_surge, max_unavailable, os_name, os_version, os_version_min, taints, volume_size, volume_type (searched the nested schema: no network attribute)"},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-23","quote":"network_id (String) The network ID to which the network interface is associated."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_instance.md#L44","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"`acl` (List of String) The Access Control List (ACL) for the MongoDB Flex instance. (searched the resource documentation: no network id attribute)"},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_instance.md#L104","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-22","quote":"access_scope (String) The network access scope of the instance. This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected. Possible values are: PUBLIC, SNA."}]},{"id":"keep-the-networks-and-place-by-tier","title":"Keep the drafted networks and place each consumer in the network of its tier","effect":"A network is kept per source subnet class and each consumer is placed where STACKIT can place it: a server by its network interface, a load balancer by its networks (networks.network_id of stackit_application_load_balancer), the Kubernetes cluster by network.id in one network (its node pools state no network, so one cluster cannot follow a split of its tasks over several networks), and a managed database or cache by an access list naming the range of its tier's network. The draft does not write this placement: a person carries it out, and the network's step stays held.","execution_effect":"MANUAL_ALTERNATIVE","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"`id` (String) ID of the STACKIT Network Area (SNA) network into which the cluster will be deployed."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L79-L101","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"Nested Schema for `node_pools` — Required: availability_zones, machine_type, maximum, minimum, name; Optional: allow_system_components, cri, labels, max_surge, max_unavailable, os_name, os_version, os_version_min, taints, volume_size, volume_type (searched the nested schema: no network attribute)"},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-23","quote":"network_id (String) The network ID to which the network interface is associated."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L397-L398","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-25","quote":"network_id (String) STACKIT network ID the Application Load Balancer and/or targets are in. role (String) The role defines how the Application Load Balancer is using the network. Possible values are: ROLE_UNSPECIFIED, ROLE_LISTENERS_AND_TARGETS, ROLE_LISTENERS, ROLE_TARGETS."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_instance.md#L44","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"`acl` (List of String) The Access Control List (ACL) for the MongoDB Flex instance. (searched the resource documentation: no network id attribute)"}]},{"id":"redesign-the-network-placement","title":"Redesign the network placement of the workloads","effect":"The architect designs the placement outside the draft (for example the cluster in an existing Network Area network of the target environment, or the workloads on servers in the drafted networks); the drafted network is replaced by that design. The draft carries none of it, and the network's step stays held.","execution_effect":"MANUAL_ALTERNATIVE","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"`id` (String) ID of the STACKIT Network Area (SNA) network into which the cluster will be deployed."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-23","quote":"network_id (String) The network ID to which the network interface is associated."}]},{"id":"accept-the-consumers-outside-the-network","title":"Accept that the drafted network holds none of the source's consumers of its subnet","effect":"The network is applied as the draft writes it, and none of the consumers the record names is placed in it: the cluster is created without network.id as drafted (which network then holds its nodes is not stated by the sources read), a load balancer takes the network its variable is set to, and a managed database or cache admits the clients of its access list. The source's placement of these workloads in the subnet is not kept; a person accepts that difference, and whether the network's range is still needed is decided with it.","execution_effect":"ACK_CURRENT_ARTIFACT","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L67","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"`network` (Attributes) Network block as defined below. (listed under Optional)"},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-26","quote":"`id` (String) ID of the STACKIT Network Area (SNA) network into which the cluster will be deployed."}]}],"recommended_option":null,"blocking_effect":"TARGET_DESIGN_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1}],"blocker_class":"OPTIONAL_CONDITIONAL","why":"The converter could not prove what the source means by the workload placement (1 converter decision): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides.","required_evidence":["the source splits these workloads over subnets, and STACKIT places them differently: an SKE cluster is deployed into one network (network.id) and its node pools state no network, a managed database, cache or broker takes an access list and no network id; no one-to-one placement of the consumers in stackit_network.vpc_vpc_private follows from the source, so the network's step waits for the decision","for each source consumer the record names (an ECS service, a cluster, a load balancer, a database, cache or broker): the STACKIT network it is placed in, or the access list that admits its clients, in the layout chosen","for a Kubernetes cluster: the STACKIT Network Area network its network.id names, and that the target project can use it; the task-level subnet split of the source has no counterpart in the cluster","for a network that holds none of its consumers after the choice: whether its address range is still needed"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:8423085c8f163f8f11a333347eb7eb7897eac61922c9c6cd69a52a5a7a6893f9","artifact_sha256":"sha256:6fcbcaeb18342452421d74df69cd6a2867a13923f52b57ba684e15b806ebb8c1","kb_dependencies_sha256":"sha256:bf8b1a74b9af3006bff3fdbd5579c5d953ccadafcdfefcf59bee748eb6c1e230"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-GEN-CONVERT-WORKLOAD-PLACEMENT","source_family":"convert","source_semantic":"WORKLOAD_PLACEMENT","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"TARGET_DESIGN_OPEN","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[{"id":"one-network-for-the-cluster-and-services","title":"Place the cluster and the servers in one STACKIT network, and admit the clients of the managed services by access lists naming its range","prerequisites":[],"effects":["The Kubernetes cluster is deployed into one network (network.id of stackit_ske_cluster names a STACKIT Network Area network; a node pool states no network, so the tasks the source spread over several subnets share it), the servers are placed in it by their network interfaces (network_id of stackit_network_interface), and a managed database or cache is not placed in a network: its access list (acl of stackit_postgresflex_instance and stackit_mongodbflex_instance) names the range of that network. The other drafted networks of the subnets hold none of these consumers. The draft writes the cluster half of this option by default (network = { id = ... } on the drafted stackit_ske_cluster, marked DEFAULT) where the target project is not stated to be outside a Network Area, the draft asks for no such project, the cluster serves workloads of exactly one drafted network, and every other consumer of that network has a decision of its own; where one of these does not hold it writes no network.id and a person carries the cluster half out. The access lists of the managed services are a separate default of the draft and not written by this option: a person (or that default) carries the services half out, and the network's step stays held until the decision is answered where the draft binds nothing."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L79-L101","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_instance.md#L44","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_instance.md#L104"],"regeneration_required":false},{"id":"keep-the-networks-and-place-by-tier","title":"Keep the drafted networks and place each consumer in the network of its tier","prerequisites":[],"effects":["A network is kept per source subnet class and each consumer is placed where STACKIT can place it: a server by its network interface, a load balancer by its networks (networks.network_id of stackit_application_load_balancer), the Kubernetes cluster by network.id in one network (its node pools state no network, so one cluster cannot follow a split of its tasks over several networks), and a managed database or cache by an access list naming the range of its tier's network. The draft does not write this placement: a person carries it out, and the network's step stays held."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L79-L101","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L397-L398","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_instance.md#L44"],"regeneration_required":false},{"id":"redesign-the-network-placement","title":"Redesign the network placement of the workloads","prerequisites":[],"effects":["The architect designs the placement outside the draft (for example the cluster in an existing Network Area network of the target environment, or the workloads on servers in the drafted networks); the drafted network is replaced by that design. The draft carries none of it, and the network's step stays held."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29"],"regeneration_required":false},{"id":"accept-the-consumers-outside-the-network","title":"Accept that the drafted network holds none of the source's consumers of its subnet","prerequisites":[],"effects":["The network is applied as the draft writes it, and none of the consumers the record names is placed in it: the cluster is created without network.id as drafted (which network then holds its nodes is not stated by the sources read), a load balancer takes the network its variable is set to, and a managed database or cache admits the clients of its access list. The source's placement of these workloads in the subnet is not kept; a person accepts that difference, and whether the network's range is still needed is decided with it."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L67","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242"],"regeneration_required":false}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L242","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L79-L101","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network_interface.md#L29","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_instance.md#L44","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_instance.md#L104","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/application_load_balancer.md#L397-L398","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/ske_cluster.md#L67"],"state_reason":"a person's decision or input is still open","source_observation":"The plan leaves this decision open on module.vpc.module.vpc.aws_subnet.private.","generated_target_behavior":"The draft holds TF/stackit_network.vpc_vpc_private until this decision is answered by an answer that frees it.","residual_difference":"the target design is open until the decision is answered","execution_effect":"1 step waits for it until it is answered: TF/stackit_network.vpc_vpc_private.","next_action":"Decide where the workloads of a drafted network are placed for module.vpc.module.vpc.aws_subnet.private: choose one of the 4 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["The converter could not prove what the source means by the workload placement (1 converter decision): the draft holds a required variable without a default and assumes no candidate, so the unit that owns one is not automation-eligible until a person decides."],"closes_when":["an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option"],"required_inputs":["the source splits these workloads over subnets, and STACKIT places them differently: an SKE cluster is deployed into one network (network.id) and its node pools state no network, a managed database, cache or broker takes an access list and no network id; no one-to-one placement of the consumers in stackit_network.vpc_vpc_private follows from the source, so the network's step waits for the decision","for each source consumer the record names (an ECS service, a cluster, a load balancer, a database, cache or broker): the STACKIT network it is placed in, or the access list that admits its clients, in the layout chosen","for a Kubernetes cluster: the STACKIT Network Area network its network.id names, and that the target project can use it; the task-level subnet split of the source has no counterpart in the cluster","for a network that holds none of its consumers after the choice: whether its address range is still needed"]},"unblocks":{"holds":3,"stuck":2,"alone":1,"shared":0,"best_option":"accept-the-consumers-outside-the-network","options":[{"option":"one-network-for-the-cluster-and-services","effects":["NOT_STATED"],"alone":0,"shared":0},{"option":"keep-the-networks-and-place-by-tier","effects":["NOT_STATED"],"alone":0,"shared":0},{"option":"redesign-the-network-placement","effects":["NOT_STATED"],"alone":0,"shared":0},{"option":"accept-the-consumers-outside-the-network","effects":["ACK_CURRENT_ARTIFACT"],"alone":1,"shared":0}]}},{"id":"DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS","kind":"retention_over_180_days","family":"stackitlogs","source":"PLAN_DECISION","group":"GRP-PLAN-DECISION-stackitlogs","block":"retention_over_180_days","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"TECHNICAL_VALIDATION_PASSED","owner_role":"Platform Architect","required_by_phase":"CUTOVER_PREREQUISITE","affected_applications":[],"options":[{"id":"set-retention-within-the-platform-range","title":"Keep the logs for the 180 days of the Logs instance only","effect":"The Logs instance is applied as the draft writes it, with a retention of 180 days (the API accepts 1 to 180 days and the FAQ states that retention beyond 180 days is not supported). Logs older than 180 days are not kept by it and no archive is configured, so the retention the source keeps beyond 180 days is not carried. No step is added.","execution_effect":"ACK_CURRENT_ARTIFACT","evidence":[{"url":"https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/logs/v1/logs.json#L164-L169","class":"SOURCE_CODE_VERIFIED","checked_at":"2026-10-12","quote":"CreateLogsInstancePayload.retentionDays: \"The log retention time in days.\", format int32, maximum 180, minimum 1; required with displayName"},{"url":"https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-12","quote":"Can I extend the retention period of \"Logs\" beyond 180 days? No. As the Logs-Service is a fully managed service, we do not support individual retention configurations beyond 180 days."}],"default":true},{"id":"archive-longer-retention-elsewhere","title":"For the period beyond 180 days, also stream the logs to long-term storage","effect":"The Logs instance keeps at most 180 days and is applied as the draft writes it. The FAQ recommends a cold-storage approach for longer periods: stream the log data in parallel to a long-term storage such as a separate Object Storage bucket. The plan holds a step for it that a person carries out (the archive store, the stream and the retention of the archive are not generated); choosing this option takes that step. A requirement of more than 180 days inside STACKIT Logs with no external archive cannot be met by STACKIT Logs alone: it is stated by rejecting this option.","execution_effect":"MANUAL_ALTERNATIVE","evidence":[{"url":"https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-12","quote":"For long-term retention (e.g., 1 year or more), we recommend implementing a \"Cold Storage\" strategy. The Approach: Stream your log data to a low-cost long-term storage solution (such as a separate Object Storage bucket) in parallel to sending it to \"STACKIT Logs\"."}]}],"recommended_option":"set-retention-within-the-platform-range","blocking_effect":"TARGET_DESIGN_OPEN","causes":[{"cause":"TARGET_LIMIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"The plan of the draft lists the question \"Decide how logs are kept beyond 180 days\" as open (1 plan decision): a person decides it, and nothing the plan states about it is carried until it is decided.","required_evidence":["the source keeps its logs for ever and a STACKIT Logs instance keeps at most 180 days, so the instance drafted for it (stackit_logs_instance.logs_retention_180d) holds only the last 180 days; logs older than that exist only if a person configures an archive beside it. Choose the archive if the workload needs them; reject it if the requirement is that more than 180 days stay inside STACKIT Logs with no external archive, which STACKIT Logs alone cannot meet","the retention period, in days, the workload's logs need, and whether an archive outside STACKIT Logs is accepted for the period beyond 180 days"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:7098dc52d2c6183a8387b8e707e8001532ae3f4483e9dbd7a0e4f826acc8a0ff","artifact_sha256":"sha256:0fd1c4ea746073abd592bcc4489b34673f50fda951496c9a3f15f5009f1f4539","kb_dependencies_sha256":"sha256:8b541d850bc366f0bb88d4fa96b68a13df34bd549295919c5c1c9f0ee460fccd"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS","source_family":"stackitlogs","source_semantic":"retention_over_180_days","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"CUTOVER_PREREQUISITE","raw_semantic_status":"TARGET_DESIGN_OPEN","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":"set-retention-within-the-platform-range","guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[{"id":"set-retention-within-the-platform-range","title":"Keep the logs for the 180 days of the Logs instance only","prerequisites":[],"effects":["The Logs instance is applied as the draft writes it, with a retention of 180 days (the API accepts 1 to 180 days and the FAQ states that retention beyond 180 days is not supported). Logs older than 180 days are not kept by it and no archive is configured, so the retention the source keeps beyond 180 days is not carried. No step is added."],"risk":[],"evidence":["https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/logs/v1/logs.json#L164-L169","https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/"],"regeneration_required":false},{"id":"archive-longer-retention-elsewhere","title":"For the period beyond 180 days, also stream the logs to long-term storage","prerequisites":[],"effects":["The Logs instance keeps at most 180 days and is applied as the draft writes it. The FAQ recommends a cold-storage approach for longer periods: stream the log data in parallel to a long-term storage such as a separate Object Storage bucket. The plan holds a step for it that a person carries out (the archive store, the stream and the retention of the archive are not generated); choosing this option takes that step. A requirement of more than 180 days inside STACKIT Logs with no external archive cannot be met by STACKIT Logs alone: it is stated by rejecting this option."],"risk":[],"evidence":["https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/"],"regeneration_required":false}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":["https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/logs/v1/logs.json#L164-L169","https://docs.stackit.cloud/products/logging-and-monitoring/logs/faq/"],"state_reason":"a person's decision or input is still open","source_observation":"The plan leaves this decision open on module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks.","generated_target_behavior":"The draft holds MAN/logs/archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks until this decision is answered by an answer that frees it.","residual_difference":"the target design is open until the decision is answered","execution_effect":"1 step waits for it until it is answered: MAN/logs/archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks.","next_action":"Decide how logs are kept beyond 180 days for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: choose one of the 2 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["The plan of the draft lists the question \"Decide how logs are kept beyond 180 days\" as open (1 plan decision): a person decides it, and nothing the plan states about it is carried until it is decided."],"closes_when":["an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option"],"required_inputs":["the source keeps its logs for ever and a STACKIT Logs instance keeps at most 180 days, so the instance drafted for it (stackit_logs_instance.logs_retention_180d) holds only the last 180 days; logs older than that exist only if a person configures an archive beside it. Choose the archive if the workload needs them; reject it if the requirement is that more than 180 days stay inside STACKIT Logs with no external archive, which STACKIT Logs alone cannot meet","the retention period, in days, the workload's logs need, and whether an archive outside STACKIT Logs is accepted for the period beyond 180 days"]},"unblocks":{"holds":2,"stuck":1,"alone":1,"shared":0,"best_option":"archive-longer-retention-elsewhere","options":[{"option":"set-retention-within-the-platform-range","effects":["ACK_CURRENT_ARTIFACT"],"alone":0,"shared":0},{"option":"archive-longer-retention-elsewhere","effects":["MANUAL_ALTERNATIVE"],"alone":1,"shared":0}]}},{"id":"DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST","kind":"NAT_FIXED_EGRESS_ADDRESS_LOST","family":"stackitroute","source":"PLAN_DECISION","group":"GRP-PLAN-DECISION-stackitroute","block":"NAT_FIXED_EGRESS_ADDRESS_LOST","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"TECHNICAL_VALIDATION_PASSED","owner_role":"Network Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"options":[{"id":"accept-the-platform-egress-address","title":"Accept the address STACKIT assigns to the network for outbound traffic","effect":"Outbound traffic of servers without a public IP leaves through source NAT with the public IP STACKIT creates and assigns to the project's Virtual Networks, not with an address the owner chose. A destination allow-list that names the source's fixed NAT address does not match it.","execution_effect":"ACK_CURRENT_ARTIFACT","evidence":[{"url":"https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-12","quote":"Every subnet is routed to the public internet. Technically this is done by source NAT (SNAT) in combination with masquerading. When creating the first network in a public project, STACKIT automatically creates and assigns a public IP for all Virtual Networks. It supports outbound internet access but does not allow traffic initiated from the public internet to reach your resources."}]},{"id":"reserve-a-public-ip-per-server","title":"Give each server that an allow-list names a STACKIT public IP","effect":"A stackit_public_ip is reserved and associated with the network interface of each such server (network_interface_id of stackit_public_ip, or stackit_public_ip_associate). The pages read do not state which source address the outbound connections of such a server then use; confirm it on the target before relying on it.","execution_effect":"REGENERATE_REQUIRED","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.116.0/docs/resources/public_ip.md#L35","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-12","quote":"network_interface_id (String) Associates the public IP with a network interface or a virtual IP (ID)."},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.116.0/docs/resources/public_ip_associate.md#L13","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-12","quote":"Associates an existing public IP to a network interface. This is useful for situations where you have a pre-allocated public IP or unable to use the stackit_public_ip resource to create a new public IP."}]}],"recommended_option":null,"blocking_effect":"TARGET_DESIGN_OPEN","causes":[{"cause":"TARGET_LIMIT","members":1}],"blocker_class":"OPTIONAL_CONDITIONAL","why":"The plan of the draft lists the question \"Decide the outbound address of the servers an allow-list names\" as open (1 plan decision): a person decides it, and nothing the plan states about it is carried until it is decided.","required_evidence":["a NAT gateway's fixed egress address is lost on STACKIT: the address a routed network leaves by is the network's own, shared by every routed network of the project, not fixed and not settable","the servers whose outbound address a destination allow-list names, and the allow-lists that name it"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:cbfcbf1e12e98cb3608485caffc5de82e33e3517a0845fc9ca14cbcf7e207d0e","artifact_sha256":"sha256:37a4992d7cb1b57ebe73b1567f6fec7b6f2f3de527370a9ba50c9d2e600bccea","kb_dependencies_sha256":"sha256:b7b1559abec6cce3207e0a1fc245a3c875b27a798d1bb922309519ace4b7642c"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST","source_family":"stackitroute","source_semantic":"NAT_FIXED_EGRESS_ADDRESS_LOST","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"TARGET_DESIGN_OPEN","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[{"id":"accept-the-platform-egress-address","title":"Accept the address STACKIT assigns to the network for outbound traffic","prerequisites":[],"effects":["Outbound traffic of servers without a public IP leaves through source NAT with the public IP STACKIT creates and assigns to the project's Virtual Networks, not with an address the owner chose. A destination allow-list that names the source's fixed NAT address does not match it."],"risk":[],"evidence":["https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/"],"regeneration_required":false},{"id":"reserve-a-public-ip-per-server","title":"Give each server that an allow-list names a STACKIT public IP","prerequisites":[],"effects":["A stackit_public_ip is reserved and associated with the network interface of each such server (network_interface_id of stackit_public_ip, or stackit_public_ip_associate). The pages read do not state which source address the outbound connections of such a server then use; confirm it on the target before relying on it."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.116.0/docs/resources/public_ip.md#L35","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.116.0/docs/resources/public_ip_associate.md#L13"],"regeneration_required":true}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":["https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.116.0/docs/resources/public_ip.md#L35","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.116.0/docs/resources/public_ip_associate.md#L13"],"state_reason":"a person's decision or input is still open","source_observation":"The plan leaves this decision open on module.vpc.module.vpc.aws_route_table.private.","generated_target_behavior":"The draft holds DEC/routing/DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST until this decision is answered by an answer that frees it.","residual_difference":"the target design is open until the decision is answered","execution_effect":"1 step waits for it until it is answered: DEC/routing/DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST.","next_action":"Decide the outbound address of the servers an allow-list names for module.vpc.module.vpc.aws_route_table.private: choose one of the 2 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["The plan of the draft lists the question \"Decide the outbound address of the servers an allow-list names\" as open (1 plan decision): a person decides it, and nothing the plan states about it is carried until it is decided."],"closes_when":["the decision DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST is answered (accepted or rejected, with its evidence) in the inputs of the run and is no longer open when the run is repeated"],"required_inputs":["a NAT gateway's fixed egress address is lost on STACKIT: the address a routed network leaves by is the network's own, shared by every routed network of the project, not fixed and not settable","the servers whose outbound address a destination allow-list names, and the allow-lists that name it","the answer to the decision DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST"]},"unblocks":{"holds":8,"stuck":7,"alone":1,"shared":0,"best_option":"accept-the-platform-egress-address","options":[{"option":"accept-the-platform-egress-address","effects":["ACK_CURRENT_ARTIFACT"],"alone":1,"shared":0},{"option":"reserve-a-public-ip-per-server","effects":["REGENERATE_REQUIRED"],"alone":0,"shared":0}]}},{"id":"DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-CLOUDWATCH-LOG-GROUP-ECS-TASKS","kind":"unit-review","family":"aws.cloudwatch_log_group","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.cloudwatch_log_group","block":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:e71bb0607c0a5ebb2ed51336e2dafb83d87e2ea428ba9c2c59f10bff5d5552d6","kb_dependencies_sha256":"sha256:5774655a1d63aa238425b6099fc69a5a26fd5b9b39b1bcac21ee61ed7f554738"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-CLOUDWATCH-LOG-GROUP-ECS-TASKS","source_family":"aws.cloudwatch_log_group","source_semantic":"unit-review","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"observability-audit","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"tc-name/decide-and-carry-out","title":"Confirm the name of the log group: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.","regeneration: not stated — treated as required"],"risk":["The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes."],"evidence":["contract note aws.cloudwatch_log_group/tc-name: \"A person decides the label convention under which the log group name survives in STACKIT Logs and reconfigures each producer to send it; the draft configures no shipper.\""],"regeneration_required":true}],"required_verification":["Confirm the name of the log group: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Confirm the name of the log group: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.cloudwatch_log_group/tc-name: \"A person decides the label convention under which the log group name survives in STACKIT Logs and reconfigures each producer to send it; the draft configures no shipper.\""],"state_reason":"the guidance names a manual step as the only path","source_observation":"The source states 1 critical setting on module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks that the knowledge base cannot decide: Confirm the name of the log group.","generated_target_behavior":"Confirm the name of the log group: The draft does not carry the setting on module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks; a manual step stands for it (MAN/logs/label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Confirm the name of the log group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/logs/label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks now.","next_action":"Confirm the name of the log group: Carry out the manual work the plan names for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks outside the draft; the plan states no title for it.","why_open":["Confirm the name of the log group: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_cloudwatch_log_group.name is the address a log producer writes to (awslogs-group, PutLogEvents logGroupName). The name is therefore not carried by anything the draft generates, and no producer is rewired: a person decides the label convention and reconfigures each producer - REVIEW (the plan holds it as a label convention manual action). Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract)."],"closes_when":["Confirm the name of the log group: A person decides the label convention under which the log group name survives in STACKIT Logs and reconfigures each producer to send it; the draft configures no shipper."],"required_inputs":[]}},{"id":"DEC-DATA-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE","kind":"unit-review","family":"aws.dynamodb_table","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.dynamodb_table","block":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Data Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":3}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":3,"why":"The knowledge base cannot decide 3 critical settings of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-data-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:be230134eb933993e87d2acca45d6600aaef296e10ea3f5acfe1bc2868503c4c","kb_dependencies_sha256":"sha256:f253dc1a178fa55575e3271a5dc6885b281fd306dbc95942af5eaa8225297c89"},"member_count":3,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-DATA-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE","source_family":"aws.dynamodb_table","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Data Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"key-schema/decide-and-carry-out","title":"Review the key schema setting: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.","regeneration: not stated — treated as required"],"risk":["The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes."],"evidence":["contract note aws.dynamodb_table/key-schema: \"A person designs the keys and indexes of the replacement collection (partition and sort key, attribute names and types, secondary index keys), because the draft names only the key as the collection's unique index.\""],"regeneration_required":true}],"required_verification":["Review the key schema setting: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Review the key schema setting: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.dynamodb_table/key-schema: \"A person designs the keys and indexes of the replacement collection (partition and sort key, attribute names and types, secondary index keys), because the draft names only the key as the collection's unique index.\""],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the point in time recovery setting; the 3 settings of the record state their own.","source_observation":"The source states 3 critical settings on module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this that the knowledge base cannot decide: Review the key schema setting; Review the point in time recovery setting; Review the TTL setting.","generated_target_behavior":"Review the key schema setting: The draft does not carry the setting on module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; a manual step stands for it (MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-data-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the point in time recovery setting: The draft does not carry the setting on module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; a manual step stands for it (MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-data-architect). Review the TTL setting: The draft does not carry the setting on module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; a manual step stands for it (MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-data-architect).","residual_difference":"Review the key schema setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the point in time recovery setting: the target behaviour of this setting is not established Review the TTL setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-data-architect now.","next_action":"Review the point in time recovery setting: Review the point in time recovery setting for module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the key schema setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The draft names the partition/sort key as the collection's unique index; the data model is rewritten by people.","Review the point in time recovery setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. MongoDB Flex has a point-in-time window in hours (options.point_in_time_window_hours); its maximum is not documented in the provider schema. The draft carries no value for it.","Review the TTL setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. DynamoDB TTL reads epoch seconds; a MongoDB TTL index expires only BSON dates, so the attribute changes type. The time-to-live check still fires only for enabled = true; the case handler REVIEW covers the other states."],"closes_when":["Review the key schema setting: A person designs the keys and indexes of the replacement collection (partition and sort key, attribute names and types, secondary index keys), because the draft names only the key as the collection's unique index.","Review the point in time recovery setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Review the TTL setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":[]}},{"id":"DEC-OPS-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE","kind":"unit-review","family":"aws.dynamodb_table","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.dynamodb_table","block":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":2}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":2,"why":"The knowledge base cannot decide 2 critical settings of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-platform-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:376e1fb33723b9c06d87ddd508b5b8413291ae6a06d048c7410dbf9c03e42876","kb_dependencies_sha256":"sha256:bc69719ca67a8a6cb0a7dbb03987ea3abd9d872b00f99be4b5c8a2db76828a44"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE","source_family":"aws.dynamodb_table","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"tc-dynamodb-table-name/verify-on-target","title":"Confirm the name of the DynamoDB table: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.dynamodb_table/tc-dynamodb-table-name: \"A person confirms the name the replacement collection carries on the target against what refers to the source name, or accepts the new name.\""],"regeneration_required":true}],"required_verification":["Confirm the name of the DynamoDB table: the check, proof or closing evidence is recorded with its result"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Confirm the name of the DynamoDB table: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.dynamodb_table/tc-dynamodb-table-name: \"A person confirms the name the replacement collection carries on the target against what refers to the source name, or accepts the new name.\""],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the index projection and name setting; the 2 settings of the record state their own.","source_observation":"The source states 2 critical settings on module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this that the knowledge base cannot decide: Review the index projection and name setting; Confirm the name of the DynamoDB table.","generated_target_behavior":"Review the index projection and name setting: The draft does not carry the setting on module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; a manual step stands for it (MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-platform-architect). Confirm the name of the DynamoDB table: The draft does not carry the setting on module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; a manual step stands for it (MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-platform-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Review the index projection and name setting: the target behaviour of this setting is not established Confirm the name of the DynamoDB table: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/open-settings-platform-architect now.","next_action":"Review the index projection and name setting: Review the index projection and name setting for module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the index projection and name setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The projection of a secondary index (keys only, INCLUDE with its non_key_attributes, ALL) decides which attributes an index query can return, and the index name is what every Query / Scan on the index selects it by (API Query IndexName). STACKIT has no provider resource for an index (pinned provider), a person re-creates the indexes and the queries that name them in the chosen engine — REVIEW.","Confirm the name of the DynamoDB table: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_dynamodb_table.name: Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). No semantic of this family has verified it as carried."],"closes_when":["Review the index projection and name setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Confirm the name of the DynamoDB table: A person confirms the name the replacement collection carries on the target against what refers to the source name, or accepts the new name."],"required_inputs":[]}},{"id":"DEC-SEC-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE","kind":"unit-review","family":"aws.dynamodb_table","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.dynamodb_table","block":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:d1f3a830429052e0e3744c4e3ab5b71cad9aa7b33241a35e16b57107591f512f","kb_dependencies_sha256":"sha256:6c34d3ca5f92fe1a1fe2ecbb48b9debfdfa82ea1d7512faa7ab7dd98db1e5a09"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-MODULE-DEPENDENCIES-MODULE-DYNAMODB-CARTS-AWS-DYNAMODB-2133F4BE","source_family":"aws.dynamodb_table","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this that the knowledge base cannot decide: Review the encryption at rest setting.","generated_target_behavior":"Review the encryption at rest setting: The draft does not carry the setting on module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this; a manual step stands for it (MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/encryption-at-rest).","residual_difference":"Review the encryption at rest setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/encryption-at-rest now.","next_action":"Review the encryption at rest setting: Review the encryption at rest setting for module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the encryption at rest setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. It is not stated in stackit_mongodbflex_instance (no encryption attribute) whether STACKIT MongoDB Flex encrypts data at rest: REVIEW (the customer managed key setting reads the key)."],"closes_when":["Review the encryption at rest setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":[]}},{"id":"DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"NOT_STATED","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-d1747e2970d4","subject":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:5049a4a2c775c1575d3ddd82422180bceb433bf018864e226e722dd02283029d","kb_dependencies_sha256":"sha256:2031816290b03c34a1327dd99d3e9e227ccb2fe1ffb7feaa61aca6b9e8fff8c6"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"NOT_STATED","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":4}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"shape":"RSH-af9a9d94158f","subject":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:7c029bf6912dd7e466ba3f83acb8125e103ae34e47e23de3a15e3579e13c7302","kb_dependencies_sha256":"sha256:676b8b28401694687638cbbe531ff19b2eed79c7bdf2c909c4f3be26384e5d3d"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"IMPLEMENTATION_GAP","members":3},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":5,"shape":"RSH-3eba2dbd3b71","subject":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:2884efd954f2c3166b542350df1a4b1da31abe480928a9ae49c5b5ec6e816f03","kb_dependencies_sha256":"sha256:740b2adc13bea6b71c5b1d64e72ccad5fc1c818dc112516074cfe17a9241851e"},"member_count":5,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-2e098a2b1756","subject":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:ad056df0eb4026158ba41d1e9bd51c3acb82966bbafea534e35a1c48bcc88e3c","kb_dependencies_sha256":"sha256:0e2ad9ffa4b2f512b402a8d8839b056708aeffe471d723e5fd310d331771f3f2"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1},{"cause":"DEPENDS_ON_UNIT","members":3}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.carts_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:8fc8c7f0b478f96951ae2ef830884975f85854c85e40dc0f90397cfd96fe7297","kb_dependencies_sha256":"sha256:af385e730e68e0815b00c9b5c09f6faad30b0026deb1d73a8c37c815dbb11f5c"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm the container definitions of the ECS task definition; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on module.retail_app_ecs.module.carts_service.aws_ecs_service.this that the knowledge base cannot decide: Confirm the container definitions of the ECS task definition; Confirm the container image registry; Confirm the container plaintext secret env; Confirm the container secret references.","generated_target_behavior":"Confirm the container definitions of the ECS task definition: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect). Confirm the container image registry: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect). Confirm the container plaintext secret env: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect). Confirm the container secret references: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect).","residual_difference":"Confirm the container definitions of the ECS task definition: the target behaviour of this setting is not established Confirm the container image registry: the target behaviour of this setting is not established Confirm the container plaintext secret env: the target behaviour of this setting is not established Confirm the container secret references: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.carts_service.aws_ecs_service.this/open-settings-security-architect now.","next_action":"Confirm the container definitions of the ECS task definition: Confirm the container definitions of the ECS task definition for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Confirm the container definitions of the ECS task definition: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.container_definitions of the unit that runs the task. The containers of the task: images, commands, environment, secret references, ports, health checks, log configuration - the workload itself, and where its credentials are injected. Decide per container: the image and where it lives, command and entry point, environment, ports and health check, cpu/memory as requests and limits, and the log destination; the secret references and the plaintext secrets among the environment entries are read by the settings of the secret references and of the plaintext secrets, the registry by the setting of the image registry. The unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) through this setting (the target does not carry it: it is REDESIGN), so what the reference becomes is part of this setting.","Confirm the container image registry: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A container image comes from Amazon ECR (a `.dkr.ecr.` or public.ecr.aws registry host) or needs `repositoryCredentials`. The images are not moved by the draft and a pod on STACKIT cannot assume the ECR pull rights of the ECS execution role. Decide: where the images live on STACKIT (the STACKIT Container Registry has a GA API, the Container Registry API specification, but no Terraform resource in pinned provider; a registry of your choice works too), how they are copied, and the pull secret the cluster uses.","Confirm the container plaintext secret env: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An `environment` entry whose NAME looks like a credential (password, secret, token, api key, private key, credential) carries a non-empty plaintext value in the task definition (a name heuristic, not a proof: the value is never shown). Decide: whether the value is a secret; if it is, it must not be copied into a Kubernetes manifest or a Terraform variable default but stored in a STACKIT Secrets Manager entry and the plaintext copy in the AWS state and task definition rotated.","Confirm the container secret references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition's container_definitions state secret references (the `secrets` list: name and valueFrom, \"the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store\", AWS ECS API reference, Secret). A person decides first which STACKIT Secrets Manager instance holds each referenced secret (stackit_secretsmanager_instance, pinned provider: name, acls, kms_key; the secret entries themselves have no Terraform resource in the pinned provider, they are created through the API or the portal, and their VALUES are never in the Terraform sources - a person copies them). Second, a person decides how the pods read them (the STACKIT Secrets Manager authenticates with Vault-compatible tokens and AppRole, docs.stackit.cloud/products/security/secrets-manager/; ECS injects valueFrom into environment variables when the container starts, and no STACKIT equivalent of that injection is stated on the documentation page checked 2026-10-06, so the Kubernetes Secret or the in-pod fetch is a design of its own)."],"closes_when":["Confirm the container definitions of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Confirm the container image registry: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Confirm the container plaintext secret env: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Confirm the container secret references: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":[]}},{"id":"DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"NOT_STATED","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-d1747e2970d4","subject":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:bd5bc5f42f2ccdd48a73d45fd65cc7d9a1889bd33e8ed34e32675b48cd9d43a6","kb_dependencies_sha256":"sha256:2031816290b03c34a1327dd99d3e9e227ccb2fe1ffb7feaa61aca6b9e8fff8c6"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"NOT_STATED","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":4}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"shape":"RSH-af9a9d94158f","subject":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:269c883e5118d2289881d64bad4bc6c1a8026b09e6b86d27706930ba115e503d","kb_dependencies_sha256":"sha256:676b8b28401694687638cbbe531ff19b2eed79c7bdf2c909c4f3be26384e5d3d"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"IMPLEMENTATION_GAP","members":3},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":5,"shape":"RSH-3eba2dbd3b71","subject":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:a7b1d712f11c89a96ee56918ef329084ce43708b20a3f11098a99baba0b9f33c","kb_dependencies_sha256":"sha256:740b2adc13bea6b71c5b1d64e72ccad5fc1c818dc112516074cfe17a9241851e"},"member_count":5,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-2e098a2b1756","subject":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:73e2e43b1b9a4861741108c4c531cf9c63a53c75ee5e01b4b73dff8acf27e7f2","kb_dependencies_sha256":"sha256:0e2ad9ffa4b2f512b402a8d8839b056708aeffe471d723e5fd310d331771f3f2"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1},{"cause":"DEPENDS_ON_UNIT","members":3}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:12a0c54a0723669691b414ab9cfc18d1b7c1a075bd4a331607a44ac5ce805152","kb_dependencies_sha256":"sha256:af385e730e68e0815b00c9b5c09f6faad30b0026deb1d73a8c37c815dbb11f5c"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm the container definitions of the ECS task definition; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on module.retail_app_ecs.module.catalog_service.aws_ecs_service.this that the knowledge base cannot decide: Confirm the container definitions of the ECS task definition; Confirm the container image registry; Confirm the container plaintext secret env; Confirm the container secret references.","generated_target_behavior":"Confirm the container definitions of the ECS task definition: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect). Confirm the container image registry: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect). Confirm the container plaintext secret env: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect). Confirm the container secret references: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect).","residual_difference":"Confirm the container definitions of the ECS task definition: the target behaviour of this setting is not established Confirm the container image registry: the target behaviour of this setting is not established Confirm the container plaintext secret env: the target behaviour of this setting is not established Confirm the container secret references: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this/open-settings-security-architect now.","next_action":"Confirm the container definitions of the ECS task definition: Confirm the container definitions of the ECS task definition for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Confirm the container definitions of the ECS task definition: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.container_definitions of the unit that runs the task. The containers of the task: images, commands, environment, secret references, ports, health checks, log configuration - the workload itself, and where its credentials are injected. Decide per container: the image and where it lives, command and entry point, environment, ports and health check, cpu/memory as requests and limits, and the log destination; the secret references and the plaintext secrets among the environment entries are read by the settings of the secret references and of the plaintext secrets, the registry by the setting of the image registry. The unit names 2 resources through this setting whose references the draft does not resolve: module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db (aws_secretsmanager_secret_version), module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_opensearch (aws_secretsmanager_secret_version). What each reference becomes is part of this setting.","Confirm the container image registry: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A container image comes from Amazon ECR (a `.dkr.ecr.` or public.ecr.aws registry host) or needs `repositoryCredentials`. The images are not moved by the draft and a pod on STACKIT cannot assume the ECR pull rights of the ECS execution role. Decide: where the images live on STACKIT (the STACKIT Container Registry has a GA API, the Container Registry API specification, but no Terraform resource in pinned provider; a registry of your choice works too), how they are copied, and the pull secret the cluster uses.","Confirm the container plaintext secret env: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An `environment` entry whose NAME looks like a credential (password, secret, token, api key, private key, credential) carries a non-empty plaintext value in the task definition (a name heuristic, not a proof: the value is never shown). Decide: whether the value is a secret; if it is, it must not be copied into a Kubernetes manifest or a Terraform variable default but stored in a STACKIT Secrets Manager entry and the plaintext copy in the AWS state and task definition rotated.","Confirm the container secret references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition's container_definitions state secret references (the `secrets` list: name and valueFrom, \"the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store\", AWS ECS API reference, Secret). A person decides first which STACKIT Secrets Manager instance holds each referenced secret (stackit_secretsmanager_instance, pinned provider: name, acls, kms_key; the secret entries themselves have no Terraform resource in the pinned provider, they are created through the API or the portal, and their VALUES are never in the Terraform sources - a person copies them). Second, a person decides how the pods read them (the STACKIT Secrets Manager authenticates with Vault-compatible tokens and AppRole, docs.stackit.cloud/products/security/secrets-manager/; ECS injects valueFrom into environment variables when the container starts, and no STACKIT equivalent of that injection is stated on the documentation page checked 2026-10-06, so the Kubernetes Secret or the in-pod fetch is a design of its own)."],"closes_when":["Confirm the container definitions of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Confirm the container image registry: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Confirm the container plaintext secret env: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Confirm the container secret references: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":[]}},{"id":"DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"NOT_STATED","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-d1747e2970d4","subject":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:623898041d449cd3e3c2d56f8809be431447e9c525cd8532005e86be1b16a734","kb_dependencies_sha256":"sha256:2031816290b03c34a1327dd99d3e9e227ccb2fe1ffb7feaa61aca6b9e8fff8c6"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"NOT_STATED","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":4}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"shape":"RSH-af9a9d94158f","subject":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:b6de1150e6debd14d0a9aa3604ac089dfcfeba7948cdbead286de7bd9595abde","kb_dependencies_sha256":"sha256:676b8b28401694687638cbbe531ff19b2eed79c7bdf2c909c4f3be26384e5d3d"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"IMPLEMENTATION_GAP","members":3},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":5,"shape":"RSH-3eba2dbd3b71","subject":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:182803b416e449e90a1a14eb9db44d8d5c0bef7a7f4e34722f4e90a13b95e587","kb_dependencies_sha256":"sha256:740b2adc13bea6b71c5b1d64e72ccad5fc1c818dc112516074cfe17a9241851e"},"member_count":5,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-2e098a2b1756","subject":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:2a81745ad63beb643a056962323f1bed54efeeb2e2761acae2698f863e5ffbb2","kb_dependencies_sha256":"sha256:0e2ad9ffa4b2f512b402a8d8839b056708aeffe471d723e5fd310d331771f3f2"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1},{"cause":"DEPENDS_ON_UNIT","members":3}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"shape":"RSH-b814595ae65d","subject":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:e14fe5e69f14c70daaa5e1cb8fb1b01b17f0cf1b730d6634665513ae538a7be6","kb_dependencies_sha256":"sha256:af385e730e68e0815b00c9b5c09f6faad30b0026deb1d73a8c37c815dbb11f5c"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"NOT_STATED","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-d1747e2970d4","subject":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:c0df273c3ce35360ad2de7275bf8232309dfe3548560c2d2bf71e5f5209e4108","kb_dependencies_sha256":"sha256:2031816290b03c34a1327dd99d3e9e227ccb2fe1ffb7feaa61aca6b9e8fff8c6"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"NOT_STATED","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":4}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"shape":"RSH-af9a9d94158f","subject":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:9355891040e968a2302882459fd2e541f14ac72d084e886cfe7bd6401c5668d1","kb_dependencies_sha256":"sha256:676b8b28401694687638cbbe531ff19b2eed79c7bdf2c909c4f3be26384e5d3d"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"IMPLEMENTATION_GAP","members":3},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":5,"shape":"RSH-3eba2dbd3b71","subject":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:c3fbe4584e6bfa97ed29b1ba37ed5b2284ee1bf2f21e5df2d762845bfcc9bcce","kb_dependencies_sha256":"sha256:740b2adc13bea6b71c5b1d64e72ccad5fc1c818dc112516074cfe17a9241851e"},"member_count":5,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-2e098a2b1756","subject":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:a99af72e26244afeba9183b468016c2f97d481f9ef9e344f8b0cd66bc4f96e85","kb_dependencies_sha256":"sha256:0e2ad9ffa4b2f512b402a8d8839b056708aeffe471d723e5fd310d331771f3f2"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1},{"cause":"DEPENDS_ON_UNIT","members":3}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.orders_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:be34e739bc39a8d7f9a75ec54e4a06207f7b84000f5f784e735bcc8fac34a2be","kb_dependencies_sha256":"sha256:af385e730e68e0815b00c9b5c09f6faad30b0026deb1d73a8c37c815dbb11f5c"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm the container definitions of the ECS task definition; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on module.retail_app_ecs.module.orders_service.aws_ecs_service.this that the knowledge base cannot decide: Confirm the container definitions of the ECS task definition; Confirm the container image registry; Confirm the container plaintext secret env; Confirm the container secret references.","generated_target_behavior":"Confirm the container definitions of the ECS task definition: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect). Confirm the container image registry: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect). Confirm the container plaintext secret env: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect). Confirm the container secret references: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect).","residual_difference":"Confirm the container definitions of the ECS task definition: the target behaviour of this setting is not established Confirm the container image registry: the target behaviour of this setting is not established Confirm the container plaintext secret env: the target behaviour of this setting is not established Confirm the container secret references: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.orders_service.aws_ecs_service.this/open-settings-security-architect now.","next_action":"Confirm the container definitions of the ECS task definition: Confirm the container definitions of the ECS task definition for module.retail_app_ecs.module.orders_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Confirm the container definitions of the ECS task definition: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.container_definitions of the unit that runs the task. The containers of the task: images, commands, environment, secret references, ports, health checks, log configuration - the workload itself, and where its credentials are injected. Decide per container: the image and where it lives, command and entry point, environment, ports and health check, cpu/memory as requests and limits, and the log destination; the secret references and the plaintext secrets among the environment entries are read by the settings of the secret references and of the plaintext secrets, the registry by the setting of the image registry. The unit names 2 resources through this setting whose references the draft does not resolve: module.retail_app_ecs.aws_secretsmanager_secret_version.mq (aws_secretsmanager_secret_version), module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db (aws_secretsmanager_secret_version). What each reference becomes is part of this setting.","Confirm the container image registry: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A container image comes from Amazon ECR (a `.dkr.ecr.` or public.ecr.aws registry host) or needs `repositoryCredentials`. The images are not moved by the draft and a pod on STACKIT cannot assume the ECR pull rights of the ECS execution role. Decide: where the images live on STACKIT (the STACKIT Container Registry has a GA API, the Container Registry API specification, but no Terraform resource in pinned provider; a registry of your choice works too), how they are copied, and the pull secret the cluster uses.","Confirm the container plaintext secret env: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An `environment` entry whose NAME looks like a credential (password, secret, token, api key, private key, credential) carries a non-empty plaintext value in the task definition (a name heuristic, not a proof: the value is never shown). Decide: whether the value is a secret; if it is, it must not be copied into a Kubernetes manifest or a Terraform variable default but stored in a STACKIT Secrets Manager entry and the plaintext copy in the AWS state and task definition rotated.","Confirm the container secret references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The task definition's container_definitions state secret references (the `secrets` list: name and valueFrom, \"the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store\", AWS ECS API reference, Secret). A person decides first which STACKIT Secrets Manager instance holds each referenced secret (stackit_secretsmanager_instance, pinned provider: name, acls, kms_key; the secret entries themselves have no Terraform resource in the pinned provider, they are created through the API or the portal, and their VALUES are never in the Terraform sources - a person copies them). Second, a person decides how the pods read them (the STACKIT Secrets Manager authenticates with Vault-compatible tokens and AppRole, docs.stackit.cloud/products/security/secrets-manager/; ECS injects valueFrom into environment variables when the container starts, and no STACKIT equivalent of that injection is stated on the documentation page checked 2026-10-06, so the Kubernetes Secret or the in-pod fetch is a design of its own)."],"closes_when":["Confirm the container definitions of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Confirm the container image registry: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Confirm the container plaintext secret env: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Confirm the container secret references: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":[]}},{"id":"DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"NOT_STATED","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-d1747e2970d4","subject":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:cd84cdba0aa722b0700f256589172631f462ab3a79939d8703d4dcf136e51830","kb_dependencies_sha256":"sha256:2031816290b03c34a1327dd99d3e9e227ccb2fe1ffb7feaa61aca6b9e8fff8c6"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-GEN-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"NOT_STATED","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":4}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"shape":"RSH-af9a9d94158f","subject":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:13b648f793c6330d876e75b4a9e7de9a954b1465c6fd5e915538b738c05650ba","kb_dependencies_sha256":"sha256:676b8b28401694687638cbbe531ff19b2eed79c7bdf2c909c4f3be26384e5d3d"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"IMPLEMENTATION_GAP","members":3},{"cause":"DEPENDS_ON_UNIT","members":1},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":6,"why":"The knowledge base cannot decide 6 critical settings of module.retail_app_ecs.module.ui_service.aws_ecs_service.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:a803971360a7c14f2d1f59ef457345625b6b24b4ab02a4c951935921fa6b197c","kb_dependencies_sha256":"sha256:e7d39dd26d25e95decbc7941cd521cd27187f04056ac8fbb3d6a588d2780ea49"},"member_count":6,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the service connect values setting; the 6 settings of the record state their own.","source_observation":"The source states 6 critical settings on module.retail_app_ecs.module.ui_service.aws_ecs_service.this that the knowledge base cannot decide: Review the service connect values setting; Review the service discovery setting; Review the service load balancer target setting; Review the service network placement setting; Review the service public IP setting setting; Confirm the network mode of the ECS task definition.","generated_target_behavior":"Review the service connect values setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect). Review the service discovery setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect). Review the service load balancer target setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect). Review the service network placement setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect). Review the service public IP setting setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect). Confirm the network mode of the ECS task definition: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_ecs_service.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect).","residual_difference":"Review the service connect values setting: the target behaviour of this setting is not established Review the service discovery setting: the target behaviour of this setting is not established Review the service load balancer target setting: the target behaviour of this setting is not established Review the service network placement setting: the target behaviour of this setting is not established Review the service public IP setting setting: the target behaviour of this setting is not established Confirm the network mode of the ECS task definition: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.ui_service.aws_ecs_service.this/open-settings-network-architect now.","next_action":"Review the service connect values setting: Review the service connect values setting for module.retail_app_ecs.module.ui_service.aws_ecs_service.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the service connect values setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Service Connect's switch, namespace, service names, client aliases (DNS name and port), traffic-test header rules, mTLS settings (KMS key, role, private CA) and proxy logging: an AWS-managed service mesh with no draft counterpart; discovery on SKE is Kubernetes Services and DNS, mesh features a person's choice.","Review the service discovery setting: A check of the knowledge base (ecs service discovery) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states how ECS services find each other: AWS Cloud Map registries and namespaces, or ECS Service Connect.","Review the service load balancer target setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states which container and port receive the load balancer's traffic, the target group or classic load balancer name, and the blue/green listener rules and role: the wiring becomes a Kubernetes Service / Ingress selector and a STACKIT load balancer target pool, written by a person (the draft has no service block to carry it).","Review the service network placement setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The subnets and security groups the tasks' network interfaces use (awsvpc mode); on SKE pods take the cluster's network and NetworkPolicies decide reachability — a person re-expresses the security group rules.","Review the service public IP setting setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. assign_public_ip in either state (the public ip setting reads only true through the public address check): tasks with a public address are exposed unless a person decides the exposure on SKE explicitly (LoadBalancer services, network policies); false is the private default and is still re-checked, the draft carries no service block.","Confirm the network mode of the ECS task definition: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. ecs_task_definition.network_mode of the template the group builds its instances from: How the containers are networked (awsvpc, bridge, host, none): whether each task has its own interface and security groups or shares the host's network. Not verified as carried by any semantic of this family — reviewed."],"closes_when":["Review the service connect values setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Review the service discovery setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person replaces the lookups with Kubernetes Services and cluster DNS on SKE.","Review the service load balancer target setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Review the service network placement setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Review the service public IP setting setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Confirm the network mode of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":[]}},{"id":"DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-2e098a2b1756","subject":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:892d8be364574bea145cb905c22d892bdcf013b62b24306a5e72cfd27f92bb59","kb_dependencies_sha256":"sha256:0e2ad9ffa4b2f512b402a8d8839b056708aeffe471d723e5fd310d331771f3f2"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","kind":"unit-review","family":"aws.ecs","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.ecs","block":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1},{"cause":"DEPENDS_ON_UNIT","members":3}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"shape":"RSH-b814595ae65d","subject":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:e4bca6f80507db70550fa30296dcb1663d180045b12ab84aef82f90af4d4591f","kb_dependencies_sha256":"sha256:af385e730e68e0815b00c9b5c09f6faad30b0026deb1d73a8c37c815dbb11f5c"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","source_family":"aws.ecs","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-EIP-NAT","kind":"unit-review","family":"aws.eip","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.eip","block":"module.vpc.module.vpc.aws_eip.nat","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"TARGET_LIMIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of module.vpc.module.vpc.aws_eip.nat: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:8d53b9492e347facc4402eb7bb6e29a11778a63c708b92d5e683cc85fb10dcd9","kb_dependencies_sha256":"sha256:4bc458f7128cf963a901fb482f5f02839c79dbf8761eb465d1d4257468472a2f"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-EIP-NAT","source_family":"aws.eip","source_semantic":"unit-review","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"private-egress-dns","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"public-address/decide-and-carry-out","title":"Review the public address setting: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.","regeneration: not stated — treated as required"],"risk":["The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes."],"evidence":["contract note aws.eip/public-address: \"A person decides how peers that allow-list the Elastic IP are served: STACKIT egress uses the project's shared address, which differs from the Elastic IP, cannot be set and can change; a STACKIT public IP per server keeps its address.\""],"regeneration_required":true}],"required_verification":["Review the public address setting: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Review the public address setting: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.eip/public-address: \"A person decides how peers that allow-list the Elastic IP are served: STACKIT egress uses the project's shared address, which differs from the Elastic IP, cannot be set and can change; a STACKIT public IP per server keeps its address.\""],"state_reason":"the guidance names a manual step as the only path","source_observation":"The source states 1 critical setting on module.vpc.module.vpc.aws_eip.nat that the knowledge base cannot decide: Review the public address setting.","generated_target_behavior":"Review the public address setting: The draft does not carry the setting on module.vpc.module.vpc.aws_eip.nat; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_eip.nat/public-address). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Review the public address setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.vpc.module.vpc.aws_eip.nat/public-address now.","next_action":"Review the public address setting: Carry out the manual work the plan names for module.vpc.module.vpc.aws_eip.nat outside the draft; the plan states no title for it.","why_open":["Review the public address setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The address changes. An Elastic IP of a NAT gateway is its fixed egress address, an open question on STACKIT (fixed egress ip of the NAT gateway rule)."],"closes_when":["Review the public address setting: A person decides how peers that allow-list the Elastic IP are served: STACKIT egress uses the project's shared address, which differs from the Elastic IP, cannot be set and can change; a STACKIT public IP per server keeps its address."],"required_inputs":[]}},{"id":"DEC-DATA-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374","kind":"unit-review","family":"aws.elasticache","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.elasticache","block":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Data Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"NOT_CLASSIFIED","members":2}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":2,"why":"The knowledge base cannot decide 2 critical settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-data-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:a81099a7a19d0a70e93099ba046b0f6ffe0b067d5d7d330a726223a11b4a8a71","kb_dependencies_sha256":"sha256:1ee3357c1d90f2bef2277d76647a933f82410caff1d0177f1f0e28eaee2ee43a"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-DATA-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374","source_family":"aws.elasticache","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Data Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the seed snapshot setting; the 2 settings of the record state their own.","source_observation":"The source states 2 critical settings on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default that the knowledge base cannot decide: Review the seed snapshot setting; Review the snapshots off setting.","generated_target_behavior":"Review the seed snapshot setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-data-architect). Review the snapshots off setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-data-architect).","residual_difference":"Review the seed snapshot setting: the target behaviour of this setting is not established Review the snapshots off setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-data-architect now.","next_action":"Review the seed snapshot setting: Review the seed snapshot setting for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the seed snapshot setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The instance is created empty: the data is migrated by a person (RDB export and import, or replication); stackit_valkey_instance and stackit_redis_instance have no snapshot or restore attribute (pinned provider). snapshot_arns is observed for every set value, an empty list included: the draft names snapshot_arns NOT CARRIED even when it is empty; a conditional with a null branch stays undecided, hence REVIEW.","Review the snapshots off setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. No snapshots in the source; whether a STACKIT Valkey instance takes snapshots by default (parameters.snapshot, not generated) is not documented — REVIEW."],"closes_when":["Review the seed snapshot setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Review the snapshots off setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":[]}},{"id":"DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374","kind":"unit-review","family":"aws.elasticache","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.elasticache","block":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:6a0885338cdc784fa0469bff7f3e328048bdf0779f8fe6695463e4f84db89ece","kb_dependencies_sha256":"sha256:d1f381c53c8452030abb8fadded9bf0c6eb8d656d37128d0d538bd6b4f33a8dc"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374","source_family":"aws.elasticache","source_semantic":"unit-review","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"managed-data-services","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"network-placement/decide-and-carry-out","title":"Review the network placement setting: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.","regeneration: not stated — treated as required"],"risk":["The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes."],"evidence":["contract note aws.elasticache/auth-token-rotation: \"A person decides the rotation strategy for the access credential on the target, where a rotated credential is a new Valkey credential.\""],"regeneration_required":true}],"required_verification":["Review the network placement setting: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Review the network placement setting: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.elasticache/auth-token-rotation: \"A person decides the rotation strategy for the access credential on the target, where a rotated credential is a new Valkey credential.\"","contract note aws.elasticache/customer-managed-key: \"A person decides whether encryption without a customer-managed key is acceptable for this cache: stackit_valkey_instance takes no customer key.\"","contract note aws.elasticache/failover-replicas: \"A person chooses a replica service plan for the Key Value Store: replica plans run across availability zones with automatic recovery, single-node plans do not.\"","contract note aws.elasticache/network-placement: \"A person decides how clients reach the Valkey instance, which has no subnet or security-group setting, for example by limiting client CIDR ranges with its access parameter.\"","contract note aws.elasticache/parameter-group: \"A person maps each parameter the group changes to the parameters of the Valkey instance (for example the memory policy and the keyspace notifications) and sets them there.\""],"state_reason":"the guidance names a manual step as the only path","source_observation":"The source states 1 critical setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default that the knowledge base cannot decide: Review the network placement setting.","generated_target_behavior":"Review the network placement setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/network-placement). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Review the network placement setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/network-placement now.","next_action":"Review the network placement setting: Carry out the manual work the plan names for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default outside the draft; the plan states no title for it.","why_open":["Review the network placement setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_valkey_instance has no subnet, security-group, zone or IP-family attribute; client access can be limited by CIDR with parameters.sgw_acl, which the draft does not generate — a person decides it."],"closes_when":["Review the network placement setting: A person decides how clients reach the Valkey instance, which has no subnet or security-group setting, for example by limiting client CIDR ranges with its access parameter."],"required_inputs":[]}},{"id":"DEC-OPS-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374","kind":"unit-review","family":"aws.elasticache","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.elasticache","block":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"IMPLEMENTATION_GAP","members":1},{"cause":"DEPENDS_ON_UNIT","members":2}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:22903c56db5911aeb017374334c4c459471b44cc52549e1be5fc3e282b7f0382","kb_dependencies_sha256":"sha256:5d0001ac4c605ad621214b69352a2f2bad9716a15d2f911df0e9d0cdcedea51b"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374","source_family":"aws.elasticache","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"parameter-group/decide-and-carry-out","title":"Review the parameter group setting: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.","regeneration: not stated — treated as required"],"risk":["The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes."],"evidence":["contract note aws.elasticache/auth-token-rotation: \"A person decides the rotation strategy for the access credential on the target, where a rotated credential is a new Valkey credential.\""],"regeneration_required":true},{"id":"parameter-group-default/verify-on-target","title":"Review the parameter group default setting: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.elasticache/at-rest-encryption: \"A person confirms the encryption at rest of the Key Value Store plan on the target; the instance has no encryption setting that could carry the value (pinned provider), and no STACKIT fact about it is documented here.\""],"regeneration_required":true},{"id":"tc-elasticache-replication-group-replication-group-id/verify-on-target","title":"Confirm the replication group ID of the ElastiCache replication group: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.elasticache/at-rest-encryption: \"A person confirms the encryption at rest of the Key Value Store plan on the target; the instance has no encryption setting that could carry the value (pinned provider), and no STACKIT fact about it is documented here.\""],"regeneration_required":true}],"required_verification":["Review the parameter group setting: the decision or the manual work is done and recorded (who, when, what was configured and why)","Review the parameter group default setting: the check, proof or closing evidence is recorded with its result","Confirm the replication group ID of the ElastiCache replication group: the check, proof or closing evidence is recorded with its result"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Review the parameter group setting: Manual work remains: a person closes the semantic, the draft does not.","Review the parameter group default setting: Manual work remains: a person closes the semantic, the draft does not.","Confirm the replication group ID of the ElastiCache replication group: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.elasticache/auth-token-rotation: \"A person decides the rotation strategy for the access credential on the target, where a rotated credential is a new Valkey credential.\"","contract note aws.elasticache/customer-managed-key: \"A person decides whether encryption without a customer-managed key is acceptable for this cache: stackit_valkey_instance takes no customer key.\"","contract note aws.elasticache/failover-replicas: \"A person chooses a replica service plan for the Key Value Store: replica plans run across availability zones with automatic recovery, single-node plans do not.\"","contract note aws.elasticache/network-placement: \"A person decides how clients reach the Valkey instance, which has no subnet or security-group setting, for example by limiting client CIDR ranges with its access parameter.\"","contract note aws.elasticache/parameter-group: \"A person maps each parameter the group changes to the parameters of the Valkey instance (for example the memory policy and the keyspace notifications) and sets them there.\"","contract note aws.elasticache/at-rest-encryption: \"A person confirms the encryption at rest of the Key Value Store plan on the target; the instance has no encryption setting that could carry the value (pinned provider), and no STACKIT fact about it is documented here.\"","contract note aws.elasticache/parameter-group-default: \"A person confirms that the defaults of the source parameter group family are what the application needs on the target and, for a cluster-mode group, treats it as the cluster-mode question.\"","contract note aws.elasticache/tc-elasticache-replication-group-replication-group-id: \"A person confirms the instance name the target uses against what refers to the replication group id, or accepts the new name.\"","contract note aws.elasticache/tcp-elasticache-replication-group-at-rest-encryption-enabled: \"A person confirms that the cache data and snapshots are encrypted at rest on the target, as the source setting requires.\"","contract note aws.elasticache/tcp-elasticache-replication-group-num-cache-clusters: \"A person confirms that the target keeps at least one replica as a failover target when the source had primary and replicas.\"","contract note aws.elasticache/tcp-elasticache-replication-group-transit-encryption-enabled: \"A person confirms that clients reach the cache over TLS on the target, so that data and the authentication token are not sent in clear.\""],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the failover off setting; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default that the knowledge base cannot decide: Review the failover off setting; Review the parameter group setting; Review the parameter group default setting; Confirm the replication group ID of the ElastiCache replication group.","generated_target_behavior":"Review the failover off setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect). Review the parameter group setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the parameter group default setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the replication group ID of the ElastiCache replication group: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Review the failover off setting: the target behaviour of this setting is not established Review the parameter group setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the parameter group default setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the replication group ID of the ElastiCache replication group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-platform-architect now.","next_action":"Review the failover off setting: Review the failover off setting for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the failover off setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A single node without failover: the draft asks for the plan (plan_name is a variable), so whether the target is a Single plan is a person's choice — REVIEW, not PRESERVED.","Review the parameter group setting: A check of the knowledge base (redis parameter group) needs a value the scan cannot read statically, so it could not decide. The setting states which custom set of engine parameters (a parameter group) the cache runs with.","Review the parameter group default setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A parameter group named default.\u003cfamily\u003e carries the AWS default settings of that engine family and version, and its name can carry the topology: a group with cluster.on in its name enables cluster mode.","Confirm the replication group ID of the ElastiCache replication group: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The identifier of the cache replication group. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract)."],"closes_when":["Review the failover off setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Review the parameter group setting: A person maps each parameter the group changes to the parameters of the Valkey instance (for example the memory policy and the keyspace notifications) and sets them there.","Review the parameter group setting: A literal value or a resolved reference in the source lets the check decide, or a person verifies the value.","Review the parameter group default setting: A person confirms that the defaults of the source parameter group family are what the application needs on the target and, for a cluster-mode group, treats it as the cluster-mode question.","Confirm the replication group ID of the ElastiCache replication group: A person confirms the instance name the target uses against what refers to the replication group id, or accepts the new name."],"required_inputs":[]}},{"id":"DEC-SEC-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374","kind":"unit-review","family":"aws.elasticache","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.elasticache","block":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":2,"why":"The knowledge base cannot decide 2 critical settings of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-security-architect.","required_evidence":["an observation on a STACKIT instance (or STACKIT's statement) of whether a connection without TLS is accepted, since the pages read do not state it","the clients of the cache and whether each can connect with TLS (and verify the certificate)"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:7a84420d04b71d9952e3521b09fbde28030d59bd2678d039f0ea48f4d8c6eec5","kb_dependencies_sha256":"sha256:2c0d94a3cf7416d1d38ee33a2c9aee2886f57b65508423676b010d17130cd4c4"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374","source_family":"aws.elasticache","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"tcp-elasticache-replication-group-transit-encryption-enabled/verify-on-target","title":"Confirm the transit encryption enabled setting of the ElastiCache replication group: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.elasticache/at-rest-encryption: \"A person confirms the encryption at rest of the Key Value Store plan on the target; the instance has no encryption setting that could carry the value (pinned provider), and no STACKIT fact about it is documented here.\""],"regeneration_required":true},{"id":"tcp-elasticache-replication-group-transit-encryption-enabled/clients-connect-with-tls","title":"Confirm the transit encryption enabled setting of the ElastiCache replication group: Switch every client to TLS against the Key Value Store","prerequisites":[],"effects":["The clients connect to the instance with TLS (the migration tutorial uses the --tls option, and a public SwissSign certificate that modern systems trust, or the SwissSign root and intermediate certificates passed to the client). Whether the instance also accepts a connection without TLS is not stated in the pages read, so the customer checks it on the instance and does not rely on the platform to refuse a plain connection. A review records the choice and closes no critical setting by itself."],"risk":[],"evidence":["https://docs.stackit.cloud/products/databases/key-value-store/","https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/"],"regeneration_required":false}],"required_verification":["Confirm the transit encryption enabled setting of the ElastiCache replication group: the check, proof or closing evidence is recorded with its result"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Confirm the transit encryption enabled setting of the ElastiCache replication group: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.elasticache/at-rest-encryption: \"A person confirms the encryption at rest of the Key Value Store plan on the target; the instance has no encryption setting that could carry the value (pinned provider), and no STACKIT fact about it is documented here.\"","contract note aws.elasticache/parameter-group-default: \"A person confirms that the defaults of the source parameter group family are what the application needs on the target and, for a cluster-mode group, treats it as the cluster-mode question.\"","contract note aws.elasticache/tc-elasticache-replication-group-replication-group-id: \"A person confirms the instance name the target uses against what refers to the replication group id, or accepts the new name.\"","contract note aws.elasticache/tcp-elasticache-replication-group-at-rest-encryption-enabled: \"A person confirms that the cache data and snapshots are encrypted at rest on the target, as the source setting requires.\"","contract note aws.elasticache/tcp-elasticache-replication-group-num-cache-clusters: \"A person confirms that the target keeps at least one replica as a failover target when the source had primary and replicas.\"","contract note aws.elasticache/tcp-elasticache-replication-group-transit-encryption-enabled: \"A person confirms that clients reach the cache over TLS on the target, so that data and the authentication token are not sent in clear.\"","https://docs.stackit.cloud/products/databases/key-value-store/","https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/"],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the at rest encryption off setting; the 2 settings of the record state their own.","source_observation":"The source states 2 critical settings on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default that the knowledge base cannot decide: Review the at rest encryption off setting; Confirm the transit encryption enabled setting of the ElastiCache replication group.","generated_target_behavior":"Review the at rest encryption off setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-security-architect). Confirm the transit encryption enabled setting of the ElastiCache replication group: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-security-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Review the at rest encryption off setting: the target behaviour of this setting is not established Confirm the transit encryption enabled setting of the ElastiCache replication group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/open-settings-security-architect now.","next_action":"Review the at rest encryption off setting: Review the at rest encryption off setting for module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the at rest encryption off setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. No at-rest encryption in the source; stackit_valkey_instance states nothing about at-rest encryption (pinned provider) — REVIEW, not PRESERVED.","Confirm the transit encryption enabled setting of the ElastiCache replication group: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_elasticache_replication_group.transit_encryption_enabled: Encryption in transit (TLS) between clients and the cache; losing it sends data and AUTH in clear. Held CRITICAL: it decides whether and with which key data or metadata is encrypted; dropping it silently could leave data unencrypted on the target."],"closes_when":["Review the at rest encryption off setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Confirm the transit encryption enabled setting of the ElastiCache replication group: A person confirms that clients reach the cache over TLS on the target, so that data and the authentication token are not sent in clear."],"required_inputs":["the clients of the cache and whether each can connect with TLS (and verify the certificate)","an observation on a STACKIT instance (or STACKIT's statement) of whether a connection without TLS is accepted, since the pages read do not state it"]}},{"id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885","kind":"unit-review","family":"aws.iam_role","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.iam_role","block":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":2},{"cause":"TARGET_LIMIT","members":1},{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings.","required_evidence":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:854ada05e50ac04e13e60fc48160978911c675e9023d17869e5df35f06130e06","kb_dependencies_sha256":"sha256:da12bc52f8386a757d9f7b16dd81b89187c369fae619839b2e09835bc8d50e06"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885","source_family":"aws.iam_role","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"iam-trust-service-workload/bring-the-closing-evidence","title":"Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\""],"regeneration_required":true},{"id":"permissions/carry-out-by-hand","title":"Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true},{"id":"permissions/bind-minimum-stackit-roles","title":"Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account","prerequisites":[],"effects":["A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"regeneration_required":false},{"id":"trust/carry-out-by-hand","title":"Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true}],"required_verification":["Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result","Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)","Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.","Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.","Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"","contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"","contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"","contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"","contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"","contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"","contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"","contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"","contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"","contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"","contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"","contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"","contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"","contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the IAM managed ECS setting; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role that the knowledge base cannot decide: Review the IAM managed ECS setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.","generated_target_behavior":"Review the IAM managed ECS setting: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings). Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Review the IAM managed ECS setting: the target behaviour of this setting is not established Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role/open-settings now.","next_action":"Review the IAM managed ECS setting: Review the IAM managed ECS setting for module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the IAM managed ECS setting: A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload.","Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person.","Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role AWS managed policy AmazonECSTaskExecutionRolePolicy (module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_execution_role_policy): a person translates each into STACKIT role assignments; the list decides nothing.","Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried."],"closes_when":["Review the IAM managed ECS setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.","Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it."],"required_inputs":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"]}},{"id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA","kind":"unit-review","family":"aws.iam_role","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.iam_role","block":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":2},{"cause":"IMPLEMENTATION_GAP","members":1},{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings.","required_evidence":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:51ceb0018ab2bfda815b7e25eead649fca3447af44bcb92f28bf7b0af815f4a4","kb_dependencies_sha256":"sha256:25511588da91a4bc932c6ded70031e9c95fc80d66256a417f72385a023ad54be"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-527061DA","source_family":"aws.iam_role","source_semantic":"unit-review","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"identity-access-secrets","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"iam-managed-customer-policy/bring-the-closing-evidence","title":"Review the IAM managed customer policy setting: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\""],"regeneration_required":true},{"id":"iam-trust-service-workload/bring-the-closing-evidence","title":"Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\""],"regeneration_required":true},{"id":"permissions/carry-out-by-hand","title":"Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true},{"id":"permissions/bind-minimum-stackit-roles","title":"Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account","prerequisites":[],"effects":["A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"regeneration_required":false},{"id":"trust/carry-out-by-hand","title":"Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true}],"required_verification":["Review the IAM managed customer policy setting: the check, proof or closing evidence is recorded with its result","Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result","Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)","Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Review the IAM managed customer policy setting: Manual work remains: a person closes the semantic, the draft does not.","Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.","Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.","Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"","contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"","contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"","contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"","contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"","contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"","contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"","contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"","contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"","contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"","contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"","contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"","contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"","contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"state_reason":"the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Translate the IAM permissions into STACKIT roles; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on module.retail_app_ecs.module.carts_service.aws_iam_role.task_role that the knowledge base cannot decide: Review the IAM managed customer policy setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.","generated_target_behavior":"Review the IAM managed customer policy setting: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.carts_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Review the IAM managed customer policy setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.carts_service.aws_iam_role.task_role/open-settings now.","next_action":"Translate the IAM permissions into STACKIT roles: Carry out the manual work the plan names for module.retail_app_ecs.module.carts_service.aws_iam_role.task_role outside the draft; the plan states no title for it.","why_open":["Review the IAM managed customer policy setting: A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.","Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. The unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) through this setting (the target does not carry it: it is REDESIGN), so what the reference becomes is part of this setting.","Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.carts_service.aws_iam_role.task_role a policy the scan cannot read (module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.cloudwatch_logs), a policy the scan cannot read (module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.ecs_exec), a policy the scan cannot read (module.retail_app_ecs.module.carts_service.aws_iam_role_policy_attachment.task_role_additional): a person translates each into STACKIT role assignments; the list decides nothing.","Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried."],"closes_when":["Review the IAM managed customer policy setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Review the IAM managed customer policy setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.","Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it."],"required_inputs":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"]}},{"id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913","kind":"unit-review","family":"aws.iam_role","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.iam_role","block":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":2},{"cause":"TARGET_LIMIT","members":1},{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings.","required_evidence":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:473be156256464a573dc12f091fa5a8c4239899c98d3c87587560d5613b7f301","kb_dependencies_sha256":"sha256:da12bc52f8386a757d9f7b16dd81b89187c369fae619839b2e09835bc8d50e06"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913","source_family":"aws.iam_role","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"iam-trust-service-workload/bring-the-closing-evidence","title":"Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\""],"regeneration_required":true},{"id":"permissions/carry-out-by-hand","title":"Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true},{"id":"permissions/bind-minimum-stackit-roles","title":"Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account","prerequisites":[],"effects":["A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"regeneration_required":false},{"id":"trust/carry-out-by-hand","title":"Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true}],"required_verification":["Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result","Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)","Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.","Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.","Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"","contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"","contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"","contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"","contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"","contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"","contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"","contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"","contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"","contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"","contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"","contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"","contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"","contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the IAM managed ECS setting; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role that the knowledge base cannot decide: Review the IAM managed ECS setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.","generated_target_behavior":"Review the IAM managed ECS setting: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings). Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Review the IAM managed ECS setting: the target behaviour of this setting is not established Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role/open-settings now.","next_action":"Review the IAM managed ECS setting: Review the IAM managed ECS setting for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the IAM managed ECS setting: A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload.","Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. The unit names 2 resources through this setting whose references the draft does not resolve: module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (aws_secretsmanager_secret), module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (aws_secretsmanager_secret). What each reference becomes is part of this setting.","Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role AWS managed policy AmazonECSTaskExecutionRolePolicy (module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_policy), a policy the scan cannot read (module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.task_execution_role_additional): a person translates each into STACKIT role assignments; the list decides nothing.","Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried."],"closes_when":["Review the IAM managed ECS setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.","Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it."],"required_inputs":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"]}},{"id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1","kind":"unit-review","family":"aws.iam_role","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.iam_role","block":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":2},{"cause":"IMPLEMENTATION_GAP","members":1},{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings.","required_evidence":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:4c1cdaf163c1329c050b9bb8c155cd2416b67516dfdcc85c9ebc37487c1c62ec","kb_dependencies_sha256":"sha256:25511588da91a4bc932c6ded70031e9c95fc80d66256a417f72385a023ad54be"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-724FEFE1","source_family":"aws.iam_role","source_semantic":"unit-review","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"identity-access-secrets","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"iam-managed-customer-policy/bring-the-closing-evidence","title":"Review the IAM managed customer policy setting: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\""],"regeneration_required":true},{"id":"iam-trust-service-workload/bring-the-closing-evidence","title":"Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\""],"regeneration_required":true},{"id":"permissions/carry-out-by-hand","title":"Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true},{"id":"permissions/bind-minimum-stackit-roles","title":"Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account","prerequisites":[],"effects":["A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"regeneration_required":false},{"id":"trust/carry-out-by-hand","title":"Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true}],"required_verification":["Review the IAM managed customer policy setting: the check, proof or closing evidence is recorded with its result","Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result","Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)","Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Review the IAM managed customer policy setting: Manual work remains: a person closes the semantic, the draft does not.","Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.","Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.","Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"","contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"","contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"","contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"","contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"","contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"","contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"","contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"","contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"","contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"","contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"","contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"","contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"","contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"state_reason":"the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Translate the IAM permissions into STACKIT roles; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role that the knowledge base cannot decide: Review the IAM managed customer policy setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.","generated_target_behavior":"Review the IAM managed customer policy setting: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Review the IAM managed customer policy setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role/open-settings now.","next_action":"Translate the IAM permissions into STACKIT roles: Carry out the manual work the plan names for module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role outside the draft; the plan states no title for it.","why_open":["Review the IAM managed customer policy setting: A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.","Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person.","Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role a policy the scan cannot read (module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.cloudwatch_logs), a policy the scan cannot read (module.retail_app_ecs.module.catalog_service.aws_iam_role_policy_attachment.ecs_exec): a person translates each into STACKIT role assignments; the list decides nothing.","Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried."],"closes_when":["Review the IAM managed customer policy setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Review the IAM managed customer policy setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.","Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it."],"required_inputs":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"]}},{"id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673","kind":"unit-review","family":"aws.iam_role","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.iam_role","block":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":2},{"cause":"TARGET_LIMIT","members":1},{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings.","required_evidence":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:b7d645453be730367ca644e3bab971d447c08ed019d765ed139181f4eae4d09c","kb_dependencies_sha256":"sha256:da12bc52f8386a757d9f7b16dd81b89187c369fae619839b2e09835bc8d50e06"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673","source_family":"aws.iam_role","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"iam-trust-service-workload/bring-the-closing-evidence","title":"Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\""],"regeneration_required":true},{"id":"permissions/carry-out-by-hand","title":"Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true},{"id":"permissions/bind-minimum-stackit-roles","title":"Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account","prerequisites":[],"effects":["A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"regeneration_required":false},{"id":"trust/carry-out-by-hand","title":"Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true}],"required_verification":["Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result","Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)","Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.","Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.","Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"","contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"","contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"","contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"","contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"","contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"","contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"","contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"","contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"","contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"","contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"","contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"","contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"","contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the IAM managed ECS setting; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role that the knowledge base cannot decide: Review the IAM managed ECS setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.","generated_target_behavior":"Review the IAM managed ECS setting: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings). Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Review the IAM managed ECS setting: the target behaviour of this setting is not established Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role/open-settings now.","next_action":"Review the IAM managed ECS setting: Review the IAM managed ECS setting for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the IAM managed ECS setting: A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload.","Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person.","Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role AWS managed policy AmazonECSTaskExecutionRolePolicy (module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_execution_role_policy): a person translates each into STACKIT role assignments; the list decides nothing.","Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried."],"closes_when":["Review the IAM managed ECS setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.","Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it."],"required_inputs":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"]}},{"id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6","kind":"unit-review","family":"aws.iam_role","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.iam_role","block":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":2},{"cause":"IMPLEMENTATION_GAP","members":1},{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings.","required_evidence":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:4cc70f00b75b15f677d467aad39fca316ea2386384bb118334f60d1b56671a18","kb_dependencies_sha256":"sha256:25511588da91a4bc932c6ded70031e9c95fc80d66256a417f72385a023ad54be"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-C6834CB6","source_family":"aws.iam_role","source_semantic":"unit-review","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"identity-access-secrets","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"iam-managed-customer-policy/bring-the-closing-evidence","title":"Review the IAM managed customer policy setting: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\""],"regeneration_required":true},{"id":"iam-trust-service-workload/bring-the-closing-evidence","title":"Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\""],"regeneration_required":true},{"id":"permissions/carry-out-by-hand","title":"Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true},{"id":"permissions/bind-minimum-stackit-roles","title":"Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account","prerequisites":[],"effects":["A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"regeneration_required":false},{"id":"trust/carry-out-by-hand","title":"Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true}],"required_verification":["Review the IAM managed customer policy setting: the check, proof or closing evidence is recorded with its result","Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result","Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)","Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Review the IAM managed customer policy setting: Manual work remains: a person closes the semantic, the draft does not.","Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.","Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.","Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"","contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"","contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"","contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"","contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"","contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"","contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"","contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"","contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"","contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"","contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"","contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"","contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"","contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"state_reason":"the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Translate the IAM permissions into STACKIT roles; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role that the knowledge base cannot decide: Review the IAM managed customer policy setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.","generated_target_behavior":"Review the IAM managed customer policy setting: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Review the IAM managed customer policy setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role/open-settings now.","next_action":"Translate the IAM permissions into STACKIT roles: Carry out the manual work the plan names for module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role outside the draft; the plan states no title for it.","why_open":["Review the IAM managed customer policy setting: A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.","Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. The unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table) through this setting (the target does not carry it: it is REDESIGN), so what the reference becomes is part of this setting.","Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role a policy the scan cannot read (module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.cloudwatch_logs), a policy the scan cannot read (module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.ecs_exec), a policy the scan cannot read (module.retail_app_ecs.module.checkout_service.aws_iam_role_policy_attachment.task_role_additional): a person translates each into STACKIT role assignments; the list decides nothing.","Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried."],"closes_when":["Review the IAM managed customer policy setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Review the IAM managed customer policy setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.","Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it."],"required_inputs":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"]}},{"id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202","kind":"unit-review","family":"aws.iam_role","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.iam_role","block":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":2},{"cause":"TARGET_LIMIT","members":1},{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings.","required_evidence":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:5cb92f5482d71bb1a60742351a8f0e11a6f28348d2ec19149d8368eb6def2cf7","kb_dependencies_sha256":"sha256:da12bc52f8386a757d9f7b16dd81b89187c369fae619839b2e09835bc8d50e06"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202","source_family":"aws.iam_role","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"iam-trust-service-workload/bring-the-closing-evidence","title":"Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\""],"regeneration_required":true},{"id":"permissions/carry-out-by-hand","title":"Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true},{"id":"permissions/bind-minimum-stackit-roles","title":"Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account","prerequisites":[],"effects":["A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"regeneration_required":false},{"id":"trust/carry-out-by-hand","title":"Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true}],"required_verification":["Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result","Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)","Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.","Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.","Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"","contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"","contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"","contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"","contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"","contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"","contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"","contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"","contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"","contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"","contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"","contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"","contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"","contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the IAM managed ECS setting; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role that the knowledge base cannot decide: Review the IAM managed ECS setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.","generated_target_behavior":"Review the IAM managed ECS setting: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings). Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Review the IAM managed ECS setting: the target behaviour of this setting is not established Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role/open-settings now.","next_action":"Review the IAM managed ECS setting: Review the IAM managed ECS setting for module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the IAM managed ECS setting: A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload.","Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person. The unit names 2 resources through this setting whose references the draft does not resolve: module.retail_app_ecs.aws_secretsmanager_secret.mq (aws_secretsmanager_secret), module.retail_app_ecs.aws_secretsmanager_secret.orders_db (aws_secretsmanager_secret). What each reference becomes is part of this setting.","Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role AWS managed policy AmazonECSTaskExecutionRolePolicy (module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_policy), a policy the scan cannot read (module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.task_execution_role_additional): a person translates each into STACKIT role assignments; the list decides nothing.","Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried."],"closes_when":["Review the IAM managed ECS setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.","Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it."],"required_inputs":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"]}},{"id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65","kind":"unit-review","family":"aws.iam_role","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.iam_role","block":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":2},{"cause":"IMPLEMENTATION_GAP","members":1},{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings.","required_evidence":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:2f0bb0ed7fec154e45a2cb12fe4064f9f20b82d2c47f71a7c542e4a2c02b85d2","kb_dependencies_sha256":"sha256:25511588da91a4bc932c6ded70031e9c95fc80d66256a417f72385a023ad54be"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-967A9A65","source_family":"aws.iam_role","source_semantic":"unit-review","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"identity-access-secrets","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"iam-managed-customer-policy/bring-the-closing-evidence","title":"Review the IAM managed customer policy setting: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\""],"regeneration_required":true},{"id":"iam-trust-service-workload/bring-the-closing-evidence","title":"Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\""],"regeneration_required":true},{"id":"permissions/carry-out-by-hand","title":"Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true},{"id":"permissions/bind-minimum-stackit-roles","title":"Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account","prerequisites":[],"effects":["A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"regeneration_required":false},{"id":"trust/carry-out-by-hand","title":"Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true}],"required_verification":["Review the IAM managed customer policy setting: the check, proof or closing evidence is recorded with its result","Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result","Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)","Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Review the IAM managed customer policy setting: Manual work remains: a person closes the semantic, the draft does not.","Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.","Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.","Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"","contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"","contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"","contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"","contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"","contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"","contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"","contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"","contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"","contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"","contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"","contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"","contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"","contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"state_reason":"the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Translate the IAM permissions into STACKIT roles; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on module.retail_app_ecs.module.orders_service.aws_iam_role.task_role that the knowledge base cannot decide: Review the IAM managed customer policy setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.","generated_target_behavior":"Review the IAM managed customer policy setting: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.orders_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Review the IAM managed customer policy setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.orders_service.aws_iam_role.task_role/open-settings now.","next_action":"Translate the IAM permissions into STACKIT roles: Carry out the manual work the plan names for module.retail_app_ecs.module.orders_service.aws_iam_role.task_role outside the draft; the plan states no title for it.","why_open":["Review the IAM managed customer policy setting: A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.","Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person.","Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.orders_service.aws_iam_role.task_role a policy the scan cannot read (module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.cloudwatch_logs), a policy the scan cannot read (module.retail_app_ecs.module.orders_service.aws_iam_role_policy_attachment.ecs_exec): a person translates each into STACKIT role assignments; the list decides nothing.","Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried."],"closes_when":["Review the IAM managed customer policy setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Review the IAM managed customer policy setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.","Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it."],"required_inputs":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"]}},{"id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0","kind":"unit-review","family":"aws.iam_role","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.iam_role","block":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":2},{"cause":"TARGET_LIMIT","members":1},{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings.","required_evidence":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:0d3abc1d1e4e02ab819f5eb020fea10c4d78955084f9cfbda065762de79660b4","kb_dependencies_sha256":"sha256:da12bc52f8386a757d9f7b16dd81b89187c369fae619839b2e09835bc8d50e06"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0","source_family":"aws.iam_role","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"iam-trust-service-workload/bring-the-closing-evidence","title":"Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\""],"regeneration_required":true},{"id":"permissions/carry-out-by-hand","title":"Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true},{"id":"permissions/bind-minimum-stackit-roles","title":"Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account","prerequisites":[],"effects":["A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"regeneration_required":false},{"id":"trust/carry-out-by-hand","title":"Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true}],"required_verification":["Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result","Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)","Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.","Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.","Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"","contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"","contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"","contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"","contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"","contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"","contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"","contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"","contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"","contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"","contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"","contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"","contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"","contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the IAM managed ECS setting; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role that the knowledge base cannot decide: Review the IAM managed ECS setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.","generated_target_behavior":"Review the IAM managed ECS setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings). Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Review the IAM managed ECS setting: the target behaviour of this setting is not established Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role/open-settings now.","next_action":"Review the IAM managed ECS setting: Review the IAM managed ECS setting for module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the IAM managed ECS setting: A check of the knowledge base (iam managed ecs) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). What to decide: the registry pull credential and the log destination of the replacing workload.","Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person.","Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role AWS managed policy AmazonECSTaskExecutionRolePolicy (module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.task_execution_role_policy): a person translates each into STACKIT role assignments; the list decides nothing.","Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried."],"closes_when":["Review the IAM managed ECS setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.","Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it."],"required_inputs":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"]}},{"id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE","kind":"unit-review","family":"aws.iam_role","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.iam_role","block":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":2},{"cause":"IMPLEMENTATION_GAP","members":1},{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings.","required_evidence":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:c2be12d3d2e2fb732e8477e43439fd19dffa3bc19f7641e8a62de8194da707fb","kb_dependencies_sha256":"sha256:25511588da91a4bc932c6ded70031e9c95fc80d66256a417f72385a023ad54be"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TASK-ROLE","source_family":"aws.iam_role","source_semantic":"unit-review","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"identity-access-secrets","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"iam-managed-customer-policy/bring-the-closing-evidence","title":"Review the IAM managed customer policy setting: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\""],"regeneration_required":true},{"id":"iam-trust-service-workload/bring-the-closing-evidence","title":"Review the IAM trust service workload setting: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\""],"regeneration_required":true},{"id":"permissions/carry-out-by-hand","title":"Translate the IAM permissions into STACKIT roles: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true},{"id":"permissions/bind-minimum-stackit-roles","title":"Translate the IAM permissions into STACKIT roles: Bind the minimum STACKIT roles the workload needs to the account","prerequisites":[],"effects":["A person chooses the least STACKIT roles the workload needs from the roles the authorization API lists and binds them to the service account (where the draft writes one, as the value of its role variable, which has no default); the AWS policies the record lists are the source facts the choice starts from, never an equivalent: STACKIT grants a role on a resource, and no policy document, condition or resource pattern is carried. A review records the choice; the roles are bound only by the value given at apply, so the review states no effect on the draft and frees nothing."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"regeneration_required":false},{"id":"trust/carry-out-by-hand","title":"Decide who may assume each IAM role: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\""],"regeneration_required":true}],"required_verification":["Review the IAM managed customer policy setting: the check, proof or closing evidence is recorded with its result","Review the IAM trust service workload setting: the check, proof or closing evidence is recorded with its result","Translate the IAM permissions into STACKIT roles: the decision or the manual work is done and recorded (who, when, what was configured and why)","Decide who may assume each IAM role: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Review the IAM managed customer policy setting: Manual work remains: a person closes the semantic, the draft does not.","Review the IAM trust service workload setting: Manual work remains: a person closes the semantic, the draft does not.","Translate the IAM permissions into STACKIT roles: Manual work remains: a person closes the semantic, the draft does not.","Decide who may assume each IAM role: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.iam_role/iam-managed-customer-policy: \"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one.\"","contract note aws.iam_role/iam-managed-eks-internal: \"Managed policy of an EKS role (VPC CNI network interfaces, node join, control-plane resource management, Fargate image pull, EBS CSI volumes).\"","contract note aws.iam_role/iam-managed-rds-monitoring: \"Managed policy AmazonRDSEnhancedMonitoringRole (AWS: RDS writes Enhanced Monitoring to CloudWatch Logs groups named RDS*).\"","contract note aws.iam_role/iam-managed-ssm-instance: \"Managed policy AmazonSSMManagedInstanceCore.\"","contract note aws.iam_role/iam-trust-federated-oidc: \"Trust policy: a federated OpenID Connect identity provider (an EKS service-account issuer for IRSA, a CI/CD system such as GitHub Actions, a web identity provider) assumes this role.\"","contract note aws.iam_role/iam-trust-principal-partly-visible: \"Trust policy: a principal of a statement that lets this role be assumed is not fully visible statically (identifiers that come from a variable, a computed value or a dynamic block, or a principal type\"","contract note aws.iam_role/iam-trust-service-ec2: \"Trust policy: ec2.amazonaws.com assumes this role (an instance role, through an instance profile).\"","contract note aws.iam_role/iam-trust-service-workload: \"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it.\"","contract note aws.iam_role/iam-trust-conditions: \"A person decides for each condition which control replaces it: multi-factor sign-in moves to the identity provider federated into STACKIT, an organisation restriction becomes the choice of the project that holds the identity, and the confused-deputy guards disappear with the service principal.\"","contract note aws.iam_role/permissions: \"A person translates each permission of the attached policies into STACKIT roles on the target resources.\"","contract note aws.iam_role/tag-conditioned-access: \"A person decides, per statement, how the access is expressed on STACKIT without a tag condition (separate projects, one service account per consumer, network rules) or accepts that it is dropped; the label copy is never the answer.\"","contract note aws.iam_role/tcfp-iam-role-policy--policy: \"A person translates each permission of the inline policy into STACKIT roles on the target resources; the draft at most summarises the policy's statements in a role assignment variable and does not translate them.\"","contract note aws.iam_role/tcfp-iam-role-policy-attachment--policy-arn: \"A person decides which STACKIT role takes the place of the managed policy the ARN names: STACKIT IAM grants roles, not AWS policies.\"","contract note aws.iam_role/trust: \"A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it.\"","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_project_role_assignment.md#L38-L40","https://docs.stackit.cloud/products/iaas-api/how-tos/use-service-accounts-via-the-iaas-api/"],"state_reason":"the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Translate the IAM permissions into STACKIT roles; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on module.retail_app_ecs.module.ui_service.aws_iam_role.task_role that the knowledge base cannot decide: Review the IAM managed customer policy setting; Review the IAM trust service workload setting; Translate the IAM permissions into STACKIT roles; Decide who may assume each IAM role.","generated_target_behavior":"Review the IAM managed customer policy setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the IAM trust service workload setting: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Translate the IAM permissions into STACKIT roles: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may assume each IAM role: The draft does not carry the setting on module.retail_app_ecs.module.ui_service.aws_iam_role.task_role; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Review the IAM managed customer policy setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the IAM trust service workload setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Translate the IAM permissions into STACKIT roles: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may assume each IAM role: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.ui_service.aws_iam_role.task_role/open-settings now.","next_action":"Translate the IAM permissions into STACKIT roles: Carry out the manual work the plan names for module.retail_app_ecs.module.ui_service.aws_iam_role.task_role outside the draft; the plan states no title for it.","why_open":["Review the IAM managed customer policy setting: A check of the knowledge base (iam managed customer policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.","Review the IAM trust service workload setting: A check of the knowledge base (iam trust service workload) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","Translate the IAM permissions into STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. STACKIT IAM grants roles; the policy documents, conditions and resource patterns of the role are translated by a person.","Translate the IAM permissions into STACKIT roles: The scanned configuration attaches to module.retail_app_ecs.module.ui_service.aws_iam_role.task_role a policy the scan cannot read (module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.cloudwatch_logs), a policy the scan cannot read (module.retail_app_ecs.module.ui_service.aws_iam_role_policy_attachment.ecs_exec): a person translates each into STACKIT role assignments; the list decides nothing.","Decide who may assume each IAM role: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The trust policy document of the role (its principals and conditions) has no STACKIT counterpart: stackit_service_account has name and project_id only (pinned provider schema), and the draft names assume_role_policy as not carried."],"closes_when":["Review the IAM managed customer policy setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Review the IAM managed customer policy setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the IAM trust service workload setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Review the IAM trust service workload setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Translate the IAM permissions into STACKIT roles: A person translates each permission of the attached policies into STACKIT roles on the target resources.","Decide who may assume each IAM role: A person decides per principal who may assume the role: a federated identity provider (IRSA), a server attachment or a service account key; a role used only by an AWS service is dropped after a person confirms it."],"required_inputs":["the STACKIT roles the workload needs at least, per target resource, chosen from the roles the authorization API lists, with what each AWS policy of the record allowed beside it","who granted them and when (a reviewed least-privilege list, not a copy of the AWS policies)"]}},{"id":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-INTERNET-GATEWAY-THIS","kind":"unit-review","family":"aws.internet_gateway","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.internet_gateway","block":"module.vpc.module.vpc.aws_internet_gateway.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"conditional_members":1,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1}],"blocker_class":"OPTIONAL_CONDITIONAL","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of module.vpc.module.vpc.aws_internet_gateway.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:47c616336e5e1ad5768b91bfcb1100491e0fcda692c9b1fee7c3c8ca251f277e","kb_dependencies_sha256":"sha256:06c50d347eb940460d3e20bd1422b491e8cd3f0defdee5b724acc00958dd3fa1"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-INTERNET-GATEWAY-THIS","source_family":"aws.internet_gateway","source_semantic":"unit-review","affected_application":[],"action_type":"VERIFY_BEHAVIOR","work_package":"routing-architecture","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"REQUIRES_VERIFICATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"network-topology-boundary/bring-the-closing-evidence","title":"Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.internet_gateway/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""],"regeneration_required":true}],"required_verification":["Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.internet_gateway/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""],"state_reason":"the guidance closes it by a runtime or validation result","source_observation":"The source states 1 critical setting on module.vpc.module.vpc.aws_internet_gateway.this that the knowledge base cannot decide: Confirm that the project is the boundary of one network.","generated_target_behavior":"Confirm that the project is the boundary of one network: The draft does not carry the setting on module.vpc.module.vpc.aws_internet_gateway.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_internet_gateway.this/network-topology-boundary). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.vpc.module.vpc.aws_internet_gateway.this/network-topology-boundary now.","next_action":"Confirm that the project is the boundary of one network: Verify on the target for module.vpc.module.vpc.aws_internet_gateway.this: the check, proof or closing evidence is recorded with its result.","why_open":["Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this gateway included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project."],"closes_when":["Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded."],"required_inputs":[]}},{"id":"DEC-IAM-MODULE-RETAIL-APP-ECS-AWS-KMS-KEY-CMK","kind":"unit-review","family":"aws.kms_key","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.kms_key","block":"module.retail_app_ecs.aws_kms_key.cmk","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"TARGET_LIMIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of module.retail_app_ecs.aws_kms_key.cmk: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:f89900f92525e7c55732bc4918958a09715b21610264e9c769a83f22f3d3d990","kb_dependencies_sha256":"sha256:5cc7d34282526a9ba869dfbc29b4eeab68615cecc701d8ccbc66e89c7cea4d13"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-RETAIL-APP-ECS-AWS-KMS-KEY-CMK","source_family":"aws.kms_key","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on module.retail_app_ecs.aws_kms_key.cmk that the knowledge base cannot decide: Review the deletion window setting.","generated_target_behavior":"Review the deletion window setting: The draft does not carry the setting on module.retail_app_ecs.aws_kms_key.cmk; a manual step stands for it (MAN/semantic/module.retail_app_ecs.aws_kms_key.cmk/deletion-window).","residual_difference":"Review the deletion window setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.aws_kms_key.cmk/deletion-window now.","next_action":"Review the deletion window setting: Review the deletion window setting for module.retail_app_ecs.aws_kms_key.cmk, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the deletion window setting: A check of the knowledge base (kms deletion window) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). STACKIT KMS deletes a key scheduled for deletion after 30 days (docs create-and-manage-keys, 'Delete a key'), with no setting: 30 is PRESERVED, another window REVIEW."],"closes_when":["Review the deletion window setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded."],"required_inputs":[]}},{"id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS","kind":"unit-review","family":"aws.lb","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.lb","block":"module.retail_app_ecs.module.alb.aws_lb.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1},{"cause":"DEPENDS_ON_UNIT","members":1},{"cause":"NOT_CLASSIFIED","members":3}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":5,"why":"The knowledge base cannot decide 5 critical settings of module.retail_app_ecs.module.alb.aws_lb.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:f757f9ce3f4966d7d8803d03f11e2b3a0e09c8f5cfa0e4a9c5081c4883698607","kb_dependencies_sha256":"sha256:ddcf6e6a242b2d5dfe5aae8e00904e05e839215e95782b4cdf84013b73814c1a"},"member_count":5,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS","source_family":"aws.lb","source_semantic":"unit-review","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"lb-network-access","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW, LEDGER","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"client-restriction/confirm-the-carried-ranges","title":"Decide the ALB client access: When the draft carries the ranges: confirm them against the source rules","prerequisites":["the critical-settings record of the run names the step that carries the ranges, and the ranges are written as the load balancer's allowed source ranges","the ingress rules of every security group on the source load balancer"],"effects":["Nothing in the draft changes; the restriction applies to the whole load balancer, not per listener or port."],"risk":["Per-port restrictions of the source are merged into one list for all listeners."],"evidence":["STACKIT provider schema 0.120.0: \"Use this option to limit the IP ranges that can use the Application Load Balancer.\"","STACKIT provider schema 0.120.0: \"Application Load Balancer is accessible only from an IP address in this range.\""],"regeneration_required":false},{"id":"client-restriction/restrict-the-clients-by-hand","title":"Decide the ALB client access: When it does not: the Security Architect restricts the clients of the load balancer (the manual step of the plan)","prerequisites":["the ingress rules of every security group on the source load balancer, with the listener ports they cover","for each rule whose source is not a range (another group, a prefix list): the ranges that stand for it, or the decision that it is dropped"],"effects":["The ranges are written on options.access_control.allowed_source_ranges after the load balancer exists (or before apply, in the draft by hand)."],"risk":["A range written for a group source is an approximation; until the step is done the load balancer admits every client."],"evidence":["rule aws.lb/lb-security-groups of the knowledge base: \"Security groups restrict clients of the load balancer; on STACKIT this becomes options.access_control.allowed_source_ranges (ALB) or options.acl (NLB).\"","provider-docs mirror stackit/stackit-api-specifications/services/alb/v2/alb.json:647: \"Traffic originating from any IP in the referenced list is denied access to the Application Load Balancer.\""],"regeneration_required":false},{"id":"client-restriction/keep-the-network-private","title":"Decide the ALB client access: Keep the load balancer on a private address only","prerequisites":["the source load balancer is internal, or its clients reach it through a private network"],"effects":["options.private_network_only makes the load balancer reachable only on a private address; it cannot be changed after creation.","regeneration: not stated — treated as required"],"risk":["It is no client restriction: every host on the networks that reach the private address is admitted. Clients on the internet no longer reach it, and the choice is fixed at creation."],"evidence":["STACKIT provider schema 0.120.0: \"Application Load Balancer is accessible only via a private network ip address. Not changeable after creation.\""],"regeneration_required":true},{"id":"client-restriction/accept-the-wider-exposure","title":"Decide the ALB client access: Accept that more clients reach the load balancer than on the source","prerequisites":["the owner's statement that the source restriction is not needed (for example a public website)"],"effects":["The draft is applied as written; the exposure widened is an accepted difference."],"risk":["Anything the source restricted to known clients is open to the internet."],"evidence":["rule aws.lb/lb-security-groups of the knowledge base: \"Security groups restrict clients of the load balancer;\""],"regeneration_required":false},{"id":"lb-subnets/verify-on-target","title":"Review the LB subnets setting: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.lb/cross-zone: \"A person checks how the STACKIT load balancer spreads traffic over targets in several availability zones, which is not documented, and confirms that the spread is acceptable.\""],"regeneration_required":true},{"id":"network-exposure/decide-and-carry-out","title":"Decide who may reach the service over the network: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.","regeneration: not stated — treated as required"],"risk":["The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes."],"evidence":["contract note aws.lb/network-exposure: \"A person decides whether the STACKIT load balancer is private network only; the draft picks no side and leaves a boolean variable without default and a comment, because the source's internal flag is not visible statically.\""],"regeneration_required":true}],"required_verification":["Decide the ALB client access: a request from an address outside the allowed ranges is refused by the target load balancer, and one from inside is served","Review the LB subnets setting: the check, proof or closing evidence is recorded with its result","Decide who may reach the service over the network: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing changes from an answer: no input topic carries client ranges. A rerun on a source whose rules name ranges by exact reference lets the draft carry them.","Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Decide the ALB client access: Manual work remains: a person closes the semantic, the draft does not.","Review the LB subnets setting: Manual work remains: a person closes the semantic, the draft does not.","Decide who may reach the service over the network: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.lb/client-restriction: \"carries the client restriction where the sources are provable IPv4 ranges: options.access_control.allowed_source_ranges of stackit_application_load_balancer\"","contract note aws.lb/cross-zone: \"A person checks how the STACKIT load balancer spreads traffic over targets in several availability zones, which is not documented, and confirms that the spread is acceptable.\"","contract note aws.lb/lb-subnets: \"The load balancer takes the network of its one converted subnet (networks.network_id; several subnets are lb subnets several, REVIEW): STACKIT networks are regional, one network holds what the source spread over zonal subnets.\"","contract note aws.lb/network-exposure: \"A person decides whether the STACKIT load balancer is private network only; the draft picks no side and leaves a boolean variable without default and a comment, because the source's internal flag is not visible statically.\""],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Decide the ALB client access; the 5 settings of the record state their own.","source_observation":"The source states 5 critical settings on module.retail_app_ecs.module.alb.aws_lb.this that the knowledge base cannot decide: Decide the ALB client access; Review the LB routing and addressing setting; Review the LB subnets setting; Decide who may reach the service over the network; Review the request handling setting.","generated_target_behavior":"Decide the ALB client access: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_lb.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect). Two states. When the draft carries the restriction (the source rules name ranges the scan proves), the load balancer is written with those ranges as its allowed source ranges (options.access_control.allowed_source_ranges), and the critical-settings record of the run names the step that carries them. When it does not (a group reference, a prefix list, a variable, or a range admitted on some ports only), the target admits more clients than the source: the load balancer waits for the decision on the widened exposure, and the plan holds a manual step of the Security Architect that restricts its clients; where no range at all can be proven, no access control is written. Review the LB routing and addressing setting: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_lb.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect). Review the LB subnets setting: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_lb.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide who may reach the service over the network: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_lb.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the request handling setting: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_lb.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect).","residual_difference":"Decide the ALB client access: That the target admits only the clients the source admitted. Review the LB routing and addressing setting: the target behaviour of this setting is not established Review the LB subnets setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide who may reach the service over the network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the request handling setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-network-architect now.","next_action":"Decide the ALB client access: Decide the ALB client access for module.retail_app_ecs.module.alb.aws_lb.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Decide the ALB client access: A check of the knowledge base (lb security groups) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Who may reach the load balancer, read from the ingress rules of the security groups that filter its clients. A group reference, a prefix list, an IPv6 range or a variable is not carried: the plan lists the clients the target would block and adds the client-access manual step for the Security Architect.","Review the LB routing and addressing setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states how the load balancer answers DNS for clients (Availability Zone affinity), whether it still forwards to targets when AWS WAF cannot be reached (fail open), zonal shift, customer-owned address pools and IPv6 source NAT prefixes.","Review the LB subnets setting: The value is not visible statically (a case of the mapping rule for this kind of unit), so nothing is credited for it. The load balancer takes the network of its one converted subnet (networks.network_id; several subnets are lb subnets several, REVIEW): STACKIT networks are regional, one network holds what the source spread over zonal subnets.","Decide who may reach the service over the network: Whether the draft carries this setting is decided by its semantic ledger entry \"network exposure\", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). internal not visible statically (a variable): the source states no exposure and the draft carries nothing for it; a person decides whether the STACKIT load balancer is private_network_only (REVIEW).","Review the request handling setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states how the load balancer treats HTTP requests that may carry a request-smuggling (desync) risk, and how it rewrites the X-Forwarded-For header before the target sees it."],"closes_when":["Decide the ALB client access: A person confirms the carried ranges against the source rules, or decides the open client-access step, and the regenerated draft carries the result.","Decide the ALB client access: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person confirms the carried ranges against the source rules, or decides the open client-access step, and the regenerated draft carries the result.","Review the LB routing and addressing setting: A person decides whether the STACKIT load balancer needs an equivalent for each of them, because the STACKIT application and network load balancers have no setting for any of them (pinned provider).","Review the LB subnets setting: The knowledge base states no closing condition for this setting; the run closes it when a literal value or a resolved reference in the source closes it, or when a person confirms the value.","Review the LB subnets setting: A literal value or a resolved reference in the source closes it, or a person confirms the value.","Decide who may reach the service over the network: A person decides whether the STACKIT load balancer is private network only; the draft picks no side and leaves a boolean variable without default and a comment, because the source's internal flag is not visible statically.","Decide who may reach the service over the network: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.","Review the request handling setting: A person confirms that the application does not depend on either behaviour: the STACKIT application load balancer has neither setting and its documentation does not state the behaviour (pinned provider), also for the AWS default values."],"required_inputs":[]}},{"id":"DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS","kind":"unit-review","family":"aws.lb","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.lb","block":"module.retail_app_ecs.module.alb.aws_lb.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"TARGET_LIMIT","members":1},{"cause":"IMPLEMENTATION_GAP","members":1},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":3,"why":"The knowledge base cannot decide 3 critical settings of module.retail_app_ecs.module.alb.aws_lb.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-platform-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:1f886639d618968c583259189057db4e9560ece36778f6e9a6944d4309935aca","kb_dependencies_sha256":"sha256:7043acb60936099ccf2d02a9579423b35351e6dd828273b9d3ca0e98be258b2e"},"member_count":3,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS","source_family":"aws.lb","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"tc-lb-name/confirm-the-carried-name","title":"Confirm the name of the load balancer: When the draft carries it: confirm the name the plan step writes against what refers to it","prerequisites":["the critical-settings record of the run names the step that writes the name","the list of things that refer to the source load balancer's name or AWS DNS name"],"effects":["Nothing in the draft changes."],"risk":["A client that used the AWS-generated host name needs the STACKIT address; the name alone does not move it."],"evidence":["STACKIT provider schema 0.120.0: \"Application Load balancer name.\""],"regeneration_required":false},{"id":"tc-lb-name/set-the-name-by-hand","title":"Confirm the name of the load balancer: When it does not: set the load balancer's name in the draft by hand, or accept the name the draft writes","prerequisites":["the name the load balancer should carry on the target"],"effects":["The name attribute of the drafted load balancer is changed by hand before apply."],"risk":["A name changed by hand after a later regeneration is lost unless it is changed again."],"evidence":["contract note aws.lb/tc-lb-name: \"aws_lb.name: Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract)\""],"regeneration_required":false}],"required_verification":["Confirm the name of the load balancer: the references to the name are listed and moved or accepted"],"next_run_changes":["Nothing: no input topic carries the name; a carried name is written again, a name not carried stays unwritten."],"remains_manual":["Confirm the name of the load balancer: Manual work remains only where the draft does not carry the setting or the input is not answered (see the paths)."],"evidence_refs":["contract note aws.lb/tc-lb-name: \"aws_lb.name: Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract)\""],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the LB connection timeouts setting; the 3 settings of the record state their own.","source_observation":"The source states 3 critical settings on module.retail_app_ecs.module.alb.aws_lb.this that the knowledge base cannot decide: Review the LB connection timeouts setting; Review the request header options setting; Confirm the name of the load balancer.","generated_target_behavior":"Review the LB connection timeouts setting: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_lb.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-platform-architect). Review the request header options setting: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_lb.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-platform-architect). Confirm the name of the load balancer: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_lb.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-platform-architect). When the draft carries it (the critical-settings record of the run names the step that writes the name, as in most estates checked when this entry was written), the source name is written on the load balancer. When it does not (the record names no carrying step, as in one estate checked), the draft does not write the source name: what it writes instead is in the unit's Terraform comments.","residual_difference":"Review the LB connection timeouts setting: the target behaviour of this setting is not established Review the request header options setting: the target behaviour of this setting is not established Confirm the name of the load balancer: That nothing that addressed the source load balancer by its name or AWS host name is left pointing at AWS.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.retail_app_ecs.module.alb.aws_lb.this/open-settings-platform-architect now.","next_action":"Review the LB connection timeouts setting: Review the LB connection timeouts setting for module.retail_app_ecs.module.alb.aws_lb.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the LB connection timeouts setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_lb.idle_timeout and client_keep_alive (aws 6.66.0): how long the load balancer lets a client connection idle and how long it keeps it open. The STACKIT application load balancer has no such attribute and the draft does not carry them - REVIEW: a person decides whether the applications behind the load balancer (long polling, streaming, WebSockets, slow requests) cope with the STACKIT default. aws_alb, the alias type, is not read here.","Review the request header options setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states which extra headers the load balancer adds to the request the target receives (TLS version and cipher suite, the client port in X-Forwarded-For) and whether it keeps the original Host header.","Confirm the name of the load balancer: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_lb.name: Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). No semantic of this family has verified it as carried."],"closes_when":["Review the LB connection timeouts setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Review the request header options setting: A person decides, for each setting, what the STACKIT load balancer or the application does instead, because the STACKIT application load balancer has no setting that adds, rewrites or renames a request header towards its targets (pinned provider).","Confirm the name of the load balancer: A person confirms the name the load balancer carries on the target against what refers to the source name, or accepts the new name."],"required_inputs":[]}},{"id":"DEC-IAM-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ","kind":"unit-review","family":"aws.mq_broker","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.mq_broker","block":"module.dependencies.aws_mq_broker.mq","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":2,"why":"The knowledge base cannot decide 2 critical settings of module.dependencies.aws_mq_broker.mq: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-identity-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:1d010c1b6ab6c30f34ff7ae81cdd495a8a439b7de14ec99385aea80975a5725b","kb_dependencies_sha256":"sha256:fcc72e842f52db1911a44094da0763f2f3861dca7a5764f68efe67724a1c29ff"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ","source_family":"aws.mq_broker","source_semantic":"unit-review","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"managed-data-services","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"broker-users/carry-out-by-hand","title":"Decide the users of the message broker: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.mq_broker/broker-network: \"A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.\""],"regeneration_required":true},{"id":"tc-user--username/verify-on-target","title":"Confirm the user name: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.mq_broker/tc-mq-broker-broker-name: \"A person confirms the broker name the target uses against what refers to the source broker name, or accepts the new name.\""],"regeneration_required":true}],"required_verification":["Decide the users of the message broker: the decision or the manual work is done and recorded (who, when, what was configured and why)","Confirm the user name: the check, proof or closing evidence is recorded with its result"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Decide the users of the message broker: Manual work remains: a person closes the semantic, the draft does not.","Confirm the user name: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.mq_broker/broker-network: \"A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.\"","contract note aws.mq_broker/broker-users: \"A person sets the permissions of each broker user on the generated RabbitMQ credentials and hands the new passwords to the clients.\"","contract note aws.mq_broker/engine: \"A person decides the target broker: ActiveMQ has no managed STACKIT counterpart, so JMS or OpenWire clients move to AMQP on a RabbitMQ instance, STOMP or MQTT clients keep their protocol, or ActiveMQ runs self-managed.\"","contract note aws.mq_broker/engine-type: \"A person moves JMS and OpenWire clients to an AMQP client against the RabbitMQ instance, keeps STOMP or MQTT clients on their protocol, or runs ActiveMQ self-managed.\"","contract note aws.mq_broker/engine-version: \"A person picks the RabbitMQ version for the target instance, since the versions STACKIT offers are not stated for this move.\"","contract note aws.mq_broker/high-availability: \"A person chooses the STACKIT RabbitMQ plan that gives the availability the source deployment mode had; which plans are clustered across zones is not stated here.\"","contract note aws.mq_broker/tc-user--password: \"A person hands the clients the password of the generated target credential instead of the literal in the source.\"","contract note aws.mq_broker/tcp-deployment-mode: \"A person decides whether the target must survive a zone failure as the source deployment mode did, and finds out which RabbitMQ plan, if any, gives that, since the zone spread of the plans is not stated.\"","contract note aws.mq_broker/tc-mq-broker-broker-name: \"A person confirms the broker name the target uses against what refers to the source broker name, or accepts the new name.\"","contract note aws.mq_broker/tc-user--username: \"A person confirms the user names the clients log in with; STACKIT generates each RabbitMQ credential's username, so the clients move to the new usernames.\"","contract note aws.mq_broker/tcp-engine-type: \"A RabbitMQ source keeps its engine; ActiveMQ has no managed STACKIT counterpart, so JMS or OpenWire clients move to AMQP, STOMP or MQTT clients keep their protocol, or ActiveMQ runs self-managed.\"","contract note aws.mq_broker/tcp-engine-version: \"A person confirms that the broker engine version of the source is compatible with the version the target instance offers.\"","contract note aws.mq_broker/tcp-subnet-ids: \"A person confirms whether the target needs a standby in another zone, as source subnets in several zones gave, and how clients reach it; the zone spread of STACKIT RabbitMQ plans is not stated.\""],"state_reason":"the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Decide the users of the message broker; the 2 settings of the record state their own.","source_observation":"The source states 2 critical settings on module.dependencies.aws_mq_broker.mq that the knowledge base cannot decide: Decide the users of the message broker; Confirm the user name.","generated_target_behavior":"Decide the users of the message broker: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-identity-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the user name: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-identity-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Decide the users of the message broker: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the user name: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-identity-architect now.","next_action":"Decide the users of the message broker: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it.","why_open":["Decide the users of the message broker: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Users become stackit_rabbitmq_credential entries with generated passwords; their permissions are set by a person.","Confirm the user name: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_mq_broker.user.username: The broker user's login identity. Held CRITICAL: it decides who or what may use, read or change the resource or the data behind it. No semantic of this family has verified it as carried."],"closes_when":["Decide the users of the message broker: A person sets the permissions of each broker user on the generated RabbitMQ credentials and hands the new passwords to the clients.","Confirm the user name: A person confirms the user names the clients log in with; STACKIT generates each RabbitMQ credential's username, so the clients move to the new usernames."],"required_inputs":[]}},{"id":"DEC-NET-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ","kind":"unit-review","family":"aws.mq_broker","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.mq_broker","block":"module.dependencies.aws_mq_broker.mq","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of module.dependencies.aws_mq_broker.mq: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:0677d3c44629dc255384d38daf4d1be95731a7b0f973c9589d4bbae60eb3321a","kb_dependencies_sha256":"sha256:6b26ef76da0d040b82dfcce3823bf0c9ee2bb5dbbfaf655bb610a1b13740c547"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ","source_family":"aws.mq_broker","source_semantic":"unit-review","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"managed-data-services","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"broker-network/carry-out-by-hand","title":"Decide the network of the message broker: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.mq_broker/broker-network: \"A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.\""],"regeneration_required":true}],"required_verification":["Decide the network of the message broker: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Decide the network of the message broker: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.mq_broker/broker-network: \"A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.\"","contract note aws.mq_broker/broker-users: \"A person sets the permissions of each broker user on the generated RabbitMQ credentials and hands the new passwords to the clients.\"","contract note aws.mq_broker/engine: \"A person decides the target broker: ActiveMQ has no managed STACKIT counterpart, so JMS or OpenWire clients move to AMQP on a RabbitMQ instance, STOMP or MQTT clients keep their protocol, or ActiveMQ runs self-managed.\"","contract note aws.mq_broker/engine-type: \"A person moves JMS and OpenWire clients to an AMQP client against the RabbitMQ instance, keeps STOMP or MQTT clients on their protocol, or runs ActiveMQ self-managed.\"","contract note aws.mq_broker/engine-version: \"A person picks the RabbitMQ version for the target instance, since the versions STACKIT offers are not stated for this move.\"","contract note aws.mq_broker/high-availability: \"A person chooses the STACKIT RabbitMQ plan that gives the availability the source deployment mode had; which plans are clustered across zones is not stated here.\"","contract note aws.mq_broker/tc-user--password: \"A person hands the clients the password of the generated target credential instead of the literal in the source.\"","contract note aws.mq_broker/tcp-deployment-mode: \"A person decides whether the target must survive a zone failure as the source deployment mode did, and finds out which RabbitMQ plan, if any, gives that, since the zone spread of the plans is not stated.\""],"state_reason":"the guidance names a manual step as the only path","source_observation":"The source states 1 critical setting on module.dependencies.aws_mq_broker.mq that the knowledge base cannot decide: Decide the network of the message broker.","generated_target_behavior":"Decide the network of the message broker: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/broker-network). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Decide the network of the message broker: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.aws_mq_broker.mq/broker-network now.","next_action":"Decide the network of the message broker: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it.","why_open":["Decide the network of the message broker: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_rabbitmq_instance has no subnet or security-group attribute (pinned provider): clients reach the instance at the address STACKIT assigns, restricted by parameters.sgw_acl — a person decides the ranges."],"closes_when":["Decide the network of the message broker: A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups."],"required_inputs":[]}},{"id":"DEC-OPS-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ","kind":"unit-review","family":"aws.mq_broker","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.mq_broker","block":"module.dependencies.aws_mq_broker.mq","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":2},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":3,"why":"The knowledge base cannot decide 3 critical settings of module.dependencies.aws_mq_broker.mq: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:ef3bdbf036354a9489578e8cc7954091c560180b4f5f81788a824d645c25a480","kb_dependencies_sha256":"sha256:d399c56bd61185be787a1d869bb94a3737d8820940db9567591409ba1b61ae9e"},"member_count":3,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ","source_family":"aws.mq_broker","source_semantic":"unit-review","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"managed-data-services","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"engine-version/carry-out-by-hand","title":"Choose the database engine version: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.mq_broker/broker-network: \"A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.\""],"regeneration_required":true},{"id":"tc-mq-broker-broker-name/verify-on-target","title":"Confirm the name of the message broker: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.mq_broker/tc-mq-broker-broker-name: \"A person confirms the broker name the target uses against what refers to the source broker name, or accepts the new name.\""],"regeneration_required":true},{"id":"tcp-deployment-mode/carry-out-by-hand","title":"Choose the deployment mode of the broker: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.mq_broker/broker-network: \"A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.\""],"regeneration_required":true}],"required_verification":["Choose the database engine version: the decision or the manual work is done and recorded (who, when, what was configured and why)","Confirm the name of the message broker: the check, proof or closing evidence is recorded with its result","Choose the deployment mode of the broker: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Choose the database engine version: Manual work remains: a person closes the semantic, the draft does not.","Confirm the name of the message broker: Manual work remains: a person closes the semantic, the draft does not.","Choose the deployment mode of the broker: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.mq_broker/broker-network: \"A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.\"","contract note aws.mq_broker/broker-users: \"A person sets the permissions of each broker user on the generated RabbitMQ credentials and hands the new passwords to the clients.\"","contract note aws.mq_broker/engine: \"A person decides the target broker: ActiveMQ has no managed STACKIT counterpart, so JMS or OpenWire clients move to AMQP on a RabbitMQ instance, STOMP or MQTT clients keep their protocol, or ActiveMQ runs self-managed.\"","contract note aws.mq_broker/engine-type: \"A person moves JMS and OpenWire clients to an AMQP client against the RabbitMQ instance, keeps STOMP or MQTT clients on their protocol, or runs ActiveMQ self-managed.\"","contract note aws.mq_broker/engine-version: \"A person picks the RabbitMQ version for the target instance, since the versions STACKIT offers are not stated for this move.\"","contract note aws.mq_broker/high-availability: \"A person chooses the STACKIT RabbitMQ plan that gives the availability the source deployment mode had; which plans are clustered across zones is not stated here.\"","contract note aws.mq_broker/tc-user--password: \"A person hands the clients the password of the generated target credential instead of the literal in the source.\"","contract note aws.mq_broker/tcp-deployment-mode: \"A person decides whether the target must survive a zone failure as the source deployment mode did, and finds out which RabbitMQ plan, if any, gives that, since the zone spread of the plans is not stated.\"","contract note aws.mq_broker/tc-mq-broker-broker-name: \"A person confirms the broker name the target uses against what refers to the source broker name, or accepts the new name.\"","contract note aws.mq_broker/tc-user--username: \"A person confirms the user names the clients log in with; STACKIT generates each RabbitMQ credential's username, so the clients move to the new usernames.\"","contract note aws.mq_broker/tcp-engine-type: \"A RabbitMQ source keeps its engine; ActiveMQ has no managed STACKIT counterpart, so JMS or OpenWire clients move to AMQP, STOMP or MQTT clients keep their protocol, or ActiveMQ runs self-managed.\"","contract note aws.mq_broker/tcp-engine-version: \"A person confirms that the broker engine version of the source is compatible with the version the target instance offers.\"","contract note aws.mq_broker/tcp-subnet-ids: \"A person confirms whether the target needs a standby in another zone, as source subnets in several zones gave, and how clients reach it; the zone spread of STACKIT RabbitMQ plans is not stated.\""],"state_reason":"the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Choose the database engine version; the 3 settings of the record state their own.","source_observation":"The source states 3 critical settings on module.dependencies.aws_mq_broker.mq that the knowledge base cannot decide: Choose the database engine version; Confirm the name of the message broker; Choose the deployment mode of the broker.","generated_target_behavior":"Choose the database engine version: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the name of the message broker: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Choose the deployment mode of the broker: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Choose the database engine version: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the name of the message broker: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Choose the deployment mode of the broker: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-platform-architect now.","next_action":"Choose the database engine version: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it.","why_open":["Choose the database engine version: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_rabbitmq_instance takes a STACKIT RabbitMQ version (the draft asks for it: rabbitmq_version) — which versions STACKIT offers is not in the rule's evidence.","Confirm the name of the message broker: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The name of the message broker. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract).","Choose the deployment mode of the broker: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_mq_broker.deployment_mode: The family's own setting for high availability already reads this as critical: it selects single instance vs. active standby multi az vs. cluster multi az, i.e. whether the broker survives an AZ failure at all. Held CRITICAL: it decides capacity, delivery guarantees, retry or failure handling that consumers depend on."],"closes_when":["Choose the database engine version: A person picks the RabbitMQ version for the target instance, since the versions STACKIT offers are not stated for this move.","Confirm the name of the message broker: A person confirms the broker name the target uses against what refers to the source broker name, or accepts the new name.","Choose the deployment mode of the broker: A person decides whether the target must survive a zone failure as the source deployment mode did, and finds out which RabbitMQ plan, if any, gives that, since the zone spread of the plans is not stated."],"required_inputs":[]}},{"id":"DEC-SEC-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ","kind":"unit-review","family":"aws.mq_broker","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.mq_broker","block":"module.dependencies.aws_mq_broker.mq","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of module.dependencies.aws_mq_broker.mq: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-security-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:4e74b75b281d7cca7f66b57294584f30ce28513bc601ae4284f9e27f1e62c0fb","kb_dependencies_sha256":"sha256:e2afe9f65e46c927d6dbb417aa8c41e8885a02158b60cc03c77e11f5edd05218"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-MODULE-DEPENDENCIES-AWS-MQ-BROKER-MQ","source_family":"aws.mq_broker","source_semantic":"unit-review","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"managed-data-services","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"tc-user--password/carry-out-by-hand","title":"Decide how the user password is supplied: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.mq_broker/broker-network: \"A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.\""],"regeneration_required":true}],"required_verification":["Decide how the user password is supplied: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Decide how the user password is supplied: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.mq_broker/broker-network: \"A person decides which client address ranges may reach the target RabbitMQ instance through its access list, in place of the source subnets and security groups.\"","contract note aws.mq_broker/broker-users: \"A person sets the permissions of each broker user on the generated RabbitMQ credentials and hands the new passwords to the clients.\"","contract note aws.mq_broker/engine: \"A person decides the target broker: ActiveMQ has no managed STACKIT counterpart, so JMS or OpenWire clients move to AMQP on a RabbitMQ instance, STOMP or MQTT clients keep their protocol, or ActiveMQ runs self-managed.\"","contract note aws.mq_broker/engine-type: \"A person moves JMS and OpenWire clients to an AMQP client against the RabbitMQ instance, keeps STOMP or MQTT clients on their protocol, or runs ActiveMQ self-managed.\"","contract note aws.mq_broker/engine-version: \"A person picks the RabbitMQ version for the target instance, since the versions STACKIT offers are not stated for this move.\"","contract note aws.mq_broker/high-availability: \"A person chooses the STACKIT RabbitMQ plan that gives the availability the source deployment mode had; which plans are clustered across zones is not stated here.\"","contract note aws.mq_broker/tc-user--password: \"A person hands the clients the password of the generated target credential instead of the literal in the source.\"","contract note aws.mq_broker/tcp-deployment-mode: \"A person decides whether the target must survive a zone failure as the source deployment mode did, and finds out which RabbitMQ plan, if any, gives that, since the zone spread of the plans is not stated.\""],"state_reason":"the guidance names a manual step as the only path","source_observation":"The source states 1 critical setting on module.dependencies.aws_mq_broker.mq that the knowledge base cannot decide: Decide how the user password is supplied.","generated_target_behavior":"Decide how the user password is supplied: The draft does not carry the setting on module.dependencies.aws_mq_broker.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-security-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Decide how the user password is supplied: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.aws_mq_broker.mq/open-settings-security-architect now.","next_action":"Decide how the user password is supplied: Carry out the manual work the plan names for module.dependencies.aws_mq_broker.mq outside the draft; the plan states no title for it.","why_open":["Decide how the user password is supplied: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_mq_broker.user.password: The broker user's login credential; a literal secret. Held CRITICAL: it carries or names a credential; the value is never copied and a person re-creates it on the target. No semantic of this family has verified it as carried."],"closes_when":["Decide how the user password is supplied: A person hands the clients the password of the generated target credential instead of the literal in the source."],"required_inputs":[]}},{"id":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-NAT-GATEWAY-THIS","kind":"unit-review","family":"aws.nat_gateway","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.nat_gateway","block":"module.vpc.module.vpc.aws_nat_gateway.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"TARGET_LIMIT","members":2}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":3,"why":"The knowledge base cannot decide 3 critical settings of module.vpc.module.vpc.aws_nat_gateway.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.vpc.module.vpc.aws_nat_gateway.this/open-settings.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:3e80a05723d110a3e1c0d44751fa6e6caf815a7d234eb525820b1d1c73adc582","kb_dependencies_sha256":"sha256:29e4f09e1d1c036f8c792a72964586ae14d7aacaa4624f262ad51c5164d96d4f"},"member_count":3,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-NAT-GATEWAY-THIS","source_family":"aws.nat_gateway","source_semantic":"unit-review","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"private-egress-dns","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"fixed-egress-ip/decide-and-carry-out","title":"Decide the fixed outbound IP address: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.","regeneration: not stated — treated as required"],"risk":["The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes."],"evidence":["contract note aws.nat_gateway/fixed-egress-ip: \"A person decides how peers that allow-list the Elastic IP are served: a routed STACKIT network leaves by the project's shared egress address, which cannot be set and can change, so the allow-list follows it or each server gets a STACKIT public IP.\""],"regeneration_required":true},{"id":"nat-placement/decide-and-carry-out","title":"Review the NAT placement setting: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.","regeneration: not stated — treated as required"],"risk":["The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes."],"evidence":["contract note aws.nat_gateway/fixed-egress-ip: \"A person decides how peers that allow-list the Elastic IP are served: a routed STACKIT network leaves by the project's shared egress address, which cannot be set and can change, so the allow-list follows it or each server gets a STACKIT public IP.\""],"regeneration_required":true},{"id":"network-topology-boundary/bring-the-closing-evidence","title":"Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.nat_gateway/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""],"regeneration_required":true}],"required_verification":["Decide the fixed outbound IP address: the decision or the manual work is done and recorded (who, when, what was configured and why)","Review the NAT placement setting: the decision or the manual work is done and recorded (who, when, what was configured and why)","Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Decide the fixed outbound IP address: Manual work remains: a person closes the semantic, the draft does not.","Review the NAT placement setting: Manual work remains: a person closes the semantic, the draft does not.","Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.nat_gateway/fixed-egress-ip: \"A person decides how peers that allow-list the Elastic IP are served: a routed STACKIT network leaves by the project's shared egress address, which cannot be set and can change, so the allow-list follows it or each server gets a STACKIT public IP.\"","contract note aws.nat_gateway/nat-placement: \"A person decides whether the egress path must stay in one zone or per zone, because the STACKIT documentation does not state whether the implicit outbound path is scoped to a zone.\"","contract note aws.nat_gateway/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""],"state_reason":"the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Decide the fixed outbound IP address; the 3 settings of the record state their own.","source_observation":"The source states 3 critical settings on module.vpc.module.vpc.aws_nat_gateway.this that the knowledge base cannot decide: Decide the fixed outbound IP address; Review the NAT placement setting; Confirm that the project is the boundary of one network.","generated_target_behavior":"Decide the fixed outbound IP address: The draft does not carry the setting on module.vpc.module.vpc.aws_nat_gateway.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_nat_gateway.this/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the NAT placement setting: The draft does not carry the setting on module.vpc.module.vpc.aws_nat_gateway.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_nat_gateway.this/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on module.vpc.module.vpc.aws_nat_gateway.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_nat_gateway.this/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Decide the fixed outbound IP address: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the NAT placement setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.vpc.module.vpc.aws_nat_gateway.this/open-settings now.","next_action":"Decide the fixed outbound IP address: Carry out the manual work the plan names for module.vpc.module.vpc.aws_nat_gateway.this outside the draft; the plan states no title for it.","why_open":["Decide the fixed outbound IP address: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A stable egress IP on STACKIT is an open question (no source in this repository answers it; the per-network SNAT address is computed and cannot be chosen or kept).","Review the NAT placement setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A zonal NAT gateway (subnet_id) is placed in one AZ; a regional one lists its per-AZ egress in availability_zone_address(es).availability_zone. STACKIT has no NAT gateway resource, and its documentation does not state whether the implicit outbound path is zone-scoped: REVIEW.","Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this NAT gateway included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project."],"closes_when":["Decide the fixed outbound IP address: A person decides how peers that allow-list the Elastic IP are served: a routed STACKIT network leaves by the project's shared egress address, which cannot be set and can change, so the allow-list follows it or each server gets a STACKIT public IP.","Review the NAT placement setting: A person decides whether the egress path must stay in one zone or per zone, because the STACKIT documentation does not state whether the implicit outbound path is scoped to a zone.","Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded."],"required_inputs":[]}},{"id":"DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E","kind":"unit-review","family":"aws.opensearch","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.opensearch","block":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"TARGET_LIMIT","members":2},{"cause":"NOT_CLASSIFIED","members":5}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":7,"why":"The knowledge base cannot decide 7 critical settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:a9e0ee79957045c23a463b07a97b52afc357b86ed2311d9024f40b66f15e8e40","kb_dependencies_sha256":"sha256:015d35ebcb41585433b3b03ff85346e2bb1ce130ac85ae7e90a2f4f6eeeef8d2"},"member_count":7,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E","source_family":"aws.opensearch","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW, UNSUPPORTED","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":3,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the access and encryption settings setting; the 7 settings of the record state their own.","source_observation":"The source states 7 critical settings on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this that the knowledge base cannot decide: Review the access and encryption settings setting; Review the credentials and keys settings setting; Review the domain credentials and keys setting; Review the domain settings setting; Review the fine grained access setting; Confirm the effect of a neighbouring OpenSearch domain policy; Review the OpenSearch domain policy resource setting.","generated_target_behavior":"Review the access and encryption settings setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect). Review the credentials and keys settings setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this. The plan refuses REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/credentials-and-keys-settings. Review the domain credentials and keys setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this. The plan refuses REF/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/domain-credentials-and-keys. Review the domain settings setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect). Review the fine grained access setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect). Confirm the effect of a neighbouring OpenSearch domain policy: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect). Review the OpenSearch domain policy resource setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect).","residual_difference":"Review the access and encryption settings setting: the target behaviour of this setting is not established Review the credentials and keys settings setting: the target behaviour of this setting is not established Review the domain credentials and keys setting: the target behaviour of this setting is not established Review the domain settings setting: the target behaviour of this setting is not established Review the fine grained access setting: the target behaviour of this setting is not established Confirm the effect of a neighbouring OpenSearch domain policy: the target behaviour of this setting is not established Review the OpenSearch domain policy resource setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-identity-architect now.","next_action":"Review the access and encryption settings setting: Review the access and encryption settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the access and encryption settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The access policy, free-form engine options, fine-grained access switches, encryption at rest and between nodes, the HTTPS and TLS policy of the endpoint and the engine version of the domain, read wherever they are set.","Review the credentials and keys settings setting: The mapping rule for this kind of unit found a setting the target has no counterpart for. The IAM master user, the master user name and password, the customer KMS key and the custom endpoint certificate, read where they are set whatever their value. STACKIT generates the OpenSearch credential (stackit_opensearch_credential username and password are computed), offers no customer KMS key for the instance and no custom endpoint certificate (pinned provider) - UNSUPPORTED; a password is never carried.","Review the domain credentials and keys setting: The mapping rule for this kind of unit found a setting the target has no counterpart for. STACKIT generates the OpenSearch credential (stackit_opensearch_credential username and password are computed), offers no customer KMS key for the instance and no custom endpoint certificate (pinned provider) — UNSUPPORTED.","Review the domain settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. stackit_opensearch_instance takes a plan (plan_name: nodes and storage), a version and parameters (sgw_acl, syslog, tls_protocols, tls_ciphers, etc.; pinned provider): the domain's node layout, zone awareness, storage, access policy, endpoint TLS and HTTPS settings, internal user database and log publishing are not generated — a person maps them to the plan and parameters — REVIEW.","Review the fine grained access setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether fine-grained access control, with users, roles and permissions inside the domain, is switched on.","Confirm the effect of a neighbouring OpenSearch domain policy: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_opensearch_domain_policy (search access policy) attaches an access policy to this domain, so who may reach and use it is decided by that policy and not by the domain's own settings.","Review the OpenSearch domain policy resource setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The domain's resource-based access policy, written as aws_opensearch_domain_policy (a part of the domain), has no counterpart on STACKIT OpenSearch."],"closes_when":["Review the access and encryption settings setting: A person maps each setting to the STACKIT OpenSearch instance, which has an access list, TLS protocols and ciphers and a version, but no policy document, no free-form option map and no encryption switch (pinned provider).","Review the credentials and keys settings setting: A person accepts the difference or the design changes: nothing in the source can make the target carry it.","Review the domain credentials and keys setting: A person accepts the difference or the design changes: nothing in the source can make the target carry it.","Review the domain settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Review the fine grained access setting: A person re-creates the access rules another way, because fine-grained IAM access has no equivalent on STACKIT OpenSearch, which offers an access list and credentials per instance.","Confirm the effect of a neighbouring OpenSearch domain policy: A person reads the policy the neighbour attaches and confirms that the replacing OpenSearch domain lets the same principals act on it, and no more, or that the access is dropped on purpose.","Review the OpenSearch domain policy resource setting: A person lists the principals and conditions the policy names, decides how their separation is kept (one instance per trust level, or in the application) and puts the source ranges into sgw_acl."],"required_inputs":[]}},{"id":"DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E","kind":"unit-review","family":"aws.opensearch","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.opensearch","block":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"NOT_CLASSIFIED","members":2}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":2,"why":"The knowledge base cannot decide 2 critical settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-network-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:efd09ed3163fcd2d1f8f02ae26a7794ec875cfcd3748cbee1def5e930d468b24","kb_dependencies_sha256":"sha256:75be6c240904ea2183ff076fce9ad6f41158d5bfba70b5f029090b67a9cf1315"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E","source_family":"aws.opensearch","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the network settings setting; the 2 settings of the record state their own.","source_observation":"The source states 2 critical settings on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this that the knowledge base cannot decide: Review the network settings setting; Review the private endpoint setting.","generated_target_behavior":"Review the network settings setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-network-architect). Review the private endpoint setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-network-architect).","residual_difference":"Review the network settings setting: the target behaviour of this setting is not established Review the private endpoint setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-network-architect now.","next_action":"Review the network settings setting: Review the network settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the network settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The VPC placement of the domain (subnet and security group ids, IP address type), read where it is set whatever its value. stackit_opensearch_instance has no network or subnet input; its access control is parameters.sgw_acl, a CIDR list (pinned provider) - REVIEW: a person translates the reachable networks into sgw_acl.","Review the private endpoint setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether the domain lives inside a VPC, with subnets and security groups, instead of behind a public endpoint."],"closes_when":["Review the network settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Review the private endpoint setting: A person translates the networks that may reach the domain into the access list (a list of CIDR ranges) of the STACKIT OpenSearch instance, which has no network or subnet input (pinned provider)."],"required_inputs":[]}},{"id":"DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E","kind":"unit-review","family":"aws.opensearch","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.opensearch","block":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1},{"cause":"NOT_CLASSIFIED","members":3}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:6624c3ac7454bc6f7584654b5457e914db689e9b03564a6ef798e8fd91f4c794","kb_dependencies_sha256":"sha256:b373a18848a30ad0874a5fec861e8845077b85460e746a25d0b9d44985e18101"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E","source_family":"aws.opensearch","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the cluster layout settings setting; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this that the knowledge base cannot decide: Review the cluster layout settings setting; Choose the database engine version; Review the storage settings setting; Confirm the domain name of the OpenSearch domain.","generated_target_behavior":"Review the cluster layout settings setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect). Choose the database engine version: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect). Review the storage settings setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect). Confirm the domain name of the OpenSearch domain: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect).","residual_difference":"Review the cluster layout settings setting: the target behaviour of this setting is not established Choose the database engine version: the target behaviour of this setting is not established Review the storage settings setting: the target behaviour of this setting is not established Confirm the domain name of the OpenSearch domain: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/open-settings-platform-architect now.","next_action":"Review the cluster layout settings setting: Review the cluster layout settings setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the cluster layout settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Every node-layout setting of the domain, read where it is set whatever its value (on, off, empty, a variable, a reference, a block written as an attribute object): instance count, dedicated masters, warm and cold storage, zone awareness and its zone count, multi-AZ with standby and the deployment strategy. A stackit_opensearch_instance takes a plan (plan_name) that fixes nodes, topology and storage, no zone-awareness or tier setting (pinned provider, the provider documentation of opensearch_instance) - REVIEW: a person picks the plan that matches the layout.","Choose the database engine version: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states which engine and version the OpenSearch domain runs: OpenSearch or legacy Elasticsearch, with its version number.","Review the storage settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether the data nodes use EBS volumes, read where it is set whatever its value. Storage of a stackit_opensearch_instance is defined by its plan (pinned provider, the provider documentation of opensearch_instance): no EBS switch - REVIEW: a person picks a plan whose disk fits the index size.","Confirm the domain name of the OpenSearch domain: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_opensearch_domain.domain_name: Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract). No semantic of this family has verified it as carried."],"closes_when":["Review the cluster layout settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Choose the database engine version: A person chooses the version of the STACKIT OpenSearch instance, which has a version setting (pinned provider), and checks that the domain's clients work with it.","Review the storage settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Confirm the domain name of the OpenSearch domain: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":[]}},{"id":"DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E","kind":"unit-review","family":"aws.opensearch","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.opensearch","block":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:caf9581bf513722f70799201583927c9f7d2aad376462690c78884ffb3e7913a","kb_dependencies_sha256":"sha256:b5e10b2382a319f48047d0166c4f698c92a41acf6803429131b6c8cb00c3f98e"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E","source_family":"aws.opensearch","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this that the knowledge base cannot decide: Review the encryption at rest setting.","generated_target_behavior":"Review the encryption at rest setting: The draft does not carry the setting on module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/encryption-at-rest).","residual_difference":"Review the encryption at rest setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this/encryption-at-rest now.","next_action":"Review the encryption at rest setting: Review the encryption at rest setting for module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the encryption at rest setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states whether the data the domain stores is encrypted at rest."],"closes_when":["Review the encryption at rest setting: A person confirms the encryption of the STACKIT OpenSearch instance on the target; the instance has no encryption setting (pinned provider), and no STACKIT fact about it is documented here."],"required_inputs":[]}},{"id":"DEC-DATA-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","kind":"unit-review","family":"aws.rds_cluster","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.rds_cluster","block":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Data Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"TARGET_LIMIT","members":1},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":2,"why":"The knowledge base cannot decide 2 critical settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-data-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:3ac0ea2fe4b2c89a0ba32b318fb09555b19d7908dee3884848002f6aaab52ca2","kb_dependencies_sha256":"sha256:5b13e5758572f5515974e89f2d84b9f3c1d0129e0f2e933bddac05a9567d5be5"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-DATA-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","source_family":"aws.rds_cluster","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Data Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"LEDGER, REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the backup retention setting; the 2 settings of the record state their own.","source_observation":"The source states 2 critical settings on module.dependencies.module.catalog_rds.aws_rds_cluster.this that the knowledge base cannot decide: Review the backup retention setting; Review the final snapshot setting.","generated_target_behavior":"Review the backup retention setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-data-architect). Review the final snapshot setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-data-architect).","residual_difference":"Review the backup retention setting: the target behaviour of this setting is not established Review the final snapshot setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-data-architect now.","next_action":"Review the backup retention setting: Review the backup retention setting for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the backup retention setting: Whether the draft carries this setting is decided by its semantic ledger entry \"backup retention\", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). A retention not visible statically (a variable) is read by no fact and the draft carries nothing for it: a person compares it with the target's backup retention (REVIEW).","Review the final snapshot setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no final snapshot or delete-time backup setting (pinned provider): it is deleted when Terraform destroys it — a person decides how data survives a destroy (export first) — REVIEW."],"closes_when":["Review the backup retention setting: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.","Review the final snapshot setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":[]}},{"id":"DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","kind":"unit-review","family":"aws.rds_cluster","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.rds_cluster","block":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-68b3deada0c7","subject":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:30cbded70d6861ce65a80938e1025f6e3f6b4b28ba08fb7268b5246df0f1c22b","kb_dependencies_sha256":"sha256:c4835a8b93fcba2849eaacdf4e71de6d98768797036cbb48f0b6210387745322"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","source_family":"aws.rds_cluster","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","kind":"unit-review","family":"aws.rds_cluster","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.rds_cluster","block":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":3}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":3,"shape":"RSH-dca9c6bbf7d1","subject":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:08ef1795fb2ca2f1693f6c9f9ca0f87f030551d26b59f47d9f5e242c34a5a85d","kb_dependencies_sha256":"sha256:f0163b390163c9abfb66c9c2e5830428595abbd5806227eb0ace7abc628c1c45"},"member_count":3,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","source_family":"aws.rds_cluster","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","kind":"unit-review","family":"aws.rds_cluster","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.rds_cluster","block":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":2},{"cause":"NOT_CLASSIFIED","members":3}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":5,"why":"The knowledge base cannot decide 5 critical settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:04c13bb75bcc4b3f06e8a9be6649f1aa33f1783b80e228945967077a7b7f440d","kb_dependencies_sha256":"sha256:3141dd436e156b462d4a71ba5ebd86efdfe3091a9d43db74d443498d9b3853d5"},"member_count":5,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","source_family":"aws.rds_cluster","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Choose the database engine; the 5 settings of the record state their own.","source_observation":"The source states 5 critical settings on module.dependencies.module.catalog_rds.aws_rds_cluster.this that the knowledge base cannot decide: Choose the database engine; Choose the database engine version; Review the member engine setting; Confirm the database name of the RDS cluster; Confirm the identifier of the RDS cluster instance.","generated_target_behavior":"Choose the database engine: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect). Choose the database engine version: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect). Review the member engine setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect). Confirm the database name of the RDS cluster: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect). Confirm the identifier of the RDS cluster instance: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect).","residual_difference":"Choose the database engine: the target behaviour of this setting is not established Choose the database engine version: the target behaviour of this setting is not established Review the member engine setting: the target behaviour of this setting is not established Confirm the database name of the RDS cluster: the target behaviour of this setting is not established Confirm the identifier of the RDS cluster instance: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-platform-architect now.","next_action":"Choose the database engine: Choose the database engine for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Choose the database engine: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The database engine of the cluster (Aurora PostgreSQL, Aurora MySQL, or a Multi-AZ cluster on PostgreSQL or MySQL), which decides the STACKIT database service it lands on.","Choose the database engine version: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The version of the database engine that the cluster runs.","Review the member engine setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Cluster members must run the cluster's engine and version (AWS), which the draft follows (TODO when a member states another): the members' engine and version are what the cluster's engine and the engine version setting decide — TRANSFORMED/PRESERVED for a supported PostgreSQL version, REVIEW otherwise.","Confirm the database name of the RDS cluster: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster.database_name: Name of the initial database created in the cluster; application setup. No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract).","Confirm the identifier of the RDS cluster instance: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster_instance.identifier (a facet of the unit): Name of the instance; it identifies the resource and changes no access, encryption, backup or availability behaviour. No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract)."],"closes_when":["Choose the database engine: For a MySQL-compatible cluster a person tests the schemas and queries on STACKIT MariaDB, the closest managed engine, because STACKIT has no MySQL product; for a PostgreSQL cluster, which lands on PostgreSQL Flex, a person confirms that no Aurora-only feature (storage auto-scaling, fast clones, global databases, serverless v2 scaling) is relied on.","Choose the database engine version: For a PostgreSQL cluster a person picks a major version that PostgreSQL Flex offers (14 to 18; 18 is beta in eu01, so production needs 17 or a generally available 18) and plans an upgrade for any other version. For a MySQL-compatible cluster a person tests the MySQL 8 features in use on STACKIT MariaDB.","Review the member engine setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Confirm the database name of the RDS cluster: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Confirm the identifier of the RDS cluster instance: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":[]}},{"id":"DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","kind":"unit-review","family":"aws.rds_cluster","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.rds_cluster","block":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":2},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":3,"why":"The knowledge base cannot decide 3 critical settings of module.dependencies.module.catalog_rds.aws_rds_cluster.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect.","required_evidence":["for storing the password in STACKIT Secrets Manager: the Secrets Manager instance and the way the secret is written there","who hands the new credentials to the clients (every connection setting that holds the source password), and where the clients read them from after the cutover"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:83e2e9a6dde82e51cd66d9801c1c5f0f3264133cdd53c48904171583c84daf89","kb_dependencies_sha256":"sha256:1551bdcb47c689bbe49c9efbfa4e802a66189277f47e4cacfda15e3dac5d2222"},"member_count":3,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-RDS-CLUSTER-THIS","source_family":"aws.rds_cluster","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[{"id":"admin-password/use-the-password-stackit-generates","title":"Decide how the administrator password is supplied: Use the password STACKIT generates for the database user","prerequisites":[],"effects":["The draft writes the database user (stackit_postgresflex_user, stackit_sqlserverflex_user, stackit_mariadb_credential or stackit_mongodbflex_user) and STACKIT generates its password at the apply. The draft exposes it as the sensitive output \u003cunit\u003e_admin_password (a reference to the resource, never a value, and no password in any file of the package); the state holds it in plain text, so the state is a secret. The source password and its Secrets Manager management are not copied and the clients get new credentials: after the apply a person reads the output, puts it into the connection settings of every client (a cutover action) and keeps it in the secret store the customer uses. This is the default the draft writes. A review records the choice; the new credentials reaching the clients stays the manual work of the record."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_user.md#L42-L61","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L460-L482"],"regeneration_required":false},{"id":"admin-password/store-the-generated-password-in-secrets-manager","title":"Decide how the administrator password is supplied: Store the generated password in STACKIT Secrets Manager","prerequisites":[],"effects":["The password is still generated by STACKIT and exposed by the draft as the sensitive output \u003cunit\u003e_admin_password; in addition a person writes it into a secret of a STACKIT Secrets Manager instance after the apply and lets the clients read it there. The draft creates no secret: the provider documentation lists stackit_secretsmanager_instance, stackit_secretsmanager_user and two role bindings and no secret resource (searched), so writing the secret is work outside the Terraform draft; the pages read do not describe the write steps (not stated). The source's rotation schedule is not carried either way."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/tree/v0.119.0/docs/resources","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_user.md#L42-L61"],"regeneration_required":false}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_user.md#L42-L61","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L460-L482","https://github.com/stackitcloud/terraform-provider-stackit/tree/v0.119.0/docs/resources"],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Decide how the administrator password is supplied; the 3 settings of the record state their own.","source_observation":"The source states 3 critical settings on module.dependencies.module.catalog_rds.aws_rds_cluster.this that the knowledge base cannot decide: Decide how the administrator password is supplied; Review the parameter and option groups setting; Review the storage encryption setting.","generated_target_behavior":"Decide how the administrator password is supplied: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect). Review the parameter and option groups setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect). Review the storage encryption setting: The draft does not carry the setting on module.dependencies.module.catalog_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect).","residual_difference":"Decide how the administrator password is supplied: the target behaviour of this setting is not established Review the parameter and option groups setting: the target behaviour of this setting is not established Review the storage encryption setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.module.catalog_rds.aws_rds_cluster.this/open-settings-security-architect now.","next_action":"Decide how the administrator password is supplied: Decide how the administrator password is supplied for module.dependencies.module.catalog_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Decide how the administrator password is supplied: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The source password (or its Secrets Manager management) is never copied, and no STACKIT database user takes a password: stackit_postgresflex_user and stackit_mariadb_credential compute it (password is computed and sensitive, pinned provider) and the create-user API of PostgreSQL Flex has no password field.","Review the parameter and option groups setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no parameter-group or option-group attribute (pinned provider): the group's settings (even a default.* group of the source engine) must be mapped to the STACKIT instance's options by a person — REVIEW.","Review the storage encryption setting: A check of the knowledge base (aurora storage encrypted mariadb) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states whether the storage of the database cluster is encrypted at rest, with the AWS-managed key because no customer key is named."],"closes_when":["Decide how the administrator password is supplied: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Review the parameter and option groups setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Review the storage encryption setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person confirms the at-rest encryption of the target database on STACKIT: the PostgreSQL Flex encryption block covers customer keys only and the default without it is not stated, and a MariaDB sandbox instance had database-level encryption off, so whether its volumes are encrypted is not stated (pinned provider)."],"required_inputs":["who hands the new credentials to the clients (every connection setting that holds the source password), and where the clients read them from after the cutover","for storing the password in STACKIT Secrets Manager: the Secrets Manager instance and the way the secret is written there"]}},{"id":"DEC-DATA-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","kind":"unit-review","family":"aws.rds_cluster","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.rds_cluster","block":"module.dependencies.module.orders_rds.aws_rds_cluster.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Data Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"TARGET_LIMIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of module.dependencies.module.orders_rds.aws_rds_cluster.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:c9776a97d7c44508822e47ba0976fac039372b9a459319ac8420e0010f5391f0","kb_dependencies_sha256":"sha256:7582d365b5cf18a48a8578bf2e9673a1a1590455fd67d128c7917dd1e54f2cdb"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-DATA-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","source_family":"aws.rds_cluster","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Data Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on module.dependencies.module.orders_rds.aws_rds_cluster.this that the knowledge base cannot decide: Review the final snapshot setting.","generated_target_behavior":"Review the final snapshot setting: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-snapshot).","residual_difference":"Review the final snapshot setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/final-snapshot now.","next_action":"Review the final snapshot setting: Review the final snapshot setting for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the final snapshot setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no final snapshot or delete-time backup setting (pinned provider): it is deleted when Terraform destroys it — a person decides how data survives a destroy (export first) — REVIEW."],"closes_when":["Review the final snapshot setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":[]}},{"id":"DEC-IAM-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","kind":"unit-review","family":"aws.rds_cluster","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.rds_cluster","block":"module.dependencies.module.orders_rds.aws_rds_cluster.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-68b3deada0c7","subject":"module.dependencies.module.orders_rds.aws_rds_cluster.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:56a8b21cfab709656b73f9d44bc0f7560aad7fc1566c66d5cd5addcb8bd1753c","kb_dependencies_sha256":"sha256:c4835a8b93fcba2849eaacdf4e71de6d98768797036cbb48f0b6210387745322"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","source_family":"aws.rds_cluster","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","kind":"unit-review","family":"aws.rds_cluster","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.rds_cluster","block":"module.dependencies.module.orders_rds.aws_rds_cluster.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":3}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":3,"shape":"RSH-dca9c6bbf7d1","subject":"module.dependencies.module.orders_rds.aws_rds_cluster.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:b3c81382b03c6c736acc4d26ff3e92a4345e4df4789e0623bd0f59c9b345b926","kb_dependencies_sha256":"sha256:f0163b390163c9abfb66c9c2e5830428595abbd5806227eb0ace7abc628c1c45"},"member_count":3,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","source_family":"aws.rds_cluster","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-OPS-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","kind":"unit-review","family":"aws.rds_cluster","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.rds_cluster","block":"module.dependencies.module.orders_rds.aws_rds_cluster.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"confirm_only_members":1,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":2}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":2,"why":"The knowledge base cannot decide 2 critical settings of module.dependencies.module.orders_rds.aws_rds_cluster.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is carried by the draft already: a person only confirms it.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:5fbeb2619f0e2cfb47bde72a31bb3e3a1f5543ba5914660763055c373724e0c8","kb_dependencies_sha256":"sha256:282d05fd56a28cd5bff146421fbd0febc7842ab3637ae182b9f279576b47992f"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","source_family":"aws.rds_cluster","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":2,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm the identifier of the RDS cluster instance; the 2 settings of the record state their own.","source_observation":"The source states 2 critical settings on module.dependencies.module.orders_rds.aws_rds_cluster.this that the knowledge base cannot decide: Confirm the database name of the RDS cluster; Confirm the identifier of the RDS cluster instance.","generated_target_behavior":"Confirm the database name of the RDS cluster: The draft carries it on module.dependencies.module.orders_rds.aws_rds_cluster.this: step TF/stackit_postgresflex_database.dependencies_orders_rds_this_orders (the source `database_name` = `orders` is written as `name` = `orders` by the draft (`terraform/data.tf`, block `stackit_postgresflex_database.dependencies_orders_rds_this_orders`): the value is the source's, the connection strings of the application that name the database are a person's to confirm). Confirm the identifier of the RDS cluster instance: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/tcf-rds-cluster-instance--identifier).","residual_difference":"Confirm the database name of the RDS cluster: a person confirms that the carried value is what the source relies on Confirm the identifier of the RDS cluster instance: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/tcf-rds-cluster-instance--identifier now.","next_action":"Confirm the identifier of the RDS cluster instance: Confirm the identifier of the RDS cluster instance for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Confirm the database name of the RDS cluster: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster.database_name: Name of the initial database created in the cluster; application setup. No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract).","Confirm the identifier of the RDS cluster instance: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_rds_cluster_instance.identifier (a facet of the unit): Name of the instance; it identifies the resource and changes no access, encryption, backup or availability behaviour. No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract)."],"closes_when":["Confirm the database name of the RDS cluster: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Confirm the identifier of the RDS cluster instance: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":[]}},{"id":"DEC-SEC-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","kind":"unit-review","family":"aws.rds_cluster","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.rds_cluster","block":"module.dependencies.module.orders_rds.aws_rds_cluster.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":2},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":3,"why":"The knowledge base cannot decide 3 critical settings of module.dependencies.module.orders_rds.aws_rds_cluster.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect.","required_evidence":["for storing the password in STACKIT Secrets Manager: the Secrets Manager instance and the way the secret is written there","who hands the new credentials to the clients (every connection setting that holds the source password), and where the clients read them from after the cutover"],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:ab8f2937699001b60dad6a667cbc1e25d1e136bd735d58b05008f2a9eb3b0d60","kb_dependencies_sha256":"sha256:1551bdcb47c689bbe49c9efbfa4e802a66189277f47e4cacfda15e3dac5d2222"},"member_count":3,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","source_family":"aws.rds_cluster","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[{"id":"admin-password/use-the-password-stackit-generates","title":"Decide how the administrator password is supplied: Use the password STACKIT generates for the database user","prerequisites":[],"effects":["The draft writes the database user (stackit_postgresflex_user, stackit_sqlserverflex_user, stackit_mariadb_credential or stackit_mongodbflex_user) and STACKIT generates its password at the apply. The draft exposes it as the sensitive output \u003cunit\u003e_admin_password (a reference to the resource, never a value, and no password in any file of the package); the state holds it in plain text, so the state is a secret. The source password and its Secrets Manager management are not copied and the clients get new credentials: after the apply a person reads the output, puts it into the connection settings of every client (a cutover action) and keeps it in the secret store the customer uses. This is the default the draft writes. A review records the choice; the new credentials reaching the clients stays the manual work of the record."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_user.md#L42-L61","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L460-L482"],"regeneration_required":false},{"id":"admin-password/store-the-generated-password-in-secrets-manager","title":"Decide how the administrator password is supplied: Store the generated password in STACKIT Secrets Manager","prerequisites":[],"effects":["The password is still generated by STACKIT and exposed by the draft as the sensitive output \u003cunit\u003e_admin_password; in addition a person writes it into a secret of a STACKIT Secrets Manager instance after the apply and lets the clients read it there. The draft creates no secret: the provider documentation lists stackit_secretsmanager_instance, stackit_secretsmanager_user and two role bindings and no secret resource (searched), so writing the secret is work outside the Terraform draft; the pages read do not describe the write steps (not stated). The source's rotation schedule is not carried either way."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/tree/v0.119.0/docs/resources","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_user.md#L42-L61"],"regeneration_required":false}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/postgresflex_user.md#L42-L61","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/postgres-flex/v3/postgres-flex.json#L460-L482","https://github.com/stackitcloud/terraform-provider-stackit/tree/v0.119.0/docs/resources"],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Decide how the administrator password is supplied; the 3 settings of the record state their own.","source_observation":"The source states 3 critical settings on module.dependencies.module.orders_rds.aws_rds_cluster.this that the knowledge base cannot decide: Decide how the administrator password is supplied; Review the parameter and option groups setting; Review the storage encryption setting.","generated_target_behavior":"Decide how the administrator password is supplied: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect). Review the parameter and option groups setting: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect). Review the storage encryption setting: The draft does not carry the setting on module.dependencies.module.orders_rds.aws_rds_cluster.this; a manual step stands for it (MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect).","residual_difference":"Decide how the administrator password is supplied: the target behaviour of this setting is not established Review the parameter and option groups setting: the target behaviour of this setting is not established Review the storage encryption setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.dependencies.module.orders_rds.aws_rds_cluster.this/open-settings-security-architect now.","next_action":"Decide how the administrator password is supplied: Decide how the administrator password is supplied for module.dependencies.module.orders_rds.aws_rds_cluster.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Decide how the administrator password is supplied: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The source password (or its Secrets Manager management) is never copied, and no STACKIT database user takes a password: stackit_postgresflex_user and stackit_mariadb_credential compute it (password is computed and sensitive, pinned provider) and the create-user API of PostgreSQL Flex has no password field.","Review the parameter and option groups setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The STACKIT database resource has no parameter-group or option-group attribute (pinned provider): the group's settings (even a default.* group of the source engine) must be mapped to the STACKIT instance's options by a person — REVIEW.","Review the storage encryption setting: A check of the knowledge base (aurora storage encrypted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states whether the storage of the database cluster is encrypted at rest, with the AWS-managed key because no customer key is named."],"closes_when":["Decide how the administrator password is supplied: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Review the parameter and option groups setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Review the storage encryption setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person confirms the at-rest encryption of the target database on STACKIT: the PostgreSQL Flex encryption block covers customer keys only and the default without it is not stated, and a MariaDB sandbox instance had database-level encryption off, so whether its volumes are encrypted is not stated (pinned provider)."],"required_inputs":["who hands the new credentials to the clients (every connection setting that holds the source password), and where the clients read them from after the cutover","for storing the password in STACKIT Secrets Manager: the Secrets Manager instance and the way the secret is written there"]}},{"id":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE","kind":"unit-review","family":"aws.route_table","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.route_table","block":"module.vpc.module.vpc.aws_route_table.private","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"conditional_members":8,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":5},{"cause":"TARGET_LIMIT","members":2},{"cause":"EVIDENCE_GAP","members":1}],"blocker_class":"OPTIONAL_CONDITIONAL","item_count":8,"why":"The knowledge base cannot decide 8 critical settings of module.vpc.module.vpc.aws_route_table.private: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 8 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them. The review step of the execution plan for these settings is MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:1561d4bf75d1713671e851b18f2c392b9346c65555cab9b2398ea2763bc5b3d6","kb_dependencies_sha256":"sha256:d2e1fb89315cf21674a6dea0b0b74b073d58e672b7d0724a1a663b3d68f19d9f"},"member_count":8,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PRIVATE","source_family":"aws.route_table","source_semantic":"unit-review","affected_application":[],"action_type":"ACCEPT_DIFFERENCE","work_package":"private-egress-dns","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"egress-restriction/verify-on-target","title":"Decide the outbound (egress) rules of the security group: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.route_table/egress-restriction: \"A person confirms that the servers of the private subnets keep a restricting egress rule set in their security groups, because on STACKIT the restriction of egress is carried by egress rules, not by a route.\""],"regeneration_required":true},{"id":"nat-fixed-egress-address/accept-the-difference","title":"Review the NAT fixed egress address setting: Accept the documented difference","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["The owner records that the target does not reproduce the setting and that the workload accepts it; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["What the setting protected on the source (data, access, availability) is not protected on the target in the same way."],"evidence":["contract note aws.route_table/nat-fixed-egress-address: \"A person accepts the project's shared egress address, which can change and cannot be set, or gives each server a STACKIT public IP when a third party allow-lists the old address.\""],"regeneration_required":true},{"id":"network-topology-boundary/verify-on-target","title":"Confirm that the project is the boundary of one network: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.route_table/edge-association: \"Ingress routing of the traffic entering through a gateway (aws_route_table_association gateway_id, AWS::EC2::GatewayRouteTableAssociation); no STACKIT counterpart is evidenced in the pinned provider.\""],"regeneration_required":true},{"id":"route-destinations/keep-default-routing-outside-area","title":"Confirm the destinations of the routes: Keep STACKIT's default routing in a project outside a Network Area","prerequisites":["every route of the table sends traffic to an internet gateway (a default-only table)","the target project is created outside a Network Area"],"effects":["No routing table is written; every network reaches the internet through source NAT and the networks of the project reach each other."],"risk":["A server without a public IP gains outbound internet through the network's shared address, which the source's internet gateway did not give it."],"evidence":["decision kind stackitroute.NAT_FIXED_EGRESS_ADDRESS_LOST of the knowledge base: \"Every subnet is routed to the public internet. Technically this is done by source NAT (SNAT) in combination with masquerading.\"","a test on a STACKIT project on 2026-10-10: \"Observed: the address a server leaves by follows its NIC's public IP (own address) or, without one, the network's `publicIp`\"","a test on a STACKIT project on 2026-10-10: \"Not inferred: a routing table. The API shows none and the probe makes no statement about the table of a Network Area; only that the connectivity exists without one in this project.\""],"regeneration_required":false},{"id":"route-destinations/draft-a-routing-table-in-a-network-area","title":"Confirm the destinations of the routes: Place the workload in a Network Area and carry the routes in a routing table","prerequisites":["a Network Area for the target project (an organisation-level decision; whether a project can join an area after creation is not stated in the sources read)","the complete route set, with a STACKIT next hop for each route"],"effects":["A stackit_routing_table with stackit_routing_table_route resources (IPv4 CIDR destinations only) is assigned to the routed networks."],"risk":["The resource is experimental and may change; IPv6 routes and routes to NAT, transit or peering targets have no counterpart."],"evidence":["STACKIT provider schema 0.120.0: \"This resource is for SNA, not VPC, based networks.\"","STACKIT provider schema 0.120.0: \"is part of the experimental feature routing-tables\"","STACKIT provider schema 0.120.0: \"Only `cidrv4` is supported during experimental stage.\"","STACKIT provider schema 0.120.0: \"Type of the next hop. Possible values are: `blackhole`, `internet`, `ipv4`, `ipv6`.\"","decision kind stackitroute.route-set of the knowledge base: \"Each STACKIT Network Area includes one default routing table. STACKIT creates this table automatically when you create a new environment. All routed networks follow the default table unless you assign a different one.\""],"regeneration_required":true},{"id":"route-targets/keep-default-routing-outside-area","title":"Confirm the targets of the routes: Keep STACKIT's default routing in a project outside a Network Area","prerequisites":["every route of the table sends traffic to an internet gateway (a default-only table)","the target project is created outside a Network Area"],"effects":["No routing table is written; every network reaches the internet through source NAT and the networks of the project reach each other."],"risk":["A server without a public IP gains outbound internet through the network's shared address, which the source's internet gateway did not give it."],"evidence":["decision kind stackitroute.NAT_FIXED_EGRESS_ADDRESS_LOST of the knowledge base: \"Every subnet is routed to the public internet. Technically this is done by source NAT (SNAT) in combination with masquerading.\"","a test on a STACKIT project on 2026-10-10: \"Observed: the address a server leaves by follows its NIC's public IP (own address) or, without one, the network's `publicIp`\"","a test on a STACKIT project on 2026-10-10: \"Not inferred: a routing table. The API shows none and the probe makes no statement about the table of a Network Area; only that the connectivity exists without one in this project.\""],"regeneration_required":false},{"id":"route-targets/draft-a-routing-table-in-a-network-area","title":"Confirm the targets of the routes: Place the workload in a Network Area and carry the routes in a routing table","prerequisites":["a Network Area for the target project (an organisation-level decision; whether a project can join an area after creation is not stated in the sources read)","the complete route set, with a STACKIT next hop for each route"],"effects":["A stackit_routing_table with stackit_routing_table_route resources (IPv4 CIDR destinations only) is assigned to the routed networks."],"risk":["The resource is experimental and may change; IPv6 routes and routes to NAT, transit or peering targets have no counterpart."],"evidence":["STACKIT provider schema 0.120.0: \"This resource is for SNA, not VPC, based networks.\"","STACKIT provider schema 0.120.0: \"is part of the experimental feature routing-tables\"","STACKIT provider schema 0.120.0: \"Only `cidrv4` is supported during experimental stage.\"","STACKIT provider schema 0.120.0: \"Type of the next hop. Possible values are: `blackhole`, `internet`, `ipv4`, `ipv6`.\"","decision kind stackitroute.route-set of the knowledge base: \"Each STACKIT Network Area includes one default routing table. STACKIT creates this table automatically when you create a new environment. All routed networks follow the default table unless you assign a different one.\""],"regeneration_required":true},{"id":"routes/keep-default-routing-outside-area","title":"Re-create the routes with STACKIT next hops: Keep STACKIT's default routing in a project outside a Network Area","prerequisites":["every route of the table sends traffic to an internet gateway (a default-only table)","the target project is created outside a Network Area"],"effects":["No routing table is written; every network reaches the internet through source NAT and the networks of the project reach each other."],"risk":["A server without a public IP gains outbound internet through the network's shared address, which the source's internet gateway did not give it."],"evidence":["decision kind stackitroute.NAT_FIXED_EGRESS_ADDRESS_LOST of the knowledge base: \"Every subnet is routed to the public internet. Technically this is done by source NAT (SNAT) in combination with masquerading.\"","a test on a STACKIT project on 2026-10-10: \"Observed: the address a server leaves by follows its NIC's public IP (own address) or, without one, the network's `publicIp`\"","a test on a STACKIT project on 2026-10-10: \"Not inferred: a routing table. The API shows none and the probe makes no statement about the table of a Network Area; only that the connectivity exists without one in this project.\""],"regeneration_required":false},{"id":"routes/draft-a-routing-table-in-a-network-area","title":"Re-create the routes with STACKIT next hops: Place the workload in a Network Area and carry the routes in a routing table","prerequisites":["a Network Area for the target project (an organisation-level decision; whether a project can join an area after creation is not stated in the sources read)","the complete route set, with a STACKIT next hop for each route"],"effects":["A stackit_routing_table with stackit_routing_table_route resources (IPv4 CIDR destinations only) is assigned to the routed networks."],"risk":["The resource is experimental and may change; IPv6 routes and routes to NAT, transit or peering targets have no counterpart."],"evidence":["STACKIT provider schema 0.120.0: \"This resource is for SNA, not VPC, based networks.\"","STACKIT provider schema 0.120.0: \"is part of the experimental feature routing-tables\"","STACKIT provider schema 0.120.0: \"Only `cidrv4` is supported during experimental stage.\"","STACKIT provider schema 0.120.0: \"Type of the next hop. Possible values are: `blackhole`, `internet`, `ipv4`, `ipv6`.\"","decision kind stackitroute.route-set of the knowledge base: \"Each STACKIT Network Area includes one default routing table. STACKIT creates this table automatically when you create a new environment. All routed networks follow the default table unless you assign a different one.\""],"regeneration_required":true},{"id":"subnet-association-target/decide-and-carry-out","title":"Confirm what each route table is associated with: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.","regeneration: not stated — treated as required"],"risk":["The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes."],"evidence":["contract note aws.route_table/subnet-association-target: \"A person decides which networks of the Network Area take the routing table and sets routing_table_id on them: STACKIT attaches a routing table to a whole network (stackit_network.routing_table_id), there is no per-subnet association, and routing tables apply only to routed Layer 3 networks in a Network Area.\""],"regeneration_required":true},{"id":"tcr-route-table-vpc-id/one-project-per-vpc","title":"Confirm the network of the route table: Keep one project per VPC with STACKIT's default routing","prerequisites":["one VPC in the estate","the project created outside a Network Area"],"effects":["The project's networks are the VPC's subnets; no table is written."],"risk":["As for the routes of the table: the default routing is observed equivalent only outside a Network Area."],"evidence":["contract note aws.route_table/tcr-route-table-vpc-id: \"the project the draft creates is that VPC's boundary\""],"regeneration_required":false},{"id":"tcr-route-table-vpc-id/assign-the-table-to-networks","title":"Confirm the network of the route table: Assign the routing table to the networks of the Network Area it should govern","prerequisites":["the Network Area the project joins","the networks that take the table"],"effects":["Each network that takes the table carries its id; a table is assigned per network, there is no per-subnet association."],"risk":["A network left without the table follows the area's default table."],"evidence":["STACKIT provider schema 0.120.0: \"The ID of the routing table associated with the network.\""],"regeneration_required":true}],"required_verification":["Decide the outbound (egress) rules of the security group: the check, proof or closing evidence is recorded with its result","Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result","Confirm the destinations of the routes: reachability observed on the target: the internet, the other networks, and nothing the source did not reach","Confirm the targets of the routes: reachability observed on the target: the internet, the other networks, and nothing the source did not reach","Re-create the routes with STACKIT next hops: reachability observed on the target: the internet, the other networks, and nothing the source did not reach","Confirm what each route table is associated with: the decision or the manual work is done and recorded (who, when, what was configured and why)","Confirm the network of the route table: the routing of each target network observed on the target"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes.","Nothing from an answer: no input topic carries routes. A bound target environment that places the project in a Network Area, or states an egress other than STACKIT's default routing, reopens the default-routing equivalence (see the plan's statement that no routing table is drafted).","Nothing from an answer: no input topic carries a Network Area; a bound target environment's placement changes what the draft writes for routing."],"remains_manual":["Decide the outbound (egress) rules of the security group: Manual work remains: a person closes the semantic, the draft does not.","Review the NAT fixed egress address setting: Manual work remains: a person closes the semantic, the draft does not.","Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.","Confirm the destinations of the routes: Manual work remains: a person closes the semantic, the draft does not.","Confirm the targets of the routes: Manual work remains: a person closes the semantic, the draft does not.","Re-create the routes with STACKIT next hops: Manual work remains: a person closes the semantic, the draft does not.","Confirm what each route table is associated with: Manual work remains: a person closes the semantic, the draft does not.","Confirm the network of the route table: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.route_table/egress-restriction: \"A person confirms that the servers of the private subnets keep a restricting egress rule set in their security groups, because on STACKIT the restriction of egress is carried by egress rules, not by a route.\"","contract note aws.route_table/inbound-none: \"A person confirms the draft's project stays outside a Network Area and that no server of the private subnets is given a public IP; inside a Network Area the absence of an inbound path is not observed.\"","contract note aws.route_table/nat-fixed-egress-address: \"A person accepts the project's shared egress address, which can change and cannot be set, or gives each server a STACKIT public IP when a third party allow-lists the old address.\"","contract note aws.route_table/edge-association: \"Ingress routing of the traffic entering through a gateway (aws_route_table_association gateway_id, AWS::EC2::GatewayRouteTableAssociation); no STACKIT counterpart is evidenced in the pinned provider.\"","contract note aws.route_table/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"","contract note aws.route_table/route-set-completeness: \"A person confirms that nothing outside the scan adds routes to the table (a virtual private gateway propagation, a route server, a route a variable switches on, a route type the scan does not model), or lists those routes.\"","contract note aws.route_table/vpn-propagation: \"Non-empty propagating_vgws (or a propagation resource) is REVIEW.\"","contract note aws.route_table/routes: \"Custom routes map to stackit_routing_table_route, an experimental resource (experiment routing-tables); next hops that name AWS gateways are chosen anew.\"","provider-docs mirror stackit/docs.stackit.cloud/products/network/core-networking/network-area/faq.html: \"Currently we do not support this, however there are plans to enable this in the future.\"","contract note aws.route_table/subnet-association-target: \"A person decides which networks of the Network Area take the routing table and sets routing_table_id on them: STACKIT attaches a routing table to a whole network (stackit_network.routing_table_id), there is no per-subnet association, and routing tables apply only to routed Layer 3 networks in a Network Area.\"","contract note aws.route_table/tcr-route-table-vpc-id: \"The VPC whose subnets this route table's rules apply to;\""],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the NAT fixed egress address setting; the 8 settings of the record state their own.","source_observation":"The source states 8 critical settings on module.vpc.module.vpc.aws_route_table.private that the knowledge base cannot decide: Decide the outbound (egress) rules of the security group; Review the NAT fixed egress address setting; Confirm that the project is the boundary of one network; Confirm the destinations of the routes; Confirm the targets of the routes; Re-create the routes with STACKIT next hops; Confirm what each route table is associated with; Confirm the network of the route table.","generated_target_behavior":"Decide the outbound (egress) rules of the security group: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the NAT fixed egress address setting: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the destinations of the routes: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings). A table whose routes all go to an internet gateway is replaced by STACKIT's default routing and no table is drafted, with the precondition that the project is created outside a Network Area (the plan's statement that no routing table is drafted). A custom table is drafted as a stackit_routing_table of a Network Area with the routes it can carry; every other route is named \"not carried\" in the Terraform comments. Confirm the targets of the routes: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings). A table whose routes all go to an internet gateway is replaced by STACKIT's default routing and no table is drafted, with the precondition that the project is created outside a Network Area (the plan's statement that no routing table is drafted). A custom table is drafted as a stackit_routing_table of a Network Area with the routes it can carry; every other route is named \"not carried\" in the Terraform comments. Re-create the routes with STACKIT next hops: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings). A table whose routes all go to an internet gateway is replaced by STACKIT's default routing and no table is drafted, with the precondition that the project is created outside a Network Area (the plan's statement that no routing table is drafted). A custom table is drafted as a stackit_routing_table of a Network Area with the routes it can carry; every other route is named \"not carried\" in the Terraform comments. Confirm what each route table is associated with: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the network of the route table: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings). With one VPC the project stands for it and the default routing applies (nothing drafted); a custom table is drafted at Network Area scope.","residual_difference":"Decide the outbound (egress) rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the NAT fixed egress address setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the destinations of the routes: That the target networks reach what the source routes reached and nothing more: the default routing of a Network Area was never read, and the equivalence outside an area was observed in one STACKIT test project only. Confirm the targets of the routes: That the target networks reach what the source routes reached and nothing more: the default routing of a Network Area was never read, and the equivalence outside an area was observed in one STACKIT test project only. Re-create the routes with STACKIT next hops: That the target networks reach what the source routes reached and nothing more: the default routing of a Network Area was never read, and the equivalence outside an area was observed in one STACKIT test project only. Confirm what each route table is associated with: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the network of the route table: Which STACKIT networks the routing rules govern.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.vpc.module.vpc.aws_route_table.private/open-settings now.","next_action":"Review the NAT fixed egress address setting: Review the NAT fixed egress address setting for module.vpc.module.vpc.aws_route_table.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Decide the outbound (egress) rules of the security group: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The restriction of egress to the NAT gateway (the only way out of a private subnet) is carried on STACKIT by the egress rules of the security groups, not by a route (the test of 2026-10-10: with egress rules for one /32 only that destination was reachable, with none nothing left). Whether the source restricts egress that way, and whether the draft carries those rules for the servers of this table's subnets, is not something this contract can read, so it is REVIEW and never PRESERVED: a person confirms that the servers of the private subnets keep a restricting egress rule set.","Review the NAT fixed egress address setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. NOT CARRIED, an observed loss (the test of 2026-10-10): the NAT gateway's fixed egress address.","Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this route table included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.","Confirm the destinations of the routes: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Destinations are read by value: every route of a default-only table sends 0.0.0.0/0 to an internet or NAT gateway — STACKIT's default network routing, observed equivalent for a draft outside a Network Area (the test of 2026-10-10) and REVIEW all the same.","Confirm the targets of the routes: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The next hop of each route of the table: a route whose target is anything but an internet or NAT gateway, or that names none, makes the table a custom routing table.","Re-create the routes with STACKIT next hops: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Custom routes map to stackit_routing_table_route, an experimental resource (experiment routing-tables); next hops that name AWS gateways are chosen anew.","Confirm what each route table is associated with: A check of the knowledge base (rt private subnet association) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states which subnet uses this route table, for the associations the draft does not attach.","Confirm the network of the route table: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). aws_route_table.vpc_id: The VPC whose subnets this route table's rules apply to; a route table's entries only make sense, and only affect reachability, within this one VPC, so losing or mismapping it silently changes which network the routing rules govern. A custom table is REVIEW whatever the estate: the draft's stackit_routing_table is organisation and Network Area scoped (organization_id, network_area_id, pinned provider), not a resource of the project that is the VPC's boundary (the experimental stackit_vpc_routing_table, pinned provider: project_id, vpc_id, is a VPC-scoped table that the draft does not write and that nothing establishes as the counterpart of an AWS route table), so which networks the table governs is decided by the Network Area the person puts the project in and the routing_table_id each network is given. A table the draft does not make (count or for_each) and one left to the architect are REVIEW. Several VPCs, a VPC count that is not visible, or a vpc_id (this table's or another unit's) that is a literal, a variable, a data source or an expression the scan cannot reduce to the estate's VPC: which routing domain the table belongs to is the architect's decision — REVIEW. Held CRITICAL: it decides which networks, clients or endpoints reach the resource or what it reaches."],"closes_when":["Decide the outbound (egress) rules of the security group: A person confirms that the servers of the private subnets keep a restricting egress rule set in their security groups, because on STACKIT the restriction of egress is carried by egress rules, not by a route.","Review the NAT fixed egress address setting: A person accepts the project's shared egress address, which can change and cannot be set, or gives each server a STACKIT public IP when a third party allow-lists the old address.","Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Confirm the destinations of the routes: A person confirms every route destination that is not the default route to an internet or NAT gateway (a CIDR, a prefix list, any IPv6 route): the draft carries none, and a specific destination needs a stackit_routing_table_route, which takes IPv4 CIDR destinations only.","Confirm the targets of the routes: A person decides the next hop of each route on STACKIT: an internet gateway becomes the next hop internet, an appliance (a network interface or an instance) a next hop of type ipv4. A NAT gateway, a transit gateway or a VPC peering has no STACKIT counterpart, so the connectivity design is the person's.","Re-create the routes with STACKIT next hops: A person creates the routes on the STACKIT routing table (stackit_routing_table_route, experimental) and chooses the next hops anew, because they name AWS gateways.","Confirm what each route table is associated with: A person decides which networks of the Network Area take the routing table and sets routing_table_id on them: STACKIT attaches a routing table to a whole network (stackit_network.routing_table_id), there is no per-subnet association, and routing tables apply only to routed Layer 3 networks in a Network Area.","Confirm what each route table is associated with: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person decides which networks of the Network Area take the routing table and sets routing_table_id on them: STACKIT attaches a routing table to a whole network (stackit_network.routing_table_id), there is no per-subnet association, and routing tables apply only to routed Layer 3 networks in a Network Area.","Confirm the network of the route table: A person decides which STACKIT networks the routing table governs: the draft's custom table is organisation and Network Area scoped, so the Network Area the project joins and the routing table each network is given decide it.","Confirm the network of the route table: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person decides which STACKIT networks the routing table governs: the draft's custom table is organisation and Network Area scoped, so the Network Area the project joins and the routing table each network is given decide it."],"required_inputs":[]}},{"id":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC","kind":"unit-review","family":"aws.route_table","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.route_table","block":"module.vpc.module.vpc.aws_route_table.public","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"conditional_members":5,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":3},{"cause":"TARGET_LIMIT","members":1},{"cause":"EVIDENCE_GAP","members":1}],"blocker_class":"OPTIONAL_CONDITIONAL","item_count":5,"why":"The knowledge base cannot decide 5 critical settings of module.vpc.module.vpc.aws_route_table.public: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 5 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them. The review step of the execution plan for these settings is MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:4381bcffbb8aba26ae5ac648a21eb6de290d0ac6a31e8dcfe9735ff5bb04a8aa","kb_dependencies_sha256":"sha256:864ef886796905191fc25d42b580a577dc5a359a9dce4fe72db62b2c42c2763d"},"member_count":5,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-ROUTE-TABLE-PUBLIC","source_family":"aws.route_table","source_semantic":"unit-review","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"routing-architecture","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"network-topology-boundary/verify-on-target","title":"Confirm that the project is the boundary of one network: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.route_table/edge-association: \"Ingress routing of the traffic entering through a gateway (aws_route_table_association gateway_id, AWS::EC2::GatewayRouteTableAssociation); no STACKIT counterpart is evidenced in the pinned provider.\""],"regeneration_required":true},{"id":"route-destinations/keep-default-routing-outside-area","title":"Confirm the destinations of the routes: Keep STACKIT's default routing in a project outside a Network Area","prerequisites":["every route of the table sends traffic to an internet gateway (a default-only table)","the target project is created outside a Network Area"],"effects":["No routing table is written; every network reaches the internet through source NAT and the networks of the project reach each other."],"risk":["A server without a public IP gains outbound internet through the network's shared address, which the source's internet gateway did not give it."],"evidence":["decision kind stackitroute.NAT_FIXED_EGRESS_ADDRESS_LOST of the knowledge base: \"Every subnet is routed to the public internet. Technically this is done by source NAT (SNAT) in combination with masquerading.\"","a test on a STACKIT project on 2026-10-10: \"Observed: the address a server leaves by follows its NIC's public IP (own address) or, without one, the network's `publicIp`\"","a test on a STACKIT project on 2026-10-10: \"Not inferred: a routing table. The API shows none and the probe makes no statement about the table of a Network Area; only that the connectivity exists without one in this project.\""],"regeneration_required":false},{"id":"route-destinations/draft-a-routing-table-in-a-network-area","title":"Confirm the destinations of the routes: Place the workload in a Network Area and carry the routes in a routing table","prerequisites":["a Network Area for the target project (an organisation-level decision; whether a project can join an area after creation is not stated in the sources read)","the complete route set, with a STACKIT next hop for each route"],"effects":["A stackit_routing_table with stackit_routing_table_route resources (IPv4 CIDR destinations only) is assigned to the routed networks."],"risk":["The resource is experimental and may change; IPv6 routes and routes to NAT, transit or peering targets have no counterpart."],"evidence":["STACKIT provider schema 0.120.0: \"This resource is for SNA, not VPC, based networks.\"","STACKIT provider schema 0.120.0: \"is part of the experimental feature routing-tables\"","STACKIT provider schema 0.120.0: \"Only `cidrv4` is supported during experimental stage.\"","STACKIT provider schema 0.120.0: \"Type of the next hop. Possible values are: `blackhole`, `internet`, `ipv4`, `ipv6`.\"","decision kind stackitroute.route-set of the knowledge base: \"Each STACKIT Network Area includes one default routing table. STACKIT creates this table automatically when you create a new environment. All routed networks follow the default table unless you assign a different one.\""],"regeneration_required":true},{"id":"route-targets/keep-default-routing-outside-area","title":"Confirm the targets of the routes: Keep STACKIT's default routing in a project outside a Network Area","prerequisites":["every route of the table sends traffic to an internet gateway (a default-only table)","the target project is created outside a Network Area"],"effects":["No routing table is written; every network reaches the internet through source NAT and the networks of the project reach each other."],"risk":["A server without a public IP gains outbound internet through the network's shared address, which the source's internet gateway did not give it."],"evidence":["decision kind stackitroute.NAT_FIXED_EGRESS_ADDRESS_LOST of the knowledge base: \"Every subnet is routed to the public internet. Technically this is done by source NAT (SNAT) in combination with masquerading.\"","a test on a STACKIT project on 2026-10-10: \"Observed: the address a server leaves by follows its NIC's public IP (own address) or, without one, the network's `publicIp`\"","a test on a STACKIT project on 2026-10-10: \"Not inferred: a routing table. The API shows none and the probe makes no statement about the table of a Network Area; only that the connectivity exists without one in this project.\""],"regeneration_required":false},{"id":"route-targets/draft-a-routing-table-in-a-network-area","title":"Confirm the targets of the routes: Place the workload in a Network Area and carry the routes in a routing table","prerequisites":["a Network Area for the target project (an organisation-level decision; whether a project can join an area after creation is not stated in the sources read)","the complete route set, with a STACKIT next hop for each route"],"effects":["A stackit_routing_table with stackit_routing_table_route resources (IPv4 CIDR destinations only) is assigned to the routed networks."],"risk":["The resource is experimental and may change; IPv6 routes and routes to NAT, transit or peering targets have no counterpart."],"evidence":["STACKIT provider schema 0.120.0: \"This resource is for SNA, not VPC, based networks.\"","STACKIT provider schema 0.120.0: \"is part of the experimental feature routing-tables\"","STACKIT provider schema 0.120.0: \"Only `cidrv4` is supported during experimental stage.\"","STACKIT provider schema 0.120.0: \"Type of the next hop. Possible values are: `blackhole`, `internet`, `ipv4`, `ipv6`.\"","decision kind stackitroute.route-set of the knowledge base: \"Each STACKIT Network Area includes one default routing table. STACKIT creates this table automatically when you create a new environment. All routed networks follow the default table unless you assign a different one.\""],"regeneration_required":true},{"id":"routes/keep-default-routing-outside-area","title":"Re-create the routes with STACKIT next hops: Keep STACKIT's default routing in a project outside a Network Area","prerequisites":["every route of the table sends traffic to an internet gateway (a default-only table)","the target project is created outside a Network Area"],"effects":["No routing table is written; every network reaches the internet through source NAT and the networks of the project reach each other."],"risk":["A server without a public IP gains outbound internet through the network's shared address, which the source's internet gateway did not give it."],"evidence":["decision kind stackitroute.NAT_FIXED_EGRESS_ADDRESS_LOST of the knowledge base: \"Every subnet is routed to the public internet. Technically this is done by source NAT (SNAT) in combination with masquerading.\"","a test on a STACKIT project on 2026-10-10: \"Observed: the address a server leaves by follows its NIC's public IP (own address) or, without one, the network's `publicIp`\"","a test on a STACKIT project on 2026-10-10: \"Not inferred: a routing table. The API shows none and the probe makes no statement about the table of a Network Area; only that the connectivity exists without one in this project.\""],"regeneration_required":false},{"id":"routes/draft-a-routing-table-in-a-network-area","title":"Re-create the routes with STACKIT next hops: Place the workload in a Network Area and carry the routes in a routing table","prerequisites":["a Network Area for the target project (an organisation-level decision; whether a project can join an area after creation is not stated in the sources read)","the complete route set, with a STACKIT next hop for each route"],"effects":["A stackit_routing_table with stackit_routing_table_route resources (IPv4 CIDR destinations only) is assigned to the routed networks."],"risk":["The resource is experimental and may change; IPv6 routes and routes to NAT, transit or peering targets have no counterpart."],"evidence":["STACKIT provider schema 0.120.0: \"This resource is for SNA, not VPC, based networks.\"","STACKIT provider schema 0.120.0: \"is part of the experimental feature routing-tables\"","STACKIT provider schema 0.120.0: \"Only `cidrv4` is supported during experimental stage.\"","STACKIT provider schema 0.120.0: \"Type of the next hop. Possible values are: `blackhole`, `internet`, `ipv4`, `ipv6`.\"","decision kind stackitroute.route-set of the knowledge base: \"Each STACKIT Network Area includes one default routing table. STACKIT creates this table automatically when you create a new environment. All routed networks follow the default table unless you assign a different one.\""],"regeneration_required":true},{"id":"tcr-route-table-vpc-id/one-project-per-vpc","title":"Confirm the network of the route table: Keep one project per VPC with STACKIT's default routing","prerequisites":["one VPC in the estate","the project created outside a Network Area"],"effects":["The project's networks are the VPC's subnets; no table is written."],"risk":["As for the routes of the table: the default routing is observed equivalent only outside a Network Area."],"evidence":["contract note aws.route_table/tcr-route-table-vpc-id: \"the project the draft creates is that VPC's boundary\""],"regeneration_required":false},{"id":"tcr-route-table-vpc-id/assign-the-table-to-networks","title":"Confirm the network of the route table: Assign the routing table to the networks of the Network Area it should govern","prerequisites":["the Network Area the project joins","the networks that take the table"],"effects":["Each network that takes the table carries its id; a table is assigned per network, there is no per-subnet association."],"risk":["A network left without the table follows the area's default table."],"evidence":["STACKIT provider schema 0.120.0: \"The ID of the routing table associated with the network.\""],"regeneration_required":true}],"required_verification":["Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result","Confirm the destinations of the routes: reachability observed on the target: the internet, the other networks, and nothing the source did not reach","Confirm the targets of the routes: reachability observed on the target: the internet, the other networks, and nothing the source did not reach","Re-create the routes with STACKIT next hops: reachability observed on the target: the internet, the other networks, and nothing the source did not reach","Confirm the network of the route table: the routing of each target network observed on the target"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes.","Nothing from an answer: no input topic carries routes. A bound target environment that places the project in a Network Area, or states an egress other than STACKIT's default routing, reopens the default-routing equivalence (see the plan's statement that no routing table is drafted).","Nothing from an answer: no input topic carries a Network Area; a bound target environment's placement changes what the draft writes for routing."],"remains_manual":["Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.","Confirm the destinations of the routes: Manual work remains: a person closes the semantic, the draft does not.","Confirm the targets of the routes: Manual work remains: a person closes the semantic, the draft does not.","Re-create the routes with STACKIT next hops: Manual work remains: a person closes the semantic, the draft does not.","Confirm the network of the route table: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.route_table/edge-association: \"Ingress routing of the traffic entering through a gateway (aws_route_table_association gateway_id, AWS::EC2::GatewayRouteTableAssociation); no STACKIT counterpart is evidenced in the pinned provider.\"","contract note aws.route_table/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"","contract note aws.route_table/route-set-completeness: \"A person confirms that nothing outside the scan adds routes to the table (a virtual private gateway propagation, a route server, a route a variable switches on, a route type the scan does not model), or lists those routes.\"","contract note aws.route_table/vpn-propagation: \"Non-empty propagating_vgws (or a propagation resource) is REVIEW.\"","contract note aws.route_table/routes: \"Custom routes map to stackit_routing_table_route, an experimental resource (experiment routing-tables); next hops that name AWS gateways are chosen anew.\"","provider-docs mirror stackit/docs.stackit.cloud/products/network/core-networking/network-area/faq.html: \"Currently we do not support this, however there are plans to enable this in the future.\"","contract note aws.route_table/tcr-route-table-vpc-id: \"The VPC whose subnets this route table's rules apply to;\""],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm the destinations of the routes; the 5 settings of the record state their own.","source_observation":"The source states 5 critical settings on module.vpc.module.vpc.aws_route_table.public that the knowledge base cannot decide: Confirm that the project is the boundary of one network; Confirm the destinations of the routes; Confirm the targets of the routes; Re-create the routes with STACKIT next hops; Confirm the network of the route table.","generated_target_behavior":"Confirm that the project is the boundary of one network: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the destinations of the routes: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings). A table whose routes all go to an internet gateway is replaced by STACKIT's default routing and no table is drafted, with the precondition that the project is created outside a Network Area (the plan's statement that no routing table is drafted). A custom table is drafted as a stackit_routing_table of a Network Area with the routes it can carry; every other route is named \"not carried\" in the Terraform comments. Confirm the targets of the routes: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings). A table whose routes all go to an internet gateway is replaced by STACKIT's default routing and no table is drafted, with the precondition that the project is created outside a Network Area (the plan's statement that no routing table is drafted). A custom table is drafted as a stackit_routing_table of a Network Area with the routes it can carry; every other route is named \"not carried\" in the Terraform comments. Re-create the routes with STACKIT next hops: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings). A table whose routes all go to an internet gateway is replaced by STACKIT's default routing and no table is drafted, with the precondition that the project is created outside a Network Area (the plan's statement that no routing table is drafted). A custom table is drafted as a stackit_routing_table of a Network Area with the routes it can carry; every other route is named \"not carried\" in the Terraform comments. Confirm the network of the route table: The draft does not carry the setting on module.vpc.module.vpc.aws_route_table.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings). With one VPC the project stands for it and the default routing applies (nothing drafted); a custom table is drafted at Network Area scope.","residual_difference":"Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the destinations of the routes: That the target networks reach what the source routes reached and nothing more: the default routing of a Network Area was never read, and the equivalence outside an area was observed in one STACKIT test project only. Confirm the targets of the routes: That the target networks reach what the source routes reached and nothing more: the default routing of a Network Area was never read, and the equivalence outside an area was observed in one STACKIT test project only. Re-create the routes with STACKIT next hops: That the target networks reach what the source routes reached and nothing more: the default routing of a Network Area was never read, and the equivalence outside an area was observed in one STACKIT test project only. Confirm the network of the route table: Which STACKIT networks the routing rules govern.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.vpc.module.vpc.aws_route_table.public/open-settings now.","next_action":"Confirm the destinations of the routes: Confirm the destinations of the routes for module.vpc.module.vpc.aws_route_table.public, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this route table included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.","Confirm the destinations of the routes: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Destinations are read by value: every route of a default-only table sends 0.0.0.0/0 to an internet or NAT gateway — STACKIT's default network routing, observed equivalent for a draft outside a Network Area (the test of 2026-10-10) and REVIEW all the same.","Confirm the targets of the routes: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The next hop of each route of the table: a route whose target is anything but an internet or NAT gateway, or that names none, makes the table a custom routing table.","Re-create the routes with STACKIT next hops: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Custom routes map to stackit_routing_table_route, an experimental resource (experiment routing-tables); next hops that name AWS gateways are chosen anew.","Confirm the network of the route table: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). aws_route_table.vpc_id: The VPC whose subnets this route table's rules apply to; a route table's entries only make sense, and only affect reachability, within this one VPC, so losing or mismapping it silently changes which network the routing rules govern. A custom table is REVIEW whatever the estate: the draft's stackit_routing_table is organisation and Network Area scoped (organization_id, network_area_id, pinned provider), not a resource of the project that is the VPC's boundary (the experimental stackit_vpc_routing_table, pinned provider: project_id, vpc_id, is a VPC-scoped table that the draft does not write and that nothing establishes as the counterpart of an AWS route table), so which networks the table governs is decided by the Network Area the person puts the project in and the routing_table_id each network is given. A table the draft does not make (count or for_each) and one left to the architect are REVIEW. Several VPCs, a VPC count that is not visible, or a vpc_id (this table's or another unit's) that is a literal, a variable, a data source or an expression the scan cannot reduce to the estate's VPC: which routing domain the table belongs to is the architect's decision — REVIEW. Held CRITICAL: it decides which networks, clients or endpoints reach the resource or what it reaches."],"closes_when":["Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Confirm the destinations of the routes: A person confirms every route destination that is not the default route to an internet or NAT gateway (a CIDR, a prefix list, any IPv6 route): the draft carries none, and a specific destination needs a stackit_routing_table_route, which takes IPv4 CIDR destinations only.","Confirm the targets of the routes: A person decides the next hop of each route on STACKIT: an internet gateway becomes the next hop internet, an appliance (a network interface or an instance) a next hop of type ipv4. A NAT gateway, a transit gateway or a VPC peering has no STACKIT counterpart, so the connectivity design is the person's.","Re-create the routes with STACKIT next hops: A person creates the routes on the STACKIT routing table (stackit_routing_table_route, experimental) and chooses the next hops anew, because they name AWS gateways.","Confirm the network of the route table: A person decides which STACKIT networks the routing table governs: the draft's custom table is organisation and Network Area scoped, so the Network Area the project joins and the routing table each network is given decide it.","Confirm the network of the route table: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person decides which STACKIT networks the routing table governs: the draft's custom table is organisation and Network Area scoped, so the Network Area the project joins and the routing table each network is given decide it."],"required_inputs":[]}},{"id":"DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB","kind":"unit-review","family":"aws.secretsmanager_secret","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.secretsmanager_secret","block":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-66a370ad14e6","subject":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:195cb41bddbb96ebcec7e0f37d5f2f429896503f4ae7885eefe450c77faddf70","kb_dependencies_sha256":"sha256:d5232f8c08470d7e2cf4d3f67d0a00b792688bf01cef4afeff71224246f0836f"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB","source_family":"aws.secretsmanager_secret","source_semantic":"unit-review","affected_application":[],"action_type":"VERIFY_BEHAVIOR","work_package":"identity-access-secrets","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"REQUIRES_VERIFICATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1}},{"id":"DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB","kind":"unit-review","family":"aws.secretsmanager_secret","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.secretsmanager_secret","block":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":2,"shape":"RSH-3961ddcd4887","subject":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:3648ebb527da2bc96efc5425a387853eeeef8b1af4da2208b4326214e2fe9417","kb_dependencies_sha256":"sha256:78742954fe6dab86c51d83509ed0f5019df417f550f7490b99d91c52b676823d"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-DB","source_family":"aws.secretsmanager_secret","source_semantic":"unit-review","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"identity-access-secrets","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1}},{"id":"DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E","kind":"unit-review","family":"aws.secretsmanager_secret","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.secretsmanager_secret","block":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-66a370ad14e6","subject":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:2073dd961a032b84b2d9831d3f75f110a2575f042a5ea8c79798030c3da3245d","kb_dependencies_sha256":"sha256:d5232f8c08470d7e2cf4d3f67d0a00b792688bf01cef4afeff71224246f0836f"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E","source_family":"aws.secretsmanager_secret","source_semantic":"unit-review","affected_application":[],"action_type":"VERIFY_BEHAVIOR","work_package":"identity-access-secrets","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"REQUIRES_VERIFICATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1}},{"id":"DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E","kind":"unit-review","family":"aws.secretsmanager_secret","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.secretsmanager_secret","block":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":2,"shape":"RSH-3961ddcd4887","subject":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:ae17628c8cbe0ab8697ae4bb2880130aeee40989541c8f0376736190f705f513","kb_dependencies_sha256":"sha256:78742954fe6dab86c51d83509ed0f5019df417f550f7490b99d91c52b676823d"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-CATALOG-F9E3300E","source_family":"aws.secretsmanager_secret","source_semantic":"unit-review","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"identity-access-secrets","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1}},{"id":"DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ","kind":"unit-review","family":"aws.secretsmanager_secret","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.secretsmanager_secret","block":"module.retail_app_ecs.aws_secretsmanager_secret.mq","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-66a370ad14e6","subject":"module.retail_app_ecs.aws_secretsmanager_secret.mq","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:5fe5a2647141b1c84f8d6ebec8419e93f5cdd3bf7608a08434c32b8983acd76f","kb_dependencies_sha256":"sha256:d5232f8c08470d7e2cf4d3f67d0a00b792688bf01cef4afeff71224246f0836f"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ","source_family":"aws.secretsmanager_secret","source_semantic":"unit-review","affected_application":[],"action_type":"VERIFY_BEHAVIOR","work_package":"identity-access-secrets","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"REQUIRES_VERIFICATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1}},{"id":"DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ","kind":"unit-review","family":"aws.secretsmanager_secret","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.secretsmanager_secret","block":"module.retail_app_ecs.aws_secretsmanager_secret.mq","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-96817918c9ce","subject":"module.retail_app_ecs.aws_secretsmanager_secret.mq","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:3ae1d83437aa0047401e57a727c9c83c53c975e37cb2489aa208cb01e090a9e2","kb_dependencies_sha256":"sha256:2cb4b0d96b051195c608023373e582242e4e572c53cb74b1e20d6dda98e3ac19"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-MQ","source_family":"aws.secretsmanager_secret","source_semantic":"unit-review","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"identity-access-secrets","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1}},{"id":"DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB","kind":"unit-review","family":"aws.secretsmanager_secret","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.secretsmanager_secret","block":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-66a370ad14e6","subject":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:0e7d0853832152461beef7d325cf888b63bc96f93367ca9eaa967f2a0d8d046d","kb_dependencies_sha256":"sha256:d5232f8c08470d7e2cf4d3f67d0a00b792688bf01cef4afeff71224246f0836f"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB","source_family":"aws.secretsmanager_secret","source_semantic":"unit-review","affected_application":[],"action_type":"VERIFY_BEHAVIOR","work_package":"identity-access-secrets","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"REQUIRES_VERIFICATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1}},{"id":"DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB","kind":"unit-review","family":"aws.secretsmanager_secret","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.secretsmanager_secret","block":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-96817918c9ce","subject":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:d75d1a13db1394da7b51b43ba4b0a2e89b879d6a844416890877de4f2206469c","kb_dependencies_sha256":"sha256:2cb4b0d96b051195c608023373e582242e4e572c53cb74b1e20d6dda98e3ac19"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-MODULE-RETAIL-APP-ECS-AWS-SECRETSMANAGER-SECRET-ORDERS-DB","source_family":"aws.secretsmanager_secret","source_semantic":"unit-review","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"identity-access-secrets","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1}},{"id":"DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG","kind":"unit-review","family":"aws.security_group","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.security_group","block":"module.dependencies.aws_security_group.catalog_opensearch_sg","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"TARGET_LIMIT","members":2},{"cause":"DEPENDS_ON_UNIT","members":2},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":6,"why":"The knowledge base cannot decide 6 critical settings of module.dependencies.aws_security_group.catalog_opensearch_sg: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:20e99159b8d629dc059056933c714a05c8d0553031578feda2e55da35374d1f9","kb_dependencies_sha256":"sha256:d123567a803a2c8c7613313b73d5e4c1f379e350b836349b8483d3601048ce69"},"member_count":6,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-CATALOG-OPENSEARCH-SG","source_family":"aws.security_group","source_semantic":"unit-review","affected_application":[],"action_type":"VERIFY_BEHAVIOR","work_package":"network-security","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW, UNSUPPORTED","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":2,"resolution_paths":[{"id":"egress-restriction/verify-on-target","title":"Decide the outbound (egress) rules of the security group: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\""],"regeneration_required":true},{"id":"network-topology-boundary/bring-the-closing-evidence","title":"Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""],"regeneration_required":true},{"id":"security-group-vpc-membership/verify-on-target","title":"Decide which networks the security group may be attached to (a STACKIT group has no network scope): Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\""],"regeneration_required":true}],"required_verification":["Decide the outbound (egress) rules of the security group: the check, proof or closing evidence is recorded with its result","Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result","Decide which networks the security group may be attached to (a STACKIT group has no network scope): the check, proof or closing evidence is recorded with its result"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Decide the outbound (egress) rules of the security group: Manual work remains: a person closes the semantic, the draft does not.","Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.","Decide which networks the security group may be attached to (a STACKIT group has no network scope): Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"","contract note aws.security_group/ingress-sources: \"cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).\"","contract note aws.security_group/rule-ports: \"Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).\"","contract note aws.security_group/security-group-vpc-membership: \"A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.\"","contract note aws.security_group/vpc-egress-rules: \"As vpc ingress rules (direction egress).\"","contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""],"state_reason":"the execution plan refuses REF/root/security-group-membership-parity because the target has no counterpart for the setting: a person accepts the difference or redesigns, and the step stays refused This is the state of the setting of this unit that asks the most, Decide which networks the security group may be attached to (a STACKIT group has no network scope); the 6 settings of the record state their own.","source_observation":"The source states 6 critical settings on module.dependencies.aws_security_group.catalog_opensearch_sg that the knowledge base cannot decide: Decide the outbound (egress) rules of the security group; Confirm that the project is the boundary of one network; Decide which networks the security group may be attached to (a STACKIT group has no network scope); Review the standalone rule not generated setting; Review the standalone rule remote not resolved setting; Review the stateful setting.","generated_target_behavior":"Decide the outbound (egress) rules of the security group: The draft does not carry the setting on module.dependencies.aws_security_group.catalog_opensearch_sg; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on module.dependencies.aws_security_group.catalog_opensearch_sg; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.dependencies.aws_security_group.catalog_opensearch_sg. The plan refuses REF/root/security-group-membership-parity. In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the standalone rule not generated setting: The draft does not carry the setting on module.dependencies.aws_security_group.catalog_opensearch_sg; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings). Review the standalone rule remote not resolved setting: The draft does not carry the setting on module.dependencies.aws_security_group.catalog_opensearch_sg; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings). Review the stateful setting: The draft does not carry the setting on module.dependencies.aws_security_group.catalog_opensearch_sg; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.catalog_opensearch_sg/open-settings).","residual_difference":"Decide the outbound (egress) rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide which networks the security group may be attached to (a STACKIT group has no network scope): That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the standalone rule not generated setting: the target behaviour of this setting is not established Review the standalone rule remote not resolved setting: the target behaviour of this setting is not established Review the stateful setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. Held by something else first: REF/root/security-group-membership-parity.","next_action":"Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.aws_security_group.catalog_opensearch_sg, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Decide the outbound (egress) rules of the security group: A check of the knowledge base (sg egress restricted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.","Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.","Decide which networks the security group may be attached to (a STACKIT group has no network scope): This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.","Review the standalone rule not generated setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An aws_security_group_rule the draft does not generate (the draft names its settings NOT CARRIED, or the KB cannot decide that it generates it): a prefix list, an ICMP type with every code, ICMPv6 limited by type or code, a protocol with no STACKIT counterpart, a source or protocol or port not visible statically, a source group that is not one whole reference to a security group of the draft, or a repeated or conditionally created group. A person re-creates the rule with the STACKIT range or group it needs (a rule is never widened: a stackit_security_group_rule without source allows every address, pinned provider) - REVIEW, per rule.","Review the standalone rule remote not resolved setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The source of a standalone security group rule: the other security group (source_security_group_id) whose members the rule lets in.","Review the stateful setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true)."],"closes_when":["Decide the outbound (egress) rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Decide the outbound (egress) rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.","Review the standalone rule not generated setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Review the standalone rule remote not resolved setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A person re-creates the rule with the STACKIT security group or address range it needs; the draft does not widen it (a stackit_security_group_rule without a source allows everything, pinned provider).","Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference."],"required_inputs":[]}},{"id":"DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ","kind":"unit-review","family":"aws.security_group","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.security_group","block":"module.dependencies.aws_security_group.mq","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"TARGET_LIMIT","members":2},{"cause":"DEPENDS_ON_UNIT","members":1},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":5,"why":"The knowledge base cannot decide 5 critical settings of module.dependencies.aws_security_group.mq: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.aws_security_group.mq/open-settings.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:8c5aaa45532d67ee2d6bcb3a9534148642f01d37c523570686e3fd349d2dee8b","kb_dependencies_sha256":"sha256:df7f82fa706407d358518a0ec2c5fb9e357107a7fe196fbbab5b9ee7685bcb0d"},"member_count":5,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-DEPENDENCIES-AWS-SECURITY-GROUP-MQ","source_family":"aws.security_group","source_semantic":"unit-review","affected_application":[],"action_type":"VERIFY_BEHAVIOR","work_package":"network-security","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW, UNSUPPORTED","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":2,"resolution_paths":[{"id":"egress-restriction/verify-on-target","title":"Decide the outbound (egress) rules of the security group: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\""],"regeneration_required":true},{"id":"network-topology-boundary/bring-the-closing-evidence","title":"Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""],"regeneration_required":true},{"id":"security-group-vpc-membership/verify-on-target","title":"Decide which networks the security group may be attached to (a STACKIT group has no network scope): Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\""],"regeneration_required":true}],"required_verification":["Decide the outbound (egress) rules of the security group: the check, proof or closing evidence is recorded with its result","Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result","Decide which networks the security group may be attached to (a STACKIT group has no network scope): the check, proof or closing evidence is recorded with its result"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Decide the outbound (egress) rules of the security group: Manual work remains: a person closes the semantic, the draft does not.","Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.","Decide which networks the security group may be attached to (a STACKIT group has no network scope): Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"","contract note aws.security_group/ingress-sources: \"cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).\"","contract note aws.security_group/rule-ports: \"Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).\"","contract note aws.security_group/security-group-vpc-membership: \"A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.\"","contract note aws.security_group/vpc-egress-rules: \"As vpc ingress rules (direction egress).\"","contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""],"state_reason":"the execution plan refuses REF/root/security-group-membership-parity because the target has no counterpart for the setting: a person accepts the difference or redesigns, and the step stays refused This is the state of the setting of this unit that asks the most, Decide which networks the security group may be attached to (a STACKIT group has no network scope); the 5 settings of the record state their own.","source_observation":"The source states 5 critical settings on module.dependencies.aws_security_group.mq that the knowledge base cannot decide: Decide the outbound (egress) rules of the security group; Confirm that the project is the boundary of one network; Decide which networks the security group may be attached to (a STACKIT group has no network scope); Review the standalone rule not generated setting; Review the stateful setting.","generated_target_behavior":"Decide the outbound (egress) rules of the security group: The draft does not carry the setting on module.dependencies.aws_security_group.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.mq/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on module.dependencies.aws_security_group.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.mq/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.dependencies.aws_security_group.mq. The plan refuses REF/root/security-group-membership-parity. In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the standalone rule not generated setting: The draft does not carry the setting on module.dependencies.aws_security_group.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.mq/open-settings). Review the stateful setting: The draft does not carry the setting on module.dependencies.aws_security_group.mq; a manual step stands for it (MAN/semantic/module.dependencies.aws_security_group.mq/open-settings).","residual_difference":"Decide the outbound (egress) rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide which networks the security group may be attached to (a STACKIT group has no network scope): That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the standalone rule not generated setting: the target behaviour of this setting is not established Review the stateful setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. Held by something else first: REF/root/security-group-membership-parity.","next_action":"Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.aws_security_group.mq, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Decide the outbound (egress) rules of the security group: A check of the knowledge base (sg egress restricted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.","Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.","Decide which networks the security group may be attached to (a STACKIT group has no network scope): This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.","Review the standalone rule not generated setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. An aws_security_group_rule the draft does not generate (the draft names its settings NOT CARRIED, or the KB cannot decide that it generates it): a prefix list, an ICMP type with every code, ICMPv6 limited by type or code, a protocol with no STACKIT counterpart, a source or protocol or port not visible statically, a source group that is not one whole reference to a security group of the draft, or a repeated or conditionally created group. A person re-creates the rule with the STACKIT range or group it needs (a rule is never widened: a stackit_security_group_rule without source allows every address, pinned provider) - REVIEW, per rule.","Review the stateful setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true)."],"closes_when":["Decide the outbound (egress) rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Decide the outbound (egress) rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.","Review the standalone rule not generated setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference."],"required_inputs":[]}},{"id":"DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS","kind":"unit-review","family":"aws.security_group","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.security_group","block":"module.dependencies.module.catalog_rds.aws_security_group.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"TARGET_LIMIT","members":2},{"cause":"DEPENDS_ON_UNIT","members":2},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":6,"shape":"RSH-9956186a90f6","subject":"module.dependencies.module.catalog_rds.aws_security_group.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:ecc068fbe9a8c1df8ea476fa3e0bcf0744ec368b08040242f186cb86c54b706c","kb_dependencies_sha256":"sha256:5118b33aa50437bb44220519f1d54b70c83925a6a3a5950128f72ff4d74601a8"},"member_count":6,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-RDS-AWS-SECURITY-GROUP-THIS","source_family":"aws.security_group","source_semantic":"unit-review","affected_application":[],"action_type":"VERIFY_BEHAVIOR","work_package":"network-security","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW, UNSUPPORTED","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":2}},{"id":"DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0","kind":"unit-review","family":"aws.security_group","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.security_group","block":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"TARGET_LIMIT","members":1},{"cause":"DEPENDS_ON_UNIT","members":4},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":7,"why":"The knowledge base cannot decide 7 critical settings of module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:e2caf76ce6b00a72a5bb989dce3f951588e583a80dba6f2f2d83fa3a24d39303","kb_dependencies_sha256":"sha256:732bd1fbc54fc9a90a3d44575b2d5e05c3097f0c28b0a7064e46d510941bb10a"},"member_count":7,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-M-D58733D0","source_family":"aws.security_group","source_semantic":"unit-review","affected_application":[],"action_type":"VERIFY_BEHAVIOR","work_package":"network-security","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW, UNSUPPORTED","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":2,"resolution_paths":[{"id":"network-topology-boundary/bring-the-closing-evidence","title":"Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""],"regeneration_required":true},{"id":"rule-ports/verify-on-target","title":"Confirm the ports of the rules of the security group: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\""],"regeneration_required":true},{"id":"security-group-vpc-membership/verify-on-target","title":"Decide which networks the security group may be attached to (a STACKIT group has no network scope): Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\""],"regeneration_required":true}],"required_verification":["Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result","Confirm the ports of the rules of the security group: the check, proof or closing evidence is recorded with its result","Decide which networks the security group may be attached to (a STACKIT group has no network scope): the check, proof or closing evidence is recorded with its result"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.","Confirm the ports of the rules of the security group: Manual work remains: a person closes the semantic, the draft does not.","Decide which networks the security group may be attached to (a STACKIT group has no network scope): Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"","contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"","contract note aws.security_group/ingress-sources: \"cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).\"","contract note aws.security_group/rule-ports: \"Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).\"","contract note aws.security_group/security-group-vpc-membership: \"A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.\"","contract note aws.security_group/vpc-egress-rules: \"As vpc ingress rules (direction egress).\""],"state_reason":"the execution plan refuses REF/root/security-group-membership-parity because the target has no counterpart for the setting: a person accepts the difference or redesigns, and the step stays refused This is the state of the setting of this unit that asks the most, Decide which networks the security group may be attached to (a STACKIT group has no network scope); the 7 settings of the record state their own.","source_observation":"The source states 7 critical settings on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd that the knowledge base cannot decide: Confirm that the project is the boundary of one network; Confirm the ports of the rules of the security group; Decide which networks the security group may be attached to (a STACKIT group has no network scope); Review the standalone rule empty sources setting; Review the standalone rule other sources setting; Review the standalone rule values setting; Review the stateful setting.","generated_target_behavior":"Confirm that the project is the boundary of one network: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the ports of the rules of the security group: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd. The plan refuses REF/root/security-group-membership-parity. In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the standalone rule empty sources setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings). Review the standalone rule other sources setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings). Review the standalone rule values setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings). Review the stateful setting: The draft does not carry the setting on module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd; a manual step stands for it (MAN/semantic/module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd/open-settings).","residual_difference":"Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the ports of the rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide which networks the security group may be attached to (a STACKIT group has no network scope): That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the standalone rule empty sources setting: the target behaviour of this setting is not established Review the standalone rule other sources setting: the target behaviour of this setting is not established Review the standalone rule values setting: the target behaviour of this setting is not established Review the stateful setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. Held by something else first: REF/root/security-group-membership-parity.","next_action":"Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.","Confirm the ports of the rules of the security group: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).","Decide which networks the security group may be attached to (a STACKIT group has no network scope): This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.","Review the standalone rule empty sources setting: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). self = false and empty IPv6/prefix-list lists (module defaults) add no source, as the drafted rule adds none — PRESERVED, per rule that states no source, next to rules that do (those are standalone rule other sources, REVIEW); REVIEW when a rule of the group is not generated (its settings are named NOT CARRIED, the rule not generated check) or a value is not visible statically: the draft names such a value NOT CARRIED and nothing here claims it carried.","Review the standalone rule other sources setting: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). A standalone rule's own group (self) and IPv6 ranges are written where the draft places the rule (self as remote_security_group_id of the group, an IPv6 range as ip_range with ether_type IPv6), and the draft names the rule NOT CARRIED when the plan withholds it; prefix lists are not generated (as rule other sources for inline rules; prefix lists: the prefix list check), and a person adds the rule if the traffic must pass — REVIEW in every order position.","Review the standalone rule values setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). An aws_security_group_rule becomes a stackit_security_group_rule: type → direction, protocol → protocol, cidr_blocks → ip_range (one rule per range), source_security_group_id → remote_security_group_id. A rule that is not generated is named NOT CARRIED and the group is REVIEW.","Review the stateful setting: This draft writes no stackit_security_group, stackit_security_group_rule for this unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of this draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true)."],"closes_when":["Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Confirm the ports of the rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm the ports of the rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.","Review the standalone rule empty sources setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the standalone rule other sources setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the standalone rule values setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference."],"required_inputs":[]}},{"id":"DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS","kind":"unit-review","family":"aws.security_group","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.security_group","block":"module.dependencies.module.orders_rds.aws_security_group.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"TARGET_LIMIT","members":2},{"cause":"DEPENDS_ON_UNIT","members":2},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":6,"shape":"RSH-9956186a90f6","subject":"module.dependencies.module.orders_rds.aws_security_group.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:c70ab8626c768f56f794aa0d2ead7d41c74347f2a6dcf8782ed4bd599a108b12","kb_dependencies_sha256":"sha256:5118b33aa50437bb44220519f1d54b70c83925a6a3a5950128f72ff4d74601a8"},"member_count":6,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-SECURITY-GROUP-THIS","source_family":"aws.security_group","source_semantic":"unit-review","affected_application":[],"action_type":"VERIFY_BEHAVIOR","work_package":"network-security","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW, UNSUPPORTED","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":2}},{"id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS","kind":"unit-review","family":"aws.security_group","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.security_group","block":"module.retail_app_ecs.module.alb.aws_security_group.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"TARGET_LIMIT","members":2},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of module.retail_app_ecs.module.alb.aws_security_group.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.alb.aws_security_group.this/open-settings.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:8e08c65f886c3621d3760f297a9f0f9270020b298c499881ee4e87eabdfb2c10","kb_dependencies_sha256":"sha256:a4363e133238bc96983902cad7b0fbafc8f1363c3d4e0ebd54c8325670ad3a45"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-SECURITY-GROUP-THIS","source_family":"aws.security_group","source_semantic":"unit-review","affected_application":[],"action_type":"VERIFY_BEHAVIOR","work_package":"network-security","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW, UNSUPPORTED","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":2,"resolution_paths":[{"id":"egress-restriction/verify-on-target","title":"Decide the outbound (egress) rules of the security group: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\""],"regeneration_required":true},{"id":"network-topology-boundary/bring-the-closing-evidence","title":"Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""],"regeneration_required":true},{"id":"security-group-vpc-membership/verify-on-target","title":"Decide which networks the security group may be attached to (a STACKIT group has no network scope): Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\""],"regeneration_required":true}],"required_verification":["Decide the outbound (egress) rules of the security group: the check, proof or closing evidence is recorded with its result","Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result","Decide which networks the security group may be attached to (a STACKIT group has no network scope): the check, proof or closing evidence is recorded with its result"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Decide the outbound (egress) rules of the security group: Manual work remains: a person closes the semantic, the draft does not.","Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.","Decide which networks the security group may be attached to (a STACKIT group has no network scope): Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"","contract note aws.security_group/ingress-sources: \"cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).\"","contract note aws.security_group/rule-ports: \"Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).\"","contract note aws.security_group/security-group-vpc-membership: \"A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.\"","contract note aws.security_group/vpc-egress-rules: \"As vpc ingress rules (direction egress).\"","contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""],"state_reason":"the execution plan refuses REF/root/security-group-membership-parity because the target has no counterpart for the setting: a person accepts the difference or redesigns, and the step stays refused This is the state of the setting of this unit that asks the most, Decide which networks the security group may be attached to (a STACKIT group has no network scope); the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on module.retail_app_ecs.module.alb.aws_security_group.this that the knowledge base cannot decide: Decide the outbound (egress) rules of the security group; Confirm that the project is the boundary of one network; Decide which networks the security group may be attached to (a STACKIT group has no network scope); Review the stateful setting.","generated_target_behavior":"Decide the outbound (egress) rules of the security group: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_security_group.this/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_security_group.this/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_security_group.this. The plan refuses REF/root/security-group-membership-parity. In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the stateful setting: The draft does not carry the setting on module.retail_app_ecs.module.alb.aws_security_group.this; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb.aws_security_group.this/open-settings).","residual_difference":"Decide the outbound (egress) rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide which networks the security group may be attached to (a STACKIT group has no network scope): That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the stateful setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. Held by something else first: REF/root/security-group-membership-parity.","next_action":"Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.retail_app_ecs.module.alb.aws_security_group.this, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Decide the outbound (egress) rules of the security group: A check of the knowledge base (sg egress restricted) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.","Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.","Decide which networks the security group may be attached to (a STACKIT group has no network scope): A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.","Review the stateful setting: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true)."],"closes_when":["Decide the outbound (egress) rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Decide the outbound (egress) rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.","Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference."],"required_inputs":[]}},{"id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862","kind":"unit-review","family":"aws.security_group","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.security_group","block":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"TARGET_LIMIT","members":1},{"cause":"DEPENDS_ON_UNIT","members":4},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":7,"why":"The knowledge base cannot decide 7 critical settings of module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:5eb9ea3019259ced92a0d178966ff7f78a63ab44e0f204fdcc70e4e9dbbbdef2","kb_dependencies_sha256":"sha256:732bd1fbc54fc9a90a3d44575b2d5e05c3097f0c28b0a7064e46d510941bb10a"},"member_count":7,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-SG-AWS-SECURITY-GROUP-68F6B862","source_family":"aws.security_group","source_semantic":"unit-review","affected_application":[],"action_type":"VERIFY_BEHAVIOR","work_package":"network-security","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW, UNSUPPORTED","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":2,"resolution_paths":[{"id":"network-topology-boundary/bring-the-closing-evidence","title":"Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""],"regeneration_required":true},{"id":"rule-ports/verify-on-target","title":"Confirm the ports of the rules of the security group: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\""],"regeneration_required":true},{"id":"security-group-vpc-membership/verify-on-target","title":"Decide which networks the security group may be attached to (a STACKIT group has no network scope): Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\""],"regeneration_required":true}],"required_verification":["Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result","Confirm the ports of the rules of the security group: the check, proof or closing evidence is recorded with its result","Decide which networks the security group may be attached to (a STACKIT group has no network scope): the check, proof or closing evidence is recorded with its result"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.","Confirm the ports of the rules of the security group: Manual work remains: a person closes the semantic, the draft does not.","Decide which networks the security group may be attached to (a STACKIT group has no network scope): Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"","contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"","contract note aws.security_group/ingress-sources: \"cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).\"","contract note aws.security_group/rule-ports: \"Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).\"","contract note aws.security_group/security-group-vpc-membership: \"A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.\"","contract note aws.security_group/vpc-egress-rules: \"As vpc ingress rules (direction egress).\""],"state_reason":"the execution plan refuses REF/root/security-group-membership-parity because the target has no counterpart for the setting: a person accepts the difference or redesigns, and the step stays refused This is the state of the setting of this unit that asks the most, Decide which networks the security group may be attached to (a STACKIT group has no network scope); the 7 settings of the record state their own.","source_observation":"The source states 7 critical settings on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix that the knowledge base cannot decide: Confirm that the project is the boundary of one network; Confirm the ports of the rules of the security group; Decide which networks the security group may be attached to (a STACKIT group has no network scope); Review the standalone rule empty sources setting; Review the standalone rule other sources setting; Review the standalone rule values setting; Review the stateful setting.","generated_target_behavior":"Confirm that the project is the boundary of one network: The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the ports of the rules of the security group: The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix. The plan refuses REF/root/security-group-membership-parity. In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the standalone rule empty sources setting: The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings). Review the standalone rule other sources setting: The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings). Review the standalone rule values setting: The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings). Review the stateful setting: The draft does not carry the setting on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix; a manual step stands for it (MAN/semantic/module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix/open-settings).","residual_difference":"Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the ports of the rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide which networks the security group may be attached to (a STACKIT group has no network scope): That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the standalone rule empty sources setting: the target behaviour of this setting is not established Review the standalone rule other sources setting: the target behaviour of this setting is not established Review the standalone rule values setting: the target behaviour of this setting is not established Review the stateful setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. Held by something else first: REF/root/security-group-membership-parity.","next_action":"Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.","Confirm the ports of the rules of the security group: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).","Decide which networks the security group may be attached to (a STACKIT group has no network scope): A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of this unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.","Review the standalone rule empty sources setting: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). self = false and empty IPv6/prefix-list lists (module defaults) add no source, as the drafted rule adds none — PRESERVED, per rule that states no source, next to rules that do (those are standalone rule other sources, REVIEW); REVIEW when a rule of the group is not generated (its settings are named NOT CARRIED, the rule not generated check) or a value is not visible statically: the draft names such a value NOT CARRIED and nothing here claims it carried.","Review the standalone rule other sources setting: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). A standalone rule's own group (self) and IPv6 ranges are written where the draft places the rule (self as remote_security_group_id of the group, an IPv6 range as ip_range with ether_type IPv6), and the draft names the rule NOT CARRIED when the plan withholds it; prefix lists are not generated (as rule other sources for inline rules; prefix lists: the prefix list check), and a person adds the rule if the traffic must pass — REVIEW in every order position.","Review the standalone rule values setting: A check of the knowledge base (sg rule not rendered) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). An aws_security_group_rule becomes a stackit_security_group_rule: type → direction, protocol → protocol, cidr_blocks → ip_range (one rule per range), source_security_group_id → remote_security_group_id. A rule that is not generated is named NOT CARRIED and the group is REVIEW.","Review the stateful setting: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; this setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true)."],"closes_when":["Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Confirm the ports of the rules of the security group: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm the ports of the rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.","Review the standalone rule empty sources setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the standalone rule other sources setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the standalone rule values setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference."],"required_inputs":[]}},{"id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF","kind":"unit-review","family":"aws.security_group","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.security_group","block":"module.retail_app_ecs.module.carts_service.aws_security_group.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"TARGET_LIMIT","members":1},{"cause":"NOT_CLASSIFIED","members":5}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":7,"shape":"RSH-087d72dbb642","subject":"module.retail_app_ecs.module.carts_service.aws_security_group.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:d2ce6c8560f61656e20bb6b51a011c7b79ca81012b6e7dda9e01fb0de53751f3","kb_dependencies_sha256":"sha256:51287d997e1fb655287d104290cba98480d61f1494b7aa34a16f46e11218a624"},"member_count":7,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF","source_family":"aws.security_group","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW, LEDGER, UNSUPPORTED","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":2}},{"id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F","kind":"unit-review","family":"aws.security_group","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.security_group","block":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"TARGET_LIMIT","members":1},{"cause":"NOT_CLASSIFIED","members":5}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":7,"shape":"RSH-087d72dbb642","subject":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:533d0003c31ab197546f7c4f8d22e3c3bf725e8b7395b5d3ea21b3278fdb62b3","kb_dependencies_sha256":"sha256:51287d997e1fb655287d104290cba98480d61f1494b7aa34a16f46e11218a624"},"member_count":7,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-SECURI-ACC9368F","source_family":"aws.security_group","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW, LEDGER, UNSUPPORTED","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":2}},{"id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F","kind":"unit-review","family":"aws.security_group","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.security_group","block":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"TARGET_LIMIT","members":1},{"cause":"NOT_CLASSIFIED","members":5}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":7,"shape":"RSH-087d72dbb642","subject":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:9d37a2eef4e29a3cb7c4a4bac8afc4bf54d07043772e5a624d09c77aa3ddb8ae","kb_dependencies_sha256":"sha256:51287d997e1fb655287d104290cba98480d61f1494b7aa34a16f46e11218a624"},"member_count":7,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F","source_family":"aws.security_group","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW, LEDGER, UNSUPPORTED","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":2}},{"id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3","kind":"unit-review","family":"aws.security_group","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.security_group","block":"module.retail_app_ecs.module.orders_service.aws_security_group.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"TARGET_LIMIT","members":1},{"cause":"NOT_CLASSIFIED","members":5}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":7,"shape":"RSH-087d72dbb642","subject":"module.retail_app_ecs.module.orders_service.aws_security_group.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:6761ee5382c2046f852e12938f4868f00aa72c16f7060930ffb775b9e048cb7e","kb_dependencies_sha256":"sha256:51287d997e1fb655287d104290cba98480d61f1494b7aa34a16f46e11218a624"},"member_count":7,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3","source_family":"aws.security_group","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW, LEDGER, UNSUPPORTED","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":2}},{"id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS","kind":"unit-review","family":"aws.security_group","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.security_group","block":"module.retail_app_ecs.module.ui_service.aws_security_group.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"TARGET_LIMIT","members":1},{"cause":"NOT_CLASSIFIED","members":5}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":7,"shape":"RSH-087d72dbb642","subject":"module.retail_app_ecs.module.ui_service.aws_security_group.this","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:d3db27e38c1fef4dfc310642c956f0cd27d824826e599bedf54475accbc6fe8c","kb_dependencies_sha256":"sha256:51287d997e1fb655287d104290cba98480d61f1494b7aa34a16f46e11218a624"},"member_count":7,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS","source_family":"aws.security_group","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW, LEDGER, UNSUPPORTED","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":2}},{"id":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE","kind":"unit-review","family":"aws.subnet","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.subnet","block":"module.vpc.module.vpc.aws_subnet.private","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"conditional_members":4,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":3},{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"OPTIONAL_CONDITIONAL","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of module.vpc.module.vpc.aws_subnet.private: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 4 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them. The review step of the execution plan for these settings is MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:b1a497b9caa9da516a8ceb6a9547cf01be0e17d4e1b868091441dfc57a5ebc5c","kb_dependencies_sha256":"sha256:97a0cc39677d5688e69a422dadb5017babb8a52cbe2ba1d6f5678a3e8c1c106e"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE","source_family":"aws.subnet","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"network-topology-boundary/bring-the-closing-evidence","title":"Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.subnet/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""],"regeneration_required":true},{"id":"private-egress-ipv4/prove-what-the-source-subnet-reaches","title":"Decide how private servers reach the internet (outbound IPv4): Prove what the source subnet reaches (what the check that cannot prove it asks for)","prerequisites":["the route table the subnet follows and its default route, named by exact references in the source, and for a route to an internet gateway the public IPv4 address of every server in the subnet","or an architect's statement of what the source subnet reaches"],"effects":["A rerun on the source with the exact references reads the subnet as reaching the internet or not; the not-equivalent case then needs one of the other paths."],"risk":["A statement that is wrong about the source makes the target wider or narrower than the source without a finding."],"evidence":["rule aws.subnet/subnet-egress-ipv4-unproven of the knowledge base: \"or an architect's statement of what the source subnet reaches.\""],"regeneration_required":true},{"id":"private-egress-ipv4/limit-egress-with-security-groups","title":"Decide how private servers reach the internet (outbound IPv4): Accept the routed network and limit outbound traffic with security-group egress rules","prerequisites":["the outbound traffic the workload really needs (protocol, port, destination)","the allow-all default egress rule of each group removed after apply"],"effects":["The network still has an internet path; what the servers may reach is limited by their groups' egress rules (an allow-list was observed enforced per destination, protocol and port).","regeneration: not stated — treated as required"],"risk":["A server whose group keeps an allow-all egress rule reaches the internet; the exposure is wider than the source's until the rules exist."],"evidence":["decision kind stackitsg.default_egress.ipv4 of the knowledge base: \"Egress (Outbound) : All outgoing traffic is allowed by default.\"","decision kind stackitsg.default_egress.ipv4 of the knowledge base: \"The group then allows only the egress rules the draft writes from the source, so its outbound IPv4 traffic is no wider than the source's.\"","a test on a STACKIT project on 2026-10-10: \"Observed: on a stateful group an egress allow-list is enforced per destination, protocol and port\""],"regeneration_required":true},{"id":"private-egress-ipv4/isolate-through-the-target-environment","title":"Decide how private servers reach the internet (outbound IPv4): Isolate the networks: a bound target environment with egress none (routed = false)","prerequisites":["the architect's decision that no network of the project must reach another or the internet (the setting applies to every network the draft creates)","a target environment file stating egress mode NONE, bound to the run (target.egress then shows the bound statement)"],"effects":["Every network is written routed = false: observed in a STACKIT test project to have no internet egress and no connection to the project's other networks. STACKIT documents no egress switch; this rests on the observation, not on documentation. routed cannot be changed by an update: a later change replaces the network."],"risk":["The networks are cut off from each other as well (narrower than the source); the behaviour rests on observations in one STACKIT test project."],"evidence":["the description of the target-environment profile in the product documentation: \"`NONE` writes `routed = false`: a non-routed network has no gateway, no public IP and no internet egress, and the project's other networks do not reach it either (observed in one project, probes 2 and 11)\"","the generator of the draft: \"routed = false; a non-routed network has no gateway, no public IP and no internet egress\"","rule aws.subnet/subnet-egress-ipv4-not-equivalent of the knowledge base: \"The sandbox observed a non-routed network to have no internet egress and no connection to the project's other networks\"","provider-docs mirror stackit/docs.stackit.cloud/products/network/core-networking/network-area/faq.html: \"Currently we do not support this, however there are plans to enable this in the future.\""],"regeneration_required":true},{"id":"subnet-vpc-membership/bring-the-closing-evidence","title":"Confirm which network each subnet belongs to: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.subnet/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""],"regeneration_required":true}],"required_verification":["Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result","Decide how private servers reach the internet (outbound IPv4): an outbound connection from a server of the network to an internet address fails (or succeeds only where the decision allows it) on the target","Decide how private servers reach the internet (outbound IPv4): where the source used private DNS: names resolve on the target through the resolvers the networks are given","Confirm which network each subnet belongs to: the check, proof or closing evidence is recorded with its result"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes.","An answer of target.egress applies nothing by itself (the answer is read, not applied); a bound target environment's egress changes routed on every network. Neither closes the setting."],"remains_manual":["Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.","Decide how private servers reach the internet (outbound IPv4): Manual work remains: a person closes the semantic, the draft does not.","Confirm which network each subnet belongs to: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.subnet/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"","contract note aws.subnet/subnet-vpc-membership: \"The VPC the subnet belongs to: the draft creates every network in one project\"","contract note aws.subnet/private-egress-ipv4: \"so the source and the target are not equivalent and the draft closes nothing\"","the description of the target-environment profile in the product documentation: \"In this build four of them have no handler (`target.project`, `target.egress`, `target.ingress.public`, `target.observability`): an answer is `READ_NOT_APPLIED`, and `inputs-template.yaml` therefore lists them last, in the group NOT APPLICABLE IN THIS BUILD\"","STACKIT provider schema 0.120.0: \"the network doesn't have a gateway.\"","STACKIT provider schema 0.120.0: \"If set to `true`, the network is routed and therefore accessible from other networks.\"","STACKIT provider schema 0.120.0: \"The IPv4 nameservers of the network.\"","STACKIT provider schema 0.120.0: \"Note: This field currently has no effect and does not enforce any access restrictions on the DNS zone.\""],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the prefix setting; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on module.vpc.module.vpc.aws_subnet.private that the knowledge base cannot decide: Confirm that the project is the boundary of one network; Review the prefix setting; Decide how private servers reach the internet (outbound IPv4); Confirm which network each subnet belongs to.","generated_target_behavior":"Confirm that the project is the boundary of one network: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the prefix setting: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect). Decide how private servers reach the internet (outbound IPv4): The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect). Without a bound target environment the network keeps STACKIT's default gateway (routed and no_ipv4_gateway unset), so its servers can start outbound connections. With a target environment whose egress is none, every network the draft creates is written routed = false (an open egress decision, and a network narrower than the source: it reaches no other network either); with STACKIT's default routing it is written routed = true (wider than a source subnet without an internet route). The setting stays open for review in every case: no equivalence of the private egress is proven. Confirm which network each subnet belongs to: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.private; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the prefix setting: the target behaviour of this setting is not established Decide how private servers reach the internet (outbound IPv4): What the source subnet reaches (where unproven); that the servers of the subnet cannot reach the internet on the target, as on the source; and, where the source resolved private names, that the target resolves them. Confirm which network each subnet belongs to: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.vpc.module.vpc.aws_subnet.private/open-settings-network-architect now.","next_action":"Review the prefix setting: Review the prefix setting for module.vpc.module.vpc.aws_subnet.private, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this subnet included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.","Review the prefix setting: The value is not visible statically (a case of the mapping rule for this kind of unit), so nothing is credited for it. stackit_network.ipv4_prefix. TRANSFORMED for a CIDR the scan has seen. The draft carries the prefix as stackit_network.ipv4_prefix taken from a variable without a default (pinned provider: \"The IPv4 prefix of the network (CIDR)\") and says in the variable's description that the source CIDR is not visible; decide the CIDR each STACKIT network gets (the source CIDRs are reused unless the address plan changes) and enter it before plan.","Decide how private servers reach the internet (outbound IPv4): A check of the knowledge base (subnet egress ipv4 unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The source and the target are not equivalent for outbound access, and the draft closes nothing: REVIEW.","Confirm which network each subnet belongs to: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The VPC the subnet belongs to: the draft creates every network in one project, so the source VPC's boundary is kept only when the estate has one VPC and every resource that names a VPC provably names it; the draft states the estate's topology and what the architect decides about it once, at the top of its network file."],"closes_when":["Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the prefix setting: A literal value or a resolved reference in the source closes it, or a person confirms the value.","Decide how private servers reach the internet (outbound IPv4): The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the check that fired asks, and that check's closing evidence or decision is recorded. Where the scan cannot prove what the source subnet reaches, the closing evidence is the route table the subnet follows and its default route by exact references, and for a route to an internet gateway the public IPv4 address of every server in the subnet, or an architect's statement of what the source subnet reaches. Where the source subnet has no internet route, it is an architect's decision that the network may reach the internet through the STACKIT gateway with the outbound limits written as security-group egress rules, a decision that the network is isolated (routed = false), or a documented or observed setting that removes the outbound path of a routed network.","Decide how private servers reach the internet (outbound IPv4): A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Confirm which network each subnet belongs to: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm which network each subnet belongs to: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded."],"required_inputs":["target.egress"]}},{"id":"DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE","kind":"unit-review","family":"aws.subnet","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.subnet","block":"module.vpc.module.vpc.aws_subnet.private","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"conditional_members":1,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"OPTIONAL_CONDITIONAL","item_count":1,"shape":"RSH-216f8f6f9fa5","subject":"module.vpc.module.vpc.aws_subnet.private","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:5f69f9a245d1ee7220cd5f7ae8dd7d6c63754281e22d38e57ece0dd324c9f7ca","kb_dependencies_sha256":"sha256:b7c227d12f16960b694c76edaebeaa4eb6e1c2ce904c0f48e83f794a07fe3138"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PRIVATE","source_family":"aws.subnet","source_semantic":"unit-review","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"availability-resilience","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1}},{"id":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC","kind":"unit-review","family":"aws.subnet","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.subnet","block":"module.vpc.module.vpc.aws_subnet.public","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"conditional_members":5,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":4},{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"OPTIONAL_CONDITIONAL","item_count":5,"why":"The knowledge base cannot decide 5 critical settings of module.vpc.module.vpc.aws_subnet.public: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 5 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them. The review step of the execution plan for these settings is MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:755f2761ac8b2e8f203b7be58efc5948a0633f72c4f5eadcad7fafd1ed820427","kb_dependencies_sha256":"sha256:0c657c51ac1ed6771de561cec8183d19d149beb1179624fa61bcba2e95fb1db2"},"member_count":5,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC","source_family":"aws.subnet","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"effective-route-table/decide-and-carry-out","title":"Confirm which route table each subnet really uses: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.","regeneration: not stated — treated as required"],"risk":["The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes."],"evidence":["contract note aws.subnet/effective-route-table: \"A person decides which routes the subnet's network gets: the draft attaches no routing table to the network, and a STACKIT network gets a default gateway unless it is told not to, so what the subnet reaches can differ from AWS.\""],"regeneration_required":true},{"id":"network-topology-boundary/bring-the-closing-evidence","title":"Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.subnet/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""],"regeneration_required":true},{"id":"private-egress-ipv4/prove-what-the-source-subnet-reaches","title":"Decide how private servers reach the internet (outbound IPv4): Prove what the source subnet reaches (what the check that cannot prove it asks for)","prerequisites":["the route table the subnet follows and its default route, named by exact references in the source, and for a route to an internet gateway the public IPv4 address of every server in the subnet","or an architect's statement of what the source subnet reaches"],"effects":["A rerun on the source with the exact references reads the subnet as reaching the internet or not; the not-equivalent case then needs one of the other paths."],"risk":["A statement that is wrong about the source makes the target wider or narrower than the source without a finding."],"evidence":["rule aws.subnet/subnet-egress-ipv4-unproven of the knowledge base: \"or an architect's statement of what the source subnet reaches.\""],"regeneration_required":true},{"id":"private-egress-ipv4/limit-egress-with-security-groups","title":"Decide how private servers reach the internet (outbound IPv4): Accept the routed network and limit outbound traffic with security-group egress rules","prerequisites":["the outbound traffic the workload really needs (protocol, port, destination)","the allow-all default egress rule of each group removed after apply"],"effects":["The network still has an internet path; what the servers may reach is limited by their groups' egress rules (an allow-list was observed enforced per destination, protocol and port).","regeneration: not stated — treated as required"],"risk":["A server whose group keeps an allow-all egress rule reaches the internet; the exposure is wider than the source's until the rules exist."],"evidence":["decision kind stackitsg.default_egress.ipv4 of the knowledge base: \"Egress (Outbound) : All outgoing traffic is allowed by default.\"","decision kind stackitsg.default_egress.ipv4 of the knowledge base: \"The group then allows only the egress rules the draft writes from the source, so its outbound IPv4 traffic is no wider than the source's.\"","a test on a STACKIT project on 2026-10-10: \"Observed: on a stateful group an egress allow-list is enforced per destination, protocol and port\""],"regeneration_required":true},{"id":"private-egress-ipv4/isolate-through-the-target-environment","title":"Decide how private servers reach the internet (outbound IPv4): Isolate the networks: a bound target environment with egress none (routed = false)","prerequisites":["the architect's decision that no network of the project must reach another or the internet (the setting applies to every network the draft creates)","a target environment file stating egress mode NONE, bound to the run (target.egress then shows the bound statement)"],"effects":["Every network is written routed = false: observed in a STACKIT test project to have no internet egress and no connection to the project's other networks. STACKIT documents no egress switch; this rests on the observation, not on documentation. routed cannot be changed by an update: a later change replaces the network."],"risk":["The networks are cut off from each other as well (narrower than the source); the behaviour rests on observations in one STACKIT test project."],"evidence":["the description of the target-environment profile in the product documentation: \"`NONE` writes `routed = false`: a non-routed network has no gateway, no public IP and no internet egress, and the project's other networks do not reach it either (observed in one project, probes 2 and 11)\"","the generator of the draft: \"routed = false; a non-routed network has no gateway, no public IP and no internet egress\"","rule aws.subnet/subnet-egress-ipv4-not-equivalent of the knowledge base: \"The sandbox observed a non-routed network to have no internet egress and no connection to the project's other networks\"","provider-docs mirror stackit/docs.stackit.cloud/products/network/core-networking/network-area/faq.html: \"Currently we do not support this, however there are plans to enable this in the future.\""],"regeneration_required":true},{"id":"subnet-vpc-membership/bring-the-closing-evidence","title":"Confirm which network each subnet belongs to: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.subnet/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""],"regeneration_required":true}],"required_verification":["Confirm which route table each subnet really uses: the decision or the manual work is done and recorded (who, when, what was configured and why)","Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result","Decide how private servers reach the internet (outbound IPv4): an outbound connection from a server of the network to an internet address fails (or succeeds only where the decision allows it) on the target","Decide how private servers reach the internet (outbound IPv4): where the source used private DNS: names resolve on the target through the resolvers the networks are given","Confirm which network each subnet belongs to: the check, proof or closing evidence is recorded with its result"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes.","An answer of target.egress applies nothing by itself (the answer is read, not applied); a bound target environment's egress changes routed on every network. Neither closes the setting."],"remains_manual":["Confirm which route table each subnet really uses: Manual work remains: a person closes the semantic, the draft does not.","Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.","Decide how private servers reach the internet (outbound IPv4): Manual work remains: a person closes the semantic, the draft does not.","Confirm which network each subnet belongs to: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.subnet/effective-route-table: \"A person decides which routes the subnet's network gets: the draft attaches no routing table to the network, and a STACKIT network gets a default gateway unless it is told not to, so what the subnet reaches can differ from AWS.\"","contract note aws.subnet/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\"","contract note aws.subnet/subnet-vpc-membership: \"The VPC the subnet belongs to: the draft creates every network in one project\"","contract note aws.subnet/private-egress-ipv4: \"so the source and the target are not equivalent and the draft closes nothing\"","the description of the target-environment profile in the product documentation: \"In this build four of them have no handler (`target.project`, `target.egress`, `target.ingress.public`, `target.observability`): an answer is `READ_NOT_APPLIED`, and `inputs-template.yaml` therefore lists them last, in the group NOT APPLICABLE IN THIS BUILD\"","STACKIT provider schema 0.120.0: \"the network doesn't have a gateway.\"","STACKIT provider schema 0.120.0: \"If set to `true`, the network is routed and therefore accessible from other networks.\"","STACKIT provider schema 0.120.0: \"The IPv4 nameservers of the network.\"","STACKIT provider schema 0.120.0: \"Note: This field currently has no effect and does not enforce any access restrictions on the DNS zone.\""],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the prefix setting; the 5 settings of the record state their own.","source_observation":"The source states 5 critical settings on module.vpc.module.vpc.aws_subnet.public that the knowledge base cannot decide: Confirm which route table each subnet really uses; Confirm that the project is the boundary of one network; Review the prefix setting; Decide how private servers reach the internet (outbound IPv4); Confirm which network each subnet belongs to.","generated_target_behavior":"Confirm which route table each subnet really uses: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the prefix setting: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect). Decide how private servers reach the internet (outbound IPv4): The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect). Without a bound target environment the network keeps STACKIT's default gateway (routed and no_ipv4_gateway unset), so its servers can start outbound connections. With a target environment whose egress is none, every network the draft creates is written routed = false (an open egress decision, and a network narrower than the source: it reaches no other network either); with STACKIT's default routing it is written routed = true (wider than a source subnet without an internet route). The setting stays open for review in every case: no equivalence of the private egress is proven. Confirm which network each subnet belongs to: The draft does not carry the setting on module.vpc.module.vpc.aws_subnet.public; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Confirm which route table each subnet really uses: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the prefix setting: the target behaviour of this setting is not established Decide how private servers reach the internet (outbound IPv4): What the source subnet reaches (where unproven); that the servers of the subnet cannot reach the internet on the target, as on the source; and, where the source resolved private names, that the target resolves them. Confirm which network each subnet belongs to: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.vpc.module.vpc.aws_subnet.public/open-settings-network-architect now.","next_action":"Review the prefix setting: Review the prefix setting for module.vpc.module.vpc.aws_subnet.public, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Confirm which route table each subnet really uses: A check of the knowledge base (subnet route table undecided) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The subnet follows the VPC's main route table when no association names a route table.","Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, this subnet included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.","Review the prefix setting: The value is not visible statically (a case of the mapping rule for this kind of unit), so nothing is credited for it. stackit_network.ipv4_prefix. TRANSFORMED for a CIDR the scan has seen. The draft carries the prefix as stackit_network.ipv4_prefix taken from a variable without a default (pinned provider: \"The IPv4 prefix of the network (CIDR)\") and says in the variable's description that the source CIDR is not visible; decide the CIDR each STACKIT network gets (the source CIDRs are reused unless the address plan changes) and enter it before plan.","Decide how private servers reach the internet (outbound IPv4): A check of the knowledge base (subnet egress ipv4 unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The source and the target are not equivalent for outbound access, and the draft closes nothing: REVIEW.","Confirm which network each subnet belongs to: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The VPC the subnet belongs to: the draft creates every network in one project, so the source VPC's boundary is kept only when the estate has one VPC and every resource that names a VPC provably names it; the draft states the estate's topology and what the architect decides about it once, at the top of its network file."],"closes_when":["Confirm which route table each subnet really uses: A person decides which routes the subnet's network gets: the draft attaches no routing table to the network, and a STACKIT network gets a default gateway unless it is told not to, so what the subnet reaches can differ from AWS.","Confirm which route table each subnet really uses: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person decides which routes the subnet's network gets: the draft attaches no routing table to the network, and a STACKIT network gets a default gateway unless it is told not to, so what the subnet reaches can differ from AWS.","Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the prefix setting: A literal value or a resolved reference in the source closes it, or a person confirms the value.","Decide how private servers reach the internet (outbound IPv4): The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the check that fired asks, and that check's closing evidence or decision is recorded. Where the scan cannot prove what the source subnet reaches, the closing evidence is the route table the subnet follows and its default route by exact references, and for a route to an internet gateway the public IPv4 address of every server in the subnet, or an architect's statement of what the source subnet reaches. Where the source subnet has no internet route, it is an architect's decision that the network may reach the internet through the STACKIT gateway with the outbound limits written as security-group egress rules, a decision that the network is isolated (routed = false), or a documented or observed setting that removes the outbound path of a routed network.","Decide how private servers reach the internet (outbound IPv4): A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Confirm which network each subnet belongs to: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm which network each subnet belongs to: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded."],"required_inputs":["target.egress"]}},{"id":"DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC","kind":"unit-review","family":"aws.subnet","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.subnet","block":"module.vpc.module.vpc.aws_subnet.public","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"conditional_members":1,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"OPTIONAL_CONDITIONAL","item_count":1,"shape":"RSH-216f8f6f9fa5","subject":"module.vpc.module.vpc.aws_subnet.public","review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:011643d2054f5f8478b444cf7895470f87a6d43d3f75c6ef3ff169fcdffdbdc3","kb_dependencies_sha256":"sha256:b7c227d12f16960b694c76edaebeaa4eb6e1c2ce904c0f48e83f794a07fe3138"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-SUBNET-PUBLIC","source_family":"aws.subnet","source_semantic":"unit-review","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"availability-resilience","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1}},{"id":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS","kind":"unit-review","family":"aws.vpc","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.vpc","block":"module.vpc.module.vpc.aws_vpc.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":3},{"cause":"TARGET_LIMIT","members":2}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":5,"why":"The knowledge base cannot decide 5 critical settings of module.vpc.module.vpc.aws_vpc.this: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:4865af5a8e50259aa89eda3cb3004ce9ea97b5c15f0b1eca3b8d2b5c3f3514dd","kb_dependencies_sha256":"sha256:b25af41cfbf903a0a38114116600fd7b6a404dd41e3651b6374d9b17e055b358"},"member_count":5,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-NET-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS","source_family":"aws.vpc","source_semantic":"unit-review","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"network-security","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"default-nacl-rules/carry-out-by-hand","title":"Review the default nacl rules setting: Carry out the work the knowledge base's note names, by hand","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person does the work outside the draft; StackToIT neither does nor verifies it.","regeneration: not stated — treated as required"],"risk":["The work is not in the draft, so it is forgotten unless it is planned as a manual step."],"evidence":["contract note aws.vpc/default-nacl-rules: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\""],"regeneration_required":true},{"id":"default-route-table/bring-the-closing-evidence","title":"Review the default route table setting: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.vpc/default-route-table: \"The account's default route table is adopted (a facet of the VPC, aws_default_route_table, AWS provider 6.66.0).\""],"regeneration_required":true},{"id":"default-security-group-omitted-direction/bring-the-closing-evidence","title":"Review the default security group omitted direction setting: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.vpc/default-security-group-omitted-direction: \"The adopted default security group of the VPC (a facet, aws_default_security_group) does not state an ingress or an egress direction.\""],"regeneration_required":true},{"id":"main-table-set/bring-the-closing-evidence","title":"Review the main table set setting: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.vpc/default-route-table: \"The account's default route table is adopted (a facet of the VPC, aws_default_route_table, AWS provider 6.66.0).\""],"regeneration_required":true},{"id":"network-topology-boundary/bring-the-closing-evidence","title":"Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.vpc/default-route-table: \"The account's default route table is adopted (a facet of the VPC, aws_default_route_table, AWS provider 6.66.0).\""],"regeneration_required":true}],"required_verification":["Review the default nacl rules setting: the decision or the manual work is done and recorded (who, when, what was configured and why)","Review the default route table setting: the check, proof or closing evidence is recorded with its result","Review the default security group omitted direction setting: the check, proof or closing evidence is recorded with its result","Review the main table set setting: the check, proof or closing evidence is recorded with its result","Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Review the default nacl rules setting: Manual work remains: a person closes the semantic, the draft does not.","Review the default route table setting: Manual work remains: a person closes the semantic, the draft does not.","Review the default security group omitted direction setting: Manual work remains: a person closes the semantic, the draft does not.","Review the main table set setting: Manual work remains: a person closes the semantic, the draft does not.","Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.vpc/default-nacl-rules: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"","contract note aws.vpc/tcfp-default-network-acl--egress--action: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"","contract note aws.vpc/tcfp-default-network-acl--egress--cidr-block: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"","contract note aws.vpc/tcfp-default-network-acl--egress--from-port: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"","contract note aws.vpc/tcfp-default-network-acl--egress--ipv6-cidr-block: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"","contract note aws.vpc/tcfp-default-network-acl--egress--protocol: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"","contract note aws.vpc/tcfp-default-network-acl--egress--rule-no: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"","contract note aws.vpc/tcfp-default-network-acl--egress--to-port: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"","contract note aws.vpc/tcfp-default-network-acl--ingress--action: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"","contract note aws.vpc/tcfp-default-network-acl--ingress--cidr-block: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"","contract note aws.vpc/tcfp-default-network-acl--ingress--from-port: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"","contract note aws.vpc/tcfp-default-network-acl--ingress--ipv6-cidr-block: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"","contract note aws.vpc/tcfp-default-network-acl--ingress--protocol: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"","contract note aws.vpc/tcfp-default-network-acl--ingress--rule-no: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"","contract note aws.vpc/tcfp-default-network-acl--ingress--to-port: \"A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.\"","contract note aws.vpc/default-route-table: \"The account's default route table is adopted (a facet of the VPC, aws_default_route_table, AWS provider 6.66.0).\"","contract note aws.vpc/main-table-set: \"The setting names the route table that is the main route table of the VPC, when the configuration sets it or the scan cannot tell.\"","contract note aws.vpc/network-topology-boundary: \"STACKIT has no VPC container in its stable model: the project is the boundary of its networks and its virtual router routes between all networks of one project (docs.stackit.cloud core-networking arch\"","contract note aws.vpc/default-security-group-omitted-direction: \"The adopted default security group of the VPC (a facet, aws_default_security_group) does not state an ingress or an egress direction.\""],"state_reason":"the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Review the default nacl rules setting; the 5 settings of the record state their own.","source_observation":"The source states 5 critical settings on module.vpc.module.vpc.aws_vpc.this that the knowledge base cannot decide: Review the default nacl rules setting; Review the default route table setting; Review the default security group omitted direction setting; Review the main table set setting; Confirm that the project is the boundary of one network.","generated_target_behavior":"Review the default nacl rules setting: The draft does not carry the setting on module.vpc.module.vpc.aws_vpc.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the default route table setting: The draft does not carry the setting on module.vpc.module.vpc.aws_vpc.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the default security group omitted direction setting: The draft does not carry the setting on module.vpc.module.vpc.aws_vpc.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the main table set setting: The draft does not carry the setting on module.vpc.module.vpc.aws_vpc.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on module.vpc.module.vpc.aws_vpc.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Review the default nacl rules setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the default route table setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the default security group omitted direction setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the main table set setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.vpc.module.vpc.aws_vpc.this/open-settings-network-architect now.","next_action":"Review the default nacl rules setting: Carry out the manual work the plan names for module.vpc.module.vpc.aws_vpc.this outside the draft; the plan states no title for it.","why_open":["Review the default nacl rules setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The account's default network ACL is adopted by the VPC (aws_default_network_acl); a deny rule, a rule that is not all-protocol, a CIDR other than 0.0.0.0/0 or ::/0, or an explicitly empty rule list narrows or leaves undecided what the AWS default allow-all states.","Review the default route table setting: A check of the knowledge base (vpc main table undecided) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The account's default route table is adopted (a facet of the VPC, aws_default_route_table, AWS provider 6.66.0). Routes other than a plain 0.0.0.0/0 to an internet or NAT gateway are REVIEW.","Review the default security group omitted direction setting: A check of the knowledge base (vpc default sg no ingress rules) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The adopted default security group of the VPC (a facet, aws_default_security_group) does not state an ingress or an egress direction. Nothing is drafted for this facet, so the empty direction is not reproduced: a person decides whether servers that used the default group must stay without outbound traffic (delete the allow-all egress rules of the STACKIT group after apply) or are meant to have it, and puts them in a STACKIT group that states no ingress rule, not in the project's default group.","Review the main table set setting: A check of the knowledge base (vpc main table undecided) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting names the route table that is the main route table of the VPC, when the configuration sets it or the scan cannot tell. STACKIT has no main route table.","Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). STACKIT has no VPC container in its stable model: the project is the boundary of its networks and its virtual router routes between all networks of one project (docs.stackit.cloud core-networking architecture, updated Aug 20, 2026: \"Routing between multiple Virtual Networks in the same project\"; SNA \"extends the networking architecture to enable cross-project connectivity\"). Several VPCs, or a count the scan cannot see: the draft puts every network in the one var.project_id and cannot keep them apart — REVIEW, the choice is the architect's. A unit that names a VPC, or is placed in a subnet (subnet_id, subnets, vpc_config.subnet_ids, ...), without one whole reference to the VPC or to a subnet of the estate may stand in a VPC the estate does not create: the architect decides it the same way (REVIEW)."],"closes_when":["Review the default nacl rules setting: A person re-expresses the default network ACL's rules as security group rules, because STACKIT has no stateless subnet ACL; no STACKIT documentation states that a server or network without an attached security group allows all traffic.","Review the default route table setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Review the default route table setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the default security group omitted direction setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Review the default security group omitted direction setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the main table set setting: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Review the main table set setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded."],"required_inputs":[]}},{"id":"DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS","kind":"unit-review","family":"aws.vpc","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-aws.vpc","block":"module.vpc.module.vpc.aws_vpc.this","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of module.vpc.module.vpc.aws_vpc.this: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:922a8c15b2b7499818c932ef55606b1e59f94f004ed39d782da13bce247b427c","kb_dependencies_sha256":"sha256:cf773f243b88c0f4a074eff319871c3bb5787549b954a01a750246bcb33248c9"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-OPS-MODULE-VPC-MODULE-VPC-AWS-VPC-THIS","source_family":"aws.vpc","source_semantic":"unit-review","affected_application":[],"action_type":"VERIFY_BEHAVIOR","work_package":"private-egress-dns","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"REQUIRES_VERIFICATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"dns-settings/verify-on-target","title":"Confirm how names resolve for the servers of the migrated networks: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.vpc/dns-settings: \"A person confirms how names resolve for the servers of the migrated networks.\""],"regeneration_required":true}],"required_verification":["Confirm how names resolve for the servers of the migrated networks: the check, proof or closing evidence is recorded with its result"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Confirm how names resolve for the servers of the migrated networks: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.vpc/dns-settings: \"A person confirms how names resolve for the servers of the migrated networks.\""],"state_reason":"the guidance closes it by a runtime or validation result","source_observation":"The source states 1 critical setting on module.vpc.module.vpc.aws_vpc.this that the knowledge base cannot decide: Confirm how names resolve for the servers of the migrated networks.","generated_target_behavior":"Confirm how names resolve for the servers of the migrated networks: The draft does not carry the setting on module.vpc.module.vpc.aws_vpc.this; a manual step stands for it (MAN/semantic/module.vpc.module.vpc.aws_vpc.this/dns-settings). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Confirm how names resolve for the servers of the migrated networks: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/module.vpc.module.vpc.aws_vpc.this/dns-settings now.","next_action":"Confirm how names resolve for the servers of the migrated networks: Verify on the target for module.vpc.module.vpc.aws_vpc.this: the check, proof or closing evidence is recorded with its result.","why_open":["Confirm how names resolve for the servers of the migrated networks: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. enable_dns_support and enable_dns_hostnames of the VPC decide how names resolve for what runs in it; STACKIT has no VPC object (each subnet becomes a stackit_network)."],"closes_when":["Confirm how names resolve for the servers of the migrated networks: A person confirms how names resolve for the servers of the migrated networks."],"required_inputs":[]}},{"id":"DEC-OPS-STACKITLOGS-ACTION-ARCHIVE-FLOW","kind":"ARCHIVE_FLOW","family":"stackitlogs","source":"MANUAL_ACTION","group":"GRP-MANUAL-ACTION-stackitlogs","block":"ARCHIVE_FLOW","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"TECHNICAL_VALIDATION_PASSED","owner_role":"Platform Architect","required_by_phase":"CUTOVER_PREREQUISITE","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"MANUAL_ACTION_OPEN","causes":[{"cause":"TARGET_LIMIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"The plan of the draft lists the stackitlogs manual action kind \"archive flow\" (1 action): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:bb64988972ed356df4aa14fc8e54b8401f2f06a46c9738974e9ce41147d7a9f6","kb_dependencies_sha256":"sha256:d0c401dfda1e6d6567b70698edf5199e12079a6a9e38903447cf4935fed73c0c"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-STACKITLOGS-ACTION-ARCHIVE-FLOW","source_family":"stackitlogs","source_semantic":"ARCHIVE_FLOW","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"CUTOVER_PREREQUISITE","raw_semantic_status":"MANUAL_ACTION_OPEN","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"the plan names manual work outside the draft","source_observation":"The plan names manual work (archive flow) on module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks.","generated_target_behavior":"The draft does not do this work; the plan lists it as manual work.","residual_difference":"the work outside the draft is neither done nor verified by StackToIT","execution_effect":"No step waits for it. Held by something else first: MAN/logs/archive:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks.","next_action":"Outside the draft, for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: Configure a cold-storage log flow for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: send a copy of its logs, in parallel to the Logs instance stackit_logs_instance.logs_retention_180d, to a long-term store (for example a separate Object Storage bucket) that keeps them for the retention beyond 180 days; the plan lists it as manual work.","why_open":["The plan of the draft lists the stackitlogs manual action kind \"archive flow\" (1 action): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan."],"closes_when":["a line the log producers of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks send is found both in the Logs instance and in the archive, and logs older than 180 days are readable from the archive"],"required_inputs":["where the archive is kept (for example an Object Storage bucket) and the retention in days the workload needs there (the source keeps its logs for ever)"]}},{"id":"DEC-OPS-STACKITLOGS-ACTION-LABEL-CONVENTION","kind":"LABEL_CONVENTION","family":"stackitlogs","source":"MANUAL_ACTION","group":"GRP-MANUAL-ACTION-stackitlogs","block":"LABEL_CONVENTION","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"TECHNICAL_VALIDATION_PASSED","owner_role":"Platform Architect","required_by_phase":"CUTOVER_PREREQUISITE","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"MANUAL_ACTION_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"The plan of the draft lists the stackitlogs manual action kind \"label convention\" (1 action): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:b58c0c06f680feba6220276e5fbad92f2c72b3b306439aa1b3976d3534797a14","kb_dependencies_sha256":"sha256:38945168b2f2937f0a3aa90cbabea8d4da46e1be8e809d7ead7bbb6d8d5c595b"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-STACKITLOGS-ACTION-LABEL-CONVENTION","source_family":"stackitlogs","source_semantic":"LABEL_CONVENTION","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"CUTOVER_PREREQUISITE","raw_semantic_status":"MANUAL_ACTION_OPEN","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"the plan names manual work outside the draft","source_observation":"The plan names manual work (label convention) on module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks.","generated_target_behavior":"The draft does not do this work; the plan lists it as manual work.","residual_difference":"the work outside the draft is neither done nor verified by StackToIT","execution_effect":"No step waits for it. The plan can start MAN/logs/label-convention:module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks now.","next_action":"Outside the draft, for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: Choose a static label and send the name of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks (and of its streams) from its log producers as the value of that label; the plan lists it as manual work.","why_open":["The plan of the draft lists the stackitlogs manual action kind \"label convention\" (1 action): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan."],"closes_when":["a static label is chosen, the log producers of module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks send its name as the value of that label, and a line one of them sends is found by that label"],"required_inputs":[]}},{"id":"DEC-OPS-STACKITLOGS-ACTION-TARGET-PRECONDITION","kind":"TARGET_PRECONDITION","family":"stackitlogs","source":"MANUAL_ACTION","group":"GRP-MANUAL-ACTION-stackitlogs","block":"TARGET_PRECONDITION","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"TECHNICAL_VALIDATION_PASSED","owner_role":"Platform Architect","required_by_phase":"CUTOVER_PREREQUISITE","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"MANUAL_ACTION_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"The plan of the draft lists the stackitlogs manual action kind \"target precondition\" (1 action): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:869fcb456492cde1234d12ef703bdb950ac8fd8e22799b1525a5563d29e506d0","kb_dependencies_sha256":"sha256:78614094fd30d57756cdc7e437d195104e62ff218fd21a5e386a86d5a8ca8f41"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-STACKITLOGS-ACTION-TARGET-PRECONDITION","source_family":"stackitlogs","source_semantic":"TARGET_PRECONDITION","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"CUTOVER_PREREQUISITE","raw_semantic_status":"MANUAL_ACTION_OPEN","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"the plan names manual work outside the draft","source_observation":"The plan names manual work (target precondition) on module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks.","generated_target_behavior":"The draft does not do this work; the plan lists it as manual work.","residual_difference":"the work outside the draft is neither done nor verified by StackToIT","execution_effect":"No step waits for it. The plan can start MAN/logs/token:stackit_logs_instance.logs_retention_180d now.","next_action":"Outside the draft, for module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks: Before any log source writes to stackit_logs_instance.logs_retention_180d: create a write access token for the instance (stackit_logs_access_token with the permission write), set the access control list of the instance, and point the shipper at the instance's ingest_url (Loki API) or ingest_otlp_url (OpenTelemetry); the plan lists it as manual work.","why_open":["The plan of the draft lists the stackitlogs manual action kind \"target precondition\" (1 action): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan."],"closes_when":["a write access token for stackit_logs_instance.logs_retention_180d exists, the access control list of the instance is set, and a log line sent with the token to the ingest address of the instance is accepted"],"required_inputs":[]}},{"id":"DEC-SEC-STACKITSG-ACTION-INCOMPLETE","kind":"INCOMPLETE","family":"stackitsg","source":"MANUAL_ACTION","group":"GRP-MANUAL-ACTION-stackitsg","block":"INCOMPLETE","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"TECHNICAL_VALIDATION_PASSED","owner_role":"Security Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"MANUAL_ACTION_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":2}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"The plan of the draft lists the stackitsg manual action kind \"incomplete\" (2 actions): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:246f8bd919be5928fd53549dda1b5936212a68d1c144c86e55d5ed6b3e165741","kb_dependencies_sha256":"sha256:82b7420c25df2b3e3dce07530fedb0c73f975b628559ac3addd227886f46cbeb"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-STACKITSG-ACTION-INCOMPLETE","source_family":"stackitsg","source_semantic":"INCOMPLETE","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"NOT_STATED","owner_role":"Security Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"MANUAL_ACTION_OPEN","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":2,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"the plan names manual work outside the draft","source_observation":"The plan names manual work (incomplete) on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.","generated_target_behavior":"The draft does not do this work; the plan lists it as manual work.","residual_difference":"the work outside the draft is neither done nor verified by StackToIT","execution_effect":"No step waits for it. The plan can start MAN/security/aws/incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group-module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.0.:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules-b506f3 and MAN/security/aws/incomplete:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:group-module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.0.:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules-a538f6 now.","next_action":"Outside the draft, for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix: Re-create the rules beyond the known set of group module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix[0] (rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules) (and 1 more manual steps); the plan lists it as manual work.","why_open":["The plan of the draft lists the stackitsg manual action kind \"incomplete\" (2 actions): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan."],"closes_when":["every entry of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules is known and has a rule, or it is confirmed that the known entries are all","every entry of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules is known and has a rule, or it is confirmed that the known entries are all"],"required_inputs":[]}},{"id":"DEC-SEC-STACKITSG-ACTION-UNPLACED","kind":"UNPLACED","family":"stackitsg","source":"MANUAL_ACTION","group":"GRP-MANUAL-ACTION-stackitsg","block":"UNPLACED","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"TECHNICAL_VALIDATION_PASSED","owner_role":"Security Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"MANUAL_ACTION_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":2}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"The plan of the draft lists the stackitsg manual action kind \"unplaced\" (2 actions): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:c30c890a1799d91f5c3dd6213a6e7ae3d8c381d635b1bb48ea9a45e4efebf255","kb_dependencies_sha256":"sha256:1e0b3d10d12c2152345db3e5a14df278ba329f473967455f9158fa0eb219684a"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-STACKITSG-ACTION-UNPLACED","source_family":"stackitsg","source_semantic":"UNPLACED","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"NOT_STATED","owner_role":"Security Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"MANUAL_ACTION_OPEN","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":2,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"the plan names manual work outside the draft","source_observation":"The plan names manual work (unplaced) on module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix.","generated_target_behavior":"The draft does not do this work; the plan lists it as manual work.","residual_difference":"the work outside the draft is neither done nor verified by StackToIT","execution_effect":"No step waits for it. The plan can start MAN/security/aws/unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules.0-217968 and MAN/security/aws/unplaced:module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules.0-f26028 now.","next_action":"Outside the draft, for module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix: Place the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] on the security group it belongs to and write it (and 1 more manual steps); the plan lists it as manual work.","why_open":["The plan of the draft lists the stackitsg manual action kind \"unplaced\" (2 actions): a person does it outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan."],"closes_when":["the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] is written on the security group it belongs to","the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] is written on the security group it belongs to"],"required_inputs":[]}},{"id":"DEC-NET-STACKITROUTE-STATEMENT-NOT-DRAFTED","kind":"NOT_DRAFTED","family":"stackitroute","source":"PLAN_STATEMENT","group":"GRP-PLAN-STATEMENT-stackitroute","block":"NOT_DRAFTED","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"PLAN_STATEMENT_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":2}],"blocker_class":"OPTIONAL_CONDITIONAL","why":"The stackitroute plan of the draft writes no resource for 2 units and states why (no resource is written for the unit and the plan names a step beside it): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:650b81a7db5184350b172778d82ba46d11cd6e33c14f6a6e897d1c2e161a6fdb","kb_dependencies_sha256":"sha256:4d101cce382446307a7bc4915ae3b5bdd3448296b22e9c0fe9e3e5508a3d60e0"},"member_count":2,"affected_unit_count":2,"evidence_ref_count":2,"resolution":{"decision_id":"DEC-NET-STACKITROUTE-STATEMENT-NOT-DRAFTED","source_family":"stackitroute","source_semantic":"NOT_DRAFTED","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"routing-architecture","owner_role":"Network Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"PLAN_STATEMENT_OPEN","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","guidance_ref":"stackitroute-not-drafted/NOT_DRAFTED","related_execution_step_count":3,"state_reason":"the plan writes no resource for the unit and names the work a person does instead","source_observation":"The plan writes no resource for module.vpc.module.vpc.aws_route_table.private: STACKIT's default routing replaces the table, with a loss: a route of the table sends traffic to a NAT gateway (the others, if any, to an internet gateway), and the reachability is observed on the target for a project outside a Network Area, which this draft does not write. Observed in one sandbox project outside a Network Area (tested on a STACKIT project on 2026-10-10; routing tables are refused there): a routed network reaches the internet with no route and no routing table configured, a server without a public IP through the network's shared SNAT address and a server with a public IP through its own; nothing initiated from the internet reached a server behind the network address; egress is restricted by the egress rules of security groups, not by a route; routed networks reach each other with no table. No stackit_routing_table is drafted. A NAT gateway adds what an internet route does not. Its fixed egress address is LOST (observed): the address a routed STACKIT network leaves by is the network's publicIp, one address for every routed network of the project, not fixed (it changed twice when every network of the project was deleted) and not settable (a PATCH of it answers 202 and is ignored), so a third party's allow-list on the NAT gateway's address does not survive; a STACKIT public IP per server keeps its address, the only one the probe saw stay fixed. The egress restriction (the gateway as the only way out of a private subnet) is carried by the egress rules of security groups, not by a route (observed); whether the source restricts egress that way is for the architect. The absence of inbound paths of a private subnet is observed for a server without a public IP (tcp 22, 80 and 8080 on the network address). Not observed: a Network Area and its default routing table. The outbound address of the servers an allow-list names is the architect's choice: keep the changing address, or give each server that an allow-list names a STACKIT public IP. The plan writes no resource for module.vpc.module.vpc.aws_route_table.public: STACKIT's default routing replaces the table: every route of the table sends traffic to an internet gateway, and the equivalence is observed on the target for a project outside a Network Area, which this draft does not write. Observed in one sandbox project outside a Network Area (tested on a STACKIT project on 2026-10-10; routing tables are refused there): a routed network reaches the internet with no route and no routing table configured, a server without a public IP through the network's shared SNAT address and a server with a public IP through its own; nothing initiated from the internet reached a server behind the network address; egress is restricted by the egress rules of security groups, not by a route; routed networks reach each other with no table. No stackit_routing_table is drafted. Observed in one project of one region on one day, so not HIGH; not observed: a Network Area and its default routing table, where this would be open again. The draft writes no routing table for a table whose routes all send traffic to an internet gateway: STACKIT's default routing gave a routed network the same reachability in one STACKIT test project outside a Network Area. The default routing table of a Network Area was never read.","generated_target_behavior":"The draft writes no resource for module.vpc.module.vpc.aws_route_table.private and module.vpc.module.vpc.aws_route_table.public. No stackit_routing_table is written; the plan names the precondition step: create the target project outside a Network Area.","residual_difference":"The reachability inside a Network Area, and for a server without a public IP the new outbound path: it leaves through the network's shared SNAT address, which the source's internet gateway did not give it.","execution_effect":"No step waits for it. The plan can start MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.private and MAN/routing/precondition-outside-area:module.vpc.module.vpc.aws_route_table.public now. Held by something else first: DEC/routing/DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST.","next_action":"Outside the draft, for module.vpc.module.vpc.aws_route_table.private and module.vpc.module.vpc.aws_route_table.public: Create the target project outside a Network Area: module.vpc.module.vpc.aws_route_table.private is replaced by STACKIT's default routing, which was observed to give a routed network the same reachability only in a project outside a Network Area (and 2 more manual steps); the plan lists it as manual work.","why_open":["The stackitroute plan of the draft writes no resource for 2 units and states why (no resource is written for the unit and the plan names a step beside it): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan."],"closes_when":["The knowledge base states no closing condition for a statement of the plan; it is done when the target project exists outside a Network Area and the reachability of its networks is observed on it.","the target project exists outside a Network Area, or the architect has decided how module.vpc.module.vpc.aws_route_table.private is replaced inside the area","the decision DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST is answered (accepted or rejected, with its evidence) in the inputs of the run and is no longer open when the run is repeated","the target project exists outside a Network Area, or the architect has decided how module.vpc.module.vpc.aws_route_table.public is replaced inside the area"],"required_inputs":["the STACKIT project the draft is created in (var.project_id) and whether it lies inside a Network Area","the answer to the decision DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST"]}},{"id":"DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW","kind":"MANUAL_REVIEW","family":"stackitsa","source":"PLAN_STATEMENT","group":"GRP-PLAN-STATEMENT-stackitsa","block":"MANUAL_REVIEW","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"PLAN_STATEMENT_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":5}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"The stackitsa plan of the draft writes no resource for 5 units and states why (the plan states the cause for each unit: module.retail_app_ecs.module.carts_service.aws_ecs_service.this: module.retail_app_ecs.module.carts_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person); module.retail_app_ecs.module.catalog_service.aws_ecs_service.this: module.retail_app_ecs.module.catalog_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person); module.retail_app_ecs.module.checkout_service.aws_ecs_service.this: module.retail_app_ecs.module.checkout_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person); and 2 more): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.","required_evidence":[],"review_binding":{"source_digest":"sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70","kb_version":"0.384.0","kb_sha256":"fc24dfbd7370bd23bbae090adf2960acf5d9b4ac749be7362ac50053ceddc6d9","members_sha256":"sha256:8ae94bd60884e4f89887095201ccae2cb675b6de0ca40c6d52a7a14653c82f28","kb_dependencies_sha256":"sha256:83a8f6eef89167b4a870555fd2ffcf930e8e1486e7893eb941efdfcf7f52cb49"},"member_count":5,"affected_unit_count":5,"evidence_ref_count":5,"resolution":{"decision_id":"DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW","source_family":"stackitsa","source_semantic":"MANUAL_REVIEW","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"PLAN_STATEMENT_OPEN","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":10,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"the plan writes no resource for the unit and names the work a person does instead","source_observation":"The plan writes no resource for module.retail_app_ecs.module.carts_service.aws_ecs_service.this: module.retail_app_ecs.module.carts_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person). The plan writes no resource for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this: module.retail_app_ecs.module.catalog_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person). The plan writes no resource for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this: module.retail_app_ecs.module.checkout_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person). The plan writes no resource for module.retail_app_ecs.module.orders_service.aws_ecs_service.this: module.retail_app_ecs.module.orders_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person). The plan writes no resource for module.retail_app_ecs.module.ui_service.aws_ecs_service.this: module.retail_app_ecs.module.ui_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person).","generated_target_behavior":"The draft writes no resource for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, module.retail_app_ecs.module.orders_service.aws_ecs_service.this and 1 more.","residual_difference":"the work outside the draft is neither done nor verified by StackToIT","execution_effect":"No step waits for it. The plan can start MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.execution_role_arn-586451, MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.task_role_arn-686488, MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.execution_role_arn-dedc98, MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.task_role_arn-15a967, MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.execution_role_arn-b70bc2, MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.task_role_arn-9651e2, MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.execution_role_arn-eacc48, MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.task_role_arn-d0b927, MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.execution_role_arn-2d22d2 and MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.task_role_arn-0c66b7 now.","next_action":"Outside the draft, for module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, module.retail_app_ecs.module.orders_service.aws_ecs_service.this and 1 more: Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach (and 9 more manual steps); the plan lists it as manual work.","why_open":["The stackitsa plan of the draft writes no resource for 5 units and states why (the plan states the cause for each unit: module.retail_app_ecs.module.carts_service.aws_ecs_service.this: module.retail_app_ecs.module.carts_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person); module.retail_app_ecs.module.catalog_service.aws_ecs_service.this: module.retail_app_ecs.module.catalog_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person); module.retail_app_ecs.module.checkout_service.aws_ecs_service.this: module.retail_app_ecs.module.checkout_service.aws_ecs_service.this is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person); and 2 more): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan."],"closes_when":["the identity fact of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed","the identity fact of module.retail_app_ecs.module.carts_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.carts_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed","the identity fact of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed","the identity fact of module.retail_app_ecs.module.catalog_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed","the identity fact of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed","the identity fact of module.retail_app_ecs.module.checkout_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed","the identity fact of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed","the identity fact of module.retail_app_ecs.module.orders_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.orders_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed","the identity fact of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (execution_role_arn of module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role) is decided on STACKIT and recorded, or recorded as not needed","the identity fact of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (task_role_arn of module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this names module.retail_app_ecs.module.ui_service.aws_iam_role.task_role) is decided on STACKIT and recorded, or recorded as not needed"],"required_inputs":[]}}],"record_shapes":[{"id":"RSH-087d72dbb642","why":"The knowledge base cannot decide 7 critical settings of {subject}: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of {name} record with its own reason, members and review state. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings.","required_evidence":[],"resolution":{"state_reason":"a person's decision or input is still open This is the state of the setting of {name} unit that asks the most, Decide how the target enforces the protocol of the outbound rules of the security group; the 7 settings of the record state their own.","source_observation":"The source states 7 critical settings on {subject} that the knowledge base cannot decide: Decide how the target enforces the protocol of the outbound rules of the security group; Decide how the target enforces the destinations the outbound rules of the security group allow; Confirm the sources the inbound rules of the security group allow; Confirm that the project is the boundary of one network; Confirm the ports of the rules of the security group; Decide which networks the security group may be attached to (a STACKIT group has no network scope); Review the stateful setting.","generated_target_behavior":"Decide how the target enforces the protocol of the outbound rules of the security group: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). Decide how the target enforces the destinations the outbound rules of the security group allow: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). Confirm the sources the inbound rules of the security group allow: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). In the estates checked when {name} entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). In the estates checked when {name} entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the ports of the rules of the security group: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). In the estates checked when {name} entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on {subject}. The plan refuses REF/root/security-group-membership-parity. In the estates checked when {name} entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the stateful setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings).","residual_difference":"Decide how the target enforces the protocol of the outbound rules of the security group: the target behaviour of {name} setting is not established Decide how the target enforces the destinations the outbound rules of the security group allow: the target behaviour of {name} setting is not established Confirm the sources the inbound rules of the security group allow: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the ports of the rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide which networks the security group may be attached to (a STACKIT group has no network scope): That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the stateful setting: the target behaviour of {name} setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/{subject}/open-settings now.","next_action":"Decide how the target enforces the protocol of the outbound rules of the security group: Decide how the target enforces the protocol of the outbound rules of the security group for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Decide how the target enforces the protocol of the outbound rules of the security group: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; {name} setting is not carried as an enforced control. protocol → stackit_security_group_rule.protocol (pinned provider). the egress restriction setting reads the same attribute and is REVIEW exactly when the egress restriction check fires; {name} semantic is then REVIEW as well, so the two critical readers of egress.protocol never disagree (TRANSFORMED only when neither check fires).","Decide how the target enforces the destinations the outbound rules of the security group allow: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; {name} setting is not carried as an enforced control. As ingress sources; the egress restriction setting reads egress.cidr_blocks too and is REVIEW exactly when the egress restriction check fires — the same order here, so the two never disagree.","Confirm the sources the inbound rules of the security group allow: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; {name} setting is not carried as an enforced control. Whether the draft carries {name} setting is decided by its semantic ledger entry \"security group rules\", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).","Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on {name} unit and leaves the setting to a person: the target does not settle it by itself (a finding of {name} unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, {name} security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.","Confirm the ports of the rules of the security group: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; {name} setting is not carried as an enforced control. Whether the draft carries {name} setting is decided by its semantic ledger entry \"security group rules\", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).","Decide which networks the security group may be attached to (a STACKIT group has no network scope): A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of {name} unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.","Review the stateful setting: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; {name} setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true)."],"closes_when":["Decide how the target enforces the protocol of the outbound rules of the security group: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.","Decide how the target enforces the destinations the outbound rules of the security group allow: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference.","Confirm the sources the inbound rules of the security group allow: The knowledge base states no closing condition for {name} setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm the sources the inbound rules of the security group allow: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.","Confirm that the project is the boundary of one network: The knowledge base states no closing condition for {name} setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Confirm the ports of the rules of the security group: The knowledge base states no closing condition for {name} setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm the ports of the rules of the security group: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.","Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in {name} project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.","Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference."],"required_inputs":[],"resolution_paths":[{"id":"ingress-sources/verify-on-target","title":"Confirm the sources the inbound rules of the security group allow: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in {name} entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\""],"regeneration_required":true},{"id":"network-topology-boundary/bring-the-closing-evidence","title":"Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in {name} entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""],"regeneration_required":true},{"id":"rule-ports/verify-on-target","title":"Confirm the ports of the rules of the security group: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in {name} entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\""],"regeneration_required":true},{"id":"security-group-vpc-membership/verify-on-target","title":"Decide which networks the security group may be attached to (a STACKIT group has no network scope): Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in {name} entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\""],"regeneration_required":true}],"required_verification":["Confirm the sources the inbound rules of the security group allow: the check, proof or closing evidence is recorded with its result","Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result","Confirm the ports of the rules of the security group: the check, proof or closing evidence is recorded with its result","Decide which networks the security group may be attached to (a STACKIT group has no network scope): the check, proof or closing evidence is recorded with its result"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Confirm the sources the inbound rules of the security group allow: Manual work remains: a person closes the semantic, the draft does not.","Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.","Confirm the ports of the rules of the security group: Manual work remains: a person closes the semantic, the draft does not.","Decide which networks the security group may be attached to (a STACKIT group has no network scope): Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"","contract note aws.security_group/ingress-sources: \"cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).\"","contract note aws.security_group/rule-ports: \"Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).\"","contract note aws.security_group/security-group-vpc-membership: \"A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in {name} project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.\"","contract note aws.security_group/vpc-egress-rules: \"As vpc ingress rules (direction egress).\"","contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""]}},{"id":"RSH-216f8f6f9fa5","why":"The knowledge base cannot decide 1 critical setting of {subject}: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.","required_evidence":["the failure-domain difference, named: a Single-AZ server is not restarted in another zone, and its volumes are not mirrored to another zone","the recovery expectation (RTO and RPO) the accepted placement has to meet, and the verification that shows it does","the source zone layout: which AWS zone each subnet is in and which servers it places there","the target placement of the servers of each subnet, as the regenerated draft writes it (target.placement.availability_zone answered); a STACKIT network is regional and has no zone"],"resolution":{"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on {subject} that the knowledge base cannot decide: Confirm the availability zone of the subnet.","generated_target_behavior":"Confirm the availability zone of the subnet: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/availability-zone). The network carries no zone (the subnet's zone is named \"not carried\" in the Terraform comments). Every server reads the one zone variable (var.availability_zone) in a source of one zone, a zone variable named after the server, without a default, in a source of several zones, or the zone answered for it in target.placement.availability_zone.","residual_difference":"Confirm the availability zone of the subnet: That the source's spread over zones and its failure domains are kept on the target. Owner hold: the record closes only by the explicit acceptance of the availability-zone difference in the decisions file. The knowledge base's closing condition names only the Single-AZ zones eu01-1, eu01-2 and eu01-3; the Metro zone is not among them.","execution_effect":"No step waits for it. The plan can start MAN/semantic/{subject}/availability-zone now.","next_action":"Confirm the availability zone of the subnet: Confirm the availability zone of the subnet for {subject}, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Confirm the availability zone of the subnet: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The availability zone of the subnet. STACKIT networks are regional (stackit_network has no zone field, pinned provider); the zone is chosen per server and volume, and AWS zone names do not map to STACKIT zones.","Confirm the availability zone of the subnet: The record closes only by the explicit acceptance of the availability-zone difference in the decisions file; an answered placement alone never closes it."],"closes_when":["Confirm the availability zone of the subnet: A person decides, per source zone, which STACKIT zone (eu01-1, eu01-2 or eu01-3) takes the servers and volumes that sat in it, so that the source's spread and its failure domains are kept.","Confirm the availability zone of the subnet: The record closes only by the explicit acceptance of the availability-zone difference in the decisions file; an answered placement alone never closes it."],"required_inputs":["target.placement.availability_zone","the source zone layout: which AWS zone each subnet is in and which servers it places there","the target placement of the servers of each subnet, as the regenerated draft writes it (target.placement.availability_zone answered); a STACKIT network is regional and has no zone","the failure-domain difference, named: a Single-AZ server is not restarted in another zone, and its volumes are not mirrored to another zone","the recovery expectation (RTO and RPO) the accepted placement has to meet, and the verification that shows it does"],"resolution_paths":[{"id":"availability-zone/map-each-source-zone","title":"Confirm the availability zone of the subnet: Map each source zone to one STACKIT zone through the servers' placement","prerequisites":["target.placement.availability_zone answered for each server whose zone the scan shows, with a zone the region's catalogue lists","the draft regenerated with the answers"],"effects":["The servers and volumes of one source subnet land in the STACKIT zone chosen for its source zone; the networks stay regional. The record stays open until a review in the decisions file accepts the difference (accept-the-availability-zone-difference with its acceptance)."],"risk":["Two source zones mapped to one STACKIT zone lose the spread without any error."],"evidence":["contract note aws.subnet/availability-zone: \"STACKIT networks are regional (stackit_network has no zone field, pinned provider); the zone is chosen per server and volume, and AWS zone names do not map to STACKIT zones.\"","STACKIT provider schema 0.120.0: \"The availability zone of the server.\""],"regeneration_required":true},{"id":"availability-zone/redesign-on-metro-zone","title":"Confirm the availability zone of the subnet: Redesign the resilience on the Metro zone (eu01-m)","prerequisites":["the architect's decision that single-instance failover replaces the spread over zones","target.placement.availability_zone answered eu01-m for the servers concerned, and the draft regenerated"],"effects":["As for the volumes' zone: Metro restarts a failed instance in another zone and does not keep a spread of several instances. The Metro zone is not among the zones the knowledge base's closing condition names (eu01-1, eu01-2 or eu01-3), so on this path too the record closes only by the explicit acceptance of the availability-zone difference."],"risk":["The source's spread is not kept as a spread, and the Metro zone is not among the zones the closing condition names."],"evidence":["provider-docs mirror stackit/docs.stackit.cloud/products/compute-engine/server/basics/regions-and-availability-zones.html: \"Because STACKIT places instances based on system load, all instances may end up in the same AZ.\"","contract note aws.subnet/availability-zone: \"which STACKIT zone (eu01-1, eu01-2 or eu01-3) takes the servers and volumes\""],"regeneration_required":true},{"id":"availability-zone/accept-the-availability-zone-difference","title":"Confirm the availability zone of the subnet: Accept the availability-zone difference of the placement the draft writes for the servers of the subnet","prerequisites":[],"effects":["The servers the subnet places stay, each with its volumes, in the one Single-AZ zone the regenerated draft writes for them; the STACKIT network of the subnet is regional. A Single-AZ server is not restarted in another zone when its zone fails and its volumes are not mirrored to another zone, so a zone outage takes down what sits in that zone. The Metro zone is no spread either: it restarts a single instance in another zone and may place all instances in one zone. The review accepts that difference with the source zone layout, the target placement of each server, the failure-domain difference, the recovery expectation (RTO and RPO) and the verification it requires; the check then closes as an accepted design change bound to the draft that writes those placements, and frees nothing else."],"risk":[],"evidence":["https://docs.stackit.cloud/products/compute-engine/server/basics/regions-and-availability-zones/","https://docs.stackit.cloud/products/storage/block-storage/basics/service-plans/","https://docs.stackit.cloud/products/compute-engine/server/basics/regions-and-availability-zones/"],"regeneration_required":false}],"required_verification":["Confirm the availability zone of the subnet: placement evidence on the target for every server of the subnet","Confirm the availability zone of the subnet: a failure-domain assessment","Confirm the availability zone of the subnet: the recovery expectations and the backup and restore chain that meets them","Confirm the availability zone of the subnet: the architect's documented decision","Confirm the availability zone of the subnet: a validation result of the regenerated draft","Confirm the availability zone of the subnet: the explicit acceptance of the availability-zone difference, recorded in the decisions file with the source and target layout, the failure-domain difference and the recovery expectations"],"next_run_changes":["An answered placement regenerates the servers and volumes in the chosen zones. The setting stays open: an answer never closes a critical setting, and the record closes only by the explicit acceptance of the availability-zone difference in the decisions file. A review in the decisions file that chooses the option accept-the-availability-zone-difference with its acceptance fields (source zone layout, target placement per pair, the failure-domain difference, the recovery expectation, the required verification) closes the record as an accepted design change, bound to the draft that writes the placements it names."],"remains_manual":["Confirm the availability zone of the subnet: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.subnet/availability-zone: \"The availability zone of the subnet.\"","owner ruling of 2026-10-26: \"Ruling 1: the placement answer stays INPUT_APPLIED; a separate ACCEPTED_DIFFERENCE review in the `--decisions` file (option `accept-the-availability-zone-difference` on the AZ records\"","provider-docs mirror stackit/docs.stackit.cloud/platform/regions.html: \"Metro AZ is not available for all services.\"","https://docs.stackit.cloud/products/compute-engine/server/basics/regions-and-availability-zones/","https://docs.stackit.cloud/products/storage/block-storage/basics/service-plans/"]}},{"id":"RSH-2e098a2b1756","why":"The knowledge base cannot decide 1 critical setting of {subject}: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of {name} record with its own reason, members and review state. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings-platform-architect.","required_evidence":[],"resolution":{"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on {subject} that the knowledge base cannot decide: Review the service desired count setting.","generated_target_behavior":"Review the service desired count setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-platform-architect).","residual_difference":"Review the service desired count setting: the target behaviour of {name} setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/{subject}/open-settings-platform-architect now.","next_action":"Review the service desired count setting: Review the service desired count setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the service desired count setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. desired_count is the number of tasks ECS keeps running (ecs_service docs: 'Number of instances of the task definition to place and keep running'); on SKE it becomes Deployment replicas or a HorizontalPodAutoscaler floor. The draft writes it as the replicas of the Deployment in kubernetes/\u003cservice\u003e/manifests.yaml when it is a literal number (a HorizontalPodAutoscaler owns the count where the service has a scaling target and policy the draft translates; a number that is not visible statically is a REQUIRED_ token) — a person confirms the number, REVIEW."],"closes_when":["Review the service desired count setting: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting."],"required_inputs":[],"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[]}},{"id":"RSH-3961ddcd4887","why":"The knowledge base cannot decide 2 critical settings of {subject}: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings-security-architect.","required_evidence":["for the platform default: STACKIT's written statement of how the values are encrypted at rest when the instance has no KMS key, since the pages read do not state it","the STACKIT KMS key (key ring, key, key version) and the service account that performs the key operations for the instance, with a role of the Secrets Manager","which AWS keys the secrets used (one key for all, or one per secret), and which secrets must stay under separate keys"],"resolution":{"state_reason":"the guidance names a manual step as the only path This is the state of the setting of this unit that asks the most, Review the secret value setting; the 2 settings of the record state their own.","source_observation":"The source states 2 critical settings on {subject} that the knowledge base cannot decide: Confirm the customer-managed encryption key; Review the secret value setting.","generated_target_behavior":"Confirm the customer-managed encryption key: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-security-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the secret value setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-security-architect). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Confirm the customer-managed encryption key: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the secret value setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/{subject}/open-settings-security-architect now.","next_action":"Review the secret value setting: Carry out the manual work the plan names for {subject} outside the draft; the plan states no title for it.","why_open":["Confirm the customer-managed encryption key: A check of the knowledge base (secret cmk) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). Critical and reading the key since 2026-09-27: the draft names it NOT CARRIED, except where it sets the instance's kms_key (below). The AWS key does not move, AWS's key per secret has no per-secret counterpart, and the draft sets the kms_key block (referencing the drafted STACKIT key) only when every source of the shared instance is an AWS secret that references that one key — otherwise it names the key NOT CARRIED with the reason; either way a person decides (REVIEW, see the customer-managed key check).","Review the secret value setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The value moves to STACKIT Secrets Manager (Vault-compatible KV). The draft generates the shared instance, and the plan a WriteSecret step for an aws_secretsmanager_secret or a SecureString aws_ssm_parameter that is not repeated. The step writes the document the person supplies and does not carry this setting (the value is the person's document); for a secret repeated by count or for_each whose instances are not all known, and for a parameter whose type is not the literal SecureString, only the instance is generated. What a person decides, per secret: where the value comes from (the same value fetched from a secure source, or a new one — moving is the moment to rotate) and the Vault path the application will read, then writes it with the Vault provider or CLI — REVIEW. History: added with aws_ssm_parameter on 2026-09-24; REVIEW since 2026-09-27 (was TRANSFORMED); 2026-10-29 the wording names the WriteSecret step of the plan; 2026-10-30 the step is also made for a SecureString parameter."],"closes_when":["Confirm the customer-managed encryption key: The knowledge base states no closing condition for this setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm the customer-managed encryption key: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the secret value setting: A person decides per secret where the value comes from (the same value from a secure source, or a new one) and the Vault path the application reads, then writes it with a Vault KV v2 client."],"required_inputs":["which AWS keys the secrets used (one key for all, or one per secret), and which secrets must stay under separate keys","the STACKIT KMS key (key ring, key, key version) and the service account that performs the key operations for the instance, with a role of the Secrets Manager","for the platform default: STACKIT's written statement of how the values are encrypted at rest when the instance has no KMS key, since the pages read do not state it"],"resolution_paths":[{"id":"customer-managed-key/verify-on-target","title":"Confirm the customer-managed encryption key: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.secretsmanager_secret/customer-managed-key: \"Critical and reading the key since 2026-09-27: the draft names it NOT CARRIED, except where it sets the instance's kms_key (below).\""],"regeneration_required":true},{"id":"customer-managed-key/kms-key-on-the-secrets-manager-instance","title":"Confirm the customer-managed encryption key: Encrypt the Secrets Manager instance with a key of the STACKIT KMS","prerequisites":[],"effects":["The instance gets a kms_key (key ring, key, key version and the service account that performs the key operations, which holds at least the Secrets Manager Reader role) and all its secret values are encrypted with that key; a key version change re-encrypts the stored secrets. The key belongs to the instance: secrets that used different AWS keys and must stay under different keys belong in different instances. The configuration is available by API and the provider; the portal does not offer it. A review records the choice and closes no critical setting by itself."],"risk":[],"evidence":["https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/secretsmanager_instance.md#L34","https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/"],"regeneration_required":false},{"id":"customer-managed-key/accept-an-instance-without-a-customer-key","title":"Confirm the customer-managed encryption key: Use the Secrets Manager instance without a customer key","prerequisites":[],"effects":["The instance has no kms_key and the secret values are not under a key the customer controls. The pages read describe encryption with a KMS key as optional and do not state how the values are encrypted at rest without one, so this choice accepts an unstated platform default and not a proven equivalent. The review records who accepts it and the requirement the customer key served. A review records the choice and closes no critical setting by itself."],"risk":[],"evidence":["https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/secretsmanager_instance.md#L34"],"regeneration_required":false},{"id":"secret-value/decide-and-carry-out","title":"Review the secret value setting: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.","regeneration: not stated — treated as required"],"risk":["The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes."],"evidence":["contract note aws.secretsmanager_secret/plain-parameter-kind: \"A person decides per parameter whether the value is plain configuration for the consuming workload or a secret, which then belongs in the Secrets Manager instance.\""],"regeneration_required":true}],"required_verification":["Confirm the customer-managed encryption key: the check, proof or closing evidence is recorded with its result","Review the secret value setting: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Confirm the customer-managed encryption key: Manual work remains: a person closes the semantic, the draft does not.","Review the secret value setting: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.secretsmanager_secret/customer-managed-key: \"Critical and reading the key since 2026-09-27: the draft names it NOT CARRIED, except where it sets the instance's kms_key (below).\"","contract note aws.secretsmanager_secret/recovery-window: \"A person confirms the deletion safety the application needs, since how long a deleted STACKIT secret can be restored is not documented.\"","contract note aws.secretsmanager_secret/tc-secretsmanager-secret-name: \"A person confirms the secret name or path the application looks up on the target, or accepts the new one.\"","contract note aws.secretsmanager_secret/tc-ssm-parameter-name: \"A person confirms the name the application uses to look the parameter up on the target, or accepts the new one.\"","https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/secretsmanager_instance.md#L34","contract note aws.secretsmanager_secret/plain-parameter-kind: \"A person decides per parameter whether the value is plain configuration for the consuming workload or a secret, which then belongs in the Secrets Manager instance.\"","contract note aws.secretsmanager_secret/plain-parameter-value: \"A person decides per parameter whether the value is plain workload configuration or a secret, and sets it there, since nothing of the value is copied.\"","contract note aws.secretsmanager_secret/secret-value: \"A person decides per secret where the value comes from (the same value from a secure source, or a new one) and the Vault path the application reads, then writes it with a Vault KV v2 client.\"","contract note aws.secretsmanager_secret/tc-ssm-parameter-value: \"A person decides whether the value is configuration or a secret and writes it to the workload configuration or, as a secret, to the Secrets Manager instance, as nothing of it is copied.\""]}},{"id":"RSH-3eba2dbd3b71","why":"The knowledge base cannot decide 5 critical settings of {subject}: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of {name} record with its own reason, members and review state. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings-network-architect.","required_evidence":[],"resolution":{"state_reason":"a person's decision or input is still open This is the state of the setting of {name} unit that asks the most, Review the service connect values setting; the 5 settings of the record state their own.","source_observation":"The source states 5 critical settings on {subject} that the knowledge base cannot decide: Review the service connect values setting; Review the service discovery setting; Review the service network placement setting; Review the service public IP setting setting; Confirm the network mode of the ECS task definition.","generated_target_behavior":"Review the service connect values setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-network-architect). Review the service discovery setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-network-architect). Review the service network placement setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-network-architect). Review the service public IP setting setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-network-architect). Confirm the network mode of the ECS task definition: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-network-architect).","residual_difference":"Review the service connect values setting: the target behaviour of {name} setting is not established Review the service discovery setting: the target behaviour of {name} setting is not established Review the service network placement setting: the target behaviour of {name} setting is not established Review the service public IP setting setting: the target behaviour of {name} setting is not established Confirm the network mode of the ECS task definition: the target behaviour of {name} setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/{subject}/open-settings-network-architect now.","next_action":"Review the service connect values setting: Review the service connect values setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the service connect values setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. Service Connect's switch, namespace, service names, client aliases (DNS name and port), traffic-test header rules, mTLS settings (KMS key, role, private CA) and proxy logging: an AWS-managed service mesh with no draft counterpart; discovery on SKE is Kubernetes Services and DNS, mesh features a person's choice.","Review the service discovery setting: A check of the knowledge base (ecs service discovery) fired on {name} unit and leaves the setting to a person: the target does not settle it by itself (a finding of {name} unit describes it). The setting states how ECS services find each other: AWS Cloud Map registries and namespaces, or ECS Service Connect.","Review the service network placement setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. The subnets and security groups the tasks' network interfaces use (awsvpc mode); on SKE pods take the cluster's network and NetworkPolicies decide reachability — a person re-expresses the security group rules.","Review the service public IP setting setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. assign_public_ip in either state (the public ip setting reads only true through the public address check): tasks with a public address are exposed unless a person decides the exposure on SKE explicitly (LoadBalancer services, network policies); false is the private default and is still re-checked, the draft carries no service block.","Confirm the network mode of the ECS task definition: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. ecs_task_definition.network_mode of the template the group builds its instances from: How the containers are networked (awsvpc, bridge, host, none): whether each task has its own interface and security groups or shares the host's network. Not verified as carried by any semantic of {name} family — reviewed."],"closes_when":["Review the service connect values setting: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.","Review the service discovery setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person replaces the lookups with Kubernetes Services and cluster DNS on SKE.","Review the service network placement setting: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.","Review the service public IP setting setting: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.","Confirm the network mode of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting."],"required_inputs":[],"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[]}},{"id":"RSH-66a370ad14e6","why":"The knowledge base cannot decide 1 critical setting of {subject}: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"resolution":{"state_reason":"the guidance closes it by a runtime or validation result","source_observation":"The source states 1 critical setting on {subject} that the knowledge base cannot decide: Confirm the name of the Secrets Manager secret.","generated_target_behavior":"Confirm the name of the Secrets Manager secret: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/tc-secretsmanager-secret-name). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Confirm the name of the Secrets Manager secret: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/{subject}/tc-secretsmanager-secret-name now.","next_action":"Confirm the name of the Secrets Manager secret: Verify on the target for {subject}: the check, proof or closing evidence is recorded with its result.","why_open":["Confirm the name of the Secrets Manager secret: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. aws_secretsmanager_secret.name: Friendly name used to address the secret; losing it breaks lookups by name but does not change who may reach or read the value, its encryption or deletion behaviour (IAM statements that scope by name are assessed on the IAM policy). No semantic of this family has verified it as carried. Held CRITICAL: the workload, its clients or its neighbours rely on it (an address, a name, a protocol or an execution contract)."],"closes_when":["Confirm the name of the Secrets Manager secret: A person confirms the secret name or path the application looks up on the target, or accepts the new one."],"required_inputs":[],"resolution_paths":[{"id":"tc-secretsmanager-secret-name/verify-on-target","title":"Confirm the name of the Secrets Manager secret: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.secretsmanager_secret/customer-managed-key: \"Critical and reading the key since 2026-09-27: the draft names it NOT CARRIED, except where it sets the instance's kms_key (below).\""],"regeneration_required":true}],"required_verification":["Confirm the name of the Secrets Manager secret: the check, proof or closing evidence is recorded with its result"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Confirm the name of the Secrets Manager secret: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.secretsmanager_secret/customer-managed-key: \"Critical and reading the key since 2026-09-27: the draft names it NOT CARRIED, except where it sets the instance's kms_key (below).\"","contract note aws.secretsmanager_secret/recovery-window: \"A person confirms the deletion safety the application needs, since how long a deleted STACKIT secret can be restored is not documented.\"","contract note aws.secretsmanager_secret/tc-secretsmanager-secret-name: \"A person confirms the secret name or path the application looks up on the target, or accepts the new one.\"","contract note aws.secretsmanager_secret/tc-ssm-parameter-name: \"A person confirms the name the application uses to look the parameter up on the target, or accepts the new one.\""]}},{"id":"RSH-68b3deada0c7","why":"The knowledge base cannot decide 1 critical setting of {subject}: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of {name} record with its own reason, members and review state. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"resolution":{"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on {subject} that the knowledge base cannot decide: Review the admin username not carried setting.","generated_target_behavior":"Review the admin username not carried setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/admin-username-not-carried).","residual_difference":"Review the admin username not carried setting: the target behaviour of {name} setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/{subject}/admin-username-not-carried now.","next_action":"Review the admin username not carried setting: Review the admin username not carried setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the admin username not carried setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. The master username is not a literal of a single cluster that PostgreSQL Flex accepts: a name a variable supplies or that is not visible statically (the draft writes the user with a variable that has no default), a name STACKIT reserves (admin and postgres: the draft writes a variable that rejects them), or a repeated cluster (a user per cluster only when every instance is evaluated). A person chooses the administrator's name on the target — REVIEW."],"closes_when":["Review the admin username not carried setting: A person creates the administrator on the target with a name the target accepts and confirms the application connects with it."],"required_inputs":[],"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[]}},{"id":"RSH-96817918c9ce","why":"The knowledge base cannot decide 1 critical setting of {subject}: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"resolution":{"state_reason":"the guidance names a manual step as the only path","source_observation":"The source states 1 critical setting on {subject} that the knowledge base cannot decide: Review the secret value setting.","generated_target_behavior":"Review the secret value setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/secret-value). In the estates checked when this entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead.","residual_difference":"Review the secret value setting: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either.","execution_effect":"No step waits for it. The plan can start MAN/semantic/{subject}/secret-value now.","next_action":"Review the secret value setting: Carry out the manual work the plan names for {subject} outside the draft; the plan states no title for it.","why_open":["Review the secret value setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The value moves to STACKIT Secrets Manager (Vault-compatible KV). The draft generates the shared instance, and the plan a WriteSecret step for an aws_secretsmanager_secret or a SecureString aws_ssm_parameter that is not repeated. The step writes the document the person supplies and does not carry this setting (the value is the person's document); for a secret repeated by count or for_each whose instances are not all known, and for a parameter whose type is not the literal SecureString, only the instance is generated. What a person decides, per secret: where the value comes from (the same value fetched from a secure source, or a new one — moving is the moment to rotate) and the Vault path the application will read, then writes it with the Vault provider or CLI — REVIEW. History: added with aws_ssm_parameter on 2026-09-24; REVIEW since 2026-09-27 (was TRANSFORMED); 2026-10-29 the wording names the WriteSecret step of the plan; 2026-10-30 the step is also made for a SecureString parameter."],"closes_when":["Review the secret value setting: A person decides per secret where the value comes from (the same value from a secure source, or a new one) and the Vault path the application reads, then writes it with a Vault KV v2 client."],"required_inputs":[],"resolution_paths":[{"id":"secret-value/decide-and-carry-out","title":"Review the secret value setting: Take the decision the knowledge base's note names and carry it out (alternatives: not stated in the knowledge base)","prerequisites":["the knowledge base's note on each setting (cited in this entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person takes the decision the closing condition names and carries it out; where it changes what the draft writes, the draft is regenerated or changed by hand.","regeneration: not stated — treated as required"],"risk":["The knowledge base states no evidenced alternatives to choose from; a decision taken without the source context the note names can change what the workload reaches, stores or exposes."],"evidence":["contract note aws.secretsmanager_secret/plain-parameter-kind: \"A person decides per parameter whether the value is plain configuration for the consuming workload or a secret, which then belongs in the Secrets Manager instance.\""],"regeneration_required":true}],"required_verification":["Review the secret value setting: the decision or the manual work is done and recorded (who, when, what was configured and why)"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Review the secret value setting: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.secretsmanager_secret/plain-parameter-kind: \"A person decides per parameter whether the value is plain configuration for the consuming workload or a secret, which then belongs in the Secrets Manager instance.\"","contract note aws.secretsmanager_secret/plain-parameter-value: \"A person decides per parameter whether the value is plain workload configuration or a secret, and sets it there, since nothing of the value is copied.\"","contract note aws.secretsmanager_secret/secret-value: \"A person decides per secret where the value comes from (the same value from a secure source, or a new one) and the Vault path the application reads, then writes it with a Vault KV v2 client.\"","contract note aws.secretsmanager_secret/tc-ssm-parameter-value: \"A person decides whether the value is configuration or a secret and writes it to the workload configuration or, as a secret, to the Secrets Manager instance, as nothing of it is copied.\""]}},{"id":"RSH-9956186a90f6","why":"The knowledge base cannot decide 6 critical settings of {subject}: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of {name} record with its own reason, members and review state. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings.","required_evidence":[],"resolution":{"state_reason":"the execution plan refuses REF/root/security-group-membership-parity because the target has no counterpart for the setting: a person accepts the difference or redesigns, and the step stays refused This is the state of the setting of {name} unit that asks the most, Decide which networks the security group may be attached to (a STACKIT group has no network scope); the 6 settings of the record state their own.","source_observation":"The source states 6 critical settings on {subject} that the knowledge base cannot decide: Decide the outbound (egress) rules of the security group; Confirm that the project is the boundary of one network; Confirm the ports of the rules of the security group; Decide which networks the security group may be attached to (a STACKIT group has no network scope); Review the standalone rule values setting; Review the stateful setting.","generated_target_behavior":"Decide the outbound (egress) rules of the security group: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). In the estates checked when {name} entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm that the project is the boundary of one network: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). In the estates checked when {name} entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Confirm the ports of the rules of the security group: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). In the estates checked when {name} entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Decide which networks the security group may be attached to (a STACKIT group has no network scope): The draft does not carry the setting on {subject}. The plan refuses REF/root/security-group-membership-parity. In the estates checked when {name} entry was written, the draft does not carry these settings: what it writes instead (a variable, a \"not carried\" line in the Terraform comments, or nothing) is stated per unit in the generated Terraform. Where the critical-settings record of a run names a step that carries a setting (with the evidence of the value), a person confirms that value instead. Review the standalone rule values setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). Review the stateful setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings).","residual_difference":"Decide the outbound (egress) rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm that the project is the boundary of one network: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Confirm the ports of the rules of the security group: That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Decide which networks the security group may be attached to (a STACKIT group has no network scope): That the STACKIT target reproduces each setting, or that the difference is acceptable for the workload: nothing in the knowledge base proves either. Review the standalone rule values setting: the target behaviour of {name} setting is not established Review the stateful setting: the target behaviour of {name} setting is not established","execution_effect":"No step waits for it. Held by something else first: REF/root/security-group-membership-parity.","next_action":"Decide which networks the security group may be attached to (a STACKIT group has no network scope): Decide which networks the security group may be attached to (a STACKIT group has no network scope) for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Decide the outbound (egress) rules of the security group: A check of the knowledge base (sg egress restricted) fired on {name} unit and leaves the setting to a person: the target does not settle it by itself (a finding of {name} unit describes it). The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.","Confirm that the project is the boundary of one network: A check of the knowledge base (topology vpc unproven) fired on {name} unit and leaves the setting to a person: the target does not settle it by itself (a finding of {name} unit describes it). Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan cannot prove is the estate's, leave the architecture to the architect for every unit of the topology, {name} security group included: STACKIT has no VPC container in its stable model, the project is the boundary of its networks, so the draft cannot keep several VPCs apart in one project.","Confirm the ports of the rules of the security group: This draft writes no stackit_security_group, stackit_security_group_rule for {name} unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of {name} draft: A check of the knowledge base (sg rule not rendered) fired on {name} unit and leaves the setting to a person: the target does not settle it by itself (a finding of {name} unit describes it). Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).","Decide which networks the security group may be attached to (a STACKIT group has no network scope): This draft writes no stackit_security_group, stackit_security_group_rule for {name} unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of {name} draft: A check of the knowledge base (topology vpc unproven) found a setting the target has no counterpart for (a finding of {name} unit describes it). UNSUPPORTED, by name: a STACKIT security group has no network (VPC) scope. stackit_security_group takes project_id, name, description, labels, stateful and region only (pinned provider), and the IaaS API object SecurityGroup has no network field either (stackit-api-specifications services/iaas/v2); the group is project-wide and can be attached to the network interfaces of every network of the project.","Review the standalone rule values setting: This draft writes no stackit_security_group, stackit_security_group_rule for {name} unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of {name} draft: A check of the knowledge base (sg rule not rendered) fired on {name} unit and leaves the setting to a person: the target does not settle it by itself (a finding of {name} unit describes it). An aws_security_group_rule becomes a stackit_security_group_rule: type → direction, protocol → protocol, cidr_blocks → ip_range (one rule per range), source_security_group_id → remote_security_group_id. A rule that is not generated is named NOT CARRIED and the group is REVIEW.","Review the stateful setting: This draft writes no stackit_security_group, stackit_security_group_rule for {name} unit: every unit that names the group is a managed data service of STACKIT, which has no security group and takes its clients from an access list of its own, so the group is listed by no resource and what it admitted reaches those access lists as addresses only. What follows states the knowledge base's candidate target, not a block of {name} draft: UNENFORCED: the security group is attached to no block of the target (it is written in the draft and listed by no resource, or, where the access lists of its members carry it, not written), so its rules (\"security group rules\") restrict nothing on the target until an attachment is designed; {name} setting is not carried as an enforced control. STACKIT security groups are stateful by default (tested on a STACKIT project on 2026-09-24: stateful=true)."],"closes_when":["Decide the outbound (egress) rules of the security group: The knowledge base states no closing condition for {name} setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Decide the outbound (egress) rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: The knowledge base states no closing condition for {name} setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm that the project is the boundary of one network: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Confirm the ports of the rules of the security group: The knowledge base states no closing condition for {name} setting; the run closes it when a person decides it as the open check asks and that check's closing evidence or decision is recorded.","Confirm the ports of the rules of the security group: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Decide which networks the security group may be attached to (a STACKIT group has no network scope): A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in {name} project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.","Review the standalone rule values setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded.","Review the stateful setting: A person designs how the target enforces what the group allowed (attaches the group, or its replacement, to the target resources that take its place), or accepts the difference."],"required_inputs":[],"resolution_paths":[{"id":"egress-restriction/verify-on-target","title":"Decide the outbound (egress) rules of the security group: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in {name} entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\""],"regeneration_required":true},{"id":"network-topology-boundary/bring-the-closing-evidence","title":"Confirm that the project is the boundary of one network: Bring the closing evidence the finding names, or record the decision it asks for","prerequisites":["the knowledge base's note on each setting (cited in {name} entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person reads the finding the critical-settings record of the run names for the setting (its message holds the closing evidence), brings that evidence or records the decision, and the record keeps it.","regeneration: not stated — treated as required"],"risk":["A decision recorded without the evidence the finding names leaves the difference the finding describes in place."],"evidence":["contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""],"regeneration_required":true},{"id":"rule-ports/verify-on-target","title":"Confirm the ports of the rules of the security group: Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in {name} entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\""],"regeneration_required":true},{"id":"security-group-vpc-membership/verify-on-target","title":"Decide which networks the security group may be attached to (a STACKIT group has no network scope): Verify what the knowledge base's note asks to confirm","prerequisites":["the knowledge base's note on each setting (cited in {name} entry) and the unit's open entry in the critical-settings record of the run"],"effects":["A person checks the setting on the STACKIT target (or against the source, the clients and the tooling that depend on it) and records the result; nothing in the draft changes.","regeneration: not stated — treated as required"],"risk":["A setting confirmed from the draft alone, without the check, can still differ at runtime."],"evidence":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\""],"regeneration_required":true}],"required_verification":["Decide the outbound (egress) rules of the security group: the check, proof or closing evidence is recorded with its result","Confirm that the project is the boundary of one network: the check, proof or closing evidence is recorded with its result","Confirm the ports of the rules of the security group: the check, proof or closing evidence is recorded with its result","Decide which networks the security group may be attached to (a STACKIT group has no network scope): the check, proof or closing evidence is recorded with its result"],"next_run_changes":["Nothing: no input topic decides these settings, and an answer never closes a critical setting, so a rerun keeps them open until the source, the knowledge base or an owner ruling changes."],"remains_manual":["Decide the outbound (egress) rules of the security group: Manual work remains: a person closes the semantic, the draft does not.","Confirm that the project is the boundary of one network: Manual work remains: a person closes the semantic, the draft does not.","Confirm the ports of the rules of the security group: Manual work remains: a person closes the semantic, the draft does not.","Decide which networks the security group may be attached to (a STACKIT group has no network scope): Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note aws.security_group/egress-restriction: \"The security group restricts its outbound traffic: it has no rule that allows every protocol to 0.0.0.0/0 or ::/0.\"","contract note aws.security_group/ingress-sources: \"cidr_blocks → stackit_security_group_rule.ip_range (one rule per range), security_groups → remote_security_group_id (pinned provider); REVIEW for the group when a rule is not generated, as rule ports (2026-09-27).\"","contract note aws.security_group/rule-ports: \"Each rule becomes a stackit_security_group_rule: protocol → protocol.name/protocol.number, from_port/to_port → port_range.min/max, or icmp_parameters type/code for icmp (pinned provider schema).\"","contract note aws.security_group/security-group-vpc-membership: \"A person confirms which VPC each network resource of the estate is in and whether the networks of another VPC belong in {name} project or in a project of their own joined through a Network Area; the group is then attached only to the interfaces of the networks that replace its VPC.\"","contract note aws.security_group/vpc-egress-rules: \"As vpc ingress rules (direction egress).\"","contract note aws.security_group/network-topology-boundary: \"Several VPCs, a VPC count that is not visible, or a unit of the estate that names a VPC, or is placed in a subnet, the scan can\""]}},{"id":"RSH-af9a9d94158f","why":"The knowledge base cannot decide 4 critical settings of {subject}: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of {name} record with its own reason, members and review state. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings-identity-architect.","required_evidence":[],"resolution":{"state_reason":"a person's decision or input is still open This is the state of the setting of {name} unit that asks the most, Review the service execute command setting; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on {subject} that the knowledge base cannot decide: Review the service execute command setting; Review the service task definition setting; Confirm the execution role ARN of the ECS task definition; Confirm the task role ARN of the ECS task definition.","generated_target_behavior":"Review the service execute command setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-identity-architect). Review the service task definition setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-identity-architect). Confirm the execution role ARN of the ECS task definition: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-identity-architect). Confirm the task role ARN of the ECS task definition: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-identity-architect).","residual_difference":"Review the service execute command setting: the target behaviour of {name} setting is not established Review the service task definition setting: the target behaviour of {name} setting is not established Confirm the execution role ARN of the ECS task definition: the target behaviour of {name} setting is not established Confirm the task role ARN of the ECS task definition: the target behaviour of {name} setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/{subject}/open-settings-identity-architect now.","next_action":"Review the service execute command setting: Review the service execute command setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the service execute command setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. ECS Exec opens a shell in a running task; kubectl exec (and who may use it through RBAC) is the counterpart and is not part of the draft.","Review the service task definition setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. The task definition the service runs (family:revision or ARN) becomes the Deployment's pod template; ecs_service.task_definition names it as a string, the definition itself is a separate resource a person translates.","Confirm the execution role ARN of the ECS task definition: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. ecs_task_definition.execution_role_arn of the template the group builds its instances from: The role ECS uses to pull images and read the secrets it injects into the containers. Not verified as carried by any semantic of {name} family — reviewed.","Confirm the task role ARN of the ECS task definition: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. ecs_task_definition.task_role_arn of the template the group builds its instances from: The role the application in the containers acts as towards AWS APIs. Not verified as carried by any semantic of {name} family — reviewed."],"closes_when":["Review the service execute command setting: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.","Review the service task definition setting: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.","Confirm the execution role ARN of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.","Confirm the task role ARN of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting."],"required_inputs":[],"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[]}},{"id":"RSH-b814595ae65d","why":"The knowledge base cannot decide 4 critical settings of {subject}: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of {name} record with its own reason, members and review state. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings-security-architect.","required_evidence":[],"resolution":{"state_reason":"a person's decision or input is still open This is the state of the setting of {name} unit that asks the most, Confirm the container definitions of the ECS task definition; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on {subject} that the knowledge base cannot decide: Confirm the container definitions of the ECS task definition; Confirm the container image registry; Confirm the container plaintext secret env; Confirm the container secret references.","generated_target_behavior":"Confirm the container definitions of the ECS task definition: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-security-architect). Confirm the container image registry: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-security-architect). Confirm the container plaintext secret env: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-security-architect). Confirm the container secret references: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-security-architect).","residual_difference":"Confirm the container definitions of the ECS task definition: the target behaviour of {name} setting is not established Confirm the container image registry: the target behaviour of {name} setting is not established Confirm the container plaintext secret env: the target behaviour of {name} setting is not established Confirm the container secret references: the target behaviour of {name} setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/{subject}/open-settings-security-architect now.","next_action":"Confirm the container definitions of the ECS task definition: Confirm the container definitions of the ECS task definition for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Confirm the container definitions of the ECS task definition: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. ecs_task_definition.container_definitions of the unit that runs the task. The containers of the task: images, commands, environment, secret references, ports, health checks, log configuration - the workload itself, and where its credentials are injected. Decide per container: the image and where it lives, command and entry point, environment, ports and health check, cpu/memory as requests and limits, and the log destination; the secret references and the plaintext secrets among the environment entries are read by the settings of the secret references and of the plaintext secrets, the registry by the setting of the image registry.","Confirm the container image registry: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. A container image comes from Amazon ECR (a `.dkr.ecr.` or public.ecr.aws registry host) or needs `repositoryCredentials`. The images are not moved by the draft and a pod on STACKIT cannot assume the ECR pull rights of the ECS execution role. Decide: where the images live on STACKIT (the STACKIT Container Registry has a GA API, the Container Registry API specification, but no Terraform resource in pinned provider; a registry of your choice works too), how they are copied, and the pull secret the cluster uses.","Confirm the container plaintext secret env: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. An `environment` entry whose NAME looks like a credential (password, secret, token, api key, private key, credential) carries a non-empty plaintext value in the task definition (a name heuristic, not a proof: the value is never shown). Decide: whether the value is a secret; if it is, it must not be copied into a Kubernetes manifest or a Terraform variable default but stored in a STACKIT Secrets Manager entry and the plaintext copy in the AWS state and task definition rotated.","Confirm the container secret references: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. The task definition's container_definitions state secret references (the `secrets` list: name and valueFrom, \"the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store\", AWS ECS API reference, Secret). A person decides first which STACKIT Secrets Manager instance holds each referenced secret (stackit_secretsmanager_instance, pinned provider: name, acls, kms_key; the secret entries themselves have no Terraform resource in the pinned provider, they are created through the API or the portal, and their VALUES are never in the Terraform sources - a person copies them). Second, a person decides how the pods read them (the STACKIT Secrets Manager authenticates with Vault-compatible tokens and AppRole, docs.stackit.cloud/products/security/secrets-manager/; ECS injects valueFrom into environment variables when the container starts, and no STACKIT equivalent of that injection is stated on the documentation page checked 2026-10-06, so the Kubernetes Secret or the in-pod fetch is a design of its own)."],"closes_when":["Confirm the container definitions of the ECS task definition: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.","Confirm the container image registry: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.","Confirm the container plaintext secret env: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.","Confirm the container secret references: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting."],"required_inputs":[],"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[]}},{"id":"RSH-d1747e2970d4","why":"The knowledge base cannot decide 1 critical setting of {subject}: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of {name} record with its own reason, members and review state. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings-platform-architect.","required_evidence":[],"resolution":{"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on {subject} that the knowledge base cannot decide: Review the task definition setting.","generated_target_behavior":"Review the task definition setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-platform-architect).","residual_difference":"Review the task definition setting: the target behaviour of {name} setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/{subject}/open-settings-platform-architect now.","next_action":"Review the task definition setting: Review the task definition setting for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the task definition setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. The ECS task definition: the containers a service runs, with their CPU and memory, environment, secrets and health checks."],"closes_when":["Review the task definition setting: A person translates the task definition into Kubernetes Deployments and Services on SKE (CPU and memory, environment, secrets and health checks become manifest fields); the rule names a Cloud Foundry push as the other way for a simple web app."],"required_inputs":[],"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[]}},{"id":"RSH-dca9c6bbf7d1","why":"The knowledge base cannot decide 3 critical settings of {subject}: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of {name} record with its own reason, members and review state. A review of {name} record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings-network-architect.","required_evidence":[],"resolution":{"state_reason":"a person's decision or input is still open This is the state of the setting of {name} unit that asks the most, Decide how clients reach the database (the endpoint STACKIT assigns and its access list); the 3 settings of the record state their own.","source_observation":"The source states 3 critical settings on {subject} that the knowledge base cannot decide: Decide how clients reach the database (the endpoint STACKIT assigns and its access list); Review the member settings setting; Review the security groups setting.","generated_target_behavior":"Decide how clients reach the database (the endpoint STACKIT assigns and its access list): The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-network-architect). Review the member settings setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-network-architect). Review the security groups setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-network-architect).","residual_difference":"Decide how clients reach the database (the endpoint STACKIT assigns and its access list): the target behaviour of {name} setting is not established Review the member settings setting: the target behaviour of {name} setting is not established Review the security groups setting: the target behaviour of {name} setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/{subject}/open-settings-network-architect now.","next_action":"Decide how clients reach the database (the endpoint STACKIT assigns and its access list): Decide how clients reach the database (the endpoint STACKIT assigns and its access list) for {subject}, and record the answer for {name} record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Decide how clients reach the database (the endpoint STACKIT assigns and its access list): The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. The STACKIT database resource has no subnet, availability-zone or IP-family attribute (pinned provider): clients reach it at the endpoint STACKIT assigns, restricted by its ACL — a person decides how clients reach it — REVIEW.","Review the member settings setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. Cluster members are not separate STACKIT resources (the flavor defines the nodes, pinned provider): a member's failover priority, parameter group, subnet group, zone, CA certificate and Performance Insights key have no attribute — a person decides what the nodes need — REVIEW.","Review the security groups setting: The mapping rule for {name} kind of unit recognises the unit but only passes {name} setting to a person; it does not decide its value. STACKIT database instances have no security groups: access is a CIDR ACL (network.acl, pinned provider); the draft's ACL variable defaults to the CIDRs of the groups' ingress rules where visible, and group-to-group rules cannot be expressed — a person checks the ACL — REVIEW."],"closes_when":["Decide how clients reach the database (the endpoint STACKIT assigns and its access list): A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.","Review the member settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting.","Review the security groups setting: A person confirms the value against the target, or the knowledge base gains a rule that decides {name} setting."],"required_inputs":[],"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[]}}]},"applications":{"input":{"state":"NOT_PROVIDED","reason":"No applications file was given, so no unit is grouped into an application. Pass --applications FILE (stacktoit assess --help names the schema of the file) to state the applications and the selectors that assign units to them."},"proposed":{"state":"SUGGESTED","reason":"Suggested from the workloads of the source, not confirmed by the customer: these groups are a reading of names, tags and references in the Terraform. Nothing is an application until the applications file (--applications) or the review file states it, and where it does the stated applications win and the suggestion is shown as a diff against them.","authority":"NOT_CUSTOMER_CONFIRMED","rule":"One group per workload that is switched on: an ECS service, a Lambda function, a Kubernetes deployment, stateful set, daemon set, replication controller, pod, job or cron job, a load balancer with the instances and Auto Scaling groups it routes to, an instance or Auto Scaling group no load balancer fronts, or an EKS cluster when the estate holds no Kubernetes workload (such a group is a platform: its workloads are not visible in Terraform). A group holds its workload and the datastores, security groups, roles, log groups, secrets, keys and similar units that only that workload reaches: what the workload depends on (for an ECS service what its task definition names, for a Lambda function what its environment names, for a load balancer what it routes to), what those depend on in turn, the queues, streams, topics, buckets and EventBridge rules that feed a member (an event source mapping, a subscription, a rule target or the permission that names the rule, a bucket notification), the units a policy of a member names in a statement that is not a Deny, the units a DNS record that the workload names points at (a DNS record or a service-discovery registration that only points at a member is shown and adds no member), the datastore behind a security group whose ingress names a security group the workload itself uses, and the units that exist only for a member and depend on it (volumes, autoscaling targets, the secret of a database, the roles and node security group of a cluster, the Service, Ingress, autoscaler, network policy and disruption budget of a Kubernetes workload). An application tag the source states as a literal (Application, App, ApplicationName, AppName, ApplicationId, Workload, or Service where there is none of those) names the application: workloads that share the value are one group, a tagged unit no workload reaches joins the group of its value, and a unit tagged with another value than the group that reaches it is shared. A tag read from a variable is shown and never decides. A unit that more than one group reaches is shared and belongs to no group, unless exactly one of them carries the unit's tag value. The network, the ECS cluster and the gateways belong to no group, and a module name never makes one. A group is named by its application tag, else by the name of its workload, else by the family of its task definition, else by its address.","groups":[{"id":"carts","name":"carts","basis":"ECS_SERVICE","name_from":"WORKLOAD_NAME","anchor":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","confidence":"MEDIUM","confidence_reason":"The references of the source make the group; no application tag confirms it.","members_sha256":"de06f8aeb74fd51bc7629421a42d2ae1a5a20ed6494d053986c16ae1d1f70a7c","evidence":[{"origin":"MODULE_BOUNDARY","source":"TERRAFORM_STRUCTURE","rank":7,"decides":false,"value":"module.retail_app_ecs.module.carts_service","note":"every member sits in the module call module.retail_app_ecs.module.carts_service; this corroborates the group and never adds or removes a member"}],"members":[{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","source_type":"aws_ecs_service","role":"WORKLOAD","via":"THE_WORKLOAD","in_totals":true,"evidence":[]},{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","source_type":"aws_iam_role","role":"SUPPORT","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","edge":"ASSUMES_ROLE","via":"execution_role_arn"}]},{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","source_type":"aws_iam_role","role":"SUPPORT","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","edge":"ASSUMES_ROLE","via":"task_role_arn"}]},{"unit":"module.retail_app_ecs.module.carts_service.aws_security_group.this","source_type":"aws_security_group","role":"SUPPORT","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.carts_service.aws_security_group.this","edge":"ATTACHED_TO","via":"network_configuration.security_groups"}]}],"selectors":["module.retail_app_ecs.module.carts_service.aws_ecs_service.this","module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","module.retail_app_ecs.module.carts_service.aws_security_group.this"],"totals":{"entries":4,"counted_in_totals":4,"units_by_class":[{"key":"RECONFIGURE","count":3},{"key":"REPLATFORM","count":1}]},"depends_on_groups":[],"shared_units":["module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"],"dependencies":"NOT_ASSESSED","dependencies_detail":{"origin":"STATIC_CODE_HINT","reason":"No application code in the source."},"answers":{"can_move":{"steps":26,"can_run_now":17,"on_unconfirmed_default":0,"after_manual":0,"waiting_for_decisions":4,"not_executable":5},"blocked_by":[{"record":"DEC-GEN-CONVERT-POD-SEGMENTATION","steps":8,"frees_alone":4},{"record":"DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","steps":4,"frees_alone":0},{"record":"DEC-GEN-CONVERT-API-OPT-IN","steps":4,"frees_alone":0},{"record":"DEC-GEN-CONVERT-DATA-MOVEMENT","steps":4,"frees_alone":0},{"record":"DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","steps":4,"frees_alone":0},{"record":"DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH","steps":4,"frees_alone":0}],"top_decisions":["DEC-GEN-CONVERT-POD-SEGMENTATION"],"work":{"manual_steps":18,"data_moves":0},"accept":[{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","area":"IAM","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885","area":"IAM","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","area":"NET","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF","area":"NET","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS","area":"SEC","kind":"SECURITY_DECISION_OPEN"}]}},{"id":"catalog","name":"catalog","basis":"ECS_SERVICE","name_from":"WORKLOAD_NAME","anchor":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","confidence":"MEDIUM","confidence_reason":"The references of the source make the group; no application tag confirms it.","members_sha256":"9b15241ad84b5b72c61a48327087eee2ee4686914314462facc6efe58bf43ec8","evidence":[],"members":[{"unit":"module.dependencies.aws_security_group.catalog_opensearch_sg","source_type":"aws_security_group","role":"SUPPORT","via":"REFERENCED_BY_A_MEMBER","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","to":"module.dependencies.aws_security_group.catalog_opensearch_sg","edge":"DEPENDS_ON","via":"vpc_options"},{"origin":"SG_INGRESS","source":"TERRAFORM_REFERENCE","rank":5,"decides":true,"from":"module.dependencies.aws_security_group_rule.allow_https_from_client","to":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","edge":"ATTACHED_TO","via":"source_security_group_id"}]},{"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","source_type":"aws_opensearch_domain","role":"DATASTORE","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"ENV_REFERENCE","source":"RUNTIME_CONFIG","rank":4,"decides":true,"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","to":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","edge":"DEPENDS_ON","via":"container_definitions"},{"origin":"SG_INGRESS","source":"TERRAFORM_REFERENCE","rank":5,"decides":true,"from":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","to":"module.dependencies.aws_security_group.catalog_opensearch_sg","edge":"DEPENDS_ON","via":"vpc_options","note":"the ports of the rule were not compared with the port module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this listens on: this run read no comparison for the pair of security groups"}]},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","source_type":"aws_ecs_service","role":"WORKLOAD","via":"THE_WORKLOAD","in_totals":true,"evidence":[]},{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","source_type":"aws_iam_role","role":"SUPPORT","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","edge":"ASSUMES_ROLE","via":"execution_role_arn"}]},{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","source_type":"aws_iam_role","role":"SUPPORT","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","edge":"ASSUMES_ROLE","via":"task_role_arn"}]}],"selectors":["module.dependencies.aws_security_group.catalog_opensearch_sg","module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role"],"totals":{"entries":5,"counted_in_totals":5,"units_by_class":[{"key":"RECONFIGURE","count":3},{"key":"REPLATFORM","count":2}]},"depends_on_groups":[],"shared_units":["module.dependencies.module.catalog_rds.aws_rds_cluster.this","module.dependencies.module.catalog_rds.aws_security_group.this","module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","module.retail_app_ecs.aws_kms_key.cmk","module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","module.retail_app_ecs.module.catalog_service.aws_security_group.this"],"dependencies":"NOT_ASSESSED","dependencies_detail":{"origin":"STATIC_CODE_HINT","reason":"No application code in the source."},"answers":{"can_move":{"steps":41,"can_run_now":19,"on_unconfirmed_default":0,"after_manual":0,"waiting_for_decisions":11,"not_executable":11},"blocked_by":[{"record":"DEC-GEN-CONVERT-POD-SEGMENTATION","steps":11,"frees_alone":3},{"record":"DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","steps":16,"frees_alone":2},{"record":"DEC-GEN-CONVERT-DATA-MOVEMENT","steps":14,"frees_alone":0},{"record":"DEC-GEN-CONVERT-API-OPT-IN","steps":7,"frees_alone":0},{"record":"DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","steps":6,"frees_alone":0},{"record":"DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH","steps":6,"frees_alone":0}],"top_decisions":["DEC-GEN-CONVERT-POD-SEGMENTATION","DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE"],"work":{"manual_steps":31,"data_moves":1},"accept":[{"record":"DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E","area":"IAM","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","area":"IAM","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913","area":"IAM","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E","area":"NET","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","area":"NET","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-SEC-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E","area":"SEC","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883","area":"SEC","kind":"SECURITY_DECISION_OPEN"}]}},{"id":"checkout","name":"checkout","basis":"ECS_SERVICE","name_from":"WORKLOAD_NAME","anchor":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","confidence":"MEDIUM","confidence_reason":"The references of the source make the group; no application tag confirms it.","members_sha256":"cdb909a243ba354d196a29bb4caa9857972152a634359224b33b343fee8c597e","evidence":[],"members":[{"unit":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","source_type":"aws_elasticache_replication_group","role":"DATASTORE","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"ENV_REFERENCE","source":"RUNTIME_CONFIG","rank":4,"decides":true,"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","to":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","edge":"DEPENDS_ON","via":"container_definitions"},{"origin":"SG_INGRESS","source":"TERRAFORM_REFERENCE","rank":5,"decides":true,"from":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","to":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","edge":"ATTACHED_TO","via":"security_group_ids","note":"the ports of the rule were not compared with the port module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default listens on: this run read no comparison for the pair of security groups"},{"origin":"DNS_RECORD","source":"TERRAFORM_REFERENCE","rank":7,"decides":false,"from":"module.dependencies.module.checkout_elasticache_redis.module.dns.aws_route53_record.default","to":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","edge":"DEPENDS_ON","via":"records","note":"the DNS record retail-store-ecs-checkout (module.dependencies.module.checkout_elasticache_redis.module.dns.aws_route53_record.default, type CNAME) points at it; shown, never used to decide a member"}]},{"unit":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","source_type":"aws_security_group","role":"SUPPORT","via":"REFERENCED_BY_A_MEMBER","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","to":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","edge":"ATTACHED_TO","via":"security_group_ids"},{"origin":"SG_INGRESS","source":"TERRAFORM_REFERENCE","rank":5,"decides":true,"from":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed","to":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","edge":"DEPENDS_ON","via":"for_each"}]},{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","source_type":"aws_ecs_service","role":"WORKLOAD","via":"THE_WORKLOAD","in_totals":true,"evidence":[]},{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","source_type":"aws_iam_role","role":"SUPPORT","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","edge":"ASSUMES_ROLE","via":"execution_role_arn"}]},{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","source_type":"aws_iam_role","role":"SUPPORT","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","edge":"ASSUMES_ROLE","via":"task_role_arn"}]},{"unit":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","source_type":"aws_security_group","role":"SUPPORT","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","edge":"ATTACHED_TO","via":"network_configuration.security_groups"},{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed","to":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","edge":"DEPENDS_ON","via":"for_each"}]}],"selectors":["module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","module.retail_app_ecs.module.checkout_service.aws_security_group.this"],"totals":{"entries":6,"counted_in_totals":6,"units_by_class":[{"key":"RECONFIGURE","count":5},{"key":"REPLATFORM","count":1}]},"depends_on_groups":["orders"],"shared_units":["module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"],"dependencies":"NOT_ASSESSED","dependencies_detail":{"origin":"STATIC_CODE_HINT","reason":"No application code in the source."},"answers":{"can_move":{"steps":46,"can_run_now":25,"on_unconfirmed_default":3,"after_manual":1,"waiting_for_decisions":11,"not_executable":9},"blocked_by":[{"record":"DEC-GEN-CONVERT-DATA-MOVEMENT","steps":15,"frees_alone":4},{"record":"DEC-GEN-CONVERT-POD-SEGMENTATION","steps":12,"frees_alone":4},{"record":"DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","steps":8,"frees_alone":0},{"record":"DEC-GEN-CONVERT-API-OPT-IN","steps":8,"frees_alone":0},{"record":"DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","steps":8,"frees_alone":0},{"record":"DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH","steps":8,"frees_alone":0}],"top_decisions":["DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-POD-SEGMENTATION"],"work":{"manual_steps":36,"data_moves":1},"accept":[{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","area":"IAM","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673","area":"IAM","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","area":"NET","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F","area":"NET","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-SEC-MODULE-DEPENDENCIES-MODULE-CHECKOUT-ELASTICACHE-REDIS-A-D6A5B374","area":"SEC","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6","area":"SEC","kind":"SECURITY_DECISION_OPEN"}]}},{"id":"orders","name":"orders","basis":"ECS_SERVICE","name_from":"WORKLOAD_NAME","anchor":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","confidence":"MEDIUM","confidence_reason":"The references of the source make the group; no application tag confirms it.","members_sha256":"8529308f0b3d03c6ed25ce7d38b7f589f55ad8279c67b11ed55e0ffb37471bca","evidence":[],"members":[{"unit":"module.dependencies.aws_mq_broker.mq","source_type":"aws_mq_broker","role":"DATASTORE","via":"REFERENCED_BY_A_MEMBER","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.retail_app_ecs.aws_secretsmanager_secret_version.mq","to":"module.dependencies.aws_mq_broker.mq","edge":"DEPENDS_ON","via":"secret_string"},{"origin":"SG_INGRESS","source":"TERRAFORM_REFERENCE","rank":5,"decides":true,"from":"module.dependencies.aws_mq_broker.mq","to":"module.dependencies.aws_security_group.mq","edge":"ATTACHED_TO","via":"security_groups","note":"the ports of the rule were not compared with the port module.dependencies.aws_mq_broker.mq listens on: this run read no comparison for the pair of security groups"}]},{"unit":"module.dependencies.aws_security_group.mq","source_type":"aws_security_group","role":"SUPPORT","via":"REFERENCED_BY_A_MEMBER","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.dependencies.aws_mq_broker.mq","to":"module.dependencies.aws_security_group.mq","edge":"ATTACHED_TO","via":"security_groups"},{"origin":"SG_INGRESS","source":"TERRAFORM_REFERENCE","rank":5,"decides":true,"from":"module.dependencies.aws_security_group_rule.mq","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this","edge":"ATTACHED_TO","via":"source_security_group_id"}]},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","source_type":"aws_rds_cluster","role":"DATASTORE","via":"REFERENCED_BY_A_MEMBER","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db","to":"module.dependencies.module.orders_rds.aws_rds_cluster.this","edge":"DEPENDS_ON","via":"secret_string"},{"origin":"SG_INGRESS","source":"TERRAFORM_REFERENCE","rank":5,"decides":true,"from":"module.dependencies.module.orders_rds.aws_rds_cluster.this","to":"module.dependencies.module.orders_rds.aws_security_group.this","edge":"ATTACHED_TO","via":"vpc_security_group_ids","note":"a security group of the store admits, by an ingress rule, a security group the unit is attached to; the ports of the rule were not read (no rule of module.dependencies.module.orders_rds.aws_security_group.this that names module.retail_app_ecs.module.orders_service.aws_security_group.this could be matched by the rule reader). A rule is not proof that the unit connects"}]},{"unit":"module.dependencies.module.orders_rds.aws_security_group.this","source_type":"aws_security_group","role":"SUPPORT","via":"REFERENCED_BY_A_MEMBER","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.dependencies.module.orders_rds.aws_rds_cluster.this","to":"module.dependencies.module.orders_rds.aws_security_group.this","edge":"ATTACHED_TO","via":"vpc_security_group_ids"},{"origin":"SG_INGRESS","source":"TERRAFORM_REFERENCE","rank":5,"decides":true,"from":"module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this","edge":"ATTACHED_TO","via":"source_security_group_id"}]},{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.mq","source_type":"aws_secretsmanager_secret","role":"SUPPORT","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"SECRET_REFERENCE","source":"RUNTIME_CONFIG","rank":4,"decides":true,"from":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.aws_secretsmanager_secret_version.mq","edge":"DEPENDS_ON","via":"container_definitions"},{"origin":"IAM_POLICY_REFERENCE","source":"TERRAFORM_REFERENCE","rank":5,"decides":true,"from":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.aws_secretsmanager_secret.mq","note":"an IAM policy of a member names it in a statement that is not a Deny (a unit that only a Deny names is no member); the actions are not read, so this is a reference and not a stated grant"},{"origin":"DEPENDS_ON_A_MEMBER","source":"TERRAFORM_REFERENCE","rank":6,"decides":true,"from":"module.retail_app_ecs.aws_secretsmanager_secret_version.mq","to":"module.dependencies.aws_mq_broker.mq","edge":"DEPENDS_ON","via":"secret_string"}]},{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","source_type":"aws_secretsmanager_secret","role":"SUPPORT","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"SECRET_REFERENCE","source":"RUNTIME_CONFIG","rank":4,"decides":true,"from":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db","edge":"DEPENDS_ON","via":"container_definitions"},{"origin":"IAM_POLICY_REFERENCE","source":"TERRAFORM_REFERENCE","rank":5,"decides":true,"from":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","note":"an IAM policy of a member names it in a statement that is not a Deny (a unit that only a Deny names is no member); the actions are not read, so this is a reference and not a stated grant"},{"origin":"DEPENDS_ON_A_MEMBER","source":"TERRAFORM_REFERENCE","rank":6,"decides":true,"from":"module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db","to":"module.dependencies.module.orders_rds.aws_rds_cluster.this","edge":"DEPENDS_ON","via":"secret_string"}]},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","source_type":"aws_ecs_service","role":"WORKLOAD","via":"THE_WORKLOAD","in_totals":true,"evidence":[]},{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","source_type":"aws_iam_role","role":"SUPPORT","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","edge":"ASSUMES_ROLE","via":"execution_role_arn"}]},{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","source_type":"aws_iam_role","role":"SUPPORT","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","edge":"ASSUMES_ROLE","via":"task_role_arn"}]},{"unit":"module.retail_app_ecs.module.orders_service.aws_security_group.this","source_type":"aws_security_group","role":"SUPPORT","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this","edge":"ATTACHED_TO","via":"network_configuration.security_groups"},{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.dependencies.aws_security_group_rule.mq","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this","edge":"ATTACHED_TO","via":"source_security_group_id"},{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this","edge":"ATTACHED_TO","via":"source_security_group_id"}]}],"selectors":["module.dependencies.aws_mq_broker.mq","module.dependencies.aws_security_group.mq","module.dependencies.module.orders_rds.aws_rds_cluster.this","module.dependencies.module.orders_rds.aws_security_group.this","module.retail_app_ecs.aws_secretsmanager_secret.mq","module.retail_app_ecs.aws_secretsmanager_secret.orders_db","module.retail_app_ecs.module.orders_service.aws_ecs_service.this","module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","module.retail_app_ecs.module.orders_service.aws_security_group.this"],"totals":{"entries":10,"counted_in_totals":10,"units_by_class":[{"key":"RECONFIGURE","count":8},{"key":"REPLATFORM","count":2}]},"depends_on_groups":[],"shared_units":["module.dependencies.module.catalog_rds.aws_rds_cluster.this","module.dependencies.module.catalog_rds.aws_security_group.this","module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","module.retail_app_ecs.aws_kms_key.cmk","module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","module.retail_app_ecs.module.catalog_service.aws_security_group.this"],"dependencies":"NOT_ASSESSED","dependencies_detail":{"origin":"STATIC_CODE_HINT","reason":"No application code in the source."},"answers":{"can_move":{"steps":79,"can_run_now":40,"on_unconfirmed_default":6,"after_manual":1,"waiting_for_decisions":24,"not_executable":14},"blocked_by":[{"record":"DEC-GEN-CONVERT-DATA-MOVEMENT","steps":31,"frees_alone":4},{"record":"DEC-GEN-CONVERT-POD-SEGMENTATION","steps":23,"frees_alone":4},{"record":"DEC-GEN-CONVERT-API-OPT-IN","steps":18,"frees_alone":2},{"record":"DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","steps":19,"frees_alone":0},{"record":"DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","steps":13,"frees_alone":0},{"record":"DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH","steps":13,"frees_alone":0}],"top_decisions":["DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-POD-SEGMENTATION","DEC-GEN-CONVERT-API-OPT-IN"],"work":{"manual_steps":62,"data_moves":1},"accept":[{"record":"DEC-IAM-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","area":"IAM","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","area":"IAM","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202","area":"IAM","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","area":"NET","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","area":"NET","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-SECURIT-D4CC95B3","area":"NET","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-SEC-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS","area":"SEC","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS","area":"SEC","kind":"SECURITY_DECISION_OPEN"}]}},{"id":"ui","name":"ui","basis":"ECS_SERVICE","name_from":"WORKLOAD_NAME","anchor":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","confidence":"MEDIUM","confidence_reason":"The references of the source make the group; no application tag confirms it.","members_sha256":"b60d5f3839fe1df0117500eb4da78b1503eba7542355c39919b4b74a2e89e8cf","evidence":[],"members":[{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","source_type":"aws_lb","role":"SUPPORT","via":"ROUTED_BY_THE_LOAD_BALANCER","in_totals":true,"evidence":[{"origin":"LB_ROUTE","source":"TERRAFORM_REFERENCE","rank":3,"decides":true,"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","edge":"ROUTES_TO","via":"load_balancer.target_group_arn","note":"the load balancer module.retail_app_ecs.module.alb.aws_lb.this routes to it through the target group module.retail_app_ecs.module.alb.aws_lb_target_group.main"}]},{"unit":"module.retail_app_ecs.module.alb.aws_security_group.this","source_type":"aws_security_group","role":"SUPPORT","via":"REFERENCED_BY_A_MEMBER","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.retail_app_ecs.module.alb.aws_lb.this","to":"module.retail_app_ecs.module.alb.aws_security_group.this","edge":"ATTACHED_TO","via":"security_groups"}]},{"unit":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","source_type":"aws_security_group","role":"SUPPORT","via":"REFERENCED_BY_A_MEMBER","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.retail_app_ecs.module.alb.aws_lb.this","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","edge":"ATTACHED_TO","via":"security_groups"}]},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","source_type":"aws_ecs_service","role":"WORKLOAD","via":"THE_WORKLOAD","in_totals":true,"evidence":[]},{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","source_type":"aws_iam_role","role":"SUPPORT","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","edge":"ASSUMES_ROLE","via":"execution_role_arn"}]},{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","source_type":"aws_iam_role","role":"SUPPORT","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","to":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","edge":"ASSUMES_ROLE","via":"task_role_arn"}]},{"unit":"module.retail_app_ecs.module.ui_service.aws_security_group.this","source_type":"aws_security_group","role":"SUPPORT","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.ui_service.aws_security_group.this","edge":"ATTACHED_TO","via":"network_configuration.security_groups"}]}],"selectors":["module.retail_app_ecs.module.alb.aws_lb.this","module.retail_app_ecs.module.alb.aws_security_group.this","module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","module.retail_app_ecs.module.ui_service.aws_ecs_service.this","module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","module.retail_app_ecs.module.ui_service.aws_security_group.this"],"totals":{"entries":7,"counted_in_totals":7,"units_by_class":[{"key":"RECONFIGURE","count":6},{"key":"REPLATFORM","count":1}]},"depends_on_groups":["carts","catalog","checkout","orders"],"shared_units":["module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"],"dependencies":"NOT_ASSESSED","dependencies_detail":{"origin":"STATIC_CODE_HINT","reason":"No application code in the source."},"answers":{"can_move":{"steps":43,"can_run_now":28,"on_unconfirmed_default":0,"after_manual":0,"waiting_for_decisions":7,"not_executable":8},"blocked_by":[{"record":"DEC-GEN-CONVERT-POD-SEGMENTATION","steps":13,"frees_alone":4},{"record":"DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","steps":10,"frees_alone":0},{"record":"DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH","steps":10,"frees_alone":0},{"record":"DEC-GEN-CONVERT-DATA-MOVEMENT","steps":9,"frees_alone":0},{"record":"DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","steps":9,"frees_alone":0},{"record":"DEC-GEN-CONVERT-API-OPT-IN","steps":8,"frees_alone":0}],"top_decisions":["DEC-GEN-CONVERT-POD-SEGMENTATION"],"work":{"manual_steps":32,"data_moves":0},"accept":[{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","area":"IAM","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0","area":"IAM","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS","area":"NET","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","area":"NET","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-SECURITY-GROUP-THIS","area":"NET","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-SEC-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS","area":"SEC","kind":"SECURITY_DECISION_OPEN"}]}}],"shared":[{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","source_type":"aws_rds_cluster","groups":["catalog","orders"],"reason":"REACHED_BY_SEVERAL"},{"unit":"module.dependencies.module.catalog_rds.aws_security_group.this","source_type":"aws_security_group","groups":["catalog","orders"],"reason":"REACHED_BY_SEVERAL"},{"unit":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","source_type":"aws_dynamodb_table","groups":["carts","checkout"],"reason":"REACHED_BY_SEVERAL"},{"unit":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","source_type":"aws_cloudwatch_log_group","groups":["carts","catalog","checkout","orders","ui"],"reason":"REACHED_BY_SEVERAL"},{"unit":"module.retail_app_ecs.aws_kms_key.cmk","source_type":"aws_kms_key","groups":["catalog","orders"],"reason":"REACHED_BY_SEVERAL"},{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","source_type":"aws_secretsmanager_secret","groups":["catalog","orders"],"reason":"REACHED_BY_SEVERAL"},{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","source_type":"aws_secretsmanager_secret","groups":["catalog","orders"],"reason":"REACHED_BY_SEVERAL"},{"unit":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","source_type":"aws_security_group","groups":["catalog","orders"],"reason":"REACHED_BY_SEVERAL","evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress","to":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","edge":"ATTACHED_TO","via":"source_security_group_id","note":"a security group of the store admits, by an ingress rule, a security group the unit is attached to; the ports of the rule were not read (no rule of module.dependencies.module.catalog_rds.aws_security_group.this that names module.retail_app_ecs.module.catalog_service.aws_security_group.this could be matched by the rule reader). A rule is not proof that the unit connects; module.retail_app_ecs.module.catalog_service.aws_security_group.this is used by the workload of another group, and whether it is part of this application is not known"}]}]},"unused_selectors":[],"applications":[],"conflicts":[]},"target_fit_matrix":{"catalogue":{"provider":"stackit","version":"0.121.0","sha256":"60bdce0074519d22377d9657ddc61160ef40e60a9c4bc6b269c74319b8af507d","rows":321},"as_of":"2026-11-02","dimensions":[{"id":"functional_parity","name":"Functional parity","stock":{"state":"NOT_ASSESSED","basis":"The model has no field for functional parity or changed semantics, so it is not assessed for any capability."}},{"id":"service","name":"Service","stock":{"state":"NOT_ASSESSED","basis":"The registry states no service availability for this capability."}},{"id":"api","name":"API","stock":{"state":"NOT_ASSESSED","basis":"The registry states no API capability for this capability."}},{"id":"terraform","name":"Terraform","stock":{"state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability."}},{"id":"region","name":"Region","stock":{"state":"NOT_ASSESSED","basis":"The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit)."}},{"id":"maturity","name":"Maturity","stock":{"state":"NOT_ASSESSED","basis":"The registry states no maturity for this capability."}},{"id":"quota","name":"Quota","stock":{"state":"NOT_ASSESSED","basis":"The registry has no complete statement of the quotas of this capability."}},{"id":"lifecycle","name":"Lifecycle","stock":{"state":"NOT_ASSESSED","basis":"The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit."}},{"id":"operability","name":"Operability","stock":{"state":"NOT_ASSESSED","basis":"No provider or backend behaviour is recorded for this capability. That is not the same as having none."}},{"id":"security","name":"Security","stock":{"state":"NOT_ASSESSED","basis":"The registry states no security features or defaults for this capability."}},{"id":"support","name":"Support","stock":{"state":"NOT_ASSESSED","basis":"A capability states no support requirement; the support verdict is per application (support_suitability)."}},{"id":"evidence","name":"Evidence and probes","stock":{"state":"NOT_ASSESSED","basis":"No probe of the live target and no capability-level evidence is recorded for this capability."}}],"rows":[{"capability_id":"account.console-customization","ref":"capability:account.console-customization","description":"Per-account display settings of the management console (colour, visible regions and services).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"account.contact-management","ref":"capability:account.contact-management","description":"A contact object of the cloud account (primary contact: name, address, phone).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"account.quota-automation","ref":"capability:account.quota-automation","description":"Templates and automatic management of quotas across new projects or accounts.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"account.quota-increase","ref":"capability:account.quota-increase","description":"A resource that raises a quota of the account or project (a limit request with a status).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ai-ops.operations-agent","ref":"capability:ai-ops.operations-agent","description":"AI operations and incident investigation agent (AWS DevOps Agent); extends the entry proposed by w2-f15-awscc-a.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ai.agent-registry","ref":"capability:ai.agent-registry","description":"A catalogue of agents, tools and MCP servers with an approval workflow.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ai.contact-centre-assistant","ref":"capability:ai.contact-centre-assistant","description":"A contact-centre agent-assist service (real-time knowledge and generative answers for agents).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ai.managed-ai-apis","ref":"capability:ai.managed-ai-apis","description":"Managed AI service accounts / cognitive APIs / model invocation logging beyond model serving.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ai.model-guardrails","ref":"capability:ai.model-guardrails","description":"Managed content-safety, topic, word and personal-data filtering of model input and output.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"alerting.sms-receiver","ref":"capability:alerting.sms-receiver","description":"An SMS (text message) receiver for alert notifications.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"analytics.managed-business-intelligence","ref":"capability:analytics.managed-business-intelligence","description":"A managed business-intelligence, dashboard or embedded-analytics service (already proposed by lane w2-f16-small).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"applications.supply-chain-management","ref":"capability:applications.supply-chain-management","description":"A supply-chain planning and visibility application with its own data lake (demand and supply planning, n-tier supplier visibility).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"backup.hypervisor-gateway","ref":"capability:backup.hypervisor-gateway","description":"Backup gateway to a customer hypervisor.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"billing.invoice-configuration","ref":"capability:billing.invoice-configuration","description":"Configuration of invoice units and the delivery of e-invoices to procurement portals.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"block-storage.default-encryption-key","ref":"capability:block-storage.default-encryption-key","description":"A project-wide default customer key for the encryption of new volumes.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"block-storage.scheduled-snapshots-by-label","ref":"capability:block-storage.scheduled-snapshots-by-label","description":"Snapshots of block volumes taken on a schedule, the volumes chosen by label/tag, a retention count or age kept (AWS Data Lifecycle Manager, GCP snapshot schedule policies, the EBS part of AWS Backup).","unit_services":[],"provided_by":["stackit_volume_automation"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,BETA","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_volume_automation","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","BETA"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_volume_automation","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.enable_beta_resources","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"block-storage.snapshot-sharing","ref":"capability:block-storage.snapshot-sharing","description":"Sharing of volume snapshots with other projects or accounts.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"block-storage.volume-encryption","ref":"capability:block-storage.volume-encryption","description":"Encryption at rest of STACKIT block storage volumes (stackit_volume: the computed encrypted flag and the optional encryption_parameters that name a STACKIT KMS key). Source counterparts: aws_ebs_volume.encrypted / kms_key_id, azurerm_managed_disk.disk_encryption_set_id, google_compute_disk.disk_encryption_key.","unit_services":[],"provided_by":["stackit_volume"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_volume","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_volume","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: resource_schemas.stackit_volume attribute encryption_parameters","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"blockchain.node-access","ref":"capability:blockchain.node-access","description":"Managed access to public blockchain networks with billing tokens.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"cdn.custom-domain","ref":"capability:cdn.custom-domain","description":"A customer domain on a CDN distribution with a managed or an uploaded certificate (stackit_cdn_custom_domain). Source counterparts: aws_cloudfront_distribution aliases with an ACM certificate, azurerm_cdn_frontdoor_custom_domain, a custom domain of a Cloud CDN backend.","unit_services":[],"provided_by":["stackit_cdn_custom_domain"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/network/load-balancing-and-content-delivery/cdn/basics/features-cdn/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/cdn/v1/cdn.json:3849-4199","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,BETA","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_cdn_custom_domain","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","BETA"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_cdn_custom_domain","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"BETA","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 (resource_schemas.stackit_cdn_custom_domain.block.description)","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.enable_beta_resources","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"cdn.distribution","ref":"capability:cdn.distribution","description":"A content delivery network distribution in front of an HTTP origin or an S3-compatible bucket (stackit_cdn_distribution: origin, regions, geoblocking, blocked IPs, cache duration, cache key (query-string vary and request headers, in the pinned provider), redirects, TLS versions, WAF, Image Optimizer). Source counterparts: aws_cloudfront_distribution, azurerm_cdn_* / azurerm_cdn_frontdoor_*, google_compute_backend_bucket with Cloud CDN.","unit_services":[],"provided_by":["stackit_cdn_distribution"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/network/load-balancing-and-content-delivery/cdn/basics/features-cdn/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/cdn/v1/cdn.json:2410-2924","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,BETA","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_cdn_distribution","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","BETA"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_cdn_distribution","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"BETA","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 (resource_schemas.stackit_cdn_distribution.block.description)","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":3},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.enable_beta_resources","freshness":"FRESH"},{"kind":"PUBLIC_ISSUE","source":"https://github.com/stackitcloud/terraform-provider-stackit/issues/1629","freshness":"FRESH"},{"kind":"PUBLIC_ISSUE","source":"https://github.com/stackitcloud/terraform-provider-stackit/issues/1630","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"chatops.integration","ref":"capability:chatops.integration","description":"A ChatOps / Slack / Teams notification integration.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compliance.multicloud-inventory","ref":"capability:compliance.multicloud-inventory","description":"Configuration inventory and compliance assessment of resources in another cloud (AWS Config connector to Azure).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.container-applications","ref":"capability:compute.container-applications","description":"A managed platform for container applications (STACKIT Container Applications, SCA: environments, applications, events, logs). Source counterparts: AWS App Runner, Cloud Run, Azure Container Apps. No docs.stackit.cloud product page for it was found (searched 2026-10-17). The pinned provider has no resource type for it.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/sca/v1alpha/sca.json:953","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability. Whether STACKIT offers this service is not established. A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT does not draft automation for it yet; extra implementation is needed."},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"PREVIEW","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/sca/v1alpha/sca.json:953","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.edge-vision-appliance","ref":"capability:compute.edge-vision-appliance","description":"A managed appliance and application deployment service for computer vision at a camera site.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.function-service","ref":"capability:compute.function-service","description":"A generally available function-as-a-service (event triggers, aliases, versions, URLs, layers, capacity providers).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.functions","ref":"capability:compute.functions","description":"A managed function-as-a-service (STACKIT Functions: functions, revisions, pull credentials). Source counterpart: AWS Lambda (the knowledge base drafts a Cloud Foundry app instead). No docs.stackit.cloud product page for it was found (searched 2026-10-17 and again 2026-10-28: the docs site has no Functions page (https://docs.stackit.cloud/products/runtime/functions/ answers 404), the release notes name no Functions release, and a marketing page of 2026-08-26 names STACKIT Functions without a status), so its official status is not established. The pinned provider has no resource type for it (the pinned provider schema: no function resource other than the Cloud Foundry organization).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/functions/v1alpha/functions.json:774","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability. Whether STACKIT offers this service is not established. A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT does not draft automation for it yet; extra implementation is needed."},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"PREVIEW","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/functions/v1alpha/functions.json:774","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.hybrid-k8s-management","ref":"capability:compute.hybrid-k8s-management","description":"Hybrid / fleet Kubernetes management (Arc, GKE Fleet).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.image-building","ref":"capability:compute.image-building","description":"A managed image-building pipeline (recipes, components, schedules, distribution, lifecycle).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.mainframe-runtime","ref":"capability:compute.mainframe-runtime","description":"A managed runtime for modernised mainframe applications.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.managed-batch","ref":"capability:compute.managed-batch","description":"A managed batch service: job queues with priority and fair share, job definitions, compute environments, quota shares and consumable resources.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.managed-desktop-instances","ref":"capability:compute.managed-desktop-instances","description":"Managed desktop instances registered with a streaming service, with licence specifications.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.managed-kubernetes","ref":"capability:compute.managed-kubernetes","description":"Managed Kubernetes control plane and node pools (STACKIT Kubernetes Engine, SKE).","unit_services":["STACKIT Kubernetes Engine (SKE)"],"provided_by":["stackit_ske_cluster"],"units":6,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_ske_cluster","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_ske_cluster","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":3},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","freshness":"FRESH"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: resource_schemas.stackit_ske_cluster extensions.argus","freshness":"FRESH"},{"kind":"PUBLIC_ISSUE","source":"https://github.com/stackitcloud/terraform-provider-stackit/issues/1713","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.managed-paas-source-deploy","ref":"capability:compute.managed-paas-source-deploy","description":"A managed service that builds and deploys a web application from a source repository.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.microvm-service","ref":"capability:compute.microvm-service","description":"A managed microVM service (images, instances with a dedicated endpoint, network connectors).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.outposts","ref":"capability:compute.outposts","description":"Outposts-style on-premises rack extension (racks, sites, capacity tasks, volumes and snapshots on a rack, EKS on a rack).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.rightsizing-recommendations","ref":"capability:compute.rightsizing-recommendations","description":"A service that recommends other sizes from measured utilisation.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.robot-fleet-and-simulation","ref":"capability:compute.robot-fleet-and-simulation","description":"A robot fleet registry with software deployment and a managed robotics simulation service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.secure-browser","ref":"capability:compute.secure-browser","description":"Managed isolated (remote) browsing with a portal, browser policy, IP rules, session logging and identity provider.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.server-volume-encryption","ref":"capability:compute.server-volume-encryption","description":"Encryption at rest of the volumes a STACKIT server runs from (stackit_server boot_volume: an image or a volume as the boot source). Source counterparts: aws_instance.root_block_device and aws_launch_template block_device_mappings (encrypted, kms_key_id), azurerm_*_virtual_machine os_disk.disk_encryption_set_id and encryption_at_host_enabled, google_compute_instance boot_disk (kms_key_self_link).","unit_services":[],"provided_by":["stackit_server"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_server","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_server","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: data_source_schemas.stackit_image_v2 block description","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.spatial-simulation","ref":"capability:compute.spatial-simulation","description":"A managed distributed spatial simulation runtime with worlds, partitions and snapshots.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.spot-capacity","ref":"capability:compute.spot-capacity","description":"Spot, preemptible or interruptible server capacity bought at a discount, and its billing data feed.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.systems-management-service-settings","ref":"capability:compute.systems-management-service-settings","description":"Account-level settings of a systems-management service (Parameter Store tiers, automation logging, default host management, document sharing).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.virtual-desktop","ref":"capability:compute.virtual-desktop","description":"Managed virtual desktops (persistent or pooled) with directory sign-in, session timeouts and IP access control.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.virtual-workstations","ref":"capability:compute.virtual-workstations","description":"A service that streams graphics workstations (with a session broker, clipboard and session-length control) to studio users.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.vm-autoscaling","ref":"capability:compute.vm-autoscaling","description":"Managed autoscaling of server groups (elastic fleets that grow and shrink on load).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.vmware-platform","ref":"capability:compute.vmware-platform","description":"A VMware Cloud Foundation environment (vCenter, NSX, vSAN) run as a cloud service (Amazon EVS).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"contact-centre.cloud-contact-centre","ref":"capability:contact-centre.cloud-contact-centre","description":"Cloud contact centre with telephony, queues, routing, flows, outbound campaigns and agent workspace (Amazon Connect).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"container.registry-account-settings","ref":"capability:container.registry-account-settings","description":"Registry-wide settings, resource policy and creation templates of a container registry.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"container.registry-public","ref":"capability:container.registry-public","description":"Anonymous public pulls from a container registry.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"cost.budget-alerts","ref":"capability:cost.budget-alerts","description":"Budgets with spend threshold alerts.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"cost.budgets","ref":"capability:cost.budgets","description":"A budget with a limit and alerting, attachable to resources.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"cost.categorization","ref":"capability:cost.categorization","description":"Rule-based cost allocation / categorization.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"cost.commitment-plans","ref":"capability:cost.commitment-plans","description":"A purchasable usage commitment (savings plan) that discounts compute and service usage.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"cost.invoice-grouping","ref":"capability:cost.invoice-grouping","description":"Regrouping of accounts or projects into separate invoices.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"cost.recommendations","ref":"capability:cost.recommendations","description":"Cost optimisation recommendations with savings estimates.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"cost.usage-report-export","ref":"capability:cost.usage-report-export","description":"Scheduled cost and usage report export to object storage in a billing data format (AWS Cost and Usage Reports).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"customer-data.profile-unification","ref":"capability:customer-data.profile-unification","description":"Customer data platform: unified customer profiles from many sources with calculated attributes, segments, event triggers and recommendations (Amazon Connect Customer Profiles).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data-protection.recycle-bin","ref":"capability:data-protection.recycle-bin","description":"Retention of deleted snapshots and images for undeletion.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data-transfer.managed-sync","ref":"capability:data-transfer.managed-sync","description":"Managed data transfer and synchronisation between storage systems (agent, locations, tasks).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data-transfer.storage-discovery","ref":"capability:data-transfer.storage-discovery","description":"Discovery of on-premises storage systems for sizing.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.analytics-zero-etl","ref":"capability:data.analytics-zero-etl","description":"Managed continuous replication of an operational database into an analytics store.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.cache-user-acl","ref":"capability:data.cache-user-acl","description":"Per-user access strings, user groups and ACLs for an in-memory data store.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.commitment-reservations","ref":"capability:data.commitment-reservations","description":"A reservation or commitment resource for database capacity.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.cross-region-replication","ref":"capability:data.cross-region-replication","description":"Managed replication of a database, table or cache across regions, and multi-region active-active SQL.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.customer-profiles","ref":"capability:data.customer-profiles","description":"A customer-data platform with profile unification and identity resolution.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.data-warehouse","ref":"capability:data.data-warehouse","description":"A managed columnar data warehouse (Redshift-class) and its serverless form.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.database-connection-pool","ref":"capability:data.database-connection-pool","description":"A managed database connection pool or proxy with extra endpoints.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.database-engine-iam-role","ref":"capability:data.database-engine-iam-role","description":"An IAM role the database engine assumes to call other services (S3 import and export, Lambda).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.database-event-notifications","ref":"capability:data.database-event-notifications","description":"A database lifecycle event feed (failover, maintenance, backup) to a notification channel.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.database-snapshot-resource","ref":"capability:data.database-snapshot-resource","description":"A named, shareable, copyable database snapshot as a resource.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.database-stop-start","ref":"capability:data.database-stop-start","description":"Stopping and starting a managed database or warehouse (pause, resume, scheduled).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.dremio","ref":"capability:data.dremio","description":"A managed Dremio data lakehouse instance and its local users (stackit_dremio_instance, stackit_dremio_user). Source counterparts: none established; the AWS, Azure and Google lakehouse and query services (Athena, Synapse, BigQuery) are not equivalents of Dremio and no rule maps to it on a feature level.","unit_services":[],"provided_by":["stackit_dremio_instance","stackit_dremio_user"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"PREVIEW","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/data-and-ai/dremio/release-notes/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/dremio/v1beta/dremio.json:518-845","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,EXPERIMENTAL","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_dremio_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"dremio"},{"type":"stackit_dremio_user","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"dremio"}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_dremio_instance","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_dremio_user","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"EXPERIMENTAL","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 (resource_schemas.stackit_dremio_instance.block.description, resource_schemas.stackit_dremio_user.block.description)","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.experiments","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.dynamodb-compatible-store","ref":"capability:data.dynamodb-compatible-store","description":"A DynamoDB-compatible key-value store and its accelerator, index, stream and policy objects.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.genomics-store","ref":"capability:data.genomics-store","description":"A managed genomics store (sequence, reference, annotation or variant data) and workflow runs.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.horizontal-sharding-relational","ref":"capability:data.horizontal-sharding-relational","description":"A horizontally sharded relational database behind one endpoint (Aurora Limitless).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.ledger-database","ref":"capability:data.ledger-database","description":"A managed immutable ledger database with a verifiable journal.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.managed-cassandra","ref":"capability:data.managed-cassandra","description":"A managed Cassandra-compatible wide-column service (CQL).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.managed-ingestion-pipeline","ref":"capability:data.managed-ingestion-pipeline","description":"A managed Data Prepper style ingestion pipeline into a search service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.managed-mysql","ref":"capability:data.managed-mysql","description":"A managed MySQL engine (MariaDB is the closest).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.managed-oracle","ref":"capability:data.managed-oracle","description":"A managed Oracle (or Db2) database.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.opensearch-instance","ref":"capability:data.opensearch-instance","description":"A managed OpenSearch instance and its credentials (stackit_opensearch_instance, stackit_opensearch_credential). Among the sources the AWS rules map to it: aws_opensearch_domain and aws_elasticsearch_domain. The serverless and identity-integration absences stay recorded under data.search-serverless and data.search-identity-integration.","unit_services":["STACKIT OpenSearch"],"provided_by":["stackit_opensearch_credential","stackit_opensearch_instance"],"units":1,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/opensearch/v2/opensearch.json:837; stackitcloud/stackit-api-specifications, services/opensearch/v2/opensearch.json:1337","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_opensearch_credential","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_opensearch_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_opensearch_credential","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_opensearch_instance","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.search-identity-integration","ref":"capability:data.search-identity-integration","description":"SAML, Cognito or Identity Center sign-in and principal-scoped data access policies for a search service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.search-serverless","ref":"capability:data.search-serverless","description":"A serverless search service with auto-scaling capacity units and capacity groups.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.time-series-database","ref":"capability:data.time-series-database","description":"A managed time-series database (Timestream SQL, managed InfluxDB).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.transfer-scheduler","ref":"capability:data.transfer-scheduler","description":"A managed scheduled data transfer / ETL connector.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.valkey-instance","ref":"capability:data.valkey-instance","description":"A managed Key Value Store (Valkey) instance and its credentials (stackit_valkey_instance, stackit_valkey_credential). Among the sources the AWS rules map to it: aws_elasticache_replication_group and aws_elasticache_cluster.","unit_services":["STACKIT Key Value Store (Valkey)"],"provided_by":["stackit_valkey_credential","stackit_valkey_instance"],"units":1,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/valkey/v2/valkey.json:864; stackitcloud/stackit-api-specifications, services/valkey/v2/valkey.json:1364","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_valkey_credential","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_valkey_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_valkey_credential","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_valkey_instance","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.warehouse-data-sharing","ref":"capability:data.warehouse-data-sharing","description":"Live data sharing between warehouses and accounts, endpoint grants and partner integrations.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.workflows","ref":"capability:data.workflows","description":"A managed Apache Airflow service (STACKIT Workflows: instances, DAG bundles, a DAG repository). Source counterparts: Amazon MWAA and Cloud Composer. It is DAG orchestration only: the low-code integration and per-task queue parts of the capability workflow.orchestration are not part of it. The pinned provider has no resource type for it (checked against the pinned provider schema: no workflow resource).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/data-and-ai/workflows/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/workflows/v1alpha/workflows.json:1133","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability. STACKIT offers this service (preview). A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT does not draft automation for it yet; extra implementation is needed."},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"PREVIEW","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_API_SPEC","source":"STACKIT API specification workflows_v1alpha","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"database.instance-protection","ref":"capability:database.instance-protection","services":["postgres-flex","sqlserverflex"],"unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}],"conflicts":[{"origin":"EVIDENCE_CONFLICT","id":"database.instance-protection","disposition":"MANUAL_ACTION","legs":[{"source_kind":"service_api","state":"SUPPORTED","source":"stackit-api-specifications services/postgres-flex/v3/postgres-flex.json (POST /v3/projects/{projectId}/regions/{region}/instances/{instanceId}/protections, operationId UpdateInstanceProtection, body isDeletable \"Protect instance from deletion.\"; GetInstanceResponse.isDeletable; lines 4452-4455, 1088-1106, 1700-1704 of the mirror) and services/sqlserverflex/v3/sqlserverflex.json (same path); https://github.com/stackitcloud/stackit-api-specifications","checked":"2026-10-07"},{"source_kind":"official_doc","state":"SUPPORTED","source":"https://docs.stackit.cloud/products/databases/postgresql-flex/how-tos/create-and-manage-instances-for-postgresql-flex/#instance-protection (\"Instance Protection prevents an instance from being deleted. While it is active, deletion calls are rejected.\") and the FAQ https://docs.stackit.cloud/products/databases/postgresql-flex/faq/ (\"deleting an instance is immediate, permanent, and unrecoverable ... To prevent accidental deletion, enable Instance Protection.\"). The pages name the feature but not the tool that enables it: they do not state that Terraform supports it.","checked":"2026-10-07"},{"source_kind":"observed_provider_schema","state":"NOT_CONFIRMED","source":"STACKIT provider schema 0.121.0 (the pinned provider version), re-read 2026-11-02: stackit_postgresflex_instance (attributes acl, backup_schedule, connection_info, encryption, flavor, flavor_id, id, instance_id, name, network, project_id, region, replicas, retention_days, storage, version) and stackit_sqlserverflex_instance (the same plus edition and options): no protection / deletable attribute, and no data source of the two services has one. The only attributes of the whole schema (resources and data sources) whose name contains protect, protection or deletable are protected (stackit_image, stackit_image_v2 and, new in 0.119.0, the results of the data source stackit_images: an image's protected flag), and protection (stackit_kms_key, stackit_kms_wrapping_key), all unrelated. The attribute sets of the two instance resources are the same as in the 0.116.0, 0.117.0 and 0.118.0 schemas (compared 2026-10-08 and 2026-10-10), and the STACKIT provider documentation of postgresflex_instance and sqlserverflex_instance (terraform-provider-stackit v0.116.0, local mirror) name no such attribute either. The fact holds on the pin: this refreshes the record of 2026-10-07, which cited the 0.117.0 schema and said that a 0.118.0 schema was not present, and was re-read on the 0.119.0 pin on 2026-10-10 (the 0.119.0 schema differs from 0.118.0 by two data sources and one resource description only) and again on the 0.120.0 pin on 2026-10-16 (the 0.120.0 schema differs from 0.119.0 by 17 block descriptions of the dremio, observability and secretsmanager services only, none of them a postgres/sqlserver flex type, an attribute or a type) and again on the 0.121.0 pin on 2026-11-02 (the 0.121.0 schema differs from 0.120.0 by one added attribute, config.cache_config of stackit_cdn_distribution, and one added data source, stackit_networks, found by a whole-tree comparison of the two files).","checked":"2026-11-02"}]}]},{"capability_id":"database.managed-mysql","ref":"capability:database.managed-mysql","description":"A managed MySQL engine.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"database.mariadb","ref":"capability:database.mariadb","description":"A managed MariaDB instance and its credentials (stackit_mariadb_instance, stackit_mariadb_credential). MariaDB, not MySQL: the absence of a managed MySQL engine stays recorded under data.managed-mysql and database.managed-mysql, and nothing here says that a MySQL source carries over unchanged. Among the sources the AWS rules map to it: aws_db_instance and aws_rds_cluster with a MySQL or MariaDB engine.","unit_services":["STACKIT MariaDB"],"provided_by":["stackit_mariadb_credential","stackit_mariadb_instance"],"units":1,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/mariadb/v2/mariadb.json:778; stackitcloud/stackit-api-specifications, services/mariadb/v2/mariadb.json:1278","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_mariadb_credential","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_mariadb_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_mariadb_credential","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_mariadb_instance","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"database.mongodb-flex","ref":"capability:database.mongodb-flex","description":"A managed MongoDB Flex instance and its users (stackit_mongodbflex_instance, stackit_mongodbflex_user). Among the sources the AWS rules map to it: aws_docdb_cluster and, as a redesign of the data model, aws_dynamodb_table; a document store is not a key-value table and nothing here says the application's access pattern carries over.","unit_services":["STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)"],"provided_by":["stackit_mongodbflex_instance","stackit_mongodbflex_user"],"units":3,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/mongodb-flex/v2/mongodb-flex.json:1185; stackitcloud/stackit-api-specifications, services/mongodb-flex/v2/mongodb-flex.json:2924","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_mongodbflex_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_mongodbflex_user","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_mongodbflex_instance","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_mongodbflex_user","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"database.postgresql-flex","ref":"capability:database.postgresql-flex","description":"A managed PostgreSQL Flex instance with its databases and users (stackit_postgresflex_instance, stackit_postgresflex_database, stackit_postgresflex_user). Among the sources the AWS rules map to it: aws_db_instance and aws_rds_cluster with the PostgreSQL engine.","unit_services":["STACKIT PostgreSQL Flex"],"provided_by":["stackit_postgresflex_database","stackit_postgresflex_instance","stackit_postgresflex_user"],"units":1,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/databases/postgresql-flex/basics/architecture-of-postgresql-flex/; stackitcloud/docs.stackit.cloud, products/databases/postgresql-flex/basics/architecture-of-postgresql-flex.txt","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/postgres-flex/v3/postgres-flex.json:2050-2332; stackitcloud/stackit-api-specifications, services/postgres-flex/v3/postgres-flex.json:3554; stackitcloud/stackit-api-specifications, services/postgres-flex/v3/postgres-flex.json:4744","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_postgresflex_database","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_postgresflex_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_postgresflex_user","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_postgresflex_database","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_postgresflex_instance","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_postgresflex_user","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: resource_schemas.stackit_postgresflex_instance (acl, flavor, replicas deprecated: true)","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"devtools.build-resource-sharing","ref":"capability:devtools.build-resource-sharing","description":"Sharing of build projects and reports with other accounts by resource policy.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"devtools.cloud-ide","ref":"capability:devtools.cloud-ide","description":"A cloud development environment or browser IDE service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"devtools.code-review-automation","ref":"capability:devtools.code-review-automation","description":"Automated code review of pull requests.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"devtools.container-registry","ref":"capability:devtools.container-registry","description":"A managed container image registry (STACKIT Container Registry: its API manages artifactories, each the STACKIT record of a Harbor project (CreateArtifactory takes claim=true to adopt an existing one, registry_v1.json:560), and lists replication adapters). Source counterparts: Amazon ECR, Azure Container Registry, Google Artifact Registry (Docker repositories) and the legacy Container Registry. The pinned provider has no resource type for it (checked against the pinned provider schema: no registry, container or artifactory resource), so a registry is set up through the portal or the API.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/developer-platform/container-registry/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/registry/v1/registry.json:454","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability. STACKIT offers this service. A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT does not draft automation for it yet; extra implementation is needed."},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"devtools.git","ref":"capability:devtools.git","description":"A managed STACKIT Git instance (stackit_git: name, ACL, flavor; the instance URL, version and consumed disk and object storage are computed). Source counterparts: a hosted repository service with access restrictions (GitHub, Azure DevOps, Cloud Source Repositories); the repositories and users inside the instance are not Terraform resources.","unit_services":[],"provided_by":["stackit_git"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/developer-platform/git/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/git/v1beta/git.json:968-1313","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,BETA","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_git","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","BETA"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_git","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"BETA","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 (resource_schemas.stackit_git.block.description)","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":3},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.enable_beta_resources","freshness":"FRESH"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: resource_schemas.stackit_git block description","freshness":"FRESH"},{"kind":"PUBLIC_ISSUE","source":"https://github.com/stackitcloud/terraform-provider-stackit/issues/1633","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"devtools.git-external-integration","ref":"capability:devtools.git-external-integration","description":"Objects of a managed Git service beyond the instance: a connection to an external Git host, a repository link or pull mirror, and an event subscription (rule, topic or chat target). STACKIT Git (stackit_git) models the instance only; its management API has instances, authentications, runner and users and no repository, mirror or connection endpoint. Source counterparts: AWS CodeConnections/CodeStar connections, repository links and notification rules.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"devtools.git-repository-resource","ref":"capability:devtools.git-repository-resource","description":"Repositories of the managed Git service as a management-API or Terraform resource (stackit_git creates the instance only).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.client-certificate-verification","ref":"capability:edge.client-certificate-verification","description":"Verification of client certificates (mutual TLS) against a trust store at the CDN or the Application Load Balancer.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.compute","ref":"capability:edge.compute","description":"Code and key-value data executed or read at the CDN edge (edge functions, connection functions, key-value stores).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.field-level-encryption","ref":"capability:edge.field-level-encryption","description":"Encryption of single request fields at the edge with a public key.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.multi-tenant-distribution","ref":"capability:edge.multi-tenant-distribution","description":"A CDN distribution that is a shared template filled in per tenant (domains, certificate request, parameters) behind a connection group.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.private-origin","ref":"capability:edge.private-origin","description":"A CDN path to an origin inside a private network (VPC origin).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.realtime-log-stream","ref":"capability:edge.realtime-log-stream","description":"A configurable stream of selected, sampled viewer-request log fields to a data stream.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.response-header-policy","ref":"capability:edge.response-header-policy","description":"Adding, overriding or removing response headers (CORS, security headers) at the CDN edge.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.signed-urls","ref":"capability:edge.signed-urls","description":"Signed URLs, signed cookies and the key groups and public keys that verify them.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.staged-rollout","ref":"capability:edge.staged-rollout","description":"A CDN staging distribution that receives a share of the production traffic before a change is promoted.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.static-anycast-addresses","ref":"capability:edge.static-anycast-addresses","description":"Dedicated static anycast IP addresses for a CDN.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"end-user.app-streaming","ref":"capability:end-user.app-streaming","description":"Desktop or application streaming to end users (AWS AppStream 2.0, WorkSpaces, Azure Virtual Desktop).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"end-user.secure-browser","ref":"capability:end-user.secure-browser","description":"A remote isolated browser with clipboard, transfer and redaction controls.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"end-user.virtual-desktop","ref":"capability:end-user.virtual-desktop","description":"Managed virtual desktops (desktop as a service) with directories, IP access groups and pools.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"file-storage.object-view","ref":"capability:file-storage.object-view","description":"S3 API view of a file system.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"file-transfer.as2","ref":"capability:file-transfer.as2","description":"Managed AS2 messaging and outbound partner connectors.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"file-transfer.managed-sftp","ref":"capability:file-transfer.managed-sftp","description":"Managed SFTP, FTPS and FTP endpoint with managed users.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"file-transfer.web-portal","ref":"capability:file-transfer.web-portal","description":"Browser interface to files in storage for end users.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"file-transfer.workflow","ref":"capability:file-transfer.workflow","description":"Post-upload processing workflow of a file-transfer endpoint.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"game.server-hosting","ref":"capability:game.server-hosting","description":"Hosting of game servers with session placement, matchmaking, fleets and Spot capacity.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"gaming.game-server-hosting","ref":"capability:gaming.game-server-hosting","description":"Dedicated game server hosting with fleets, placement queues and Spot capacity.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"geo.location-services","ref":"capability:geo.location-services","description":"Managed maps, geocoding, routing, device tracking and geofencing.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.application-metadata","ref":"capability:governance.application-metadata","description":"An application registry with structured (nested) metadata attached to applications.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.application-registry","ref":"capability:governance.application-registry","description":"A registry of applications with attribute groups and associated resources.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.architecture-review","ref":"capability:governance.architecture-review","description":"A tool that reviews workloads against question catalogues (lenses) and produces improvement plans and recommendations.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.audit-evidence","ref":"capability:governance.audit-evidence","description":"Collection of audit evidence against compliance frameworks, with assessments.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.commitment-plans","ref":"capability:governance.commitment-plans","description":"A subscription to a pricing plan or savings plan applied to resources.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.config-recorder","ref":"capability:governance.config-recorder","description":"A configuration recorder / resource configuration history.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.dynamic-grouping","ref":"capability:governance.dynamic-grouping","description":"Dynamic resource groups / self-service product catalogs.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.generic-resource-proxy","ref":"capability:governance.generic-resource-proxy","description":"A generic resource proxy and an extension-type registry for infrastructure templates.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.landing-zone","ref":"capability:governance.landing-zone","description":"A managed landing zone with guardrails and baselines (STACKIT offers the Landing Zone Accelerator framework, not a managed service).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.launch-constraints","ref":"capability:governance.launch-constraints","description":"Launch constraints on catalogue products: notification topics, parameter rules, stack set deployment and update control.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.license-tracking","ref":"capability:governance.license-tracking","description":"Counting of licence use with limits that block launches above the count.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.multi-account-deployment","ref":"capability:governance.multi-account-deployment","description":"Fan-out of one template to many accounts and regions with an operation preference.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.policy-engine","ref":"capability:governance.policy-engine","description":"A policy engine for resource configuration (guardrails, compliance evaluation).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.product-catalog","ref":"capability:governance.product-catalog","description":"A self-service product catalog (portfolios, products, versions, launches).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.resilience-assessment","ref":"capability:governance.resilience-assessment","description":"A managed assessment of application resilience against recovery time and recovery point policies with recommendations.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.resource-search","ref":"capability:governance.resource-search","description":"Tag- and type-based queries and cross-region search over the resources of an account.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.resource-sharing","ref":"capability:governance.resource-sharing","description":"Sharing of resources and permissions with other accounts (STACKIT has Network Area for the projects of one organisation, and role assignments).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.service-catalog","ref":"capability:governance.service-catalog","description":"A self-service product catalogue with portfolios, constraints, shares and provisioned products.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.tag-policy","ref":"capability:governance.tag-policy","description":"A managed catalogue of allowed tag keys and values offered at provisioning.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"healthcare.agent-domain","ref":"capability:healthcare.agent-domain","description":"The HealthAgent service domain for healthcare providers.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"hybrid-storage.gateway","ref":"capability:hybrid-storage.gateway","description":"On-premises storage gateway appliance with local cache (file, volume).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"identity.access-brokering","ref":"capability:identity.access-brokering","description":"Brokered access of identity-provider users and groups to roles in other accounts or projects (Identity Center Account Access).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"identity.application-authorization-policy-store","ref":"capability:identity.application-authorization-policy-store","description":"A managed application-authorization policy store (Cedar policies, schema and an is-authorized API).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"identity.end-user-idp","ref":"capability:identity.end-user-idp","description":"A managed identity service for application end users (CIAM).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"identity.managed-directory","ref":"capability:identity.managed-directory","description":"A managed directory service (Active Directory compatible or LDAP) with domain controllers and trusts.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"identity.role-assignment","ref":"capability:identity.role-assignment","description":"Granting a role to a subject on a resource (stackit_authorization_{organization,folder,project}_role_assignment) and to a service account on a service account (stackit_authorization_service_account_role_assignment, the \"Act-As\" permission), and the project custom roles a role assignment can name. Source counterparts: the permission policies attached to an aws_iam_role (managed policy attachments, inline policies) and the trust of one principal in another (who may assume the role).","unit_services":["STACKIT service account for the workload"],"provided_by":["stackit_authorization_folder_role_assignment","stackit_authorization_organization_role_assignment","stackit_authorization_project_custom_role","stackit_authorization_project_role_assignment","stackit_authorization_service_account_role_assignment"],"units":10,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/roles-permissions/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/authorization/v2/authorization.json:807-840","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,EXPERIMENTAL","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_authorization_folder_role_assignment","facts":["RESOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"iam"},{"type":"stackit_authorization_organization_role_assignment","facts":["RESOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"iam"},{"type":"stackit_authorization_project_custom_role","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_authorization_project_role_assignment","facts":["RESOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"iam"},{"type":"stackit_authorization_service_account_role_assignment","facts":["RESOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"iam"}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_folder_role_assignment","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_organization_role_assignment","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_project_custom_role","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_project_role_assignment","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_service_account_role_assignment","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"EXPERIMENTAL","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 (resource_schemas.stackit_authorization_project_role_assignment.block.description, ..._folder_..., ..._organization_..., ..._service_account_role_assignment.block.description)","freshness":"UNKNOWN"}]},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":1}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.experiments","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"identity.secretsmanager-role-binding","ref":"capability:identity.secretsmanager-role-binding","description":"Granting a role to a subject on a Secrets Manager instance or on one of its secret groups (stackit_secretsmanager_instance_role_binding_v1, stackit_secretsmanager_secret_group_role_binding_v1; experimental feature iam). Source counterparts: a resource policy on an aws_secretsmanager_secret, an access policy of an azurerm_key_vault, an IAM binding of a google_secret_manager_secret. Documentation of these two resources and of the roles they accept: unverified (the Secrets Manager pages of docs.stackit.cloud, searched 2026-10-11, describe instance users and the project-level roles but name neither resource).","unit_services":[],"provided_by":["stackit_secretsmanager_instance_role_binding_v1","stackit_secretsmanager_secret_group_role_binding_v1"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/secrets-manager/v1alpha/secrets-manager.json:361-1171","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,EXPERIMENTAL","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_secretsmanager_instance_role_binding_v1","facts":["RESOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"iam"},{"type":"stackit_secretsmanager_secret_group_role_binding_v1","facts":["RESOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"iam"}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_secretsmanager_instance_role_binding_v1","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_secretsmanager_secret_group_role_binding_v1","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"EXPERIMENTAL","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 (resource_schemas.stackit_secretsmanager_instance_role_binding_v1.block.description, resource_schemas.stackit_secretsmanager_secret_group_role_binding_v1.block.description)","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.experiments","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"identity.server-service-account","ref":"capability:identity.server-service-account","description":"The service account a server runs as (stackit_service_account, stackit_server_service_account_attach; STACKIT IaaS API v2 and the service-account API): creating the account, attaching it to a server, how many a server takes, and how code on the server gets a token for it (metadata service). Source counterparts: aws_iam_instance_profile / iam_instance_profile, azurerm managed identity of a virtual machine, google_compute_instance.service_account.","unit_services":["STACKIT service account for the workload"],"provided_by":["stackit_server_service_account_attach","stackit_service_account"],"units":10,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/compute-engine/server/how-tos/attaching-service-account-to-servers/","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"WRITE_SUPPORTED","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"STACKIT IaaS API v2 specification (path /v2/projects/{projectId}/regions/{region}/servers/{serverId}/service-accounts/{serviceAccountMail})","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-09","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_server_service_account_attach","facts":["RESOURCE_AVAILABLE"]},{"type":"stackit_service_account","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_server_service_account_attach","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_service_account","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":1}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","state":"ASSESSED","value":"RECORDED","basis":"Probes of the live target and evidence of the capability as a whole. A probe is an observation of one exact variant, not of the capability. A disagreement between sources is listed as a conflict of the row.","counts":[{"key":"PROBES","count":9},{"key":"EVIDENCE_ITEMS","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-09","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-09","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-09","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-09","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-10","freshness":"UNKNOWN"}]}]},{"capability_id":"identity.service-account-key","ref":"capability:identity.service-account-key","description":"A key of a STACKIT service account for the key flow (stackit_service_account_key). Source counterpart: the long-lived access key or the credentials a workload of an AWS role is given when it cannot use federation.","unit_services":["STACKIT service account for the workload"],"provided_by":["stackit_service_account_key"],"units":10,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/platform/access-and-identity/service-accounts/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/service-account/v2/service-account.json:1680-1740","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_service_account_key","facts":["RESOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_service_account_key","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"identity.workload-identity-federation","ref":"capability:identity.workload-identity-federation","description":"A STACKIT service account that trusts tokens of an external OIDC issuer (stackit_service_account_federated_identity_provider: issuer URL and assertions). Source counterparts: the Federated principal of an aws_iam_role trust policy (an EKS service-account issuer for IRSA, GitHub Actions, another web identity provider) and aws_iam_openid_connect_provider.","unit_services":[],"provided_by":["stackit_service_account_federated_identity_provider"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/platform/access-and-identity/service-accounts/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/service-account/v2/service-account.json:1168-1230","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_service_account_federated_identity_provider","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_service_account_federated_identity_provider","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":1}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"integration.event-bus","ref":"capability:integration.event-bus","description":"An event bus with SaaS event sources and routing rules (the STACKIT PubSub API v1beta has topics and subscriptions; no provider resource and no SaaS sources).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"integration.managed-api-gateway","ref":"capability:integration.managed-api-gateway","description":"A managed API gateway / API management (routes, auth, quotas, throttling, developer portal).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"integration.saas-audit-ingestion","ref":"capability:integration.saas-audit-ingestion","description":"Connectors that pull the audit logs of SaaS applications and normalise them.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"integration.saas-data-connector","ref":"capability:integration.saas-data-connector","description":"Scheduled data pulls from a SaaS source into a store.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.analytics","ref":"capability:iot.analytics","description":"Managed flow that ingests device messages into a channel, transforms them in a pipeline, stores them in a data store and produces datasets.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.device-defender","ref":"capability:iot.device-defender","description":"Audit of device certificates, device policies and role aliases, custom device metrics, behaviour profiles and automatic mitigation actions.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.device-management","ref":"capability:iot.device-management","description":"A device registry with credentials, policies, fleet provisioning, remote jobs and behaviour monitoring.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.device-management-and-rules","ref":"capability:iot.device-management-and-rules","description":"IoT device registry, shadows, fleet indexing, device certificates and a rules engine over device messages.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.device-remote-access","ref":"capability:iot.device-remote-access","description":"A time-limited tunnel from an operator to a service on a single device behind a firewall.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.device-software-deployment","ref":"capability:iot.device-software-deployment","description":"Delivery of software components (recipes, artifacts, Lambda-derived components) to customer-owned devices with rollout and failure policies, and over-the-air file streams.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.device-testing-and-fleet-view","ref":"capability:iot.device-testing-and-fleet-view","description":"Device test suites against an IoT endpoint and a fleet monitoring application.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.digital-twin","ref":"capability:iot.digital-twin","description":"A digital twin service with workspaces, 3D scenes and entity sync jobs.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.event-detection","ref":"capability:iot.event-detection","description":"Evaluation of device messages against state machines (detector models) and threshold alarms, with actions.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.industrial-asset-data","ref":"capability:iot.industrial-asset-data","description":"Industrial asset models, assets, datasets, tasks, pipelines and access policies over device data.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.industrial-data","ref":"capability:iot.industrial-data","description":"Industrial asset data ingestion, modelling and dashboards.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.rules-engine","ref":"capability:iot.rules-engine","description":"SQL routing of device messages to other services.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.vehicle-data-collection","ref":"capability:iot.vehicle-data-collection","description":"Collection of vehicle signals by conditions with spooling, signal catalogs, model manifests and campaigns.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.wireless-network-server","ref":"capability:iot.wireless-network-server","description":"A managed LoRaWAN (and Sidewalk) network server with device and gateway registry, profiles, firmware updates over the air and traces.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"kubernetes.external-oidc","ref":"capability:kubernetes.external-oidc","description":"An external OIDC identity provider accepted by the Kubernetes API of a managed cluster.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"kubernetes.managed-platform-components","ref":"capability:kubernetes.managed-platform-components","description":"Managed platform components of a Kubernetes cluster that the provider runs outside it (Argo CD, controllers).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"kubernetes.serverless-nodes","ref":"capability:kubernetes.serverless-nodes","description":"Serverless (per-pod, nodeless) capacity in a managed Kubernetes cluster.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"licensing.license-issuing","ref":"capability:licensing.license-issuing","description":"Issuing licenses with entitlements to beneficiaries and tracking license usage.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"mainframe.runtime","ref":"capability:mainframe.runtime","description":"A managed runtime for migrated mainframe applications on a vendor engine.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.ad-insertion","ref":"capability:media.ad-insertion","description":"Server-side ad insertion, linear channel assembly and ad prefetch.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.file-transcoding","ref":"capability:media.file-transcoding","description":"Managed file-based video transcoding with presets and queues.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.live-encoding","ref":"capability:media.live-encoding","description":"Live video encoding clusters, multiplexes and alarm and event templates for media resources.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.live-streaming","ref":"capability:media.live-streaming","description":"Managed live video ingest and delivery, with chat rooms.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.live-video-encoding","ref":"capability:media.live-video-encoding","description":"Managed live video encoding, ingest and multiplexing.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.packaging-origin","ref":"capability:media.packaging-origin","description":"Just-in-time packaging of video to HLS, DASH, CMAF and Smooth Streaming with DRM, start-over and CDN authorization.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.real-time-analytics","ref":"capability:media.real-time-analytics","description":"Real-time analysis of live audio and video streams.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.transcoding","ref":"capability:media.transcoding","description":"Managed media transcoding with presets and pipelines.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.transcoding-packaging","ref":"capability:media.transcoding-packaging","description":"Managed video transcoding queues and packaging channels.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.video-inference","ref":"capability:media.video-inference","description":"AI processing of video: clipping, cropping and subtitling with custom dictionaries (AWS Elemental Inference).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.video-transport","ref":"capability:media.video-transport","description":"Reliable live video transport between sites with bridges, gateways and a media router.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.customer-engagement","ref":"capability:messaging.customer-engagement","description":"A customer-engagement platform with segments, campaigns and journeys.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.email-contact-lists","ref":"capability:messaging.email-contact-lists","description":"Recipient lists with topic subscriptions managed by the e-mail service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.email-dedicated-ips","ref":"capability:messaging.email-dedicated-ips","description":"Dedicated sending IP addresses and pools for an e-mail service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.email-deliverability-insights","ref":"capability:messaging.email-deliverability-insights","description":"A deliverability dashboard and optimised delivery for an e-mail service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.email-multi-region","ref":"capability:messaging.email-multi-region","description":"A multi-region sending endpoint with failover between regions.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.email-tenants","ref":"capability:messaging.email-tenants","description":"Per-tenant isolation of sending reputation and settings in an e-mail service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.event-notifications","ref":"capability:messaging.event-notifications","description":"A service that routes platform and service events to e-mail, chat and mobile channels with per-configuration batching.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.inbound-mail","ref":"capability:messaging.inbound-mail","description":"Receiving incoming email (an inbound SMTP endpoint with rules: AWS SES receipt rules, a mail relay).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.mail-receiving","ref":"capability:messaging.mail-receiving","description":"Receiving and processing of incoming e-mail (inbound SMTP with rules, filters and storage).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.mail-templates-and-events","ref":"capability:messaging.mail-templates-and-events","description":"Stored e-mail templates, configuration sets and delivery event feeds of the outbound mail service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.mailbox-hosting","ref":"capability:messaging.mailbox-hosting","description":"Hosted mailboxes for users (nearest target: Workspace by STACKIT, ordered through sales, no API or provider resource described).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.mailbox-platform","ref":"capability:messaging.mailbox-platform","description":"A managed mailbox platform (organization, domains, groups, mailboxes) with an API.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.managed-activemq","ref":"capability:messaging.managed-activemq","description":"A managed ActiveMQ broker with Spring XML configuration.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.managed-kafka","ref":"capability:messaging.managed-kafka","description":"A managed Apache Kafka (topics, partitions, consumer groups, ACLs).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.managed-kafka-connect","ref":"capability:messaging.managed-kafka-connect","description":"Managed Kafka and Kafka Connect workers.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.mqtt-broker","ref":"capability:messaging.mqtt-broker","description":"An MQTT broker for devices, as the rabbitmq_mqtt plugin of a RabbitMQ instance (no device registry, certificates or rules engine).","unit_services":["STACKIT RabbitMQ"],"provided_by":["stackit_rabbitmq_instance"],"units":1,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_rabbitmq_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_rabbitmq_instance","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.pubsub","ref":"capability:messaging.pubsub","description":"A managed publish/subscribe service (STACKIT PubSub: topics, publishers, subscriptions, subscribers). Source counterparts: SNS, SQS, Google Pub/Sub, Service Bus topics. No docs.stackit.cloud product page for it was found (searched 2026-10-17; the Messaging index lists MailOut and RabbitMQ). The pinned provider has no resource type for it. It has no message-schema setting.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/pubsub/v1beta/pubsub.json:516","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability. Whether STACKIT offers this service is not established. A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT does not draft automation for it yet; extra implementation is needed."},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"PREVIEW","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/pubsub/v1beta/pubsub.json:516","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.push-notifications","ref":"capability:messaging.push-notifications","description":"A push notification gateway for mobile platforms.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.rabbitmq-credential","ref":"capability:messaging.rabbitmq-credential","description":"A credential (user name, password and connection URIs) of a STACKIT RabbitMQ instance (stackit_rabbitmq_credential); the instance itself is listed under messaging.mqtt-broker. Among the sources the AWS rules map to it: aws_mq_broker; a source password is never carried by the draft.","unit_services":["STACKIT RabbitMQ"],"provided_by":["stackit_rabbitmq_credential"],"units":1,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/rabbitmq/v2/rabbitmq.json:1379","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_rabbitmq_credential","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_rabbitmq_credential","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.schema-registry","ref":"capability:messaging.schema-registry","description":"Validation of published messages against a registered schema (Pub/Sub schemas, a schema registry).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.secure-team-messaging","ref":"capability:messaging.secure-team-messaging","description":"An end-to-end encrypted staff messaging and collaboration service with retention and administrative controls.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.sms-and-voice","ref":"capability:messaging.sms-and-voice","description":"SMS and voice messaging with leased origination numbers, pools and sender ids.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.sms-and-whatsapp","ref":"capability:messaging.sms-and-whatsapp","description":"Sending text messages and WhatsApp messages to end users.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ml.anomaly-detection","ref":"capability:ml.anomaly-detection","description":"Managed anomaly detection on equipment sensor data, metrics and images.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ml.data-labeling","ref":"capability:ml.data-labeling","description":"A managed data-labeling or human-review service with workforce and task templates.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ml.edge-device-fleet","ref":"capability:ml.edge-device-fleet","description":"A device registry and fleet service that delivers models to edge devices.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ml.experiment-lineage","ref":"capability:ml.experiment-lineage","description":"Terraform-managed experiment-tracking entities and a lineage graph of actions, artifacts and contexts.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ml.model-hub","ref":"capability:ml.model-hub","description":"A curated model hub or catalogue that a customer can maintain for its users.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.application-load-balancer","ref":"capability:network.application-load-balancer","description":"A STACKIT Application Load Balancer (layer 7) with its listeners, target pools and rules (stackit_application_load_balancer), and the TLS certificates its HTTPS listeners use (stackit_alb_certificate). Among the sources the AWS rules map to it: aws_lb and aws_acm_certificate.","unit_services":["STACKIT Application Load Balancer"],"provided_by":["stackit_alb_certificate","stackit_application_load_balancer"],"units":1,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/network/load-balancing-and-content-delivery/application-load-balancer/basics/basic-concepts-alb/; stackitcloud/docs.stackit.cloud, products/network/load-balancing-and-content-delivery/application-load-balancer/basics/basic-concepts-alb.txt","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/alb/v2/alb.json:1587-1783; stackitcloud/stackit-api-specifications, services/certificates/v2/certificates.json:343","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_alb_certificate","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_application_load_balancer","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_alb_certificate","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_application_load_balancer","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":2},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-09-30 (Findings Q2, Q2b, Q3)","freshness":"FRESH"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-09-30 (Findings Q1, Q1b)","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.application-networking","ref":"capability:network.application-networking","description":"Application networking: a service network, service directory, resource gateway and resource configuration with request-level authorisation.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.ddos-protection","ref":"capability:network.ddos-protection","description":"A DDoS protection service with a response team that acts on the account.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.dedicated-connection","ref":"capability:network.dedicated-connection","description":"A dedicated customer connection (cross connect, interconnect to a partner network).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.dynamic-route-exchange","ref":"capability:network.dynamic-route-exchange","description":"Dynamic route exchange with virtual appliances (a managed BGP speaker that installs learned routes in route tables).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.failover-routing-control","ref":"capability:network.failover-routing-control","description":"Routing controls with safety rules that move traffic between replicas.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.global-accelerator","ref":"capability:network.global-accelerator","description":"A global accelerator with static anycast addresses, regional endpoint groups, traffic dials and cross-account endpoint sharing.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.http-https-redirect","ref":"capability:network.http-https-redirect","description":"A load balancer setting that redirects HTTP requests to HTTPS.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.interface","ref":"capability:network.interface","description":"Network interfaces and their attachment to servers (stackit_network_interface, stackit_server_network_interface_attach; STACKIT IaaS API v2): the interface that carries a private address in one network, the security groups attached to it by id, NIC security, allowed addresses, IPv4 only, the attachment that takes effect after a reboot. Source counterparts: aws_network_interface / aws_network_interface_attachment, azurerm_network_interface, the network_interface block of google_compute_instance.","unit_services":[],"provided_by":["stackit_network_interface","stackit_server_network_interface_attach"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/network/core-networking/network-interfaces/how-tos/create-and-manage-network-interfaces/","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08 (Phase B)","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"WRITE_SUPPORTED","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"STACKIT IaaS API v2 specification (paths .../networks/{networkId}/nics, .../nics/{nicId} and .../servers/{serverId}/nics/{nicId})","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_network_interface","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_server_network_interface_attach","facts":["RESOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_network_interface","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_server_network_interface_attach","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":4}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","state":"ASSESSED","value":"RECORDED","basis":"Probes of the live target and evidence of the capability as a whole. A probe is an observation of one exact variant, not of the capability. A disagreement between sources is listed as a conflict of the row.","counts":[{"key":"PROBES","count":2},{"key":"EVIDENCE_ITEMS","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"}]}]},{"capability_id":"network.interface-security-default","ref":"capability:network.interface-security-default","services":["iaas"],"unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}],"conflicts":[{"origin":"EVIDENCE_CONFLICT","id":"network.interface-security-default","disposition":"MANUAL_REVIEW","legs":[{"source_kind":"service_api","state":"SUPPORTED","source":"STACKIT IaaS API v2 specification components.schemas.NIC.nicSecurity and CreateNicPayload.nicSecurity: \"default\": true, so a network interface created without nicSecurity has security (its security groups apply). NICSecurity: \"If this is set to false, then no security groups will apply to this network interface.\"","checked":"2026-10-08"},{"source_kind":"official_doc","state":"UNSUPPORTED","source":"https://docs.stackit.cloud/products/network/core-networking/network-interfaces/how-tos/create-and-manage-network-interfaces/ (\"the optional flag `--nic-security` enables you to turn network interface security on. Per default it is disabled.\"), read 2026-10-08 through a page-summarising fetch tool. The sentence is about the CLI flag, not the API, so the two may both be true (the CLI would then send an explicit false); the page does not say. Probe 11: the page sentence is not true of STACKIT CLI 0.73.0 (its own help says \"--nic-security ... (default true)\", and `network-interface create` without the flag stored nicSecurity true), so the page is the outlier, not the specification.","checked":"2026-10-08"},{"source_kind":"observed_provider_schema","state":"NOT_STATED","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_network_interface.block.attributes.security: optional, computed bool without a stated default; the provider (mirror tag v0.116.0, networkinterface/resource.go:643) sends nothing when it is unset, so the API default decides. Probe 11 (provider 0.118.0): a network interface written without security was stored and read back with nicSecurity true (state security = true). The attribute is the same in the 0.119.0 schema (re-read 2026-10-10) the 0.120.0 schema (re-read 2026-10-16) and the 0.121.0 schema (re-read 2026-11-02).","checked":"2026-11-02"}]}]},{"capability_id":"network.internet-facing-dns-resolver","ref":"capability:network.internet-facing-dns-resolver","description":"An internet-facing, anycast DNS resolver with DNS filtering for clients outside the cloud.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.ipam-discovery-and-byoip","ref":"capability:network.ipam-discovery-and-byoip","description":"Bring-your-own-IP and IP address management (IPAM) discovery.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.ipv6-networks","ref":"capability:network.ipv6-networks","description":"IPv6 inside a STACKIT network.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.lb-http-redirect","ref":"capability:network.lb-http-redirect","description":"An HTTP to HTTPS redirect setting on the application load balancer.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.lb-ip-block-lists","ref":"capability:network.lb-ip-block-lists","description":"A named list of IPv4 CIDR ranges whose sources an Application Load Balancer denies (STACKIT Load Balancer IP Lists, referenced by ipBlockListName in the ALB options). It is a block list of the load balancer, not a condition set of the WAF, and it takes IPv4 only. The pinned provider has no resource type for the list and no attribute that references it (stackit_application_load_balancer).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/network/load-balancing-and-content-delivery/application-load-balancer/basics/features-alb/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/lb-ip-lists/v1alpha/lb-ip-lists.json:237","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability. STACKIT offers this service (preview). A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT does not draft automation for it yet; extra implementation is needed."},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"PREVIEW","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/lb-ip-lists/v1alpha/lb-ip-lists.json:237","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.managed-certificates","ref":"capability:network.managed-certificates","description":"Certificates issued, validated and renewed by the platform for a customer domain.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.modernisation-proxy","ref":"capability:network.modernisation-proxy","description":"A managed strangler-fig proxy that moves traffic from a legacy application to new services route by route.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.network","ref":"capability:network.network","description":"Networks of a project and the network area they sit in (stackit_network, stackit_network_area, stackit_network_area_region; STACKIT IaaS API v2): IPv4 prefix and prefix length, gateway, nameservers, DHCP, routed or isolated, the routing table assignment, the VPC attributes, the area's address ranges and prefix length bounds. Source counterparts: aws_vpc / aws_subnet, azurerm_virtual_network / azurerm_subnet, google_compute_network / google_compute_subnetwork. The VPC container, the VPC network range and the VPC routing table stay on network.vpc-container.","unit_services":["STACKIT network","STACKIT network DNS settings","STACKIT project networking / Network Area (SNA)"],"provided_by":["stackit_network","stackit_network_area","stackit_network_area_region"],"units":10,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"WRITE_SUPPORTED","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"STACKIT IaaS API v2 specification (paths /v2/projects/{projectId}/regions/{region}/networks and .../networks/{networkId}, /v2/organizations/{organizationId}/network-areas and .../regions/{region} (+ network-ranges))","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_network","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_network_area","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_network_area_region","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_network","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_network_area","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_network_area_region","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":4}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":2},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-09-24","freshness":"FRESH"},{"kind":"PUBLIC_ISSUE","source":"https://github.com/stackitcloud/terraform-provider-stackit/issues/1751","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","state":"ASSESSED","value":"RECORDED","basis":"Probes of the live target and evidence of the capability as a whole. A probe is an observation of one exact variant, not of the capability. A disagreement between sources is listed as a conflict of the row.","counts":[{"key":"PROBES","count":4},{"key":"EVIDENCE_ITEMS","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-09-24","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"}]}]},{"capability_id":"network.private-link","ref":"capability:network.private-link","description":"Private endpoints / private link to managed services.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.private-zone-global-resolution","ref":"capability:network.private-zone-global-resolution","description":"Resolution of the records of a private DNS zone for clients anywhere through a global resolver.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.public-ip-and-egress","ref":"capability:network.public-ip-and-egress","description":"Public IP addresses and the implicit outbound path of a routed network (stackit_public_ip, stackit_public_ip_associate; STACKIT IaaS API v2): what replaces an AWS elastic IP, internet gateway and NAT gateway (a public IP attached to a network interface, and the SNAT address of the routed networks that servers without a public IP share), what is implicit, the IPv4 limit and the open questions. Source counterparts: aws_eip / aws_eip_association / aws_internet_gateway / aws_nat_gateway, azurerm_public_ip / azurerm_nat_gateway, google_compute_address / google_compute_router_nat.","unit_services":[],"provided_by":["stackit_public_ip","stackit_public_ip_associate"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/network/core-networking/public-ip-address/basics/concepts/","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08 (Phase B)","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"WRITE_SUPPORTED","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"STACKIT IaaS API v2 specification (paths /v2/projects/{projectId}/regions/{region}/public-ips and .../servers/{serverId}/public-ips/{publicIpId})","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_public_ip","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_public_ip_associate","facts":["RESOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_public_ip","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_public_ip_associate","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":2}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":2},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: resource_schemas.stackit_public_ip_associate block description","freshness":"FRESH"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: resource_schemas.stackit_public_ip attribute network_interface_id","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","state":"ASSESSED","value":"RECORDED","basis":"Probes of the live target and evidence of the capability as a whole. A probe is an observation of one exact variant, not of the capability. A disagreement between sources is listed as a conflict of the row.","counts":[{"key":"PROBES","count":3},{"key":"EVIDENCE_ITEMS","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-10","freshness":"UNKNOWN"}]}]},{"capability_id":"network.routing","ref":"capability:network.routing","description":"Static and dynamic routes of a STACKIT network (STACKIT IaaS API v2 for network areas, v2alpha1 for VPCs): what a route is (destination CIDR, next hop of type ipv4, ipv6, internet or blackhole), the network-area routing tables the routes live in, the VPC static route behind an experiment and an entitlement. Source counterparts: aws_route_table / aws_route, azurerm_route_table / azurerm_route, google_compute_route. The row records what the cited sources establish and names, as probe-needed constraints, what they leave open; per-network routing table assignment is recorded on network.network.","unit_services":[],"provided_by":["stackit_network_area_route","stackit_routing_table","stackit_routing_table_route","stackit_vpc_routing_table_static_route"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"PARTIAL","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/network/core-networking/network-area/basics/routing-tables/","freshness":"UNKNOWN"},{"kind":"TARGET_OFFICIAL_DOC","source":"stackitcloud/professional-service, examples/vpn-full-tunnel-central-egress/README.md:262-263","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"PARTIAL","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"STACKIT IaaS API v2 specification (paths .../network-areas/{areaId}/regions/{region}/routes, .../routes/{routeId}, .../routing-tables, .../routing-tables/{routingTableId}/routes and .../routes/{routeId})","freshness":"UNKNOWN"},{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/iaas/v2alpha1/iaas.json:3992","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,EXPERIMENTAL","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_network_area_route","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_routing_table","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"routing-tables"},{"type":"stackit_routing_table_route","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"routing-tables"},{"type":"stackit_vpc_routing_table_static_route","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"vpc"}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_network_area_route","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_routing_table","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_routing_table_route","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_vpc_routing_table_static_route","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":2}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":2},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.experiments","freshness":"FRESH"},{"kind":"PUBLIC_ISSUE","source":"https://github.com/stackitcloud/terraform-provider-stackit/issues/1751","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","state":"ASSESSED","value":"RECORDED","basis":"Probes of the live target and evidence of the capability as a whole. A probe is an observation of one exact variant, not of the capability. A disagreement between sources is listed as a conflict of the row.","counts":[{"key":"PROBES","count":4},{"key":"EVIDENCE_ITEMS","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-10","freshness":"UNKNOWN"}]}]},{"capability_id":"network.rtb-interconnect","ref":"capability:network.rtb-interconnect","description":"A managed low-latency interconnect for real-time bidding traffic with gateways, links and traffic modules (rate limit, no-bid, OpenRTB filter).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.security-group","ref":"capability:network.security-group","description":"Per-project security groups and their allow rules for server network interfaces (stackit_security_group, stackit_security_group_rule; STACKIT IaaS API v2): stateful or stateless, ingress and egress rules on a protocol, port range or ICMP type/code, with an IP range or another security group as the remote. Source counterparts: aws_security_group and its rule resources, azurerm_network_security_group, google_compute_firewall.","unit_services":["STACKIT security group","STACKIT security groups (no stateless NACLs)"],"provided_by":["stackit_security_group","stackit_security_group_rule"],"units":17,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"WRITE_SUPPORTED","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"STACKIT IaaS API v2 specification (paths /v2/projects/{projectId}/regions/{region}/security-groups, .../security-groups/{securityGroupId}, .../rules)","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_security_group","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_security_group_rule","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_security_group","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_security_group_rule","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":9}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":2},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"FRESH"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","state":"ASSESSED","value":"RECORDED","basis":"Probes of the live target and evidence of the capability as a whole. A probe is an observation of one exact variant, not of the capability. A disagreement between sources is listed as a conflict of the row.","counts":[{"key":"PROBES","count":8},{"key":"EVIDENCE_ITEMS","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-09","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-09","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-10","freshness":"UNKNOWN"}]}],"conflicts":[{"origin":"CONSTRAINT_FACT","id":"intra-group-implicit-allow-claimed-by-docs","words":"The STACKIT documentation and the live platform disagree on whether traffic inside one security group is allowed by default; the draft follows the observed platform behaviour (an explicit rule is needed)."}]},{"capability_id":"network.service-registry","ref":"capability:network.service-registry","description":"A run-time service registry with registration, health and discovery API.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.virtual-wan","ref":"capability:network.virtual-wan","description":"A managed hub-and-spoke / virtual WAN routing product.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.vpc-container","ref":"capability:network.vpc-container","description":"A VPC container (stackit_vpc) above regions, network ranges and routing tables, and stackit_network.vpc_id / ipv4_vpc_network_range_id / ipv6_vpc_network_range_id attaching a network to it (all three are attributes of stackit_network in the pinned provider schema). Maturity: experimental (provider experiment `vpc`, maturity table experimental:vpc), not GA. Entitlement (HYPOTHESIS, not CONFIRMED): the tests on a STACKIT project on 2026-10-07 got 400 \"project not allowed to interact with a VPC\" from stackit_vpc create, so the backend gates it per project; the provider acceptance fixture creates its project with the label `enable-vpc = \"true\"`, but that label being the gate is unproven (the same 400 came again with the label set on the existing project; the record of that test is the evidence, not this note).","unit_services":[],"provided_by":["stackit_vpc","stackit_vpc_network_range","stackit_vpc_region","stackit_vpc_routing_table"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,EXPERIMENTAL","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_vpc","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"vpc"},{"type":"stackit_vpc_network_range","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"vpc"},{"type":"stackit_vpc_region","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"vpc"},{"type":"stackit_vpc_routing_table","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"vpc"}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_vpc","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_vpc_network_range","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_vpc_region","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_vpc_routing_table","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"EXPERIMENTAL","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 (resource_schemas.stackit_vpc.block.description, the pinned provider version)","freshness":"UNKNOWN"}]},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":1}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":2},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"FRESH"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.experiments","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","state":"ASSESSED","value":"RECORDED","basis":"Probes of the live target and evidence of the capability as a whole. A probe is an observation of one exact variant, not of the capability. A disagreement between sources is listed as a conflict of the row.","counts":[{"key":"PROBES","count":2},{"key":"EVIDENCE_ITEMS","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"UNKNOWN"}]}]},{"capability_id":"observability.audit-event-ingestion","ref":"capability:observability.audit-event-ingestion","description":"An ingestion endpoint that accepts audit events from partner or custom sources into an event store.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"observability.checks","ref":"capability:observability.checks","description":"Observability checks that probe a URL, a domain, an address or a certificate on a schedule (STACKIT Observability API v1: http, ping, network and certificate checks). Source counterparts: Route 53 health checks and CloudWatch Synthetics canaries that only call a URL. A scripted canary has no counterpart. The pinned provider has no resource type for the checks (stackit_observability_instance and stackit_observability_scrapeconfig are other capabilities).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/observability/v1/observability.json:11702","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability. Whether STACKIT offers this service is not established. A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT does not draft automation for it yet; extra implementation is needed."},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"observability.continuous-profiling","ref":"capability:observability.continuous-profiling","description":"Continuous profiling of running applications.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"observability.log-routing","ref":"capability:observability.log-routing","description":"Account-wide log routing / forwarding / exclusion / data-collection rules.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"observability.logs","ref":"capability:observability.logs","description":"The managed log store of STACKIT (STACKIT Logs, built on Grafana Loki): an instance with a retention in days and an ACL, written by OTLP or Loki clients with an access token. Source counterparts: aws_cloudwatch_log_group (with its log streams, metric filters and subscription filters), azurerm_log_analytics_workspace, google_logging_project_sink destinations.","unit_services":["STACKIT Logs","STACKIT Logs access tokens"],"provided_by":["stackit_logs_access_token","stackit_logs_instance"],"units":8,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/logging-and-monitoring/logs/","freshness":"UNKNOWN"},{"kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/logging-and-monitoring/logs/release-notes/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"WRITE_SUPPORTED","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/logs/v1/logs.json:463-557","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_logs_access_token","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_logs_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_logs_access_token","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_logs_instance","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"GA","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/logging-and-monitoring/logs/release-notes/","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 (resource_schemas.stackit_logs_instance.block.description and resource_schemas.stackit_logs_access_token.block.description)","freshness":"UNKNOWN"}]},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":3}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"observability.metrics-and-alerting","ref":"capability:observability.metrics-and-alerting","description":"A STACKIT Observability instance with its metric alert groups (Thanos), log alert groups (Loki), scrape configurations and credentials (stackit_observability_instance, stackit_observability_alertgroup, stackit_observability_logalertgroup, stackit_observability_scrapeconfig, stackit_observability_credential). The provider schema says the service is only available with default_region \"eu01\". Among the sources the AWS rules map to it: aws_cloudwatch_metric_alarm and aws_cloudwatch_dashboard; the managed log store is observability.logs.","unit_services":["STACKIT Observability alert rules"],"provided_by":["stackit_observability_alertgroup","stackit_observability_credential","stackit_observability_instance","stackit_observability_logalertgroup","stackit_observability_scrapeconfig"],"units":2,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/observability/v1/observability.json:5296; stackitcloud/stackit-api-specifications, services/observability/v1/observability.json:7245; stackitcloud/stackit-api-specifications, services/observability/v1/observability.json:10619; stackitcloud/stackit-api-specifications, services/observability/v1/observability.json:11983; stackitcloud/stackit-api-specifications, services/observability/v1/observability.json:14826","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_observability_alertgroup","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_observability_credential","facts":["RESOURCE_AVAILABLE"]},{"type":"stackit_observability_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_observability_logalertgroup","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_observability_scrapeconfig","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_observability_alertgroup","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_observability_credential","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_observability_instance","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_observability_logalertgroup","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_observability_scrapeconfig","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: resource_schemas.stackit_ske_cluster extensions.argus","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"observability.operational-work-items","ref":"capability:observability.operational-work-items","description":"A tracked operational work item (incident or ticket) service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"observability.smart-detection","ref":"capability:observability.smart-detection","description":"Managed anomaly / smart detection on telemetry.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.fleet-configuration","ref":"capability:operations.fleet-configuration","description":"Roll-out of a named configuration (patching, host management, backup) to many accounts, organizational units and regions at once.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.fleet-configuration-deployment","ref":"capability:operations.fleet-configuration-deployment","description":"Deployment of configuration definitions (patching, host management) to several accounts, organisational units and regions by one object.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.incident-management","ref":"capability:operations.incident-management","description":"On-call rotations, escalation and incident response plans.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.incident-store","ref":"capability:operations.incident-store","description":"A managed incident record store replicated across regions with customer managed keys.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.on-call-and-escalation","ref":"capability:operations.on-call-and-escalation","description":"On-call schedules, rotations, contacts and escalation plans with acknowledgement and SMS or voice engagement.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.oncall-escalation","ref":"capability:operations.oncall-escalation","description":"On-call contacts, contact channels (e-mail, SMS, voice) and staged escalation plans.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.remote-session-recording","ref":"capability:operations.remote-session-recording","description":"Managed remote-desktop access to servers with recording of the sessions.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.sap-management","ref":"capability:operations.sap-management","description":"A managed service that registers SAP HANA and ABAP applications for application-aware backup and operations.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.self-service-actions","ref":"capability:operations.self-service-actions","description":"Self-service operations (automation documents) that users run on launched products.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.support-chat-integration","ref":"capability:operations.support-chat-integration","description":"Support case notification and handling in a chat tool.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.user-notifications","ref":"capability:operations.user-notifications","description":"A service that notifies people of service events by e-mail, mobile or chat, with organisation-wide assignment.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"optimization.recommendation-and-automation","ref":"capability:optimization.recommendation-and-automation","description":"Resource optimization recommendations with automatic implementation by rule (AWS Compute Optimizer automation).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"organization.delegated-service-admin","ref":"capability:organization.delegated-service-admin","description":"Delegation of a service's administration for the whole organisation to one member account.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"organization.resource-sharing","ref":"capability:organization.resource-sharing","description":"Sharing of individual resources with principals of other accounts or organisations.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"platform.app-config-delivery","ref":"capability:platform.app-config-delivery","description":"Delivery of application configuration and feature flags with validation and gradual rollout.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"platform.configuration-management","ref":"capability:platform.configuration-management","description":"A managed Chef Automate or Puppet Enterprise server (configuration management of servers).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"platform.iac-templating-service","ref":"capability:platform.iac-templating-service","description":"A managed service for infrastructure templates, guided workload deployments and application repositories.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"platform.service-mesh","ref":"capability:platform.service-mesh","description":"A managed service mesh (service-to-service routing, retries, mutual TLS).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"rendering.managed-render-farm","ref":"capability:rendering.managed-render-farm","description":"Managed render management: farms, queues, worker fleets, licence limits and budgets for rendering and compute- intensive batch work (AWS Deadline Cloud).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"resilience.assessment","ref":"capability:resilience.assessment","description":"Assessment of an application against recovery objectives.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"resilience.failover-orchestration","ref":"capability:resilience.failover-orchestration","description":"Orchestrated failover between regions or zones (plans, workflows, zonal shift).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"resilience.fault-injection","ref":"capability:resilience.fault-injection","description":"Managed chaos engineering: fault injection experiments with stop conditions on cloud workloads (AWS FIS).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"runtime.edge-cloud","ref":"capability:runtime.edge-cloud","description":"A STACKIT Edge Cloud instance and the credentials to reach it (stackit_edgecloud_instance, stackit_edgecloud_kubeconfig, stackit_edgecloud_token). The provider says Edge Cloud is in private beta and not generally available. Source counterparts: none established; no rule maps a source resource to Edge Cloud.","unit_services":[],"provided_by":["stackit_edgecloud_instance","stackit_edgecloud_kubeconfig","stackit_edgecloud_token"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/edge/v1beta1/edge.json:427-1271","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,BETA","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_edgecloud_instance","facts":["RESOURCE_AVAILABLE","BETA"]},{"type":"stackit_edgecloud_kubeconfig","facts":["RESOURCE_AVAILABLE","BETA"]},{"type":"stackit_edgecloud_token","facts":["RESOURCE_AVAILABLE","BETA"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_edgecloud_instance","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_edgecloud_kubeconfig","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_edgecloud_token","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"BETA","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 (resource_schemas.stackit_edgecloud_instance.block.description, resource_schemas.stackit_edgecloud_kubeconfig.block.description, resource_schemas.stackit_edgecloud_token.block.description)","freshness":"UNKNOWN"},{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/edge-cloud/getting-started/authentication/","freshness":"UNKNOWN"}]},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":2}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.enable_beta_resources","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"satellite.ground-segment","ref":"capability:satellite.ground-segment","description":"Antenna time, radio contact scheduling and data delivery for satellites.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"search.resource-inventory","ref":"capability:search.resource-inventory","description":"A cross-resource search index or saved query over the resources of an account, project or organization.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.audit-log","ref":"capability:security.audit-log","description":"The platform-wide record of administrative activity (who called which API in an organisation, folder or project): on by default, 90 days of history in the Portal, readable with the audit-log.reader role, routed onward with the Telemetry Router. It records API calls, not the resulting configuration. No Terraform resource enables or configures it.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/platform/audit-log/","freshness":"UNKNOWN"},{"kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/release-notes/","freshness":"UNKNOWN"}]},{"dimension":"api","stock":true},{"dimension":"terraform","state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability. STACKIT offers this service. A public STACKIT API for it is not established. The pinned Terraform provider has no resource for it. StackToIT does not draft automation for it yet; extra implementation is needed."},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.code-scanning","ref":"capability:security.code-scanning","description":"Scanning of source code repositories (SAST, infrastructure as code, dependencies) and of other clouds.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.code-signing","ref":"capability:security.code-signing","description":"A managed code-signing service with signing profiles, platforms, jobs and revocation.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.code-signing-permissions","ref":"capability:security.code-signing-permissions","description":"Cross-account or cross-identity grants on a code-signing profile.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.data-lake","ref":"capability:security.data-lake","description":"A managed security data lake with OCSF normalisation, subscribers, lifecycle and cross-region replication.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.ddos-protection","ref":"capability:security.ddos-protection","description":"Managed DDoS protection (volumetric and application layer) for load balancers, public IP addresses and DNS, with a response team.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.findings-hub","ref":"capability:security.findings-hub","description":"A hub that aggregates findings of many products with automation rules, saved views and product integrations (STACKIT CSPM covers the STACKIT project only).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.investigation","ref":"capability:security.investigation","description":"An investigation graph over audit, flow and finding data.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.investigation-graph","ref":"capability:security.investigation-graph","description":"Security investigation graph over cloud activity and findings (Amazon Detective); extends the entry proposed by w2-f15-awscc-a.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.kms","ref":"capability:security.kms","description":"The STACKIT Key Management Service: key rings, keys and wrapping keys (stackit_kms_keyring, stackit_kms_key, stackit_kms_wrapping_key). Among the sources the AWS rules map to it: aws_kms_key. The provider notes that keys and key rings are not destroyed at once by a destroy (provider schema description); the default-encryption-key absence of block storage stays recorded under block-storage.default-encryption-key.","unit_services":["STACKIT KMS"],"provided_by":["stackit_kms_key","stackit_kms_keyring","stackit_kms_wrapping_key"],"units":1,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/kms/v1/kms.json:730; stackitcloud/stackit-api-specifications, services/kms/v1/kms.json:901; stackitcloud/stackit-api-specifications, services/kms/v1/kms.json:1863","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_kms_key","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_kms_keyring","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_kms_wrapping_key","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_kms_key","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_kms_keyring","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_kms_wrapping_key","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":2},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: resource_schemas.stackit_kms_key block description","freshness":"FRESH"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: resource_schemas.stackit_kms_keyring block description","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.log-lake","ref":"capability:security.log-lake","description":"A managed security data lake that normalises logs (OCSF) from many sources and serves subscribers.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.malware-scanning","ref":"capability:security.malware-scanning","description":"Malware scanning of objects in a storage bucket.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.managed-penetration-testing","ref":"capability:security.managed-penetration-testing","description":"A managed service that runs authorised, AI-driven penetration tests and code reviews against deployed applications.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.multi-party-approval","ref":"capability:security.multi-party-approval","description":"A rule that a sensitive operation needs the approval of several approvers.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.organisation-firewall-policy","ref":"capability:security.organisation-firewall-policy","description":"Organisation-wide enforcement of firewall, WAF and security-group policies across accounts.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.organization-network-policy","ref":"capability:security.organization-network-policy","description":"Central firewall policy management across accounts with reusable application, protocol and resource lists (AWS Firewall Manager); extends the entry proposed by w2-f15-awscc-a.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.payment-hsm","ref":"capability:security.payment-hsm","description":"A payment HSM service with payment key usages and payment operations.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.payment-key-alias","ref":"capability:security.payment-key-alias","description":"A named alias that can be re-pointed at a payment HSM key.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.posture-aggregation","ref":"capability:security.posture-aggregation","description":"Aggregation of security findings across projects, accounts or regions, with insights, automation rules, suppression and alerting.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.posture-management","ref":"capability:security.posture-management","description":"Managed security posture management (assessment of a project against fixed benchmarks): STACKIT Cloud Security Posture Management, a Portal service (generally available since 2026-10-05; enabled in the Portal or through the Service Enablement API) whose documented API reference is labelled v1beta, with no Terraform resource. It shows a project-level dashboard with a scan every 24 hours and offers no alerting. Managed threat detection is not part of it.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/security/cspm/","freshness":"UNKNOWN"},{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/security/cspm/basics/concepts/","freshness":"UNKNOWN"},{"kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/security/cspm/release-notes/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/security/cspm/","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability. STACKIT offers this service (generally available). A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT does not draft automation for it yet; extra implementation is needed."},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"GA","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/release-notes/","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.posture-standards","ref":"capability:security.posture-standards","description":"Choice of compliance standards and control-level parameters or suppression in a posture service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.posture-ticketing-integration","ref":"capability:security.posture-ticketing-integration","description":"Integration of security posture findings with ticketing systems (Jira Cloud, ServiceNow).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.private-ca","ref":"capability:security.private-ca","description":"A private certificate authority service (issue, revoke, share a CA).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.private-ca-templates","ref":"capability:security.private-ca-templates","description":"Certificate templates of a private certificate authority for directory-joined clients (validity, key, key usage, subject name and enrolment flags).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.secrets-manager","ref":"capability:security.secrets-manager","description":"A STACKIT Secrets Manager instance and its users (stackit_secretsmanager_instance, stackit_secretsmanager_user); the role bindings are identity.secretsmanager-role-binding. The provider schema says the service is only available with default_region \"eu01\". Among the sources the AWS rules map to it: aws_secretsmanager_secret; a secret value is never carried by the draft.","unit_services":["STACKIT Secrets Manager"],"provided_by":["stackit_secretsmanager_instance","stackit_secretsmanager_user"],"units":4,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/secrets-manager/v1/secrets-manager.json:481; stackitcloud/stackit-api-specifications, services/secrets-manager/v1/secrets-manager.json:1922","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_secretsmanager_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_secretsmanager_user","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_secretsmanager_instance","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_secretsmanager_user","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.sensitive-data-discovery","ref":"capability:security.sensitive-data-discovery","description":"Discovery and classification of sensitive data in object storage.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.siem","ref":"capability:security.siem","description":"A managed SIEM / security analytics product.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.threat-detection","ref":"capability:security.threat-detection","description":"Managed threat detection on logs and traffic (findings, threat intelligence lists, member accounts).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.voice-biometrics","ref":"capability:security.voice-biometrics","description":"Voice authentication of callers by voiceprint with a fraudster watchlist.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.vulnerability-assessment","ref":"capability:security.vulnerability-assessment","description":"Managed vulnerability and benchmark assessment of servers and images.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.vulnerability-scanning","ref":"capability:security.vulnerability-scanning","description":"Vulnerability scanning of hosts, functions and images (STACKIT Container Registry scans images with Trivy; no host or function scan).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"storage.bucket-policy","ref":"capability:storage.bucket-policy","description":"A resource policy or resource-based grant on an object storage bucket. STACKIT's management API (object-storage v1 and v2) and the pinned provider have no object for it; its S3 API takes Put Bucket Policy (docs.stackit.cloud object-storage reference supported-operations-on-buckets-and-objects), in a grammar of its own whose principals are credentials groups or * (key bucket_policy of execution-capabilities.yaml), so access by the identity of a compute resource does not exist.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"storage.object-lambda-access-point","ref":"capability:storage.object-lambda-access-point","description":"An Object Lambda access point that transforms objects on read, with its own access policy.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"storage.object-versioning","ref":"capability:storage.object-versioning","description":"Object versioning and public-access rules on a bucket.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"telephony.contact-center","ref":"capability:telephony.contact-center","description":"A cloud contact centre with telephony, queues, routing and agents.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"telephony.programmable-voice","ref":"capability:telephony.programmable-voice","description":"Programmable voice applications, SIP rules, speaker verification and call records.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"telephony.sip-trunking","ref":"capability:telephony.sip-trunking","description":"SIP trunking to the public telephone network with inbound and outbound settings.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"testing.device-farm","ref":"capability:testing.device-farm","description":"Real-device testing of mobile and web applications.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"testing.fault-injection","ref":"capability:testing.fault-injection","description":"A fault-injection service for controlled failure experiments.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"tls.acme-endpoint","ref":"capability:tls.acme-endpoint","description":"An ACME endpoint with domain prevalidation and external account binding.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"tls.certificate-expiry-events","ref":"capability:tls.certificate-expiry-events","description":"Platform events before a certificate expires.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"waf.captcha-and-challenge","ref":"capability:waf.captcha-and-challenge","description":"CAPTCHA, challenge and client token services of a WAF.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"waf.custom-conditions-and-reusable-sets","ref":"capability:waf.custom-conditions-and-reusable-sets","description":"Reusable, named condition sets and custom conditions in the CDN WAF and the load balancer WAF.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"waf.geographic-conditions","ref":"capability:waf.geographic-conditions","description":"Geographic (country) conditions in the load balancer WAF.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"waf.rate-limiting","ref":"capability:waf.rate-limiting","description":"Rate-based rules in a WAF.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"web.hosting-and-build","ref":"capability:web.hosting-and-build","description":"Managed build and hosting of web applications from a repository (static and server-side rendered).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"workflow.orchestration","ref":"capability:workflow.orchestration","description":"A managed workflow / low-code integration / step orchestration engine.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]}],"units":{"with_target":83,"without_target":10,"matched":67,"partial":0,"capability_unlinked":2,"no_catalogue_row":0,"not_applicable":14,"by_presence":[{"presence":"KNOWN_PRESENT","with_target":44,"without_target":0,"matched":37,"partial":0,"capability_unlinked":0,"no_catalogue_row":0,"not_applicable":7},{"presence":"CONDITIONAL","with_target":8,"without_target":0,"matched":4,"partial":0,"capability_unlinked":0,"no_catalogue_row":0,"not_applicable":4},{"presence":"KNOWN_ABSENT","with_target":31,"without_target":10,"matched":26,"partial":0,"capability_unlinked":2,"no_catalogue_row":0,"not_applicable":3}]},"uncovered_resource_types":[{"type":"stackit_dns_record_set","units":1,"standing":"RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED","functional_parity":"NOT_ASSESSED","basis":"The pinned STACKIT provider has this resource; StackToIT's capability metadata for it is incomplete.","terraform":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_vpn_connection","units":1,"standing":"RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED","functional_parity":"NOT_ASSESSED","basis":"The pinned STACKIT provider has this resource; StackToIT's capability metadata for it is incomplete.","terraform":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_vpn_gateway","units":1,"standing":"RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED","functional_parity":"NOT_ASSESSED","basis":"The pinned STACKIT provider has this resource; StackToIT's capability metadata for it is incomplete.","terraform":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"api_only_gaps":{"catalogued_not_generated":3,"rows":[{"capability":"compute.image-share","aws_source":["aws_ami_launch_permission"],"operation":"iaas_v2 SetImageShare","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has the source type aws_ami_launch_permission."}},{"capability":"database.postgresql.deletion-protection","aws_source":["aws_db_instance","aws_rds_cluster","awscc_rds_db_instance","awscc_rds_db_cluster"],"operation":"postgres-flex_v3 UpdateInstanceProtection","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":2,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: the 1 unit of its source types that exist (module.dependencies.module.orders_rds.aws_rds_cluster.this) asks for no deletion protection (deletion_protection is not set to true), so no step is needed."}},{"capability":"database.sqlserver.deletion-protection","aws_source":["aws_db_instance","awscc_rds_db_instance"],"operation":"sqlserverflex_v3 UpdateInstanceProtection","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has one of the source types aws_db_instance, awscc_rds_db_instance."}},{"capability":"function.http","aws_source":["aws_lambda_function","aws_lambda_function_url","aws_lambda_alias","aws_lambda_layer_version","aws_lambda_permission"],"operation":"functions_v1alpha CreateFunction","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":1},"estate":{"state":"SWITCHED_OFF","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate that exists: the 1 unit of its source types (aws_lambda_function, aws_lambda_function_url, aws_lambda_alias, aws_lambda_layer_version, aws_lambda_permission) is switched off in this configuration."}},{"capability":"identity.secret","aws_source":["aws_secretsmanager_secret","aws_ssm_parameter","awscc_secretsmanager_secret"],"operation":"secretsmanager-vault WriteSecret","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":4,"conditional":0,"known_absent":0},"estate":{"state":"STEPS","steps":{"terraform":0,"stackit_api":4,"manual":0,"refused":0},"units":["module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","module.retail_app_ecs.aws_secretsmanager_secret.mq","module.retail_app_ecs.aws_secretsmanager_secret.orders_db"],"words":"4 STACKIT API steps, generated in this run's execution plan."}},{"capability":"network.lb-block-list","aws_source":["aws_wafv2_ip_set","awscc_wafv2_ip_set"],"operation":"lb-ip-lists_v1alpha UploadIPList","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has one of the source types aws_wafv2_ip_set, awscc_wafv2_ip_set."}},{"capability":"network.security-group.default-egress-rules","aws_source":["aws_subnet"],"operation":"iaas_v2 DeleteSecurityGroupRule","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":2,"known_absent":5},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":["module.vpc.module.vpc.aws_subnet.private","module.vpc.module.vpc.aws_subnet.public"],"words":"Not used by any unit of this estate: no subnet has widened outbound access, so target.network.egress is not asked and no step deletes the default egress rules of a group."}},{"capability":"objectstorage.bucket.cors","aws_source":["aws_s3_bucket_cors_configuration"],"operation":"s3 PutBucketCors","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has the source type aws_s3_bucket_cors_configuration."}},{"capability":"objectstorage.bucket.lifecycle","aws_source":["aws_s3_bucket_lifecycle_configuration"],"operation":"s3 PutBucketLifecycleConfiguration","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has the source type aws_s3_bucket_lifecycle_configuration."}},{"capability":"objectstorage.bucket.tagging","aws_source":["aws_s3_bucket"],"operation":"s3 PutBucketTagging","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has the source type aws_s3_bucket."}},{"capability":"objectstorage.bucket.versioning","aws_source":["aws_s3_bucket_versioning"],"operation":"s3 PutBucketVersioning","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has the source type aws_s3_bucket_versioning."}},{"capability":"pubsub.queue","aws_source":["aws_sqs_queue"],"operation":"pubsub_v1beta create-topic","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has the source type aws_sqs_queue."}},{"capability":"pubsub.subscription","aws_source":["aws_sns_topic_subscription"],"operation":"pubsub_v1beta create-subscription","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has the source type aws_sns_topic_subscription."}},{"capability":"pubsub.topic","aws_source":["aws_sns_topic"],"operation":"pubsub_v1beta create-topic","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has the source type aws_sns_topic."}},{"capability":"registry.repository","aws_source":["aws_ecr_repository","awscc_ecr_repository","aws_ecr_pull_through_cache_rule"],"operation":"registry_v1 CreateArtifactory","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has one of the source types aws_ecr_repository, awscc_ecr_repository, aws_ecr_pull_through_cache_rule."}},{"capability":"workflows.airflow","aws_source":["aws_mwaa_environment"],"operation":"workflows_v1alpha CreateInstance","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has the source type aws_mwaa_environment."}}]}},"evidence_index":{"limits":["A unit id is its Terraform address: renaming a resource in the source is a new unit. Continuity of a unit across a rename is not built (a semantic fingerprint is a later item).","An id names an object and holds no run: the same estate gives the same ids in every run. The JSON pointer into a file of the report is valid for the run named in header.run.","A line is given only for a block of the draft that parses as HCL. A block the draft writes as a comment has a file and no line, and a block the report could not place has neither.","A hop that reads UNSUPPORTED is not produced by this build; one that reads NOT_AVAILABLE is produced by this build and made nothing in this run. Neither is a finding of no risk."],"counts":{"units":93,"units_with_targets":38,"targets":53,"edges":64,"unowned_targets":0},"families":[{"family":"AWS_SECURITY_GROUP","units":15,"trace_producer":true,"traced_units":15,"hops":[{"hop":"source","states":[{"state":"ESTABLISHED","units":15}]},{"hop":"intent","states":[{"state":"ESTABLISHED","units":12},{"state":"NONE","units":3}]},{"hop":"plan","states":[{"state":"ESTABLISHED","units":1},{"state":"OPEN","units":6},{"state":"NONE","units":8}]},{"hop":"hcl","states":[{"state":"ESTABLISHED","units":7},{"state":"NONE","units":8}]},{"hop":"validation","states":[{"state":"ESTABLISHED","units":12},{"state":"NONE","units":3}]}]},{"family":"AWS_ROUTING","units":6,"trace_producer":true,"traced_units":6,"hops":[{"hop":"source","states":[{"state":"ESTABLISHED","units":6}]},{"hop":"intent","states":[{"state":"ESTABLISHED","units":2},{"state":"NONE","units":4}]},{"hop":"plan","states":[{"state":"NONE","units":6}]},{"hop":"hcl","states":[{"state":"NONE","units":6}]},{"hop":"validation","states":[{"state":"ESTABLISHED","units":2},{"state":"NONE","units":4}]}]},{"family":"AWS_IDENTITY_ATTACH","units":5,"trace_producer":true,"traced_units":5,"hops":[{"hop":"source","states":[{"state":"ESTABLISHED","units":5}]},{"hop":"intent","states":[{"state":"ESTABLISHED","units":5}]},{"hop":"plan","states":[{"state":"OPEN","units":5}]},{"hop":"hcl","states":[{"state":"ESTABLISHED","units":5}]},{"hop":"validation","states":[{"state":"ESTABLISHED","units":5}]}]},{"family":"LOG_SOURCE","units":6,"trace_producer":true,"traced_units":6,"hops":[{"hop":"source","states":[{"state":"ESTABLISHED","units":6}]},{"hop":"intent","states":[{"state":"ESTABLISHED","units":2},{"state":"NONE","units":4}]},{"hop":"plan","states":[{"state":"OPEN","units":1},{"state":"NONE","units":5}]},{"hop":"hcl","states":[{"state":"ESTABLISHED","units":1},{"state":"NONE","units":5}]},{"hop":"validation","states":[{"state":"ESTABLISHED","units":1},{"state":"NONE","units":5}]}]},{"family":"LEGACY_GENERATOR","units":61,"trace_producer":true,"traced_units":25,"hops":[{"hop":"source","states":[{"state":"ESTABLISHED","units":61}]},{"hop":"intent","states":[{"state":"NONE","units":30},{"state":"UNSUPPORTED","units":31}]},{"hop":"plan","states":[{"state":"NONE","units":30},{"state":"UNSUPPORTED","units":31}]},{"hop":"hcl","states":[{"state":"ESTABLISHED","units":25},{"state":"NONE","units":36}]},{"hop":"validation","states":[{"state":"NONE","units":30},{"state":"UNSUPPORTED","units":31}]}]}],"targets":{"rows_total":53,"by_block":{"HCL_BLOCK":53},"by_origin":{"LEGACY_GENERATOR":40,"PLAN":13}},"checks":[{"id":"check:GLOBAL_RESOURCE_UNIQUENESS","state":"PASS","checked":134,"file":"manifest.json","pointer":"/verification/0"},{"id":"check:NO_UNPLANNED_RESOURCE","state":"PASS","checked":53,"file":"manifest.json","pointer":"/verification/1"},{"id":"check:NO_UNPLANNED_REFERENCE","state":"PASS","checked":37,"file":"manifest.json","pointer":"/verification/2"},{"id":"check:NO_UNRESOLVED_REQUIRED_FIELD","state":"PASS","checked":155,"file":"manifest.json","pointer":"/verification/3"},{"id":"check:NO_SECURITY_WIDENING","state":"PASS","checked":35,"file":"manifest.json","pointer":"/verification/4"},{"id":"check:ALL_OUTPUTS_SAME_RUN","state":"PASS","checked":47,"file":"manifest.json","pointer":"/verification/5"},{"id":"check:VARIABLE_IDENTITY_PRESERVED","state":"PASS","checked":29,"file":"manifest.json","pointer":"/verification/6"},{"id":"check:NO_ORPHAN_MANUAL_ACTION","state":"PASS","checked":21,"file":"manifest.json","pointer":"/verification/7"},{"id":"check:SOURCE_PROVIDER_MATCHES_SCHEMA_OR_IS_UNVERIFIED","state":"PASS","checked":93,"file":"manifest.json","pointer":"/verification/8"},{"id":"check:APPLICATION_READY_IMPLIES_REQUIRED_ENV_SECRETS_DEPENDENCIES","state":"PASS","checked":5,"file":"manifest.json","pointer":"/verification/9"},{"id":"check:ALL_EMITTED_TARGET_TYPES_CLASSIFIED","state":"PASS","checked":53,"file":"manifest.json","pointer":"/verification/10"},{"id":"check:ALL_UNACCOUNTED_PROPERTIES_EXPLICIT","state":"PASS","checked":404,"file":"manifest.json","pointer":"/verification/11"},{"id":"check:SOURCE_COMPLETENESS","state":"PARTIAL","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/0"},{"id":"check:DRAFT_GENERATION","state":"GENERATED","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/1"},{"id":"check:STACKTOIT_DRAFT_CHECKS","state":"PASSED","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/2"},{"id":"check:GLOBAL_INVARIANTS","state":"PASSED","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/3"},{"id":"check:TOFU_STATIC_VALIDATION","state":"PASSED","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/4"},{"id":"check:OUTPUT_SCHEMA_VALIDATION","state":"PASSED","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/5"},{"id":"check:STACKIT_PLAN","state":"NOT_RUN","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/6"},{"id":"check:ARCHITECT_APPROVAL","state":"NOT_PROVIDED","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/7"},{"id":"check:SEMANTIC_EQUIVALENCE","state":"NOT_ASSESSED","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/8"},{"id":"check:SAFE_TO_APPLY","state":"NOT_ASSERTED","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/9"}]},"finding_groups":{"counts":{"findings":213,"in_groups":166,"singletons":47,"groups":19},"groups":[{"id":"findinggroup:dynamodb-secondary-indexes:14818af98772","check_id":"dynamodb-secondary-indexes","severity":"info","message":"Secondary indexes become MongoDB indexes on the collection; projections and the eventual consistency of global secondary indexes do not carry over.","records":3,"units":["module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore","module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this"]},{"id":"findinggroup:ecs-service-discovery:0c89a3c3677b","check_id":"ecs-service-discovery","severity":"warning","message":"Services find each other through Cloud Map / Service Connect; on SKE this becomes Kubernetes Services and DNS.","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/ske_cluster"],"records":5,"units":["module.retail_app_ecs.module.carts_service.aws_ecs_service.this","module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","module.retail_app_ecs.module.orders_service.aws_ecs_service.this","module.retail_app_ecs.module.ui_service.aws_ecs_service.this"]},{"id":"findinggroup:iam-inline-kms:3bb35459f179","check_id":"iam-inline-kms","severity":"info","message":"A policy of this role grants KMS actions. STACKIT KMS access comes from role assignments on an organisation, folder, project or service account, not on a key ring or key (stackit_kms_key has no policy or grant attribute in the pinned STACKIT provider), so a per-key permission widens to every key of the project. What to decide: which identities may use and which may administer keys, and whether keys that need different access move to their own project.","evidence":["https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/roles-permissions/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/authorization_project_role_assignment","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/kms_key"],"records":2,"units":["module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role"]},{"id":"findinggroup:iam-inline-secrets:bb792d944d86","check_id":"iam-inline-secrets","severity":"info","message":"A policy of this role reads or writes secrets or parameters. STACKIT Secrets Manager grants access with role bindings on the instance and on secret groups (stackit_secretsmanager_instance_role_binding_v1, stackit_secretsmanager_secret_group_role_binding_v1; documented roles Secrets Manager Reader and Admin) and with users that carry credentials. What to decide: per secret group, which identity reads and which writes. One more limit exists per instance: a source-address list (stackit_secretsmanager_instance acls, IP addresses or CIDR ranges that may reach the instance), the nearest thing to an aws:SourceIp condition; there is no per-identity or per-secret condition.","evidence":["https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/secretsmanager_instance","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/secretsmanager_instance_role_binding_v1"],"records":2,"units":["module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role"]},{"id":"findinggroup:iam-managed-customer-policy:9445be986089","check_id":"iam-managed-customer-policy","severity":"info","message":"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. STACKIT has no managed-policy object to attach: the permissions become role assignments of the service account (stackit_authorization_project_role_assignment: resource_id, role, subject), decided from the policy's document, whose shape is reported on the policy itself (a Deny, a Condition and sts:AssumeRole are UNSUPPORTED there; the service families s3, kms, secrets, logs, ec2 and iam name the STACKIT role or credential). What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several.","evidence":["https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/custom-roles/","https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/roles-permissions/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/authorization_project_custom_role","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/authorization_project_role_assignment"],"records":3,"units":["module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","module.retail_app_ecs.module.ui_service.aws_iam_role.task_role"]},{"id":"findinggroup:iam-managed-customer-policy:a7c9d58ec62b","check_id":"iam-managed-customer-policy","severity":"info","message":"This attachment names a customer-managed policy of this estate (an aws_iam_policy), not an AWS-managed one. STACKIT has no managed-policy object to attach: the permissions become role assignments of the service account (stackit_authorization_project_role_assignment: resource_id, role, subject), decided from the policy's document, whose shape is reported on the policy itself (a Deny, a Condition and sts:AssumeRole are UNSUPPORTED there; the service families s3, kms, secrets, logs, ec2 and iam name the STACKIT role or credential). What to decide: the roles of this role's service account from the findings of every policy attached here, and whether one policy shared by several roles becomes one set of role assignments or several. — a variable's default, not a fact","evidence":["https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/custom-roles/","https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/roles-permissions/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/authorization_project_custom_role","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/authorization_project_role_assignment"],"records":2,"units":["module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role"]},{"id":"findinggroup:iam-managed-ecs:f4af03acb481","check_id":"iam-managed-ecs","severity":"info","message":"Managed policy of an ECS role (AWS: task execution pulls images from ECR and writes CloudWatch Logs; the container-instance role registers hosts with ECS). STACKIT has no ECS: image pull is a registry credential (Container Registry roles, Guest is read-only) and log shipping a platform or credential setting (stackit_logs_access_token); no STACKIT role replaces these grants. Container Registry: STACKIT offers this service. A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT does not draft automation for it yet; extra implementation is needed. (schema checked 2026-10-11: none of the 115 resource types of the pinned STACKIT provider), so the pull credential is not drafted (project roles: docs.stackit.cloud, updated Jul 2, 2026). What to decide: the registry pull credential and the log destination of the replacing workload.","evidence":["STACKIT provider schema 0.119.0","https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEC2ContainerServiceforEC2Role.html","https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonECSTaskExecutionRolePolicy.html","https://docs.stackit.cloud/products/developer-platform/container-registry/how-tos/securing-access-with-role-based-access-control-_rbac_/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/logs_access_token"],"records":5,"units":["module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role"]},{"id":"findinggroup:iam-trust-service-workload:142d4f6560a3","check_id":"iam-trust-service-workload","severity":"info","message":"Trust policy: lambda.amazonaws.com or ecs-tasks.amazonaws.com assumes this role, so an application workload (a Lambda function or an ECS task) runs as it. On STACKIT the workload runs as a service account (stackit_service_account) and nothing assumes it: it authenticates with a service account key (stackit_service_account_key, key flow) or, on SKE, by Workload Identity Federation (a federated identity provider on the account). What to decide: key or federation, and the roles of the attached policies (see the permission findings of this unit).","evidence":["https://docs.stackit.cloud/platform/access-and-identity/service-accounts/","https://docs.stackit.cloud/platform/access-and-identity/service-accounts/authentication-flows/","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_federated_identity_provider","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/service_account_key"],"records":10,"units":["module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.ui_service.aws_iam_role.task_role"]},{"id":"findinggroup:linked-dependency-unread:9073c87476b6","check_id":"linked-dependency-unread","severity":"warning","message":"This unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table), whose own decision the target does not carry (it is REDESIGN), and the semantic contract of aws_iam_role does not read aws_dynamodb_table, so what the reference becomes is not assessed.","records":2,"units":["module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role"]},{"id":"findinggroup:role-aws-service-principal:08895a257190","check_id":"role-aws-service-principal","severity":"info","message":"This is a service role used by AWS itself (EKS control plane, RDS monitoring, flow logs, CloudWatch Logs delivery, CloudTrail). STACKIT managed services run without customer-side service roles; the role usually disappears rather than being migrated.","evidence":["https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html"],"records":2,"units":["module.dependencies.module.catalog_rds.aws_iam_role.rds_enhanced_monitoring","module.dependencies.module.orders_rds.aws_iam_role.rds_enhanced_monitoring"]},{"id":"findinggroup:secret-cmk:7c8993c742ec","check_id":"secret-cmk","severity":"info","message":"The secret is encrypted with a customer-managed KMS key. STACKIT Secrets Manager can encrypt with a customer-chosen key too, but the AWS key does not move: the instance's kms_key block (stackit_secretsmanager_instance: key_id, key_ring_id, key_version, service_account_email) names a STACKIT KMS key, one key for all secret values of the instance. The draft sets that block only when every source of the shared instance is an AWS secret that references the same drafted key; otherwise it does not set it and names the key NOT CARRIED with the reason. Decide whether to create the key (stackit_kms_keyring, stackit_kms_key) and a service account with at least the Secrets Manager Reader role in the same project and region, put the kms_key block on the instance, and which secrets share an instance when they used different keys (one key per instance, not per secret). Without the block the instance uses STACKIT's default encryption.","evidence":["https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/secrets-manager/v1/secrets-manager.json","https://registry.terraform.io/providers/stackitcloud/stackit/0.117.0/docs/resources/secretsmanager_instance"],"records":2,"units":["module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch"]},{"id":"findinggroup:sg-egress-restricted:91a635025d36","check_id":"sg-egress-restricted","severity":"warning","message":"The source restricts egress (the AWS provider removes AWS's default allow-all egress rule; only the listed egress rules apply). Every new STACKIT security group gets two default egress rules, IPv4 and IPv6, with no ip range (any address), no protocol and no port restriction (the test of 2026-10-07, 2026-10-07: API read-back of a new group, docs concepts page), that stackit_security_group (the pinned STACKIT provider) does not manage — as generated, the draft allows all egress. After apply, delete them (stackit security-group rule list / delete --security-group-id \u003cid\u003e), or egress is wider than in the source.","evidence":["tested on a STACKIT project on 2026-10-07","https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/security_group.md"],"records":8,"units":["module.dependencies.aws_security_group.catalog_opensearch_sg","module.dependencies.aws_security_group.mq","module.dependencies.module.catalog_opensearch.aws_security_group.this","module.dependencies.module.catalog_rds.aws_security_group.this","module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default","module.dependencies.module.orders_rds.aws_security_group.this","module.retail_app_ecs.module.alb.aws_security_group.this","module.retail_app_ecs.module.alb_sg.aws_security_group.this"]},{"id":"findinggroup:sg-rule-not-rendered:0b56dbc03fb2","check_id":"sg-rule-not-rendered","severity":"warning","message":"At least one rule of this group is not in the draft as the source has it. The plan withholds it, holds it as a commented-out rule until a value or a decision is filled in, writes it with a fact that decides what it allows not carried exactly, or cannot name it at all because the source has more rules than are visible statically (a dynamic block over a collection, a count or a rule list that is not known until apply, or a list with a hidden member: the plan's INCOMPLETE action says which set and why, the draft's TODO \"rules beyond the known set\" names it, and only the known rules are drafted). Typical causes: a protocol, port or source whose value is known only at apply time or comes from a root variable; a source group that is a choice between groups or not a group of the draft; a protocol with no STACKIT counterpart; an ICMP type with every code; an ICMP or ICMPv6 rule whose range is of the other IP family (the API answers HTTP 400, the test of 2026-10-08); a tcp or udp rule with a negative port, a port above 65535, a reversed range, or port 0 only (STACKIT stores no port range for 0 to 0, so the rule would match every port). A tcp or udp range that starts at port 0 and ends below 65535 is written from port 1 (the STACKIT API rejects a range that starts at 0; tested on a STACKIT project on 2026-10-07): port 0 itself is not carried. A stackit_security_group_rule without protocol, port_range or source allows everything (the pinned STACKIT provider), so such a rule is never widened; re-create it with the values it needs (the plan names each one).","evidence":["tested on a STACKIT project on 2026-10-07","tested on a STACKIT project on 2026-10-08","https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_IpPermission.html","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/security_group_rule"],"records":6,"units":["module.dependencies.aws_security_group.catalog_opensearch_sg","module.dependencies.aws_security_group.mq","module.dependencies.module.catalog_rds.aws_security_group.this","module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","module.dependencies.module.orders_rds.aws_security_group.this","module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix"]},{"id":"findinggroup:source-provider-unpinned:e11f99a83eba","check_id":"source-provider-unpinned","severity":"warning","message":"No lock file entry pins aws (\u003e= 3.0, \u003e= 3.29, \u003e= 4.18, \u003e= 4.30, \u003e= 4.59, \u003e= 5.64, \u003e= 5.79, ~\u003e 5.0): the version the plan would use is not proven, so the knowledge base (checked against 5.100.0) is not taken as proof of it (stated once for the whole estate, with the units it covers and the rest of the words)","records":93,"units":["module.dependencies.aws_mq_broker.mq","module.dependencies.aws_security_group.catalog_opensearch_sg","module.dependencies.aws_security_group.mq","module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_group.this","module.dependencies.module.catalog_opensearch.aws_cloudwatch_log_resource_policy.this","module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","module.dependencies.module.catalog_opensearch.aws_security_group.this","module.dependencies.module.catalog_rds.aws_cloudwatch_log_group.this","module.dependencies.module.catalog_rds.aws_iam_role.rds_enhanced_monitoring","module.dependencies.module.catalog_rds.aws_rds_cluster.this","module.dependencies.module.catalog_rds.aws_security_group.this","module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_cpu","module.dependencies.module.checkout_elasticache_redis.aws_cloudwatch_metric_alarm.cache_memory","module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.default","module.dependencies.module.checkout_elasticache_redis.module.dns.aws_route53_record.default","module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore","module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","module.dependencies.module.orders_rds.aws_cloudwatch_log_group.this","module.dependencies.module.orders_rds.aws_iam_role.rds_enhanced_monitoring","module.dependencies.module.orders_rds.aws_rds_cluster.this","module.dependencies.module.orders_rds.aws_security_group.this","module.retail_app_ecs.aws_cloudwatch_event_rule.ecs_events","module.retail_app_ecs.aws_cloudwatch_log_group.ecs_container_insights","module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","module.retail_app_ecs.aws_cloudwatch_log_resource_policy.eventbridge_ecs","module.retail_app_ecs.aws_ecs_cluster.cluster","module.retail_app_ecs.aws_kms_key.cmk","module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","module.retail_app_ecs.aws_secretsmanager_secret.mq","module.retail_app_ecs.aws_secretsmanager_secret.orders_db","module.retail_app_ecs.module.alb.aws_lambda_permission.lb","module.retail_app_ecs.module.alb.aws_lb.this","module.retail_app_ecs.module.alb.aws_security_group.this","module.retail_app_ecs.module.alb.aws_wafv2_web_acl_association.this","module.retail_app_ecs.module.alb_sg.aws_security_group.this","module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","module.retail_app_ecs.module.carts_service.aws_ecs_service.this","module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","module.retail_app_ecs.module.carts_service.aws_security_group.this","module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","module.retail_app_ecs.module.catalog_service.aws_security_group.this","module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","module.retail_app_ecs.module.checkout_service.aws_security_group.this","module.retail_app_ecs.module.orders_service.aws_ecs_service.this","module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","module.retail_app_ecs.module.orders_service.aws_security_group.this","module.retail_app_ecs.module.ui_service.aws_ecs_service.this","module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","module.retail_app_ecs.module.ui_service.aws_security_group.this","module.vpc.module.vpc.aws_cloudwatch_log_group.flow_log","module.vpc.module.vpc.aws_default_vpc.this","module.vpc.module.vpc.aws_eip.nat","module.vpc.module.vpc.aws_flow_log.this","module.vpc.module.vpc.aws_iam_role.vpc_flow_log_cloudwatch","module.vpc.module.vpc.aws_internet_gateway.this","module.vpc.module.vpc.aws_nat_gateway.this","module.vpc.module.vpc.aws_network_acl.database","module.vpc.module.vpc.aws_network_acl.elasticache","module.vpc.module.vpc.aws_network_acl.intra","module.vpc.module.vpc.aws_network_acl.outpost","module.vpc.module.vpc.aws_network_acl.private","module.vpc.module.vpc.aws_network_acl.public","module.vpc.module.vpc.aws_network_acl.redshift","module.vpc.module.vpc.aws_route_table.database","module.vpc.module.vpc.aws_route_table.elasticache","module.vpc.module.vpc.aws_route_table.intra","module.vpc.module.vpc.aws_route_table.private","module.vpc.module.vpc.aws_route_table.public","module.vpc.module.vpc.aws_route_table.redshift","module.vpc.module.vpc.aws_subnet.database","module.vpc.module.vpc.aws_subnet.elasticache","module.vpc.module.vpc.aws_subnet.intra","module.vpc.module.vpc.aws_subnet.outpost","module.vpc.module.vpc.aws_subnet.private","module.vpc.module.vpc.aws_subnet.public","module.vpc.module.vpc.aws_subnet.redshift","module.vpc.module.vpc.aws_vpc.this","module.vpc.module.vpc.aws_vpc_block_public_access_exclusion.this","module.vpc.module.vpc.aws_vpc_block_public_access_options.this","module.vpc.module.vpc.aws_vpc_dhcp_options.this","module.vpc.module.vpc.aws_vpn_gateway.this","module.vpc.module.vpc.aws_vpn_gateway_attachment.this"]},{"id":"findinggroup:topology-route-table-not-drafted:58e9e5dc0d71","check_id":"topology-route-table-not-drafted","severity":"warning","message":"This route table is created with count or for_each. What the draft makes of it follows the decision of this unit. A table that STACKIT's default routing replaces (the cases of a table with only internet or NAT routes in a project outside a Network Area) is not drafted at all, whatever its count: no routing table is made and none is to be attached, and this warning only records that the table is repeated. A table the decision keeps as a routing table of its own (rt-custom) is made only where the source names, instance by instance, which route and which subnet belongs to which instance (a table created with count whose routes and associations name the table by their own count.index): one routing table for each instance, with the routes the draft carries in each, attached to no network, and none at all when the draft carries none of the routes. Where the source does not name them, the draft makes none (which instance a route belongs to is not decided). For a table the decision keeps, nothing in the draft states which VPC the table belonged to (the routing table the draft writes, stackit_routing_table, belongs to a Network Area; the experimental stackit_vpc_routing_table of the pinned provider takes a vpc_id, but the draft writes none): the table, its routes and the subnets it is associated with are re-created or attached by hand once the VPC architecture is decided.","evidence":["https://docs.stackit.cloud/products/network/core-networking/network-area/basics/routing-tables/","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.120.0/docs/resources/routing_table.md"],"records":2,"units":["module.vpc.module.vpc.aws_route_table.private","module.vpc.module.vpc.aws_route_table.public"]},{"id":"findinggroup:topology-vpc-unproven:3dbafe2bf1da","check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this subnet names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"records":2,"units":["module.vpc.module.vpc.aws_subnet.private","module.vpc.module.vpc.aws_subnet.public"]},{"id":"findinggroup:topology-vpc-unproven:59f69264c493","check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this security group names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"records":12,"units":["module.dependencies.aws_security_group.catalog_opensearch_sg","module.dependencies.aws_security_group.mq","module.dependencies.module.catalog_rds.aws_security_group.this","module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","module.dependencies.module.orders_rds.aws_security_group.this","module.retail_app_ecs.module.alb.aws_security_group.this","module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","module.retail_app_ecs.module.carts_service.aws_security_group.this","module.retail_app_ecs.module.catalog_service.aws_security_group.this","module.retail_app_ecs.module.checkout_service.aws_security_group.this","module.retail_app_ecs.module.orders_service.aws_security_group.this","module.retail_app_ecs.module.ui_service.aws_security_group.this"]},{"id":"findinggroup:topology-vpc-unproven:681fce20a39c","check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: a resource of the estate (a subnet, route table, security group, network ACL, flow log, peering connection, a Cloud Control twin of those, ...) names a VPC by a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"records":3,"units":["module.vpc.module.vpc.aws_internet_gateway.this","module.vpc.module.vpc.aws_nat_gateway.this","module.vpc.module.vpc.aws_vpc.this"]},{"id":"findinggroup:topology-vpc-unproven:c709e8f577e2","check_id":"topology-vpc-unproven","severity":"warning","message":"The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this route table names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud Control subnet, ...), is a literal id, a variable, a data source, an attribute of a VPC other than its id (its arn, its owner id, ...) or an expression the scan cannot reduce to one reference to the VPC the estate creates (or the estate creates no VPC of its own). A unit placed in a subnet that the scan cannot show is one of the estate's (a server, load balancer, function or NAT gateway in a subnet given by a variable, a data source or a literal id) is in the same position: it may stand in another VPC. The draft puts every network, security group and routing table in the one var.project_id and cannot say that they all belong to one VPC. Confirm which VPC each of them is in, and whether the networks of another VPC belong in this project or in a project of their own joined through a Network Area. No unit of the VPC topology is automation-eligible until then (gate blocker TOPOLOGY:vpc-unproven).","evidence":["https://docs.stackit.cloud/products/network/core-networking/basics/architecture/","https://docs.stackit.cloud/products/network/core-networking/network-area/basics/concepts/"],"records":2,"units":["module.vpc.module.vpc.aws_route_table.private","module.vpc.module.vpc.aws_route_table.public"]}]},"diagrams":[{"scope":{"kind":"estate"},"node_count":49,"edge_count":109,"nodes":[{"unit":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","type":"aws_dynamodb_table","class":"REDESIGN","confidence":"MEDIUM","service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","no_target":false,"not_carried":2,"tier":"data","critical_open":6,"conditional":false},{"unit":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","type":"aws_cloudwatch_log_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Logs","no_target":false,"not_carried":1,"tier":"support","critical_open":1,"conditional":false},{"unit":"module.retail_app_ecs.aws_ecs_cluster.cluster","type":"aws_ecs_cluster","class":"REPLATFORM","confidence":"MEDIUM","service":"STACKIT Kubernetes Engine (SKE)","no_target":false,"not_carried":2,"tier":"compute","critical_open":0,"conditional":false},{"unit":"module.retail_app_ecs.aws_kms_key.cmk","type":"aws_kms_key","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT KMS","no_target":false,"not_carried":1,"tier":"support","critical_open":1,"conditional":false},{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.vpc.module.vpc.aws_eip.nat","type":"aws_eip","class":"RECONFIGURE","confidence":"MEDIUM","service":"implicit (belongs to the NAT gateway)","no_target":false,"not_carried":null,"tier":"network","critical_open":1,"conditional":false},{"unit":"module.vpc.module.vpc.aws_vpc.this","type":"aws_vpc","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT project networking / Network Area (SNA)","no_target":false,"not_carried":null,"tier":"network","critical_open":6,"conditional":false},{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","type":"aws_secretsmanager_secret","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Secrets Manager","no_target":false,"not_carried":3,"tier":"support","critical_open":3,"conditional":false},{"unit":"module.retail_app_ecs.module.alb.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":1,"tier":"network","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":15,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"LOW","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.carts_service.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":2,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":2,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"LOW","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":2,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.orders_service.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":2,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.ui_service.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":2,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.vpc.module.vpc.aws_nat_gateway.this","type":"aws_nat_gateway","class":"RECONFIGURE","confidence":"MEDIUM","service":"implicit outbound (STACKIT network)","no_target":false,"not_carried":null,"tier":"network","critical_open":3,"conditional":false},{"unit":"module.dependencies.aws_security_group.catalog_opensearch_sg","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","no_target":false,"not_carried":null,"tier":"network","critical_open":6,"conditional":false},{"unit":"module.dependencies.aws_security_group.mq","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","no_target":false,"not_carried":null,"tier":"network","critical_open":5,"conditional":false},{"unit":"module.dependencies.module.catalog_rds.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","no_target":false,"not_carried":null,"tier":"network","critical_open":6,"conditional":false},{"unit":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","no_target":false,"not_carried":null,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.dependencies.module.orders_rds.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","no_target":false,"not_carried":null,"tier":"network","critical_open":6,"conditional":false},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","type":"aws_lb","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Application Load Balancer","no_target":false,"not_carried":6,"tier":"network","critical_open":8,"conditional":false},{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","type":"aws_ecs_service","class":"REPLATFORM","confidence":"LOW","service":"STACKIT Kubernetes Engine (SKE)","no_target":false,"not_carried":14,"tier":"compute","critical_open":15,"conditional":false},{"unit":"module.dependencies.aws_mq_broker.mq","type":"aws_mq_broker","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT RabbitMQ","no_target":false,"not_carried":4,"tier":"compute","critical_open":8,"conditional":false},{"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","type":"aws_opensearch_domain","class":"REPLATFORM","confidence":"LOW","service":"STACKIT OpenSearch","no_target":false,"not_carried":23,"tier":"data","critical_open":14,"conditional":false},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","type":"aws_rds_cluster","class":"REPLATFORM","confidence":"LOW","service":"STACKIT MariaDB","no_target":false,"not_carried":16,"tier":"data","critical_open":14,"conditional":false},{"unit":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","type":"aws_elasticache_replication_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Key Value Store (Valkey)","no_target":false,"not_carried":10,"tier":"data","critical_open":9,"conditional":false},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","type":"aws_rds_cluster","class":"REPLATFORM","confidence":"MEDIUM","service":"STACKIT PostgreSQL Flex","no_target":false,"not_carried":12,"tier":"data","critical_open":10,"conditional":false},{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","type":"aws_secretsmanager_secret","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Secrets Manager","no_target":false,"not_carried":3,"tier":"support","critical_open":3,"conditional":false},{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.mq","type":"aws_secretsmanager_secret","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Secrets Manager","no_target":false,"not_carried":2,"tier":"support","critical_open":2,"conditional":false},{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","type":"aws_secretsmanager_secret","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Secrets Manager","no_target":false,"not_carried":2,"tier":"support","critical_open":2,"conditional":false},{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"LOW","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"LOW","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","type":"aws_ecs_service","class":"REPLATFORM","confidence":"LOW","service":"STACKIT Kubernetes Engine (SKE)","no_target":false,"not_carried":14,"tier":"compute","critical_open":15,"conditional":false},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","type":"aws_ecs_service","class":"REPLATFORM","confidence":"LOW","service":"STACKIT Kubernetes Engine (SKE)","no_target":false,"not_carried":14,"tier":"compute","critical_open":15,"conditional":false},{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","type":"aws_ecs_service","class":"REPLATFORM","confidence":"MEDIUM","service":"STACKIT Kubernetes Engine (SKE)","no_target":false,"not_carried":14,"tier":"compute","critical_open":15,"conditional":false},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","type":"aws_ecs_service","class":"REPLATFORM","confidence":"MEDIUM","service":"STACKIT Kubernetes Engine (SKE)","no_target":false,"not_carried":14,"tier":"compute","critical_open":16,"conditional":false},{"unit":"module.vpc.module.vpc.aws_internet_gateway.this","type":"aws_internet_gateway","class":"RECONFIGURE","confidence":"MEDIUM","service":"implicit (STACKIT network default gateway)","no_target":false,"not_carried":null,"tier":"network","critical_open":1,"conditional":true},{"unit":"module.vpc.module.vpc.aws_route_table.private","type":"aws_route_table","class":"RECONFIGURE","confidence":"LOW","service":"implicit (STACKIT network default routing)","no_target":false,"not_carried":null,"tier":"network","critical_open":8,"conditional":true},{"unit":"module.vpc.module.vpc.aws_route_table.public","type":"aws_route_table","class":"RECONFIGURE","confidence":"MEDIUM","service":"implicit (STACKIT network default routing)","no_target":false,"not_carried":null,"tier":"network","critical_open":5,"conditional":true},{"unit":"module.vpc.module.vpc.aws_subnet.private","type":"aws_subnet","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT network","no_target":false,"not_carried":3,"tier":"network","parent":"module.vpc.module.vpc.aws_vpc.this","critical_open":5,"conditional":true},{"unit":"module.vpc.module.vpc.aws_subnet.public","type":"aws_subnet","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT network","no_target":false,"not_carried":3,"tier":"network","parent":"module.vpc.module.vpc.aws_vpc.this","critical_open":6,"conditional":true}],"edges":[{"from":"module.dependencies.aws_mq_broker.mq","to":"module.dependencies.aws_security_group.mq"},{"from":"module.dependencies.aws_mq_broker.mq","to":"module.vpc.module.vpc.aws_subnet.private"},{"from":"module.dependencies.aws_security_group.catalog_opensearch_sg","to":"module.retail_app_ecs.module.catalog_service.aws_security_group.this"},{"from":"module.dependencies.aws_security_group.catalog_opensearch_sg","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.dependencies.aws_security_group.mq","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this"},{"from":"module.dependencies.aws_security_group.mq","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","to":"module.dependencies.aws_security_group.catalog_opensearch_sg"},{"from":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","to":"module.vpc.module.vpc.aws_subnet.private"},{"from":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","to":"module.dependencies.module.catalog_rds.aws_security_group.this"},{"from":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","to":"module.vpc.module.vpc.aws_subnet.private"},{"from":"module.dependencies.module.catalog_rds.aws_security_group.this","to":"module.retail_app_ecs.module.catalog_service.aws_security_group.this"},{"from":"module.dependencies.module.catalog_rds.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","to":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd"},{"from":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","to":"module.vpc.module.vpc.aws_subnet.private"},{"from":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","to":"module.retail_app_ecs.module.checkout_service.aws_security_group.this"},{"from":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.dependencies.module.orders_rds.aws_rds_cluster.this","to":"module.dependencies.module.orders_rds.aws_security_group.this"},{"from":"module.dependencies.module.orders_rds.aws_rds_cluster.this","to":"module.vpc.module.vpc.aws_subnet.private"},{"from":"module.dependencies.module.orders_rds.aws_security_group.this","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this"},{"from":"module.dependencies.module.orders_rds.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","to":"module.dependencies.module.catalog_rds.aws_rds_cluster.this"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","to":"module.retail_app_ecs.aws_kms_key.cmk"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","to":"module.retail_app_ecs.aws_kms_key.cmk"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret.mq","to":"module.dependencies.aws_mq_broker.mq"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","to":"module.dependencies.module.orders_rds.aws_rds_cluster.this"},{"from":"module.retail_app_ecs.module.alb.aws_lb.this","to":"module.retail_app_ecs.module.alb.aws_security_group.this"},{"from":"module.retail_app_ecs.module.alb.aws_lb.this","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix"},{"from":"module.retail_app_ecs.module.alb.aws_lb.this","to":"module.vpc.module.vpc.aws_subnet.public"},{"from":"module.retail_app_ecs.module.alb.aws_lb.this","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.retail_app_ecs.module.alb.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_ecs_cluster.cluster"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.carts_service.aws_security_group.this"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.vpc.module.vpc.aws_subnet.private"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","to":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.carts_service.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_ecs_cluster.cluster"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.catalog_service.aws_security_group.this"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.vpc.module.vpc.aws_subnet.private"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.aws_kms_key.cmk"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_ecs_cluster.cluster"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.checkout_service.aws_security_group.this"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.vpc.module.vpc.aws_subnet.private"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","to":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_ecs_cluster.cluster"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_secretsmanager_secret.mq"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.vpc.module.vpc.aws_subnet.private"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.aws_kms_key.cmk"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.aws_secretsmanager_secret.mq"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.orders_service.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_ecs_cluster.cluster"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.ui_service.aws_security_group.this"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.vpc.module.vpc.aws_subnet.private"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.ui_service.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.vpc.module.vpc.aws_eip.nat","to":"module.vpc.module.vpc.aws_internet_gateway.this"},{"from":"module.vpc.module.vpc.aws_internet_gateway.this","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.vpc.module.vpc.aws_nat_gateway.this","to":"module.vpc.module.vpc.aws_eip.nat"},{"from":"module.vpc.module.vpc.aws_nat_gateway.this","to":"module.vpc.module.vpc.aws_internet_gateway.this"},{"from":"module.vpc.module.vpc.aws_nat_gateway.this","to":"module.vpc.module.vpc.aws_subnet.public"},{"from":"module.vpc.module.vpc.aws_route_table.private","to":"module.vpc.module.vpc.aws_nat_gateway.this"},{"from":"module.vpc.module.vpc.aws_route_table.private","to":"module.vpc.module.vpc.aws_subnet.private"},{"from":"module.vpc.module.vpc.aws_route_table.private","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.vpc.module.vpc.aws_route_table.public","to":"module.vpc.module.vpc.aws_internet_gateway.this"},{"from":"module.vpc.module.vpc.aws_route_table.public","to":"module.vpc.module.vpc.aws_subnet.public"},{"from":"module.vpc.module.vpc.aws_route_table.public","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.vpc.module.vpc.aws_subnet.private","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.vpc.module.vpc.aws_subnet.public","to":"module.vpc.module.vpc.aws_vpc.this"}]},{"scope":{"kind":"module_call","id":"module.dependencies"},"node_count":11,"edge_count":5,"nodes":[{"unit":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","type":"aws_dynamodb_table","class":"REDESIGN","confidence":"MEDIUM","service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","no_target":false,"not_carried":2,"tier":"data","critical_open":6,"conditional":false},{"unit":"module.dependencies.aws_security_group.catalog_opensearch_sg","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","no_target":false,"not_carried":null,"tier":"network","critical_open":6,"conditional":false},{"unit":"module.dependencies.aws_security_group.mq","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","no_target":false,"not_carried":null,"tier":"network","critical_open":5,"conditional":false},{"unit":"module.dependencies.module.catalog_rds.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","no_target":false,"not_carried":null,"tier":"network","critical_open":6,"conditional":false},{"unit":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","no_target":false,"not_carried":null,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.dependencies.module.orders_rds.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","no_target":false,"not_carried":null,"tier":"network","critical_open":6,"conditional":false},{"unit":"module.dependencies.aws_mq_broker.mq","type":"aws_mq_broker","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT RabbitMQ","no_target":false,"not_carried":4,"tier":"compute","critical_open":8,"conditional":false},{"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","type":"aws_opensearch_domain","class":"REPLATFORM","confidence":"LOW","service":"STACKIT OpenSearch","no_target":false,"not_carried":23,"tier":"data","critical_open":14,"conditional":false},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","type":"aws_rds_cluster","class":"REPLATFORM","confidence":"LOW","service":"STACKIT MariaDB","no_target":false,"not_carried":16,"tier":"data","critical_open":14,"conditional":false},{"unit":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","type":"aws_elasticache_replication_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Key Value Store (Valkey)","no_target":false,"not_carried":10,"tier":"data","critical_open":9,"conditional":false},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","type":"aws_rds_cluster","class":"REPLATFORM","confidence":"MEDIUM","service":"STACKIT PostgreSQL Flex","no_target":false,"not_carried":12,"tier":"data","critical_open":10,"conditional":false}],"edges":[{"from":"module.dependencies.aws_mq_broker.mq","to":"module.dependencies.aws_security_group.mq"},{"from":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","to":"module.dependencies.aws_security_group.catalog_opensearch_sg"},{"from":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","to":"module.dependencies.module.catalog_rds.aws_security_group.this"},{"from":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","to":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd"},{"from":"module.dependencies.module.orders_rds.aws_rds_cluster.this","to":"module.dependencies.module.orders_rds.aws_security_group.this"}]},{"scope":{"kind":"module_call","id":"module.dependencies.module.catalog_rds"},"node_count":2,"edge_count":1,"nodes":[{"unit":"module.dependencies.module.catalog_rds.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","no_target":false,"not_carried":null,"tier":"network","critical_open":6,"conditional":false},{"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","type":"aws_rds_cluster","class":"REPLATFORM","confidence":"LOW","service":"STACKIT MariaDB","no_target":false,"not_carried":16,"tier":"data","critical_open":14,"conditional":false}],"edges":[{"from":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","to":"module.dependencies.module.catalog_rds.aws_security_group.this"}]},{"scope":{"kind":"module_call","id":"module.dependencies.module.checkout_elasticache_redis"},"node_count":2,"edge_count":1,"nodes":[{"unit":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","no_target":false,"not_carried":null,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","type":"aws_elasticache_replication_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Key Value Store (Valkey)","no_target":false,"not_carried":10,"tier":"data","critical_open":9,"conditional":false}],"edges":[{"from":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","to":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd"}]},{"scope":{"kind":"module_call","id":"module.dependencies.module.orders_rds"},"node_count":2,"edge_count":1,"nodes":[{"unit":"module.dependencies.module.orders_rds.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"not written by this draft (stackit_security_group, stackit_security_group_rule)","no_target":false,"not_carried":null,"tier":"network","critical_open":6,"conditional":false},{"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","type":"aws_rds_cluster","class":"REPLATFORM","confidence":"MEDIUM","service":"STACKIT PostgreSQL Flex","no_target":false,"not_carried":12,"tier":"data","critical_open":10,"conditional":false}],"edges":[{"from":"module.dependencies.module.orders_rds.aws_rds_cluster.this","to":"module.dependencies.module.orders_rds.aws_security_group.this"}]},{"scope":{"kind":"module_call","id":"module.retail_app_ecs"},"node_count":30,"edge_count":49,"nodes":[{"unit":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks","type":"aws_cloudwatch_log_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Logs","no_target":false,"not_carried":1,"tier":"support","critical_open":1,"conditional":false},{"unit":"module.retail_app_ecs.aws_ecs_cluster.cluster","type":"aws_ecs_cluster","class":"REPLATFORM","confidence":"MEDIUM","service":"STACKIT Kubernetes Engine (SKE)","no_target":false,"not_carried":2,"tier":"compute","critical_open":0,"conditional":false},{"unit":"module.retail_app_ecs.aws_kms_key.cmk","type":"aws_kms_key","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT KMS","no_target":false,"not_carried":1,"tier":"support","critical_open":1,"conditional":false},{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","type":"aws_secretsmanager_secret","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Secrets Manager","no_target":false,"not_carried":3,"tier":"support","critical_open":3,"conditional":false},{"unit":"module.retail_app_ecs.module.alb.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":1,"tier":"network","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":15,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"LOW","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.carts_service.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":2,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":2,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"LOW","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":2,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.orders_service.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":2,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.ui_service.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":2,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","type":"aws_lb","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Application Load Balancer","no_target":false,"not_carried":6,"tier":"network","critical_open":8,"conditional":false},{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","type":"aws_ecs_service","class":"REPLATFORM","confidence":"LOW","service":"STACKIT Kubernetes Engine (SKE)","no_target":false,"not_carried":14,"tier":"compute","critical_open":15,"conditional":false},{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","type":"aws_secretsmanager_secret","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Secrets Manager","no_target":false,"not_carried":3,"tier":"support","critical_open":3,"conditional":false},{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.mq","type":"aws_secretsmanager_secret","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Secrets Manager","no_target":false,"not_carried":2,"tier":"support","critical_open":2,"conditional":false},{"unit":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","type":"aws_secretsmanager_secret","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Secrets Manager","no_target":false,"not_carried":2,"tier":"support","critical_open":2,"conditional":false},{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"LOW","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"LOW","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","type":"aws_ecs_service","class":"REPLATFORM","confidence":"LOW","service":"STACKIT Kubernetes Engine (SKE)","no_target":false,"not_carried":14,"tier":"compute","critical_open":15,"conditional":false},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","type":"aws_ecs_service","class":"REPLATFORM","confidence":"LOW","service":"STACKIT Kubernetes Engine (SKE)","no_target":false,"not_carried":14,"tier":"compute","critical_open":15,"conditional":false},{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","type":"aws_ecs_service","class":"REPLATFORM","confidence":"MEDIUM","service":"STACKIT Kubernetes Engine (SKE)","no_target":false,"not_carried":14,"tier":"compute","critical_open":15,"conditional":false},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","type":"aws_ecs_service","class":"REPLATFORM","confidence":"MEDIUM","service":"STACKIT Kubernetes Engine (SKE)","no_target":false,"not_carried":14,"tier":"compute","critical_open":16,"conditional":false}],"edges":[{"from":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","to":"module.retail_app_ecs.aws_kms_key.cmk"},{"from":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","to":"module.retail_app_ecs.aws_kms_key.cmk"},{"from":"module.retail_app_ecs.module.alb.aws_lb.this","to":"module.retail_app_ecs.module.alb.aws_security_group.this"},{"from":"module.retail_app_ecs.module.alb.aws_lb.this","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_ecs_cluster.cluster"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.carts_service.aws_security_group.this"},{"from":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_ecs_cluster.cluster"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.catalog_service.aws_security_group.this"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.aws_kms_key.cmk"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch"},{"from":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_ecs_cluster.cluster"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.checkout_service.aws_security_group.this"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this"},{"from":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_ecs_cluster.cluster"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_secretsmanager_secret.mq"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.aws_kms_key.cmk"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.aws_secretsmanager_secret.mq"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","to":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db"},{"from":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.aws_ecs_cluster.cluster"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.ui_service.aws_security_group.this"},{"from":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","to":"module.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks"}]},{"scope":{"kind":"module_call","id":"module.retail_app_ecs.module.alb"},"node_count":2,"edge_count":1,"nodes":[{"unit":"module.retail_app_ecs.module.alb.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":1,"tier":"network","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.alb.aws_lb.this","type":"aws_lb","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Application Load Balancer","no_target":false,"not_carried":6,"tier":"network","critical_open":8,"conditional":false}],"edges":[{"from":"module.retail_app_ecs.module.alb.aws_lb.this","to":"module.retail_app_ecs.module.alb.aws_security_group.this"}]},{"scope":{"kind":"module_call","id":"module.retail_app_ecs.module.carts_service"},"node_count":4,"edge_count":3,"nodes":[{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"LOW","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.carts_service.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":2,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","type":"aws_ecs_service","class":"REPLATFORM","confidence":"LOW","service":"STACKIT Kubernetes Engine (SKE)","no_target":false,"not_carried":14,"tier":"compute","critical_open":15,"conditional":false}],"edges":[{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role"},{"from":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.carts_service.aws_security_group.this"}]},{"scope":{"kind":"module_call","id":"module.retail_app_ecs.module.catalog_service"},"node_count":4,"edge_count":3,"nodes":[{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":2,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"LOW","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","type":"aws_ecs_service","class":"REPLATFORM","confidence":"LOW","service":"STACKIT Kubernetes Engine (SKE)","no_target":false,"not_carried":14,"tier":"compute","critical_open":15,"conditional":false}],"edges":[{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role"},{"from":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.catalog_service.aws_security_group.this"}]},{"scope":{"kind":"module_call","id":"module.retail_app_ecs.module.checkout_service"},"node_count":4,"edge_count":3,"nodes":[{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"LOW","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":2,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","type":"aws_ecs_service","class":"REPLATFORM","confidence":"MEDIUM","service":"STACKIT Kubernetes Engine (SKE)","no_target":false,"not_carried":14,"tier":"compute","critical_open":15,"conditional":false}],"edges":[{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role"},{"from":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.checkout_service.aws_security_group.this"}]},{"scope":{"kind":"module_call","id":"module.retail_app_ecs.module.orders_service"},"node_count":4,"edge_count":3,"nodes":[{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.orders_service.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":2,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"LOW","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","type":"aws_ecs_service","class":"REPLATFORM","confidence":"LOW","service":"STACKIT Kubernetes Engine (SKE)","no_target":false,"not_carried":14,"tier":"compute","critical_open":15,"conditional":false}],"edges":[{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role"},{"from":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this"}]},{"scope":{"kind":"module_call","id":"module.retail_app_ecs.module.ui_service"},"node_count":4,"edge_count":3,"nodes":[{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","type":"aws_iam_role","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account for the workload","no_target":false,"not_carried":2,"tier":"support","critical_open":4,"conditional":false},{"unit":"module.retail_app_ecs.module.ui_service.aws_security_group.this","type":"aws_security_group","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT security group","no_target":false,"not_carried":2,"tier":"network","critical_open":7,"conditional":false},{"unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","type":"aws_ecs_service","class":"REPLATFORM","confidence":"MEDIUM","service":"STACKIT Kubernetes Engine (SKE)","no_target":false,"not_carried":14,"tier":"compute","critical_open":16,"conditional":false}],"edges":[{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role"},{"from":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","to":"module.retail_app_ecs.module.ui_service.aws_security_group.this"}]},{"scope":{"kind":"module_call","id":"module.vpc"},"node_count":8,"edge_count":13,"nodes":[{"unit":"module.vpc.module.vpc.aws_eip.nat","type":"aws_eip","class":"RECONFIGURE","confidence":"MEDIUM","service":"implicit (belongs to the NAT gateway)","no_target":false,"not_carried":null,"tier":"network","critical_open":1,"conditional":false},{"unit":"module.vpc.module.vpc.aws_vpc.this","type":"aws_vpc","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT project networking / Network Area (SNA)","no_target":false,"not_carried":null,"tier":"network","critical_open":6,"conditional":false},{"unit":"module.vpc.module.vpc.aws_nat_gateway.this","type":"aws_nat_gateway","class":"RECONFIGURE","confidence":"MEDIUM","service":"implicit outbound (STACKIT network)","no_target":false,"not_carried":null,"tier":"network","critical_open":3,"conditional":false},{"unit":"module.vpc.module.vpc.aws_internet_gateway.this","type":"aws_internet_gateway","class":"RECONFIGURE","confidence":"MEDIUM","service":"implicit (STACKIT network default gateway)","no_target":false,"not_carried":null,"tier":"network","critical_open":1,"conditional":true},{"unit":"module.vpc.module.vpc.aws_route_table.private","type":"aws_route_table","class":"RECONFIGURE","confidence":"LOW","service":"implicit (STACKIT network default routing)","no_target":false,"not_carried":null,"tier":"network","critical_open":8,"conditional":true},{"unit":"module.vpc.module.vpc.aws_route_table.public","type":"aws_route_table","class":"RECONFIGURE","confidence":"MEDIUM","service":"implicit (STACKIT network default routing)","no_target":false,"not_carried":null,"tier":"network","critical_open":5,"conditional":true},{"unit":"module.vpc.module.vpc.aws_subnet.private","type":"aws_subnet","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT network","no_target":false,"not_carried":3,"tier":"network","parent":"module.vpc.module.vpc.aws_vpc.this","critical_open":5,"conditional":true},{"unit":"module.vpc.module.vpc.aws_subnet.public","type":"aws_subnet","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT network","no_target":false,"not_carried":3,"tier":"network","parent":"module.vpc.module.vpc.aws_vpc.this","critical_open":6,"conditional":true}],"edges":[{"from":"module.vpc.module.vpc.aws_eip.nat","to":"module.vpc.module.vpc.aws_internet_gateway.this"},{"from":"module.vpc.module.vpc.aws_internet_gateway.this","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.vpc.module.vpc.aws_nat_gateway.this","to":"module.vpc.module.vpc.aws_eip.nat"},{"from":"module.vpc.module.vpc.aws_nat_gateway.this","to":"module.vpc.module.vpc.aws_internet_gateway.this"},{"from":"module.vpc.module.vpc.aws_nat_gateway.this","to":"module.vpc.module.vpc.aws_subnet.public"},{"from":"module.vpc.module.vpc.aws_route_table.private","to":"module.vpc.module.vpc.aws_nat_gateway.this"},{"from":"module.vpc.module.vpc.aws_route_table.private","to":"module.vpc.module.vpc.aws_subnet.private"},{"from":"module.vpc.module.vpc.aws_route_table.private","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.vpc.module.vpc.aws_route_table.public","to":"module.vpc.module.vpc.aws_internet_gateway.this"},{"from":"module.vpc.module.vpc.aws_route_table.public","to":"module.vpc.module.vpc.aws_subnet.public"},{"from":"module.vpc.module.vpc.aws_route_table.public","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.vpc.module.vpc.aws_subnet.private","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.vpc.module.vpc.aws_subnet.public","to":"module.vpc.module.vpc.aws_vpc.this"}]},{"scope":{"kind":"module_call","id":"module.vpc.module.vpc"},"node_count":8,"edge_count":13,"nodes":[{"unit":"module.vpc.module.vpc.aws_eip.nat","type":"aws_eip","class":"RECONFIGURE","confidence":"MEDIUM","service":"implicit (belongs to the NAT gateway)","no_target":false,"not_carried":null,"tier":"network","critical_open":1,"conditional":false},{"unit":"module.vpc.module.vpc.aws_vpc.this","type":"aws_vpc","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT project networking / Network Area (SNA)","no_target":false,"not_carried":null,"tier":"network","critical_open":6,"conditional":false},{"unit":"module.vpc.module.vpc.aws_nat_gateway.this","type":"aws_nat_gateway","class":"RECONFIGURE","confidence":"MEDIUM","service":"implicit outbound (STACKIT network)","no_target":false,"not_carried":null,"tier":"network","critical_open":3,"conditional":false},{"unit":"module.vpc.module.vpc.aws_internet_gateway.this","type":"aws_internet_gateway","class":"RECONFIGURE","confidence":"MEDIUM","service":"implicit (STACKIT network default gateway)","no_target":false,"not_carried":null,"tier":"network","critical_open":1,"conditional":true},{"unit":"module.vpc.module.vpc.aws_route_table.private","type":"aws_route_table","class":"RECONFIGURE","confidence":"LOW","service":"implicit (STACKIT network default routing)","no_target":false,"not_carried":null,"tier":"network","critical_open":8,"conditional":true},{"unit":"module.vpc.module.vpc.aws_route_table.public","type":"aws_route_table","class":"RECONFIGURE","confidence":"MEDIUM","service":"implicit (STACKIT network default routing)","no_target":false,"not_carried":null,"tier":"network","critical_open":5,"conditional":true},{"unit":"module.vpc.module.vpc.aws_subnet.private","type":"aws_subnet","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT network","no_target":false,"not_carried":3,"tier":"network","parent":"module.vpc.module.vpc.aws_vpc.this","critical_open":5,"conditional":true},{"unit":"module.vpc.module.vpc.aws_subnet.public","type":"aws_subnet","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT network","no_target":false,"not_carried":3,"tier":"network","parent":"module.vpc.module.vpc.aws_vpc.this","critical_open":6,"conditional":true}],"edges":[{"from":"module.vpc.module.vpc.aws_eip.nat","to":"module.vpc.module.vpc.aws_internet_gateway.this"},{"from":"module.vpc.module.vpc.aws_internet_gateway.this","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.vpc.module.vpc.aws_nat_gateway.this","to":"module.vpc.module.vpc.aws_eip.nat"},{"from":"module.vpc.module.vpc.aws_nat_gateway.this","to":"module.vpc.module.vpc.aws_internet_gateway.this"},{"from":"module.vpc.module.vpc.aws_nat_gateway.this","to":"module.vpc.module.vpc.aws_subnet.public"},{"from":"module.vpc.module.vpc.aws_route_table.private","to":"module.vpc.module.vpc.aws_nat_gateway.this"},{"from":"module.vpc.module.vpc.aws_route_table.private","to":"module.vpc.module.vpc.aws_subnet.private"},{"from":"module.vpc.module.vpc.aws_route_table.private","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.vpc.module.vpc.aws_route_table.public","to":"module.vpc.module.vpc.aws_internet_gateway.this"},{"from":"module.vpc.module.vpc.aws_route_table.public","to":"module.vpc.module.vpc.aws_subnet.public"},{"from":"module.vpc.module.vpc.aws_route_table.public","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.vpc.module.vpc.aws_subnet.private","to":"module.vpc.module.vpc.aws_vpc.this"},{"from":"module.vpc.module.vpc.aws_subnet.public","to":"module.vpc.module.vpc.aws_vpc.this"}]}],"target_architecture":{"drawing":{"scope":{"kind":"generated_target"},"node_count":9,"edge_count":8,"nodes":[{"unit":"stackit_application_load_balancer.retail_app_ecs_alb_this","type":"stackit_application_load_balancer","class":"","confidence":"","service":"from lb this","no_target":false,"not_carried":null,"tier":"network","parent":"stackit_network.vpc_vpc_public","critical_open":0,"conditional":false},{"unit":"stackit_mariadb_instance.dependencies_catalog_rds_this","type":"stackit_mariadb_instance","class":"","confidence":"","service":"from rds cluster this","no_target":false,"not_carried":null,"tier":"data","critical_open":0,"conditional":false},{"unit":"stackit_mongodbflex_instance.dynamodb_tables","type":"stackit_mongodbflex_instance","class":"","confidence":"","service":"from dynamodb table this","no_target":false,"not_carried":null,"tier":"data","critical_open":0,"conditional":false},{"unit":"stackit_network.vpc_vpc_private","type":"stackit_network","class":"","confidence":"","service":"from subnet private","no_target":false,"not_carried":null,"tier":"network","critical_open":0,"conditional":false},{"unit":"stackit_network.vpc_vpc_public","type":"stackit_network","class":"","confidence":"","service":"from subnet public","no_target":false,"not_carried":null,"tier":"network","critical_open":0,"conditional":false},{"unit":"stackit_opensearch_instance.dependencies_catalog_opensearch_this","type":"stackit_opensearch_instance","class":"","confidence":"","service":"from opensearch domain this","no_target":false,"not_carried":null,"tier":"data","critical_open":0,"conditional":false},{"unit":"stackit_postgresflex_instance.dependencies_orders_rds_this","type":"stackit_postgresflex_instance","class":"","confidence":"","service":"from rds cluster this","no_target":false,"not_carried":null,"tier":"data","critical_open":0,"conditional":false},{"unit":"stackit_ske_cluster.retail_app_ecs_cluster","type":"stackit_ske_cluster","class":"","confidence":"","service":"from 6 source units","no_target":false,"not_carried":null,"tier":"compute","critical_open":0,"conditional":false},{"unit":"stackit_valkey_instance.dependencies_checkout_elasticache_redis_default","type":"stackit_valkey_instance","class":"","confidence":"","service":"from elasticache replication group default","no_target":false,"not_carried":null,"tier":"data","critical_open":0,"conditional":false}],"edges":[{"from":"stackit_application_load_balancer.retail_app_ecs_alb_this","to":"stackit_network.vpc_vpc_public"},{"from":"stackit_mariadb_instance.dependencies_catalog_rds_this","to":"stackit_ske_cluster.retail_app_ecs_cluster"},{"from":"stackit_opensearch_instance.dependencies_catalog_opensearch_this","to":"stackit_network.vpc_vpc_private","unknown":true},{"from":"stackit_opensearch_instance.dependencies_catalog_opensearch_this","to":"stackit_ske_cluster.retail_app_ecs_cluster"},{"from":"stackit_postgresflex_instance.dependencies_orders_rds_this","to":"stackit_ske_cluster.retail_app_ecs_cluster"},{"from":"stackit_ske_cluster.retail_app_ecs_cluster","to":"stackit_mongodbflex_instance.dynamodb_tables","unknown":true},{"from":"stackit_ske_cluster.retail_app_ecs_cluster","to":"stackit_network.vpc_vpc_private","unknown":true},{"from":"stackit_ske_cluster.retail_app_ecs_cluster","to":"stackit_valkey_instance.dependencies_checkout_elasticache_redis_default","unknown":true}]},"source_units":14,"by_kind":[{"name":"network","count":2},{"name":"load-balancer","count":1},{"name":"server","count":1},{"name":"data-store","count":5}],"not_drawn":[{"name":"stackit_authorization_project_role_assignment","count":10},{"name":"stackit_kms_key","count":1},{"name":"stackit_kms_keyring","count":1},{"name":"stackit_logs_instance","count":1},{"name":"stackit_mariadb_credential","count":1},{"name":"stackit_opensearch_credential","count":1},{"name":"stackit_postgresflex_database","count":1},{"name":"stackit_postgresflex_user","count":1},{"name":"stackit_rabbitmq_credential","count":1},{"name":"stackit_rabbitmq_instance","count":1},{"name":"stackit_secretsmanager_instance","count":1},{"name":"stackit_secretsmanager_user","count":1},{"name":"stackit_security_group","count":7},{"name":"stackit_security_group_rule","count":5},{"name":"stackit_service_account","count":10},{"name":"stackit_valkey_credential","count":1}],"unknown_edges":[{"from":"stackit_opensearch_instance.dependencies_catalog_opensearch_this","to":"stackit_network.vpc_vpc_private","why":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this refers to module.vpc.module.vpc.aws_subnet.private (vpc_options) in the source; the draft writes no reference between stackit_opensearch_instance.dependencies_catalog_opensearch_this and stackit_network.vpc_vpc_private; what decides it: stackit_opensearch_instance has no network attribute (provider schema 0.120.0); parameters.sgw_acl is its access control, so it cannot be placed in stackit_network.vpc_vpc_private and who reaches it is decided by var.dependencies_catalog_opensearch_this_allowed_cidrs, which stands for the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster by default (decision DEC-GEN-CONVERT-EXPOSURE-WIDENED/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this)"},{"from":"stackit_ske_cluster.retail_app_ecs_cluster","to":"stackit_mongodbflex_instance.dynamodb_tables","why":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this refers to module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (container_definitions) in the source; the draft writes no reference between stackit_ske_cluster.retail_app_ecs_cluster and stackit_mongodbflex_instance.dynamodb_tables; what decides it: stackit_mongodbflex_instance has no network attribute (provider schema 0.120.0); acl is its access control, so who reaches it is decided by var.dynamodb_tables_allowed_cidrs, which the draft leaves without a default, which is to name the addresses the workload connects from: the pods of a drafted cluster connect from its egress_address_ranges (a computed attribute: \"The outgoing network ranges (in CIDR notation) of traffic originating from workload on the cluster.\", provider schema 0.120.0)"},{"from":"stackit_ske_cluster.retail_app_ecs_cluster","to":"stackit_network.vpc_vpc_private","why":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this refers to module.vpc.module.vpc.aws_subnet.private (network_configuration.subnets) in the source; the draft writes no reference between stackit_ske_cluster.retail_app_ecs_cluster and stackit_network.vpc_vpc_private; what decides it: stackit_ske_cluster takes network.id (\"ID of the STACKIT Network Area (SNA) network into which the cluster will be deployed\", provider schema 0.120.0) and no other placement; the draft sets none: in a project outside a Network Area SKE creates the cluster's own network, in a project in a Network Area an SNA network must be selected (docs.stackit.cloud, Kubernetes Engine, Networking), so the target project decides (decision DEC-GEN-CONVERT-WORKLOAD-PLACEMENT)"},{"from":"stackit_ske_cluster.retail_app_ecs_cluster","to":"stackit_valkey_instance.dependencies_checkout_elasticache_redis_default","why":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this refers to module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (container_definitions) in the source; the draft writes no reference between stackit_ske_cluster.retail_app_ecs_cluster and stackit_valkey_instance.dependencies_checkout_elasticache_redis_default; what decides it: stackit_valkey_instance has no network attribute (provider schema 0.120.0); parameters.sgw_acl is its access control, so who reaches it is decided by var.dependencies_checkout_elasticache_redis_default_allowed_cidrs, which the draft leaves without a default, which is to name the addresses the workload connects from: the pods of a drafted cluster connect from its egress_address_ranges (a computed attribute: \"The outgoing network ranges (in CIDR notation) of traffic originating from workload on the cluster.\", provider schema 0.120.0) (decision DEC-GEN-CONVERT-EXPOSURE-WIDENED/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default)"}],"changes":[{"kind":"ARCHITECTURE_CHANGE","clause":"generated networks that hold no interface — stackit_network.vpc_vpc_private for module.vpc.module.vpc.aws_subnet.private: drafted, consumers not placed: decision DEC-GEN-CONVERT-WORKLOAD-PLACEMENT — nothing in the draft is placed in it, although the source places module.dependencies.aws_mq_broker.mq, module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this, module.dependencies.module.catalog_rds.aws_rds_cluster.this and 7 more in module.vpc.module.vpc.aws_subnet.private; the drafted Kubernetes cluster stackit_ske_cluster.retail_app_ecs_cluster of these consumers sets no network.id. Decide whether the address range of each is still needed (security-group rules, routes or workloads of the source may name it); to drop one, regenerate the draft rather than edit it"},{"kind":"ARCHITECTURE_CHANGE","clause":"private DNS parity not established: the source resolves internal EC2 host names (module.vpc.module.vpc.aws_vpc.this enable_dns_hostnames = true) through the VPC resolver; the drafted stackit_network.vpc_vpc_private and stackit_network.vpc_vpc_public use var.default_ipv4_nameservers (public names only), and STACKIT documents no private DNS zone or internal name resolution (STACKIT DNS serves public zones only; the DNS Resolver product is in beta): names only the VPC resolver answers need a DNS server of your own"}],"setting_origins":[{"target_resource":"stackit_application_load_balancer.retail_app_ecs_alb_this","target_attribute":"listeners[listener-1].http.hosts[*].rules[*].target_pool (default route)","source_unit":"module.retail_app_ecs.module.alb.aws_lb_listener.frontend_http_tcp","source_attribute":"default_action","state":"ORIGIN_PROVEN"},{"target_resource":"stackit_application_load_balancer.retail_app_ecs_alb_this","target_attribute":"listeners[listener-1].port","source_unit":"module.retail_app_ecs.module.alb.aws_lb_listener.frontend_http_tcp","source_attribute":"port","state":"ORIGIN_PROVEN"},{"target_resource":"stackit_application_load_balancer.retail_app_ecs_alb_this","target_attribute":"listeners[listener-1].protocol","source_unit":"module.retail_app_ecs.module.alb.aws_lb_listener.frontend_http_tcp","source_attribute":"protocol","state":"ORIGIN_PROVEN"},{"target_resource":"stackit_application_load_balancer.retail_app_ecs_alb_this","target_attribute":"name","source_unit":"module.retail_app_ecs.module.alb.aws_lb.this","source_attribute":"name","state":"ORIGIN_PROVEN"},{"target_resource":"stackit_application_load_balancer.retail_app_ecs_alb_this","target_attribute":"networks[0].network_id","source_unit":"module.retail_app_ecs.module.alb.aws_lb.this","source_attribute":"subnets","state":"SOURCE_UNPROVEN","why":"the load balancer spans several subnets of the source, or a repeated one, and the network the draft places it in is a variable or a choice of the placement, not a setting of the source"},{"target_resource":"stackit_application_load_balancer.retail_app_ecs_alb_this","target_attribute":"options.ephemeral_address","source_unit":"module.retail_app_ecs.module.alb.aws_lb.this","source_attribute":"internal","state":"ORIGIN_PROVEN"},{"target_resource":"stackit_application_load_balancer.retail_app_ecs_alb_this","target_attribute":"plan_id","state":"SOURCE_UNPROVEN","why":"a STACKIT Application Load Balancer plan has no setting in the source: it is chosen from the catalogue of the target"},{"target_resource":"stackit_application_load_balancer.retail_app_ecs_alb_this","target_attribute":"target_pools[retail-app-ecs-alb-main].active_health_check.healthy_threshold","source_unit":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","source_attribute":"health_check.healthy_threshold","state":"ORIGIN_PROVEN"},{"target_resource":"stackit_application_load_balancer.retail_app_ecs_alb_this","target_attribute":"target_pools[retail-app-ecs-alb-main].active_health_check.http_health_checks.ok_status","source_unit":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","source_attribute":"health_check.matcher","state":"SOURCE_UNPROVEN","why":"the source matcher is absent or is no list of HTTP status codes: a variable"},{"target_resource":"stackit_application_load_balancer.retail_app_ecs_alb_this","target_attribute":"target_pools[retail-app-ecs-alb-main].active_health_check.http_health_checks.path","source_unit":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","source_attribute":"health_check.path","state":"ORIGIN_PROVEN"},{"target_resource":"stackit_application_load_balancer.retail_app_ecs_alb_this","target_attribute":"target_pools[retail-app-ecs-alb-main].active_health_check.interval","source_unit":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","source_attribute":"health_check.interval","state":"ORIGIN_PROVEN"},{"target_resource":"stackit_application_load_balancer.retail_app_ecs_alb_this","target_attribute":"target_pools[retail-app-ecs-alb-main].active_health_check.interval_jitter","state":"SOURCE_UNPROVEN","why":"the source load balancer has no such setting: a variable without a default"},{"target_resource":"stackit_application_load_balancer.retail_app_ecs_alb_this","target_attribute":"target_pools[retail-app-ecs-alb-main].active_health_check.timeout","source_unit":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","source_attribute":"health_check.timeout","state":"ORIGIN_PROVEN"},{"target_resource":"stackit_application_load_balancer.retail_app_ecs_alb_this","target_attribute":"target_pools[retail-app-ecs-alb-main].active_health_check.unhealthy_threshold","source_unit":"module.retail_app_ecs.module.alb.aws_lb_target_group.main","source_attribute":"health_check.unhealthy_threshold","state":"ORIGIN_PROVEN"},{"target_resource":"stackit_application_load_balancer.retail_app_ecs_alb_this","target_attribute":"target_pools[retail-app-ecs-alb-main].target_port","source_unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","source_attribute":"load_balancer","state":"SOURCE_UNPROVEN","why":"the node port 30000 of the NodePort Service ui-nodeport the draft writes for the workload of module.retail_app_ecs.module.ui_service.aws_ecs_service.this (the source forwarded to container port 8080): the exposure path is a decision (aws.ingress.exposure-path)"},{"target_resource":"stackit_application_load_balancer.retail_app_ecs_alb_this","target_attribute":"target_pools[retail-app-ecs-alb-main].targets","source_unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","source_attribute":"load_balancer","state":"SOURCE_UNPROVEN","why":"the targets are the nodes of the SKE cluster that runs the workload ui of module.retail_app_ecs.module.ui_service.aws_ecs_service.this, reached on the node port 30000 of the NodePort Service ui-nodeport; STACKIT exports no node address to Terraform: the target IPs are a variable"}],"mappings":[{"kind":"MANY_TO_ONE","units":["module.retail_app_ecs.aws_ecs_cluster.cluster","module.retail_app_ecs.module.carts_service.aws_ecs_service.this","module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","module.retail_app_ecs.module.orders_service.aws_ecs_service.this","module.retail_app_ecs.module.ui_service.aws_ecs_service.this"],"resources":["stackit_ske_cluster.retail_app_ecs_cluster"]}],"mermaid_views":[{"path":"architecture/network-security.mmd","text":"%% PROPOSAL — generated by StackToIT Assess. Architect review required before any decision.\n%% What this view is: the network and security picture of the migration, drawn from the plans of the draft (security group rules, attachments, routing) and from the assessment (the references the source configuration makes). One box per source unit: its address, its source type, the STACKIT service the assessment proposes and, when a plan drafts resources from it, their addresses.\n%% Arrows: a thin arrow is a reference the source configuration makes (its label is the attribute that holds it); a thick arrow is a path a rule, a route or a listener permits (direction, protocol, ports); a dashed arrow is UNKNOWN (its label says why the sources do not settle it). Nothing here is observed traffic or a verified connection, and a connection no source states is not drawn.\n%% Only AWS units of a network role are drawn. architecture/dependencies.mmd holds every unit.\n%% A label that ends in \"full reason at the end of this file\" is cut at the end of a clause: the lines \"Full reason of arrow N\" at the end of this file, and the key of the drawn view, carry the whole reason.\nflowchart LR\n  n_internet[\"internet\"]:::internet\n  n_module_dependencies_aws_security_group_catalog_opensearch_sg[\"module.dependencies.aws_security_group.catalog_opensearch_sg\u003cbr/\u003e\u003csmall\u003eaws_security_group → not written by this draft (stackit_security_group, stackit_security_group_rule)\u003c/small\u003e\"]:::unit\n  n_module_dependencies_aws_security_group_mq[\"module.dependencies.aws_security_group.mq\u003cbr/\u003e\u003csmall\u003eaws_security_group → not written by this draft (stackit_security_group, stackit_security_group_rule)\u003c/small\u003e\"]:::unit\n  n_module_dependencies_module_catalog_rds_aws_rds_cluster_this[\"module.dependencies.module.catalog_rds.aws_rds_cluster.this\u003cbr/\u003e\u003csmall\u003eaws_rds_cluster → STACKIT MariaDB\u003c/small\u003e\"]:::unit\n  n_module_dependencies_module_catalog_rds_aws_security_group_this[\"module.dependencies.module.catalog_rds.aws_security_group.this\u003cbr/\u003e\u003csmall\u003eaws_security_group → not written by this draft (stackit_security_group, stackit_security_group_rule)\u003c/small\u003e\"]:::unit\n  n_module_dependencies_module_checkout_elasticache_redis_aws_elasticache_replication_group_default[\"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default\u003cbr/\u003e\u003csmall\u003eaws_elasticache_replication_group → STACKIT Key Value Store (Valkey)\u003c/small\u003e\"]:::unit\n  n_module_dependencies_module_checkout_elasticache_redis_module_aws_security_group_aws_security_group_cbd[\"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd\u003cbr/\u003e\u003csmall\u003eaws_security_group → not written by this draft (stackit_security_group, stackit_security_group_rule)\u003c/small\u003e\"]:::unit\n  n_module_dependencies_module_orders_rds_aws_rds_cluster_this[\"module.dependencies.module.orders_rds.aws_rds_cluster.this\u003cbr/\u003e\u003csmall\u003eaws_rds_cluster → STACKIT PostgreSQL Flex\u003c/small\u003e\"]:::unit\n  n_module_dependencies_module_orders_rds_aws_security_group_this[\"module.dependencies.module.orders_rds.aws_security_group.this\u003cbr/\u003e\u003csmall\u003eaws_security_group → not written by this draft (stackit_security_group, stackit_security_group_rule)\u003c/small\u003e\"]:::unit\n  n_module_retail_app_ecs_module_alb_aws_lb_this[\"module.retail_app_ecs.module.alb.aws_lb.this\u003cbr/\u003e\u003csmall\u003eaws_lb → STACKIT Application Load Balancer\u003c/small\u003e\"]:::unit\n  n_module_retail_app_ecs_module_alb_aws_security_group_this[\"module.retail_app_ecs.module.alb.aws_security_group.this\u003cbr/\u003e\u003csmall\u003eaws_security_group → STACKIT security group\u003c/small\u003e\u003cbr/\u003e\u003csmall\u003eplan: stackit_security_group.retail_app_ecs_alb_this\u003c/small\u003e\"]:::unit\n  n_module_retail_app_ecs_module_alb_sg_aws_security_group_this_name_prefix[\"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix\u003cbr/\u003e\u003csmall\u003eaws_security_group → STACKIT security group\u003c/small\u003e\u003cbr/\u003e\u003csmall\u003eplan: stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix\u003c/small\u003e\"]:::unit\n  n_module_retail_app_ecs_module_carts_service_aws_security_group_this[\"module.retail_app_ecs.module.carts_service.aws_security_group.this\u003cbr/\u003e\u003csmall\u003eaws_security_group → STACKIT security group\u003c/small\u003e\u003cbr/\u003e\u003csmall\u003eplan: stackit_security_group.retail_app_ecs_carts_service_this, stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1\u003c/small\u003e\"]:::unit\n  n_module_retail_app_ecs_module_catalog_service_aws_security_group_this[\"module.retail_app_ecs.module.catalog_service.aws_security_group.this\u003cbr/\u003e\u003csmall\u003eaws_security_group → STACKIT security group\u003c/small\u003e\u003cbr/\u003e\u003csmall\u003eplan: stackit_security_group.retail_app_ecs_catalog_service_this, stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1\u003c/small\u003e\"]:::unit\n  n_module_retail_app_ecs_module_checkout_service_aws_security_group_this[\"module.retail_app_ecs.module.checkout_service.aws_security_group.this\u003cbr/\u003e\u003csmall\u003eaws_security_group → STACKIT security group\u003c/small\u003e\u003cbr/\u003e\u003csmall\u003eplan: stackit_security_group.retail_app_ecs_checkout_service_this, stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1\u003c/small\u003e\"]:::unit\n  n_module_retail_app_ecs_module_orders_service_aws_security_group_this[\"module.retail_app_ecs.module.orders_service.aws_security_group.this\u003cbr/\u003e\u003csmall\u003eaws_security_group → STACKIT security group\u003c/small\u003e\u003cbr/\u003e\u003csmall\u003eplan: stackit_security_group.retail_app_ecs_orders_service_this, stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1\u003c/small\u003e\"]:::unit\n  n_module_retail_app_ecs_module_ui_service_aws_security_group_this[\"module.retail_app_ecs.module.ui_service.aws_security_group.this\u003cbr/\u003e\u003csmall\u003eaws_security_group → STACKIT security group\u003c/small\u003e\u003cbr/\u003e\u003csmall\u003eplan: stackit_security_group.retail_app_ecs_ui_service_this, stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1\u003c/small\u003e\"]:::unit\n  n_module_vpc_module_vpc_aws_eip_nat[\"module.vpc.module.vpc.aws_eip.nat\u003cbr/\u003e\u003csmall\u003eaws_eip → implicit (belongs to the NAT gateway)\u003c/small\u003e\"]:::unit\n  n_module_vpc_module_vpc_aws_internet_gateway_this[\"module.vpc.module.vpc.aws_internet_gateway.this\u003cbr/\u003e\u003csmall\u003eaws_internet_gateway (conditional) → implicit (STACKIT network default gateway)\u003c/small\u003e\"]:::unit\n  n_module_vpc_module_vpc_aws_nat_gateway_this[\"module.vpc.module.vpc.aws_nat_gateway.this\u003cbr/\u003e\u003csmall\u003eaws_nat_gateway → implicit outbound (STACKIT network)\u003c/small\u003e\"]:::unit\n  n_module_vpc_module_vpc_aws_route_table_private[\"module.vpc.module.vpc.aws_route_table.private\u003cbr/\u003e\u003csmall\u003eaws_route_table (conditional) → implicit (STACKIT network default routing)\u003c/small\u003e\"]:::unit\n  n_module_vpc_module_vpc_aws_route_table_public[\"module.vpc.module.vpc.aws_route_table.public\u003cbr/\u003e\u003csmall\u003eaws_route_table (conditional) → implicit (STACKIT network default routing)\u003c/small\u003e\"]:::unit\n  n_module_vpc_module_vpc_aws_subnet_private[\"module.vpc.module.vpc.aws_subnet.private\u003cbr/\u003e\u003csmall\u003eaws_subnet (conditional) → STACKIT network\u003c/small\u003e\"]:::unit\n  n_module_vpc_module_vpc_aws_subnet_public[\"module.vpc.module.vpc.aws_subnet.public\u003cbr/\u003e\u003csmall\u003eaws_subnet (conditional) → STACKIT network\u003c/small\u003e\"]:::unit\n  n_module_vpc_module_vpc_aws_vpc_this[\"module.vpc.module.vpc.aws_vpc.this\u003cbr/\u003e\u003csmall\u003eaws_vpc → STACKIT project networking (outside a Network Area)\u003c/small\u003e\"]:::unit\n  n_internet ==\u003e|\"internet-facing: internal = false\"| n_module_retail_app_ecs_module_alb_aws_lb_this\n  n_internet ==\u003e|\"ingress tcp 8080\"| n_module_retail_app_ecs_module_carts_service_aws_security_group_this\n  n_internet ==\u003e|\"ingress tcp 8080\"| n_module_retail_app_ecs_module_catalog_service_aws_security_group_this\n  n_internet ==\u003e|\"ingress tcp 8080\"| n_module_retail_app_ecs_module_checkout_service_aws_security_group_this\n  n_internet ==\u003e|\"ingress tcp 8080\"| n_module_retail_app_ecs_module_orders_service_aws_security_group_this\n  n_internet ==\u003e|\"ingress tcp 8080\"| n_module_retail_app_ecs_module_ui_service_aws_security_group_this\n  n_module_dependencies_aws_security_group_catalog_opensearch_sg --\u003e|\"source_security_group_id\"| n_module_retail_app_ecs_module_catalog_service_aws_security_group_this\n  n_module_dependencies_aws_security_group_catalog_opensearch_sg --\u003e|\"vpc_id\"| n_module_vpc_module_vpc_aws_vpc_this\n  n_module_dependencies_aws_security_group_mq --\u003e|\"count\"| n_module_retail_app_ecs_module_orders_service_aws_security_group_this\n  n_module_dependencies_aws_security_group_mq --\u003e|\"source_security_group_id\"| n_module_retail_app_ecs_module_orders_service_aws_security_group_this\n  n_module_dependencies_aws_security_group_mq --\u003e|\"vpc_id\"| n_module_vpc_module_vpc_aws_vpc_this\n  n_module_dependencies_module_catalog_rds_aws_rds_cluster_this --\u003e|\"vpc_security_group_ids\"| n_module_dependencies_module_catalog_rds_aws_security_group_this\n  n_module_dependencies_module_catalog_rds_aws_rds_cluster_this --\u003e|\"db_subnet_group_name → subnet_ids\"| n_module_vpc_module_vpc_aws_subnet_private\n  n_module_dependencies_module_catalog_rds_aws_security_group_this --\u003e|\"count\"| n_module_retail_app_ecs_module_catalog_service_aws_security_group_this\n  n_module_dependencies_module_catalog_rds_aws_security_group_this --\u003e|\"source_security_group_id\"| n_module_retail_app_ecs_module_catalog_service_aws_security_group_this\n  n_module_dependencies_module_catalog_rds_aws_security_group_this --\u003e|\"vpc_id\"| n_module_vpc_module_vpc_aws_vpc_this\n  n_module_dependencies_module_checkout_elasticache_redis_aws_elasticache_replication_group_default --\u003e|\"security_group_ids\"| n_module_dependencies_module_checkout_elasticache_redis_module_aws_security_group_aws_security_group_cbd\n  n_module_dependencies_module_checkout_elasticache_redis_aws_elasticache_replication_group_default --\u003e|\"db_subnet_group_name → subnet_ids\"| n_module_vpc_module_vpc_aws_subnet_private\n  n_module_dependencies_module_checkout_elasticache_redis_module_aws_security_group_aws_security_group_cbd --\u003e|\"for_each\"| n_module_retail_app_ecs_module_checkout_service_aws_security_group_this\n  n_module_dependencies_module_checkout_elasticache_redis_module_aws_security_group_aws_security_group_cbd --\u003e|\"vpc_id\"| n_module_vpc_module_vpc_aws_vpc_this\n  n_module_dependencies_module_orders_rds_aws_rds_cluster_this --\u003e|\"vpc_security_group_ids\"| n_module_dependencies_module_orders_rds_aws_security_group_this\n  n_module_dependencies_module_orders_rds_aws_rds_cluster_this --\u003e|\"db_subnet_group_name → subnet_ids\"| n_module_vpc_module_vpc_aws_subnet_private\n  n_module_dependencies_module_orders_rds_aws_security_group_this --\u003e|\"count\"| n_module_retail_app_ecs_module_orders_service_aws_security_group_this\n  n_module_dependencies_module_orders_rds_aws_security_group_this --\u003e|\"source_security_group_id\"| n_module_retail_app_ecs_module_orders_service_aws_security_group_this\n  n_module_dependencies_module_orders_rds_aws_security_group_this --\u003e|\"vpc_id\"| n_module_vpc_module_vpc_aws_vpc_this\n  n_module_retail_app_ecs_module_alb_aws_lb_this --\u003e|\"security_groups\"| n_module_retail_app_ecs_module_alb_aws_security_group_this\n  n_module_retail_app_ecs_module_alb_aws_lb_this --\u003e|\"security_groups\"| n_module_retail_app_ecs_module_alb_sg_aws_security_group_this_name_prefix\n  n_module_retail_app_ecs_module_alb_aws_lb_this --\u003e|\"subnets\"| n_module_vpc_module_vpc_aws_subnet_public\n  n_module_retail_app_ecs_module_alb_aws_security_group_this --\u003e|\"vpc_id\"| n_module_vpc_module_vpc_aws_vpc_this\n  n_module_retail_app_ecs_module_alb_sg_aws_security_group_this_name_prefix --\u003e|\"vpc_id\"| n_module_vpc_module_vpc_aws_vpc_this\n  n_module_retail_app_ecs_module_carts_service_aws_security_group_this --\u003e|\"vpc_id\"| n_module_vpc_module_vpc_aws_vpc_this\n  n_module_retail_app_ecs_module_catalog_service_aws_security_group_this --\u003e|\"vpc_id\"| n_module_vpc_module_vpc_aws_vpc_this\n  n_module_retail_app_ecs_module_checkout_service_aws_security_group_this --\u003e|\"vpc_id\"| n_module_vpc_module_vpc_aws_vpc_this\n  n_module_retail_app_ecs_module_orders_service_aws_security_group_this --\u003e|\"vpc_id\"| n_module_vpc_module_vpc_aws_vpc_this\n  n_module_retail_app_ecs_module_ui_service_aws_security_group_this --\u003e|\"vpc_id\"| n_module_vpc_module_vpc_aws_vpc_this\n  n_module_vpc_module_vpc_aws_internet_gateway_this --\u003e|\"internet gateway\"| n_internet\n  n_module_vpc_module_vpc_aws_internet_gateway_this --\u003e|\"vpc_id\"| n_module_vpc_module_vpc_aws_vpc_this\n  n_module_vpc_module_vpc_aws_nat_gateway_this --\u003e|\"outbound through the NAT gateway\"| n_internet\n  n_module_vpc_module_vpc_aws_nat_gateway_this --\u003e|\"allocation_id\"| n_module_vpc_module_vpc_aws_eip_nat\n  n_module_vpc_module_vpc_aws_nat_gateway_this --\u003e|\"subnet_id\"| n_module_vpc_module_vpc_aws_subnet_public\n  n_module_vpc_module_vpc_aws_route_table_private -.-\u003e|\"unknown: the source routes here (nat_gateway_id), the draft does not carry it — STACKIT's default routing replaces the table, with a loss: a route of the table sends traffic to a NAT gateway (the others, if any, to an internet gateway), and the reachability is observed on the target for a project outside a Network Area … (full reason at the end of this file and in the key of the drawn view)\"| n_module_vpc_module_vpc_aws_nat_gateway_this\n  n_module_vpc_module_vpc_aws_route_table_private --\u003e|\"route_table_association.subnet_id\"| n_module_vpc_module_vpc_aws_subnet_private\n  n_module_vpc_module_vpc_aws_route_table_private --\u003e|\"egress_only_gateway_id\"| n_module_vpc_module_vpc_aws_vpc_this\n  n_module_vpc_module_vpc_aws_route_table_private --\u003e|\"vpc_id\"| n_module_vpc_module_vpc_aws_vpc_this\n  n_module_vpc_module_vpc_aws_route_table_public -.-\u003e|\"unknown: the source routes here (gateway_id), the draft does not carry it — STACKIT's default routing replaces the table: every route of the table sends traffic to an internet gateway, and the equivalence is observed on the target for a project outside a Network Area, which this draft does not write\"| n_module_vpc_module_vpc_aws_internet_gateway_this\n  n_module_vpc_module_vpc_aws_route_table_public --\u003e|\"route_table_association.subnet_id\"| n_module_vpc_module_vpc_aws_subnet_public\n  n_module_vpc_module_vpc_aws_route_table_public --\u003e|\"vpc_id\"| n_module_vpc_module_vpc_aws_vpc_this\n  n_module_vpc_module_vpc_aws_subnet_private --\u003e|\"vpc_id\"| n_module_vpc_module_vpc_aws_vpc_this\n  n_module_vpc_module_vpc_aws_subnet_public --\u003e|\"vpc_id\"| n_module_vpc_module_vpc_aws_vpc_this\n  classDef unit fill:#e1e5f5,stroke:#4b5ba6\n  classDef synthetic fill:#f3f3f3,stroke:#566663\n  classDef unknown fill:#f3f3f3,stroke:#566663,stroke-dasharray:4 3\n  classDef manual fill:#f6e7cf,stroke:#a8650c\n  classDef internet fill:#f8deda,stroke:#b1261b\n%% Full reason of arrow 41 (module.vpc.module.vpc.aws_route_table.private → module.vpc.module.vpc.aws_nat_gateway.this): unknown: the source routes here (nat_gateway_id), the draft does not carry it — STACKIT's default routing replaces the table, with a loss: a route of the table sends traffic to a NAT gateway (the others, if any, to an internet gateway), and the reachability is observed on the target for a project outside a Network Area, which this draft does not write\n","drawing":{"scope":"network_security","nodes":[{"key":"internet","title":"internet","kind":"internet","tier":"network"},{"key":"module.dependencies.aws_security_group.catalog_opensearch_sg","title":"module.dependencies.aws_security_group.catalog_opensearch_sg","lines":["aws_security_group → not written by this draft (stackit_security_group, stackit_security_group_rule)"],"kind":"unit","tier":"network"},{"key":"module.dependencies.aws_security_group.mq","title":"module.dependencies.aws_security_group.mq","lines":["aws_security_group → not written by this draft (stackit_security_group, stackit_security_group_rule)"],"kind":"unit","tier":"network"},{"key":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","title":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","lines":["aws_rds_cluster → STACKIT MariaDB"],"kind":"unit","tier":"data"},{"key":"module.dependencies.module.catalog_rds.aws_security_group.this","title":"module.dependencies.module.catalog_rds.aws_security_group.this","lines":["aws_security_group → not written by this draft (stackit_security_group, stackit_security_group_rule)"],"kind":"unit","tier":"network"},{"key":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","title":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","lines":["aws_elasticache_replication_group → STACKIT Key Value Store (Valkey)"],"kind":"unit","tier":"data"},{"key":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","title":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","lines":["aws_security_group → not written by this draft (stackit_security_group, stackit_security_group_rule)"],"kind":"unit","tier":"network"},{"key":"module.dependencies.module.orders_rds.aws_rds_cluster.this","title":"module.dependencies.module.orders_rds.aws_rds_cluster.this","lines":["aws_rds_cluster → STACKIT PostgreSQL Flex"],"kind":"unit","tier":"data"},{"key":"module.dependencies.module.orders_rds.aws_security_group.this","title":"module.dependencies.module.orders_rds.aws_security_group.this","lines":["aws_security_group → not written by this draft (stackit_security_group, stackit_security_group_rule)"],"kind":"unit","tier":"network"},{"key":"module.retail_app_ecs.module.alb.aws_lb.this","title":"module.retail_app_ecs.module.alb.aws_lb.this","lines":["aws_lb → STACKIT Application Load Balancer"],"kind":"unit","tier":"network"},{"key":"module.retail_app_ecs.module.alb.aws_security_group.this","title":"module.retail_app_ecs.module.alb.aws_security_group.this","lines":["aws_security_group → STACKIT security group","plan: stackit_security_group.retail_app_ecs_alb_this"],"kind":"unit","tier":"network"},{"key":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","title":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","lines":["aws_security_group → STACKIT security group","plan: stackit_security_group.retail_app_ecs_alb_sg_this_name_prefix"],"kind":"unit","tier":"network"},{"key":"module.retail_app_ecs.module.carts_service.aws_security_group.this","title":"module.retail_app_ecs.module.carts_service.aws_security_group.this","lines":["aws_security_group → STACKIT security group","plan: stackit_security_group.retail_app_ecs_carts_service_this, stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1"],"kind":"unit","tier":"network"},{"key":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","title":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","lines":["aws_security_group → STACKIT security group","plan: stackit_security_group.retail_app_ecs_catalog_service_this, stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1"],"kind":"unit","tier":"network"},{"key":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","title":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","lines":["aws_security_group → STACKIT security group","plan: stackit_security_group.retail_app_ecs_checkout_service_this, stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1"],"kind":"unit","tier":"network"},{"key":"module.retail_app_ecs.module.orders_service.aws_security_group.this","title":"module.retail_app_ecs.module.orders_service.aws_security_group.this","lines":["aws_security_group → STACKIT security group","plan: stackit_security_group.retail_app_ecs_orders_service_this, stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1"],"kind":"unit","tier":"network"},{"key":"module.retail_app_ecs.module.ui_service.aws_security_group.this","title":"module.retail_app_ecs.module.ui_service.aws_security_group.this","lines":["aws_security_group → STACKIT security group","plan: stackit_security_group.retail_app_ecs_ui_service_this, stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1"],"kind":"unit","tier":"network"},{"key":"module.vpc.module.vpc.aws_eip.nat","title":"module.vpc.module.vpc.aws_eip.nat","lines":["aws_eip → implicit (belongs to the NAT gateway)"],"kind":"unit","tier":"network"},{"key":"module.vpc.module.vpc.aws_internet_gateway.this","title":"module.vpc.module.vpc.aws_internet_gateway.this","lines":["aws_internet_gateway (conditional) → implicit (STACKIT network default gateway)"],"kind":"unit","tier":"network"},{"key":"module.vpc.module.vpc.aws_nat_gateway.this","title":"module.vpc.module.vpc.aws_nat_gateway.this","lines":["aws_nat_gateway → implicit outbound (STACKIT network)"],"kind":"unit","tier":"network"},{"key":"module.vpc.module.vpc.aws_route_table.private","title":"module.vpc.module.vpc.aws_route_table.private","lines":["aws_route_table (conditional) → implicit (STACKIT network default routing)"],"kind":"unit","tier":"network"},{"key":"module.vpc.module.vpc.aws_route_table.public","title":"module.vpc.module.vpc.aws_route_table.public","lines":["aws_route_table (conditional) → implicit (STACKIT network default routing)"],"kind":"unit","tier":"network"},{"key":"module.vpc.module.vpc.aws_subnet.private","title":"module.vpc.module.vpc.aws_subnet.private","lines":["aws_subnet (conditional) → STACKIT network"],"kind":"unit","tier":"network"},{"key":"module.vpc.module.vpc.aws_subnet.public","title":"module.vpc.module.vpc.aws_subnet.public","lines":["aws_subnet (conditional) → STACKIT network"],"kind":"unit","tier":"network"},{"key":"module.vpc.module.vpc.aws_vpc.this","title":"module.vpc.module.vpc.aws_vpc.this","lines":["aws_vpc → STACKIT project networking (outside a Network Area)"],"kind":"unit","tier":"network"}],"edges":[{"from":"internet","to":"module.retail_app_ecs.module.alb.aws_lb.this","kind":"target","label":"internet-facing: internal = false"},{"from":"internet","to":"module.retail_app_ecs.module.carts_service.aws_security_group.this","kind":"target","label":"ingress tcp 8080"},{"from":"internet","to":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","kind":"target","label":"ingress tcp 8080"},{"from":"internet","to":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","kind":"target","label":"ingress tcp 8080"},{"from":"internet","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this","kind":"target","label":"ingress tcp 8080"},{"from":"internet","to":"module.retail_app_ecs.module.ui_service.aws_security_group.this","kind":"target","label":"ingress tcp 8080"},{"from":"module.dependencies.aws_security_group.catalog_opensearch_sg","to":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","kind":"source","label":"source_security_group_id"},{"from":"module.dependencies.aws_security_group.catalog_opensearch_sg","to":"module.vpc.module.vpc.aws_vpc.this","kind":"source","label":"vpc_id"},{"from":"module.dependencies.aws_security_group.mq","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this","kind":"source","label":"count"},{"from":"module.dependencies.aws_security_group.mq","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this","kind":"source","label":"source_security_group_id"},{"from":"module.dependencies.aws_security_group.mq","to":"module.vpc.module.vpc.aws_vpc.this","kind":"source","label":"vpc_id"},{"from":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","to":"module.dependencies.module.catalog_rds.aws_security_group.this","kind":"source","label":"vpc_security_group_ids"},{"from":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","to":"module.vpc.module.vpc.aws_subnet.private","kind":"source","label":"db_subnet_group_name → subnet_ids"},{"from":"module.dependencies.module.catalog_rds.aws_security_group.this","to":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","kind":"source","label":"count"},{"from":"module.dependencies.module.catalog_rds.aws_security_group.this","to":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","kind":"source","label":"source_security_group_id"},{"from":"module.dependencies.module.catalog_rds.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this","kind":"source","label":"vpc_id"},{"from":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","to":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","kind":"source","label":"security_group_ids"},{"from":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","to":"module.vpc.module.vpc.aws_subnet.private","kind":"source","label":"db_subnet_group_name → subnet_ids"},{"from":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","to":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","kind":"source","label":"for_each"},{"from":"module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group.cbd","to":"module.vpc.module.vpc.aws_vpc.this","kind":"source","label":"vpc_id"},{"from":"module.dependencies.module.orders_rds.aws_rds_cluster.this","to":"module.dependencies.module.orders_rds.aws_security_group.this","kind":"source","label":"vpc_security_group_ids"},{"from":"module.dependencies.module.orders_rds.aws_rds_cluster.this","to":"module.vpc.module.vpc.aws_subnet.private","kind":"source","label":"db_subnet_group_name → subnet_ids"},{"from":"module.dependencies.module.orders_rds.aws_security_group.this","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this","kind":"source","label":"count"},{"from":"module.dependencies.module.orders_rds.aws_security_group.this","to":"module.retail_app_ecs.module.orders_service.aws_security_group.this","kind":"source","label":"source_security_group_id"},{"from":"module.dependencies.module.orders_rds.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this","kind":"source","label":"vpc_id"},{"from":"module.retail_app_ecs.module.alb.aws_lb.this","to":"module.retail_app_ecs.module.alb.aws_security_group.this","kind":"source","label":"security_groups"},{"from":"module.retail_app_ecs.module.alb.aws_lb.this","to":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","kind":"source","label":"security_groups"},{"from":"module.retail_app_ecs.module.alb.aws_lb.this","to":"module.vpc.module.vpc.aws_subnet.public","kind":"source","label":"subnets"},{"from":"module.retail_app_ecs.module.alb.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this","kind":"source","label":"vpc_id"},{"from":"module.retail_app_ecs.module.alb_sg.aws_security_group.this_name_prefix","to":"module.vpc.module.vpc.aws_vpc.this","kind":"source","label":"vpc_id"},{"from":"module.retail_app_ecs.module.carts_service.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this","kind":"source","label":"vpc_id"},{"from":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this","kind":"source","label":"vpc_id"},{"from":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this","kind":"source","label":"vpc_id"},{"from":"module.retail_app_ecs.module.orders_service.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this","kind":"source","label":"vpc_id"},{"from":"module.retail_app_ecs.module.ui_service.aws_security_group.this","to":"module.vpc.module.vpc.aws_vpc.this","kind":"source","label":"vpc_id"},{"from":"module.vpc.module.vpc.aws_internet_gateway.this","to":"internet","kind":"source","label":"internet gateway"},{"from":"module.vpc.module.vpc.aws_internet_gateway.this","to":"module.vpc.module.vpc.aws_vpc.this","kind":"source","label":"vpc_id"},{"from":"module.vpc.module.vpc.aws_nat_gateway.this","to":"internet","kind":"source","label":"outbound through the NAT gateway"},{"from":"module.vpc.module.vpc.aws_nat_gateway.this","to":"module.vpc.module.vpc.aws_eip.nat","kind":"source","label":"allocation_id"},{"from":"module.vpc.module.vpc.aws_nat_gateway.this","to":"module.vpc.module.vpc.aws_subnet.public","kind":"source","label":"subnet_id"},{"from":"module.vpc.module.vpc.aws_route_table.private","to":"module.vpc.module.vpc.aws_nat_gateway.this","kind":"unknown","label":"unknown: the source routes here (nat_gateway_id), the draft does not carry it — STACKIT's default routing replaces the table, with a loss: a route of the table sends traffic to a NAT gateway (the others, if any, to an internet gateway), and the reachability is observed on the target for a project outside a Network Area, which this draft does not write"},{"from":"module.vpc.module.vpc.aws_route_table.private","to":"module.vpc.module.vpc.aws_subnet.private","kind":"source","label":"route_table_association.subnet_id"},{"from":"module.vpc.module.vpc.aws_route_table.private","to":"module.vpc.module.vpc.aws_vpc.this","kind":"source","label":"egress_only_gateway_id"},{"from":"module.vpc.module.vpc.aws_route_table.private","to":"module.vpc.module.vpc.aws_vpc.this","kind":"source","label":"vpc_id"},{"from":"module.vpc.module.vpc.aws_route_table.public","to":"module.vpc.module.vpc.aws_internet_gateway.this","kind":"unknown","label":"unknown: the source routes here (gateway_id), the draft does not carry it — STACKIT's default routing replaces the table: every route of the table sends traffic to an internet gateway, and the equivalence is observed on the target for a project outside a Network Area, which this draft does not write"},{"from":"module.vpc.module.vpc.aws_route_table.public","to":"module.vpc.module.vpc.aws_subnet.public","kind":"source","label":"route_table_association.subnet_id"},{"from":"module.vpc.module.vpc.aws_route_table.public","to":"module.vpc.module.vpc.aws_vpc.this","kind":"source","label":"vpc_id"},{"from":"module.vpc.module.vpc.aws_subnet.private","to":"module.vpc.module.vpc.aws_vpc.this","kind":"source","label":"vpc_id"},{"from":"module.vpc.module.vpc.aws_subnet.public","to":"module.vpc.module.vpc.aws_vpc.this","kind":"source","label":"vpc_id"}]}},{"path":"architecture/data-flows.mmd","text":"%% PROPOSAL — generated by StackToIT Assess. Architect review required before any decision.\n%% What this view is: the data flows between the clients, load balancers, applications, databases, object storage and registries of the estate, drawn from the listeners and target groups of the source, the security group rules of the plans and the references the source configuration makes. Each flow says its protocol and port where the source states them, whether it is public or private, and the migration effect (the class the assessment gives the unit it ends in). What the source does not state is written unknown.\n%% The flows are the paths a listener or a rule permits, not observed traffic. A thick arrow is a flow a listener or rule states; a rule is drawn thick, public or private, only when the draft attaches the rule's group to the unit it filters (a network interface that lists the group, or an attachment the plan states), else the flow is dashed, public or private unknown, and says what the group is attached to in the draft; a thin arrow is a reference from an application to a unit it uses, whose protocol and port the source does not state; a dashed arrow is UNKNOWN. External systems appear only where a security group rule of the plans names them (an egress rule); no other input names an external system.\n%% Only AWS units are drawn. architecture/dependencies.mmd holds every unit and the dependencies among them.\n%% 5 managed service units that no flow touches are not drawn and not counted toward the 120 units above which this view is cut into partitions: module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this, module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch, module.retail_app_ecs.aws_secretsmanager_secret.mq, module.retail_app_ecs.aws_secretsmanager_secret.orders_db. architecture/dependencies.mmd holds every unit.\nflowchart LR\n  n_clients_public[\"clients\u003cbr/\u003einternet\"]:::internet\n  n_module_dependencies_module_catalog_rds_aws_rds_cluster_this[\"module.dependencies.module.catalog_rds.aws_rds_cluster.this\u003cbr/\u003e\u003csmall\u003eaws_rds_cluster → STACKIT MariaDB\u003c/small\u003e\"]:::unit\n  n_module_dependencies_module_checkout_elasticache_redis_aws_elasticache_replication_group_default[\"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default\u003cbr/\u003e\u003csmall\u003eaws_elasticache_replication_group → STACKIT Key Value Store (Valkey)\u003c/small\u003e\"]:::unit\n  n_module_dependencies_module_orders_rds_aws_rds_cluster_this[\"module.dependencies.module.orders_rds.aws_rds_cluster.this\u003cbr/\u003e\u003csmall\u003eaws_rds_cluster → STACKIT PostgreSQL Flex\u003c/small\u003e\"]:::unit\n  n_module_retail_app_ecs_module_alb_aws_lb_this[\"module.retail_app_ecs.module.alb.aws_lb.this\u003cbr/\u003e\u003csmall\u003eaws_lb → STACKIT Application Load Balancer\u003c/small\u003e\"]:::unit\n  n_unknown[\"undetermined\u003cbr/\u003esee the dashed edges\"]:::unknown\n  n_clients_public ==\u003e|\"protocol and port unknown, public; effect: RECONFIGURE\"| n_module_retail_app_ecs_module_alb_aws_lb_this\n  n_module_retail_app_ecs_module_alb_aws_lb_this -.-\u003e|\"unknown: no member of target group module.retail_app_ecs.module.alb.aws_lb_target_group.main is named in the source (protocol and port unknown, private)\"| n_unknown\n  classDef unit fill:#e1e5f5,stroke:#4b5ba6\n  classDef synthetic fill:#f3f3f3,stroke:#566663\n  classDef unknown fill:#f3f3f3,stroke:#566663,stroke-dasharray:4 3\n  classDef manual fill:#f6e7cf,stroke:#a8650c\n  classDef internet fill:#f8deda,stroke:#b1261b\n","drawing":{"scope":"data_flows","nodes":[{"key":"clients:public","title":"clients","lines":["internet"],"kind":"internet","tier":"network"},{"key":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","title":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","lines":["aws_rds_cluster → STACKIT MariaDB"],"kind":"unit","tier":"data"},{"key":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","title":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","lines":["aws_elasticache_replication_group → STACKIT Key Value Store (Valkey)"],"kind":"unit","tier":"data"},{"key":"module.dependencies.module.orders_rds.aws_rds_cluster.this","title":"module.dependencies.module.orders_rds.aws_rds_cluster.this","lines":["aws_rds_cluster → STACKIT PostgreSQL Flex"],"kind":"unit","tier":"data"},{"key":"module.retail_app_ecs.module.alb.aws_lb.this","title":"module.retail_app_ecs.module.alb.aws_lb.this","lines":["aws_lb → STACKIT Application Load Balancer"],"kind":"unit","tier":"network"},{"key":"unknown","title":"undetermined","lines":["see the dashed edges"],"kind":"unknown","tier":"other"}],"edges":[{"from":"clients:public","to":"module.retail_app_ecs.module.alb.aws_lb.this","kind":"target","label":"protocol and port unknown, public; effect: RECONFIGURE"},{"from":"module.retail_app_ecs.module.alb.aws_lb.this","to":"unknown","kind":"unknown","label":"unknown: no member of target group module.retail_app_ecs.module.alb.aws_lb_target_group.main is named in the source (protocol and port unknown, private)"}]}}]},"lenses":[{"id":"executive","label":"Executive","sections":["overview","decisions","applications","target-fit","security-assurance","sovereignty","cost","migration","work-board","operations","evidence","architecture","engineering"],"hidden":["architecture","engineering"],"note":"Executive lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside."},{"id":"architect","label":"Architect","sections":["overview","architecture","applications","decisions","target-fit","migration","work-board","operations","security-assurance","sovereignty","evidence","cost","engineering"],"hidden":["cost"],"note":"Architect lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside."},{"id":"platform","label":"Platform","sections":["overview","architecture","target-fit","operations","security-assurance","decisions","applications","migration","work-board","evidence","sovereignty","cost","engineering"],"hidden":["cost"],"note":"Platform lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside."},{"id":"security","label":"Security","sections":["overview","security-assurance","decisions","sovereignty","target-fit","architecture","evidence","applications","operations","migration","work-board","cost","engineering"],"hidden":["cost","migration"],"note":"Security lens: the sections are in the order this reader usually wants, and Costs and Migration Plan are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside."},{"id":"application-owner","label":"Application owner","sections":["overview","applications","decisions","architecture","target-fit","operations","migration","work-board","evidence","security-assurance","sovereignty","cost","engineering"],"hidden":["engineering"],"note":"Application owner lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside."},{"id":"programme","label":"Programme","sections":["overview","applications","decisions","migration","work-board","operations","target-fit","architecture","evidence","security-assurance","sovereignty","cost","engineering"],"hidden":["engineering"],"note":"Programme lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside."},{"id":"finops","label":"FinOps","sections":["overview","cost","applications","target-fit","decisions","operations","security-assurance","migration","work-board","sovereignty","evidence","architecture","engineering"],"hidden":["architecture","engineering"],"note":"FinOps lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside."},{"id":"engineering","label":"Engineering","sections":["overview","engineering","architecture","evidence","decisions","target-fit","operations","applications","security-assurance","migration","work-board","sovereignty","cost"],"hidden":["cost"],"note":"Engineering lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside."}],"workload_readiness":{"statement":"Terraform generated is not workload ready: 1 of 44 units carry open workload items","units":44,"units_not_measured":49,"units_applicable":7,"units_with_open_workload_items":1,"units_needing_input":0,"units_decision_required":0,"units_blocking":0,"units_without_evidence":6,"dimensions":[{"id":"bootstrap_configuration","name":"Bootstrap configuration","asks":"How is the workload installed on this unit?","not_assessed_reason":"StackToIT cannot see how the workload is installed: no provisioner block, user data or startup script was observed on the unit."},{"id":"source_artifacts","name":"Source artifacts","asks":"Which files do the unit's attributes or its bootstrap read that the scan did not find?","not_assessed_reason":"No file the unit depends on was listed as missing, unreadable or unresolved; that does not establish that the scripts and templates are the right ones."},{"id":"target_preconditions","name":"Target preconditions","asks":"What must exist on STACKIT before a resource of the draft works?","not_assessed_reason":"No plan manual action of the kind target precondition names the unit in this build."},{"id":"cutover","name":"Cutover","asks":"What must be true before the cutover?","not_assessed_reason":"This build reads the cutover from two things only: the DNS endpoint reading (a record whose address the draft re-binds to a generated resource carries the cutover requirement; an A or AAAA record whose address is not bound to one needs evidence) and the manual actions of the plan that are due before the cutover. A unit none of them names is not assessed, which is not ready."},{"id":"day2_operations","name":"Day 2 operations","asks":"What do the plans ask after the move?","not_assessed_reason":"No plan manual action due on day 2 or for optimisation names the unit in this build."}],"counts":[{"dimension":"bootstrap_configuration","states":[{"key":"DECISION_REQUIRED","count":0},{"key":"EVIDENCE_REQUIRED","count":0},{"key":"READY_WITH_ACTIONS","count":0},{"key":"NOT_ASSESSED","count":6},{"key":"NOT_APPLICABLE","count":38}]},{"dimension":"source_artifacts","states":[{"key":"DECISION_REQUIRED","count":0},{"key":"EVIDENCE_REQUIRED","count":0},{"key":"READY_WITH_ACTIONS","count":0},{"key":"NOT_ASSESSED","count":6},{"key":"NOT_APPLICABLE","count":38}]},{"dimension":"target_preconditions","states":[{"key":"DECISION_REQUIRED","count":0},{"key":"EVIDENCE_REQUIRED","count":0},{"key":"READY_WITH_ACTIONS","count":1},{"key":"NOT_ASSESSED","count":6},{"key":"NOT_APPLICABLE","count":37}]},{"dimension":"cutover","states":[{"key":"DECISION_REQUIRED","count":0},{"key":"EVIDENCE_REQUIRED","count":0},{"key":"READY_WITH_ACTIONS","count":1},{"key":"NOT_ASSESSED","count":6},{"key":"NOT_APPLICABLE","count":37}]},{"dimension":"day2_operations","states":[{"key":"DECISION_REQUIRED","count":0},{"key":"EVIDENCE_REQUIRED","count":0},{"key":"READY_WITH_ACTIONS","count":0},{"key":"NOT_ASSESSED","count":6},{"key":"NOT_APPLICABLE","count":38}]}],"not_assessed_dimensions":[{"id":"iam","name":"IAM","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"wif","name":"WIF","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"audit_logs","name":"Audit logs","state":"NOT_ASSESSED","reason":"the draft creates and configures no audit log: the record of administrative activity is a platform fact, not something the draft made. STACKIT Audit Log (capability registry security.audit-log): The platform-wide record of administrative activity (who called which API in an organisation, folder or project): on by default, 90 days of history in the Portal, readable with the audit-log.reader role, routed onward with the Telemetry Router. It records API calls, not the resulting configuration. No Terraform resource enables or configures it. A Telemetry Router destination is drafted for a source CloudTrail trail with logging on; the router takes the Audit Logs of STACKIT products only, so none is drafted for a CloudWatch metric stream or log delivery destination; the link that makes the router receive the project's audit events is not drafted, a person sets it up; the legacy Audit Log API was decommissioned on 2026-06-02, and the Telemetry Router is the way to take the log out."},{"id":"application_logs","name":"Application logs","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"metrics","name":"Metrics","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"traces","name":"Traces","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"alerts","name":"Alerts","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"backup","name":"Backup","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"restore","name":"Restore","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"dr","name":"DR","state":"NOT_ASSESSED","reason":"this build states nothing about it; business recovery objectives (RTO, RPO) are not provided to this build"},{"id":"patching","name":"Patching","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"upgrade_lifecycle","name":"Upgrade lifecycle","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"support","name":"Support","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"quota_monitoring","name":"Quota monitoring","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"incident_handling","name":"Incident handling","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"capacity","name":"Capacity","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"cost_allocation","name":"Cost allocation","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"security_posture","name":"Security posture","state":"NOT_ASSESSED","reason":"the draft does not enable it and the provider has no resource for it: CSPM is a platform fact, not something the draft made. STACKIT Cloud Security Posture Management (capability registry security.posture-management): Managed security posture management (assessment of a project against fixed benchmarks): STACKIT Cloud Security Posture Management, a Portal service (generally available since 2026-10-05; enabled in the Portal or through the Service Enablement API) whose documented API reference is labelled v1beta, with no Terraform resource. It shows a project-level dashboard with a scan every 24 hours and offers no alerting. Managed threat detection is not part of it. It scans against BSI C5, ISO 27000 and the STACKIT standard. Where the estate has AWS Config or Security Hub rules they are not carried: a person enables CSPM and maps the controls."},{"id":"secrets","name":"Secrets","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"runbook_ownership","name":"Runbook ownership","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"}],"limits":["A generated Terraform resource does not mark these ready: no dimension is ready in this build, and a unit without evidence is not assessed, never ready.","A state is read from a typed fact of the assessment or of a plan (an open critical semantic, an observed bootstrap, a source artifact the scan did not find, a manual action with its kind and phase); nothing is inferred from a resource name.","A compute unit is a unit of the catalogue category compute; every other unit applies to a dimension only where a typed fact concerns it.","The cutover requirement is read for the DNS records of this build only (the re-bound address of an Elastic IP, or an address record with no endpoint binding) and for the manual actions of the plan due before the cutover; the cutover of any other endpoint (load balancer, certificate, allow-list) is not read by this build. StackToIT applies no cutover and the requirement does not change a unit's class, confidence or eligibility."]},"support_suitability":{"source":"STACKIT support plans (https://docs.stackit.cloud/support/plans/)","as_of":"2026-11-02","options":[{"id":"essential","name":"Essential Support","includes":["Free of charge and available to all STACKIT customers by default.","Ideal for development and test environments that host non-critical cloud workloads.","Service hours 10/5 for service requests, incidents and business-critical incidents.","Reaction time 15 minutes for all support cases; response time for business-critical incidents 4 hours; no response time targeted for service requests and other incidents (N/A)."],"service_hours":{"service_requests":"10/5","incidents":"10/5","critical_incidents":"10/5"},"evidence_kind":"TARGET_OFFICIAL_DOC","evidence_document":"https://docs.stackit.cloud/support/plans/","evidence_date":"2026-07-20","verified_at":"2026-10-08","recheck_after":"2027-01-06","caveats":["The page states that, for Essential Support, these times are targeted on a best-effort basis, are not binding, and that exceeding them does not entitle the customer to penalties or financial compensation.","The page refers to sections A.5 and A.6 of the service description document for more information; that document was not read."],"freshness":"FRESH"},{"id":"advanced","name":"Advanced Support","includes":["Designed for customers with cloud workloads that run in production and host business-critical services.","Booked on a per-project basis; can be cancelled monthly.","Service hours 10/5 for service requests and incidents; 24/7 for business-critical incidents.","Reaction time 15 minutes for all support cases; response time 8 hours for service requests, 4 hours for incidents, 1 hour for business-critical incidents."],"service_hours":{"service_requests":"10/5","incidents":"10/5","critical_incidents":"24/7"},"evidence_kind":"TARGET_OFFICIAL_DOC","evidence_document":"https://docs.stackit.cloud/support/plans/","evidence_date":"2026-07-20","verified_at":"2026-10-08","recheck_after":"2027-01-06","supporting":[{"kind":"TARGET_OFFICIAL_DOC","document":"https://stackit.com/en/support/advanced-support","verified_at":"2026-10-08","detail":"Product page (sales page: evidence that the plan is offered). Its footnote: \"24/7 support refers exclusively to the response time for business-critical issues within the scope of STACKIT Advanced Support.\" Business-critical issues: 1 hour (24/7); incidents within 4 hours during business hours, Monday through Friday, 8:00-18:00."}],"caveats":["24/7 applies to business-critical incidents only; other incidents and service requests are handled in 10/5 hours.","The documents read do not say whether the stated times are contractual (SLA, penalties); the Advanced Support contract terms (Vertragsbedingungen) were not read."],"freshness":"FRESH"},{"id":"ultimate","name":"Ultimate Support","includes":["High-end support plan for enterprise customers who require immediate assistance for their most critical cloud workloads.","Includes specialized consulting and training.","Service hours 10/5 for service requests; 24/7 for incidents and for business-critical incidents.","Reaction time 15 minutes for all support cases; response time 4 hours for service requests, 2 hours for incidents, 30 minutes for business-critical incidents."],"service_hours":{"service_requests":"10/5","incidents":"24/7","critical_incidents":"24/7"},"evidence_kind":"TARGET_OFFICIAL_DOC","evidence_document":"https://docs.stackit.cloud/support/plans/","evidence_date":"2026-07-20","verified_at":"2026-10-08","recheck_after":"2027-01-06","supporting":[{"kind":"TARGET_OFFICIAL_DOC","document":"https://stackit.com/en/support/ultimate-support","verified_at":"2026-10-08","detail":"Product page (sales page: evidence that the features are offered). Lists 24/7 escalation management (an escalation manager can be activated 30 minutes after a business-critical ticket is opened), training and consulting, a dedicated number and service reports."}],"caveats":["The documents read do not say whether the stated times are contractual (SLA, penalties); the Ultimate Support contract terms were not read."],"freshness":"FRESH"}],"entries":[{"subject":{"kind":"ESTATE"},"state":"NOT_ASSESSED","available_support_options":["Essential Support","Advanced Support","Ultimate Support"],"support_gap":"UNKNOWN","reason":"No criticality stated; pass --applications to state criticality and explicit support requirements","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/support/plans/","detail":"Essential Support: plan comparison table; the document states \"Last updated on 2026-07-20\"","freshness":{"retrieved_at":"2026-10-08","checked_at":"2026-10-08","recheck_after":"2027-01-06"}},{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/support/plans/","detail":"Advanced Support: plan comparison table; the document states \"Last updated on 2026-07-20\"","freshness":{"retrieved_at":"2026-10-08","checked_at":"2026-10-08","recheck_after":"2027-01-06"}},{"kind":"TARGET_OFFICIAL_DOC","source":"https://stackit.com/en/support/advanced-support","detail":"Advanced Support: Product page (sales page: evidence that the plan is offered). Its footnote: \"24/7 support refers exclusively to the response time for business-critical issues within the scope of STACKIT Advanced Support.\" Business-critical issues: 1 hour (24/7); incidents within 4 hours during business hours, Monday through Friday, 8:00-18:00.","freshness":{"retrieved_at":"2026-10-08","checked_at":"2026-10-08","recheck_after":"2027-01-06"}},{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/support/plans/","detail":"Ultimate Support: plan comparison table; the document states \"Last updated on 2026-07-20\"","freshness":{"retrieved_at":"2026-10-08","checked_at":"2026-10-08","recheck_after":"2027-01-06"}},{"kind":"TARGET_OFFICIAL_DOC","source":"https://stackit.com/en/support/ultimate-support","detail":"Ultimate Support: Product page (sales page: evidence that the features are offered). Lists 24/7 escalation management (an escalation manager can be activated 30 minutes after a business-critical ticket is opened), training and consulting, a dedicated number and service reports.","freshness":{"retrieved_at":"2026-10-08","checked_at":"2026-10-08","recheck_after":"2027-01-06"}}]}]},"assurance":{"sources":["STACKIT certificates and attestations by service (the certificates page stackit.com/en/why-stackit/benefits/certificates and the documents it links; each row names its document)","STACKIT certificates and attestations of the provider organisation and its facilities (the certificates page stackit.com/en/why-stackit/benefits/certificates and the documents it links; each row names its document)"],"as_of":"2026-11-02","recheck_days":90,"disclaimer":"Provider evidence describes the provider's own controls and attestations. It is not a statement about the workload and does not make a workload compliant with any framework; the customer's own controls and an external review decide that.","frameworks":["BSI C5","GDPR","ISAE 3000 (SOC 2)","ISAE 3402","ISO 22301","ISO/IEC 20000-1","ISO/IEC 27001","ISO/IEC 27017","ISO/IEC 27018","TISAX"],"requested_frameworks":[],"services":["STACKIT Application Load Balancer","STACKIT KMS","STACKIT Key Value Store (Valkey)","STACKIT Kubernetes Engine (SKE)","STACKIT Logs","STACKIT MariaDB","STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","STACKIT OpenSearch","STACKIT PostgreSQL Flex","STACKIT RabbitMQ","STACKIT Secrets Manager","STACKIT network","STACKIT project networking / Network Area (SNA)","STACKIT security group","STACKIT service account for the workload"],"other_targets":[],"cells":[{"service":"STACKIT Application Load Balancer","framework":"BSI C5","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for BSI C5; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[0]},{"service":"STACKIT Application Load Balancer","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT Application Load Balancer","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT Application Load Balancer","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT Application Load Balancer","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT Application Load Balancer","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT Application Load Balancer","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT Application Load Balancer","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[10]},{"service":"STACKIT Application Load Balancer","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT Application Load Balancer","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT KMS","framework":"BSI C5","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for BSI C5; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[0]},{"service":"STACKIT KMS","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT KMS","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT KMS, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT KMS","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT KMS","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT KMS","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT KMS","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT KMS","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[10]},{"service":"STACKIT KMS","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT KMS","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT Key Value Store (Valkey)","framework":"BSI C5","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for BSI C5; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[0]},{"service":"STACKIT Key Value Store (Valkey)","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT Key Value Store (Valkey)","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT Key Value Store (Valkey)","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT Key Value Store (Valkey)","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT Key Value Store (Valkey)","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT Key Value Store (Valkey)","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT Key Value Store (Valkey)","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[10]},{"service":"STACKIT Key Value Store (Valkey)","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT Key Value Store (Valkey)","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT Kubernetes Engine (SKE)","framework":"BSI C5","requested":false,"state":"CUSTOMER_CONTROL_REQUIRED","reason":"the evidence covers the provider's side at most; the customer's own controls for this framework are still required and are not assessed here","provider_evidence":true,"organisation_only":false,"evidence_rows":[1]},{"service":"STACKIT Kubernetes Engine (SKE)","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT Kubernetes Engine (SKE)","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT Kubernetes Engine (SKE)","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT Kubernetes Engine (SKE)","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT Kubernetes Engine (SKE)","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT Kubernetes Engine (SKE)","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT Kubernetes Engine (SKE)","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[10]},{"service":"STACKIT Kubernetes Engine (SKE)","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT Kubernetes Engine (SKE)","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT Logs","framework":"BSI C5","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for BSI C5; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[0]},{"service":"STACKIT Logs","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT Logs","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Logs, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT Logs","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT Logs","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT Logs","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT Logs","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT Logs","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[10]},{"service":"STACKIT Logs","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT Logs","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT MariaDB","framework":"BSI C5","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for BSI C5; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[0]},{"service":"STACKIT MariaDB","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT MariaDB","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT MariaDB","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT MariaDB","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT MariaDB","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT MariaDB","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT MariaDB","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[10]},{"service":"STACKIT MariaDB","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT MariaDB","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","framework":"BSI C5","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for BSI C5; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[0]},{"service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[10]},{"service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT OpenSearch","framework":"BSI C5","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for BSI C5; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[0]},{"service":"STACKIT OpenSearch","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT OpenSearch","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT OpenSearch","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT OpenSearch","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT OpenSearch","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT OpenSearch","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT OpenSearch","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[10]},{"service":"STACKIT OpenSearch","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT OpenSearch","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT PostgreSQL Flex","framework":"BSI C5","requested":false,"state":"CUSTOMER_CONTROL_REQUIRED","reason":"the evidence covers the provider's side at most; the customer's own controls for this framework are still required and are not assessed here","provider_evidence":true,"organisation_only":false,"evidence_rows":[2]},{"service":"STACKIT PostgreSQL Flex","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT PostgreSQL Flex","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT PostgreSQL Flex","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT PostgreSQL Flex","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT PostgreSQL Flex","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT PostgreSQL Flex","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT PostgreSQL Flex","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[10]},{"service":"STACKIT PostgreSQL Flex","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT PostgreSQL Flex","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT RabbitMQ","framework":"BSI C5","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for BSI C5; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[0]},{"service":"STACKIT RabbitMQ","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT RabbitMQ","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT RabbitMQ","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT RabbitMQ","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT RabbitMQ","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT RabbitMQ","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT RabbitMQ","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[10]},{"service":"STACKIT RabbitMQ","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT RabbitMQ","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT Secrets Manager","framework":"BSI C5","requested":false,"state":"CUSTOMER_CONTROL_REQUIRED","reason":"the evidence covers the provider's side at most; the customer's own controls for this framework are still required and are not assessed here","provider_evidence":true,"organisation_only":false,"evidence_rows":[3]},{"service":"STACKIT Secrets Manager","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT Secrets Manager","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT Secrets Manager","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT Secrets Manager","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT Secrets Manager","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT Secrets Manager","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT Secrets Manager","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[10]},{"service":"STACKIT Secrets Manager","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT Secrets Manager","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT network","framework":"BSI C5","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for BSI C5; its document does not name STACKIT network, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[0]},{"service":"STACKIT network","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT network, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT network","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT network, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT network","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT network, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT network","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT network, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT network","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT network, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT network","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT network, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT network","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT network, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[10]},{"service":"STACKIT network","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT network, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT network","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT network, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT project networking / Network Area (SNA)","framework":"BSI C5","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for BSI C5; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[0]},{"service":"STACKIT project networking / Network Area (SNA)","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT project networking / Network Area (SNA)","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT project networking / Network Area (SNA)","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT project networking / Network Area (SNA)","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT project networking / Network Area (SNA)","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT project networking / Network Area (SNA)","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT project networking / Network Area (SNA)","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[10]},{"service":"STACKIT project networking / Network Area (SNA)","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT project networking / Network Area (SNA)","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT security group","framework":"BSI C5","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for BSI C5; its document does not name STACKIT security group, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[0]},{"service":"STACKIT security group","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT security group, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT security group","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT security group, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT security group","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT security group, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT security group","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT security group, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT security group","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT security group, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT security group","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT security group, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT security group","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT security group, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[10]},{"service":"STACKIT security group","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT security group, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT security group","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT security group, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT service account for the workload","framework":"BSI C5","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for BSI C5; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[0]},{"service":"STACKIT service account for the workload","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT service account for the workload","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT service account for the workload","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT service account for the workload","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT service account for the workload","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT service account for the workload","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT service account for the workload","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[10]},{"service":"STACKIT service account for the workload","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT service account for the workload","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]}],"evidence":[{"framework":"BSI C5","claim":"STACKIT states that its infrastructure is certified according to C5 Type 2 of the BSI","scope":"Statement on the STACKIT certificates page: the report covers the products listed there (the certificates page of STACKIT, stackit.com/en/why-stackit/benefits/certificates) and all basic and additional criteria. The attestation report was not opened. The STACKIT C5 page says a C5 certificate is valid for one year as a rule; no page opened names a date for STACKIT's own attestation, an auditor or an audit period. Press release of 2024-08-21 (opened): C5 Type 1 for the infrastructure stack at the end of 2023, type 2 effectiveness audit confirmed in 2024, appropriateness tested for STACKIT IaaS (Compute Engine, Network \u0026 Security, Block Storage, Object Storage).","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/why-stackit/benefits/certificates","verified_at":"2026-10-08","validity_stated":false},{"framework":"BSI C5","claim":"STACKIT states that its infrastructure is certified according to C5 Type 2 and that the report covers this product and all basic and additional criteria","scope":"Product listed under \"C5 certified cloud products\" on the STACKIT certificates page; C5 Type 2 as that page states it. The attestation report itself was not opened. The page names no audit period, no auditor, no region and no end of validity.","service":"STACKIT Kubernetes Engine (SKE)","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/why-stackit/benefits/certificates","verified_at":"2026-10-08","validity_stated":false},{"framework":"BSI C5","claim":"STACKIT states that its infrastructure is certified according to C5 Type 2 and that the report covers this product and all basic and additional criteria","scope":"Product listed under \"C5 certified cloud products\" on the STACKIT certificates page; C5 Type 2 as that page states it. The attestation report itself was not opened. The page names no audit period, no auditor, no region and no end of validity.","service":"STACKIT PostgreSQL Flex","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/why-stackit/benefits/certificates","verified_at":"2026-10-08","validity_stated":false},{"framework":"BSI C5","claim":"STACKIT states that its infrastructure is certified according to C5 Type 2 and that the report covers this product and all basic and additional criteria","scope":"Product listed under \"C5 certified cloud products\" on the STACKIT certificates page; C5 Type 2 as that page states it. The attestation report itself was not opened. The page names no audit period, no auditor, no region and no end of validity.","service":"STACKIT Secrets Manager","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/why-stackit/benefits/certificates","verified_at":"2026-10-08","validity_stated":false},{"framework":"GDPR","claim":"STACKIT states that the development of its cloud takes place in Germany, that its servers and data centers are located in Germany and Austria, and that its cloud operates in accordance with European data protection standards","scope":"Statement on the STACKIT certificates page (provider-side text, not an attestation or a certificate). It is a statement about where and how the provider operates; the customer's own obligations toward personal data stay with the customer. The page names no region id and no attestation document.","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/why-stackit/benefits/certificates","verified_at":"2026-10-08","validity_stated":false},{"framework":"ISAE 3000 (SOC 2)","claim":"STACKIT states that its infrastructure holds an ISAE 3000 (SOC 2) certification in addition to C5","scope":"Statement on the STACKIT certificates page. The report was not opened and the page states no type, no audit period, no auditor and no end of validity. The Schwarz Digits press release of 2024-01-23 (opened) says ISAE 3000 (SOC 2) and ISAE 3402 were issued as type 1 at that time; whether a type 2 exists now is not stated on any page opened. Which products the report covers is not separately stated.","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/why-stackit/benefits/certificates","verified_at":"2026-10-08","validity_stated":false},{"framework":"ISAE 3402","claim":"STACKIT states that its infrastructure holds an ISAE 3402 certificate in addition to C5","scope":"Statement on the STACKIT certificates page. The report was not opened and the page states no type, no audit period, no auditor and no end of validity. The Schwarz Digits press release of 2024-01-23 (opened) says it was issued as type 1 at that time. Which products the report covers is not separately stated.","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/why-stackit/benefits/certificates","verified_at":"2026-10-08","validity_stated":false},{"framework":"ISO 22301","claim":"TÜV Rheinland Cert GmbH certified that the requirements of ISO 22301:2019 are met by Schwarz Digits Cloud GmbH \u0026 Co. KG, certificate registration number 01 195 2500863, initial certification 2026","scope":"Holder Schwarz Digits Cloud GmbH \u0026 Co. KG, Bad Friedrichshall (not STACKIT GmbH \u0026 Co. KG). Scope as the certificate words it (German): Cloud Infrastruktur- und Plattform-Services (IaaS und PaaS) sowie Colocation in Form der Bereitstellung von Rechenzentrums- oder Rackspace. Business continuity management system of the provider; the certificate lists no products and no locations.","control":"PROVIDER","status":"CURRENT","document":"https://stackit.com/en/asset/download/61434/file/ISO22301.pdf?version=2","evidence_date":"2026-08-28","valid_until":"2029-08-26","verified_at":"2026-10-08","validity_stated":true},{"framework":"ISO/IEC 20000-1","claim":"TÜV SÜD Management Service GmbH certified that the requirements of ISO/IEC 20000-1:2018 are met by Schwarz Digits KG, certificate registration number 12 410 60762 TMS","scope":"Holder Schwarz Digits KG, Neckarsulm. IT service management system; scope as the certificate words it (German): Betrieb der IT-Infrastruktur, Server- und Netzwerkadministration, Datenspeicherung, Rechenzentrums- sowie Colocation Services (STACKIT Colocation, Housing), mit den Rechenzentren in Deutschland und Österreich für interne und externe Kunden; sites per the annex: Neckarsulm, Ellhofen, Weinsberg (two), Heilbronn and Ostermiething (Austria).","control":"PROVIDER","status":"CURRENT","document":"https://stackit.com/en/asset/download/40661/file/240206_STACKIT_Zertifikat_ISO-20000-1_DE_ug%2520%25281%2529.pdf?version=4","evidence_date":"2024-01-18","valid_until":"2027-01-17","verified_at":"2026-10-08","validity_stated":true},{"framework":"ISO/IEC 27001","claim":"TÜV Rheinland Cert GmbH certified that the requirements of ISO/IEC 27001:2022 are met by STACKIT GmbH \u0026 Co. KG, certificate registration number 01 153 2500863","scope":"Holder STACKIT GmbH \u0026 Co. KG, Neckarsulm. Scope as the certificate words it: cloud infrastructure and platform services (IaaS and PaaS) as well as colocation in the form of providing data center or rack space. Statement of Applicability version 22 of 2025-11-28. The certificate lists no products and no locations.","control":"PROVIDER","status":"CURRENT","document":"https://stackit.com/en/asset/download/50680/file/ISO%253AIEC%252027001_2022_EN.pdf?version=2","evidence_date":"2026-02-09","valid_until":"2029-02-08","verified_at":"2026-10-08","validity_stated":true},{"framework":"ISO/IEC 27017","claim":"The ISO/IEC 27001:2022 certificate of STACKIT GmbH \u0026 Co. KG states a Statement of Applicability with the additional measures for ISO/IEC 27017:2015","scope":"The additional measures of ISO/IEC 27017:2015 are part of the Statement of Applicability (version 22 of 2025-11-28) of the ISO/IEC 27001:2022 certificate 01 153 2500863; the certificate is not a separate ISO/IEC 27017 certificate. The STACKIT certificates page words it as a certification according to ISO/IEC 27017.","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/asset/download/50680/file/ISO%253AIEC%252027001_2022_EN.pdf?version=2","evidence_date":"2026-02-09","valid_until":"2029-02-08","verified_at":"2026-10-08","validity_stated":true},{"framework":"ISO/IEC 27018","claim":"The ISO/IEC 27001:2022 certificate of STACKIT GmbH \u0026 Co. KG states a Statement of Applicability with the additional measures for ISO/IEC 27018:2019","scope":"The additional measures of ISO/IEC 27018:2019 are part of the Statement of Applicability (version 22 of 2025-11-28) of the ISO/IEC 27001:2022 certificate 01 153 2500863; the certificate is not a separate ISO/IEC 27018 certificate. The STACKIT certificates page words it as a certification according to ISO/IEC 27018 (personal data in the cloud).","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/asset/download/50680/file/ISO%253AIEC%252027001_2022_EN.pdf?version=2","evidence_date":"2026-02-09","valid_until":"2029-02-08","verified_at":"2026-10-08","validity_stated":true},{"framework":"TISAX","claim":"STACKIT states a successful TISAX assessment, Level 3, for the automotive industry","scope":"Statement on the STACKIT certificates page with assessment ID ATA163-1 and scope ID SH938N; the result is published in the ENX portal, which was not opened. The page names no assessment date, no end of validity and no products.","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/why-stackit/benefits/certificates","verified_at":"2026-10-08","validity_stated":false}]},"verification":{"invariants":[{"id":"GLOBAL_RESOURCE_UNIQUENESS","status":"PASS","checked":134,"detail":"121 addressable blocks in the final files and 13 resources of the plans, every address once"},{"id":"NO_UNPLANNED_RESOURCE","status":"PASS","checked":53,"detail":"53 resource blocks: 13 resources of a plan, 40 written by a registered legacy generator, none unplanned","listed":["legacy.data-services: 12 resource(s) written by a registered legacy generator","legacy.identity: 20 resource(s) written by a registered legacy generator","legacy.kubernetes: 1 resource(s) written by a registered legacy generator","legacy.load-balancing: 1 resource(s) written by a registered legacy generator","legacy.network: 2 resource(s) written by a registered legacy generator","legacy.secrets-and-keys: 4 resource(s) written by a registered legacy generator"]},{"id":"NO_UNPLANNED_REFERENCE","status":"PASS","checked":37,"detail":"37 references between resources: every one is written, and the references of plan resources are stated by their plan; 1 reference(s) to an instance nothing proves are required selector variables with an open decision, none a concrete index (legacy to legacy: 32, plan to plan: 5)","listed":["legacy to legacy: 32","plan to plan: 5"]},{"id":"NO_UNRESOLVED_REQUIRED_FIELD","status":"PASS","checked":155,"detail":"155 required arguments of the resources written: every one is written (a value, a reference or a declared variable) or declared as a target gap"},{"id":"NO_SECURITY_WIDENING","status":"PASS","checked":35,"detail":"35 grant-defining attributes of the rules and routes written, each equal to the plan, none added (files against the plan; whether the plan carries everything the source allows is said by the unit findings and the NOT CARRIED lines, not by this check)"},{"id":"ALL_OUTPUTS_SAME_RUN","status":"PASS","checked":47,"detail":"47 artefacts carry the run id that manifest.json carries","listed":["assurance/compliance-evidence.csv: carries no run id by design, bound to the run by its sha256 in the manifest","assurance/equivalence-ledger.csv: carries no run id by design, bound to the run by its sha256 in the manifest","assurance/evidence-ledger.csv: carries no run id by design, bound to the run by its sha256 in the manifest","engineering/not-carried-summary.csv: carries no run id by design, bound to the run by its sha256 in the manifest","engineering/not-carried.csv: carries no run id by design, bound to the run by its sha256 in the manifest","engineering/review-edges.csv: carries no run id by design, bound to the run by its sha256 in the manifest","engineering/review.csv: carries no run id by design, bound to the run by its sha256 in the manifest","financial/mapping.csv: carries no run id by design, bound to the run by its sha256 in the manifest","financial/priced-resources.csv: carries no run id by design, bound to the run by its sha256 in the manifest","migration/actions.csv: carries no run id by design, bound to the run by its sha256 in the manifest","migration/application-chain.csv: carries no run id by design, bound to the run by its sha256 in the manifest","migration/applications.csv: carries no run id by design, bound to the run by its sha256 in the manifest","migration/data-movement.csv: carries no run id by design, bound to the run by its sha256 in the manifest","migration/decisions.csv: carries no run id by design, bound to the run by its sha256 in the manifest","migration/source-target.csv: carries no run id by design, bound to the run by its sha256 in the manifest","migration/waves.csv: carries no run id by design, bound to the run by its sha256 in the manifest","migration/work-board.csv: carries no run id by design, bound to the run by its sha256 in the manifest"]},{"id":"VARIABLE_IDENTITY_PRESERVED","status":"PASS","checked":29,"detail":"20 variable references are exactly the variable the plan states, and the 9 variables read are declared as the plan declares them (type and description)","listed":["var.project_id: type compared, description not: the converter declares project_id once for every family, and the plan's own description of it is not written"]},{"id":"NO_ORPHAN_MANUAL_ACTION","status":"PASS","checked":21,"detail":"21 manual actions and decisions, each naming a unit of the assessment"},{"id":"SOURCE_PROVIDER_MATCHES_SCHEMA_OR_IS_UNVERIFIED","status":"PASS","checked":93,"detail":"93 units of a source provider: 0 verified against a compatibility record, 93 explicitly not verified through a root record, 0 stated by their provider row"},{"id":"APPLICATION_READY_IMPLIES_REQUIRED_ENV_SECRETS_DEPENDENCIES","status":"PASS","checked":5,"detail":"5 application contract(s): none is stated ready (READY_FOR_VALIDATION or CUSTOMER_ATTESTED) while a required environment value, secret, dependency rebinding or data store item is not attested (0 ready, 4 not ready with required items open)"},{"id":"ALL_EMITTED_TARGET_TYPES_CLASSIFIED","status":"PASS","checked":53,"detail":"53 resource and data blocks of 24 type(s) in the final files, every STACKIT type classified by the target catalogue"},{"id":"ALL_UNACCOUNTED_PROPERTIES_EXPLICIT","status":"PASS","checked":404,"detail":"404 meaningful properties of 38 generated units each end as accounted by a contract, consumed, a wired reference, a placement decision or named NOT CARRIED; none is UNACCOUNTED"}],"product_invariants":[{"id":"ALL_MANUAL_STEPS_ACTIONABLE_OR_MARKED_UNASSIGNED","status":"PASS","checked":254,"detail":"254 manual steps, each with an owner role, a success condition and a phase"}]},"validation_matrix":{"scope":"What has been established about this draft, row by row, and what has not. Nothing here approves the draft, asserts that it is equivalent to the source, or says it is safe to apply.","rows":[{"id":"SOURCE_COMPLETENESS","name":"Source completeness","state":"PARTIAL","detail":"source status RUNTIME_TOPOLOGY_PARTIAL","scope":"how much of the source configuration StackToIT read; not whether what it read is correct","evidence":{"file":"assessment.json","pointer":"/summary/source_status"}},{"id":"DRAFT_GENERATION","name":"Draft generation","state":"GENERATED","detail":"the draft is in terraform/","scope":"whether a STACKIT draft was written for this run","evidence":{"file":"manifest.json","pointer":"/draft"}},{"id":"STACKTOIT_DRAFT_CHECKS","name":"StackToIT draft checks","state":"PASSED","detail":"100 checks, none found a violation","scope":"StackToIT's own checks of the plan and the rendered text of the families it writes from a plan; not what OpenTofu or STACKIT would say","evidence":{"file":"workspace.json","pointer":"/units"}},{"id":"GLOBAL_INVARIANTS","name":"Global invariants","state":"PASSED","detail":"12 of 12 invariants PASS","scope":"eight consistency checks over the files of the draft and the plans, ALL_OUTPUTS_SAME_RUN among them, and one product check that no meaningful source property is left without a stated fate (ALL_UNACCOUNTED_PROPERTIES_EXPLICIT); not a check of target behaviour","evidence":{"file":"manifest.json","pointer":"/verification"}},{"id":"TOFU_STATIC_VALIDATION","name":"OpenTofu validation","state":"PASSED","detail":"tofu init -backend=false and tofu validate accepted the draft; tofu 1.13.1","scope":"static validation of the draft against the pinned provider schema — not target behaviour, not approval","evidence":{"file":"manifest.json","pointer":"/validation/tofu_validate"}},{"id":"OUTPUT_SCHEMA_VALIDATION","name":"Output schema validation","state":"PASSED","detail":"verified at publish: every JSON file that has a schema is validated against it (see run_verification in manifest.json)","scope":"the machine-readable output files that have a schema, against the schemas recorded in manifest.json","evidence":{"file":"manifest.json","pointer":"/run_verification"}},{"id":"STACKIT_PLAN","name":"STACKIT plan","state":"NOT_RUN","detail":"this build runs no plan against a STACKIT project","scope":"a plan of the draft against a live STACKIT project: whether the provider accepts the values and what it would create"},{"id":"ARCHITECT_APPROVAL","name":"Architect approval","state":"NOT_PROVIDED","detail":"no review decision is recorded for this run","scope":"a named architect's decision on the draft; StackToIT records none"},{"id":"SEMANTIC_EQUIVALENCE","name":"Semantic equivalence","state":"NOT_ASSESSED","detail":"this build has no measure for it","scope":"whether the target behaves like the source; StackToIT assesses units and settings one by one and makes no statement about the whole"},{"id":"SAFE_TO_APPLY","name":"Safe to apply","state":"NOT_ASSERTED","detail":"StackToIT never asserts it","scope":"whether the draft can be applied to a live project without harm; StackToIT never asserts this"}],"tofu_validate":{"state":"PASSED","tool_version":"1.13.1","scope":"static validation of the draft against the pinned provider schema — not target behaviour, not approval"}},"run_summary":{"package_state":"PARTIALLY_EXECUTABLE","package_kpi":{"generated_automatically":49,"generated_with_decisions":4,"manual_carry_over":238,"unsupported":3,"steps":314,"terraform_steps":49,"terraform_steps_after_manual_prerequisite":1,"automated_now":"48 of the 57 automated steps (OpenTofu or a script) can run now (1 waits for a manual prerequisite, 8 require a design decision) · 9 of those 48 rest on a default you have not confirmed (public endpoint, size derived from the source) · stages of 57 automated steps: 57 can be generated, 48 can run now, 39 rest on no default left to confirm, 0 are approved (every decision and default confirmed in the decisions file)","runnable":{"automated_steps":57,"can_run_now":48,"need_values":48,"variables":43,"project_id":true},"draft_defaults":"the default of 8 decisions nobody has answered: public endpoint (5), size derived from the source (3); confirm or change each in decisions.yaml; confirming one accepts what the draft does as it stands: the steps that rest on it then count among those that rest on no default left to confirm, and as approved once every decision they rest on is answered in the decisions file; decisions are counted one by one here, while the register's decisions to make and defaults to confirm count the records that group them","stages":"stages of 57 automated steps: 57 can be generated, 48 can run now, 39 rest on no default left to confirm, 0 are approved (every decision and default confirmed in the decisions file)","figures":[{"n":48,"words":"of the 57 automated steps (OpenTofu or a script) can run now","tone":"ready","state":"EXECUTABLE_NOW"},{"n":1,"words":"waits for a manual prerequisite","of":"of the 57 automated steps","state":"MANUAL_PREREQUISITE"},{"n":8,"words":"require a design decision","tone":"attention","of":"of the 57 automated steps","state":"REQUIRES_DESIGN_DECISION"},{"n":9,"words":"of those 48 rest on a default you have not confirmed","tone":"attention"},{"n":0,"words":"are approved","of":"of the 57 automated steps"}],"api_steps":4,"api_steps_waiting":4,"api_steps_opt_in":4,"design_inputs":4,"manual_migration_work_steps":154,"lifecycle_steps":84,"review_steps":69,"review_settings":272,"stuck_steps":0,"refused_steps":3,"not_taken_steps":0,"alternative_method_steps":16,"source_units_api":0,"hybrid_units":4},"inputs":{"open_requests":47,"blocking_draft":14,"preferences_not_applied":4},"run_id":"f6267c3f-2848-4aa5-89df-5fee8b15b3b9","run_publication":"COMPLETE","source_status":"RUNTIME_TOPOLOGY_PARTIAL","source":{"units":44,"conditional":8,"switched_off":41,"resources":282,"files":105,"conditional_by_state":{"present_on_defaults":0,"disabled_on_defaults_but_overridable":3,"runtime_data_unknown":5,"variable_unknown":0,"undecided_other_cause":0}},"critical_semantics":{"total":319,"resolved":36,"open":283,"units_without_contract":0,"carried_open":1,"conditional_open":25,"conditional_units":5},"review":{"register":"BUILT","register_decisions":113,"plan_read":true,"plan_decisions":25,"plan_decision_states":{"pending":25,"accepted_awaiting_verification":0,"rejected":0,"stale":0},"manual_actions":7,"units_with_open_plan_items":20,"units_with_open_records":48,"by_source":[{"source":"PLAN_DECISION","records":11,"open_items":25,"accepted_items":0,"units":19,"conditional":0,"open_records":11,"open_units":19,"open_default_records":2,"open_draft_default_records":2},{"source":"CRITICAL_SEMANTIC","records":95,"open_items":308,"accepted_items":0,"units":48,"conditional":25,"open_records":95,"open_units":48,"open_confirm_only_items":1},{"source":"MANUAL_ACTION","records":5,"open_items":7,"accepted_items":0,"units":2,"conditional":0,"open_records":5,"open_units":2},{"source":"PLAN_STATEMENT","records":2,"open_items":7,"accepted_items":0,"units":7,"conditional":0,"open_records":2,"open_units":7}]},"draft":{"state":"GENERATED","considered":52,"generated":38,"no_resource":11,"left_for_architect":3,"variables":60},"checks":{"invariants_total":12,"invariants_passed":12,"invariants_failed":0,"invariants_pending":0,"invariants_vacuous":0,"draft_checks":100,"draft_checks_failed":0},"tofu_validate":{"state":"PASSED","tool_version":"1.13.1","scope":"static validation of the draft against the pinned provider schema — not target behaviour, not approval"},"architect_approval":"NOT_PROVIDED","semantic_equivalence":"NOT_ASSESSED","safe_to_apply":"NOT_ASSERTED","next":[{"code":"REVIEW_CRITICAL_SEMANTICS","text":"Review the 307 open critical settings: a person decides each (index.html, Decisions page; assurance/critical-semantics.json, critical_semantic_resolution.open). 25 of them belong to units that exist only if a plan-time input holds (critical_semantic_resolution.conditional_open). 1 more is carried by the draft already: confirm only."},{"code":"REVIEW_PLAN_ITEMS","text":"Review the 9 open plan decisions and 5 manual actions of the draft (index.html, Architecture, Deployment prerequisites). Confirm the 2 defaults the draft carries out (index.html, Decisions page): no step waits for the answer, a person confirms each or changes it."},{"code":"REVIEW_DRAFT","text":"Review the draft in terraform/: it is a proposal, and an architect has to review it before any use."},{"code":"OPEN_WORKSPACE","text":"Open index.html in a browser for the unit-by-unit view (offline, nothing is loaded)."}],"mappings":{"units":44,"production_eligible":0,"by_maturity":[{"key":"beta","count":44}],"automation_known":true,"automation_answerable":17,"automation_not_automatable":27,"not_automatable_reasons":[{"key":"a critical setting STACKIT does not support","count":13},{"key":"a target resource the provider marks experimental","count":10},{"key":"a decision whose every option is work a person does by hand","count":5},{"key":"a permission document the source does not show","count":5},{"key":"a unit left to an architect","count":1}]}},"assumptions":[{"id":"convert:module.retail_app_ecs.module.alb.aws_lb.this:client_access:ASSUMED_UNMANAGED_NETWORK_ACL","kind":"ASSUMED_UNMANAGED_NETWORK_ACL","unit":"module.retail_app_ecs.module.alb.aws_lb.this","address":"stackit_application_load_balancer.retail_app_ecs_alb_this","text":"the network ACLs of the subnets of module.retail_app_ecs.module.alb.aws_lb.this is not managed by this source and is taken as unrestricted — not verified"}],"security_observations":[{"id":"convert:module.dependencies.aws_mq_broker.mq:deployment_mode:SINGLE_NODE_DATA_STORE","kind":"SINGLE_NODE_DATA_STORE","severity":"SECURITY_OBSERVATION","blocking":false,"unit":"module.dependencies.aws_mq_broker.mq","node":"module.dependencies.aws_mq_broker.mq","attribute":"deployment_mode","address":"stackit_rabbitmq_instance.dependencies_mq","source":"../../lib/dependencies/mq.tf:12","presence":"KNOWN_PRESENT","states":"The source broker module.dependencies.aws_mq_broker.mq runs as SINGLE_INSTANCE: one broker in one availability zone, no standby.","draft":"NOT_VERIFIED","draft_words":"the redundancy of the drafted stackit_rabbitmq_instance is the plan the draft leaves to a person (a variable), and this build does not compare it with the source's single instance.","hardening":"choose a target plan with more than one node, or accept the single instance knowingly.","owner":"Security Architect","level":"MEDIUM","waits_for_acceptance":false,"acceptance":"MEDIUM: stays an observation; no acceptance is asked for."},{"id":"convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:cluster_config.instance_count:SINGLE_NODE_DATA_STORE","kind":"SINGLE_NODE_DATA_STORE","severity":"SECURITY_OBSERVATION","blocking":false,"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","attribute":"cluster_config.instance_count","address":"stackit_opensearch_instance.dependencies_catalog_opensearch_this","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:29","presence":"KNOWN_PRESENT","states":"The source domain module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this runs on one data node (cluster_config.instance_count = 1): a failure or a maintenance of that node takes the domain down.","draft":"NOT_VERIFIED","draft_words":"the cluster_config is not carried (the drafted stackit_opensearch_instance takes a plan that sets the size, a variable); this build does not compare the plan with the source's single node.","hardening":"choose a target plan with more than one node, or accept the single node knowingly.","owner":"Security Architect","level":"MEDIUM","waits_for_acceptance":false,"acceptance":"MEDIUM: stays an observation; no acceptance is asked for."},{"id":"convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:access_policies.Statement[0]:WILDCARD_PRINCIPAL_POLICY","kind":"WILDCARD_PRINCIPAL_POLICY","severity":"SECURITY_OBSERVATION","blocking":false,"unit":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","node":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain_policy.this","attribute":"access_policies.Statement[0]","address":"stackit_opensearch_instance.dependencies_catalog_opensearch_this","source":".terraform/modules/dependencies.catalog_opensearch/main.tf:269","presence":"KNOWN_PRESENT","states":"The access policy of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (module.dependencies.module.catalog_opensearch.aws_opensearch_domain_policy.this) has Statement[0]: Effect Allow for Principal \"*\" with no condition for es:*: every caller that can reach the resource is allowed by the policy; only the network and the other controls limit who can.","draft":"NOT_CARRIED","draft_words":"the draft writes no resource policy: a stackit_opensearch_instance has no policy attribute (pinned provider schema) and is limited by its access list (parameters.sgw_acl), which the draft takes from a variable without a default, so the wildcard principal is not carried and the clients are named by a person.","hardening":"name the principals that need access instead of \"*\", or add a condition that limits the caller (the network, the account or the source address).","owner":"Security Architect","level":"HIGH","waits_for_acceptance":false,"acceptance":"HIGH: needs no acceptance, because the draft does not carry the weakness (narrowed, replaced or removed, as the draft line says)."},{"id":"convert:module.dependencies.module.catalog_rds.aws_rds_cluster.this:skip_final_snapshot:FINAL_SNAPSHOT_SKIPPED","kind":"FINAL_SNAPSHOT_SKIPPED","severity":"SECURITY_OBSERVATION","blocking":false,"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","node":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","attribute":"skip_final_snapshot","address":"stackit_mariadb_instance.dependencies_catalog_rds_this","source":".terraform/modules/dependencies.catalog_rds/main.tf:61","presence":"KNOWN_PRESENT","states":"The source aws_rds_cluster module.dependencies.module.catalog_rds.aws_rds_cluster.this is deleted without a final snapshot (skip_final_snapshot = true): when it is destroyed, its data is gone unless it was exported or backed up separately.","draft":"NOT_CARRIED","draft_words":"the draft carries no final-snapshot setting (the NOT CARRIED line of stackit_mariadb_instance.dependencies_catalog_rds_this says the target has none): destroying the drafted instance requests no final backup either.","hardening":"export the data (or take a backup you keep) before the instance is destroyed, and do not rely on the draft's destroy to keep it.","owner":"Security Architect","level":"MEDIUM","waits_for_acceptance":false,"acceptance":"MEDIUM: stays an observation; no acceptance is asked for."},{"id":"convert:module.dependencies.module.catalog_rds.aws_rds_cluster.this:aws_rds_cluster_instance:SINGLE_NODE_DATA_STORE","kind":"SINGLE_NODE_DATA_STORE","severity":"SECURITY_OBSERVATION","blocking":false,"unit":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","node":"module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this","attribute":"aws_rds_cluster_instance","address":"stackit_mariadb_instance.dependencies_catalog_rds_this","source":".terraform/modules/dependencies.catalog_rds/main.tf:175","presence":"KNOWN_PRESENT","states":"The source cluster module.dependencies.module.catalog_rds.aws_rds_cluster.this has one instance (module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this): no reader in a second zone to take over, a failure or a maintenance of that instance interrupts the database.","draft":"NOT_VERIFIED","draft_words":"the redundancy of the drafted stackit_mariadb_instance is its flavor and plan, which the draft states where it can (see the ledger row high availability when the source states standby); this build does not compare it with the source's single instance.","hardening":"choose a target flavor with a replica, or accept the single instance knowingly.","owner":"Security Architect","level":"MEDIUM","waits_for_acceptance":false,"acceptance":"MEDIUM: stays an observation; no acceptance is asked for."},{"id":"convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:transit_encryption_enabled:TRANSIT_ENCRYPTION_OFF","kind":"TRANSIT_ENCRYPTION_OFF","severity":"SECURITY_OBSERVATION","blocking":false,"unit":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"transit_encryption_enabled","address":"stackit_valkey_instance.dependencies_checkout_elasticache_redis_default","source":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf:115","presence":"KNOWN_PRESENT","states":"The source replication group module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default has transit_encryption_enabled = false: clients connect without TLS and the traffic between the nodes is not encrypted.","draft":"NOT_CARRIED","draft_words":"the draft does not carry the plaintext transport: STACKIT Key Value Store enforces TLS (a test on a STACKIT project, Valkey 8, eu01, 2026-09-24, found a plaintext connection closed by the server; knowledge base rule aws.elasticache_replication_group), so the clients that connect without TLS must switch to rediss://.","hardening":"have every client connect with TLS (rediss://) and keep the target TLS-only; this is a change to the clients, not to the draft.","owner":"Security Architect","level":"HIGH","waits_for_acceptance":false,"acceptance":"HIGH: needs no acceptance, because the draft does not carry the weakness (narrowed, replaced or removed, as the draft line says)."},{"id":"convert:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default:num_cache_clusters:SINGLE_NODE_DATA_STORE","kind":"SINGLE_NODE_DATA_STORE","severity":"SECURITY_OBSERVATION","blocking":false,"unit":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","node":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","attribute":"num_cache_clusters","address":"stackit_valkey_instance.dependencies_checkout_elasticache_redis_default","source":".terraform/modules/dependencies.checkout_elasticache_redis/main.tf:115","presence":"KNOWN_PRESENT","states":"The source replication group module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default runs on one node (num_cache_clusters states it): a failure or a maintenance of that node takes the cache down.","draft":"NOT_VERIFIED","draft_words":"the redundancy of the drafted stackit_valkey_instance is the plan the draft leaves to a person (a variable), and this build does not compare it with the source's single node.","hardening":"choose a target plan with more than one node, or accept the single node knowingly.","owner":"Security Architect","level":"MEDIUM","waits_for_acceptance":false,"acceptance":"MEDIUM: stays an observation; no acceptance is asked for."},{"id":"convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:skip_final_snapshot:FINAL_SNAPSHOT_SKIPPED","kind":"FINAL_SNAPSHOT_SKIPPED","severity":"SECURITY_OBSERVATION","blocking":false,"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","node":"module.dependencies.module.orders_rds.aws_rds_cluster.this","attribute":"skip_final_snapshot","address":"stackit_postgresflex_instance.dependencies_orders_rds_this","source":".terraform/modules/dependencies.orders_rds/main.tf:61","presence":"KNOWN_PRESENT","states":"The source aws_rds_cluster module.dependencies.module.orders_rds.aws_rds_cluster.this is deleted without a final snapshot (skip_final_snapshot = true): when it is destroyed, its data is gone unless it was exported or backed up separately.","draft":"NOT_CARRIED","draft_words":"the draft carries no final-snapshot setting (the NOT CARRIED line of stackit_postgresflex_instance.dependencies_orders_rds_this says the target has none): destroying the drafted instance requests no final backup either.","hardening":"export the data (or take a backup you keep) before the instance is destroyed, and do not rely on the draft's destroy to keep it.","owner":"Security Architect","level":"MEDIUM","waits_for_acceptance":false,"acceptance":"MEDIUM: stays an observation; no acceptance is asked for."},{"id":"convert:module.dependencies.module.orders_rds.aws_rds_cluster.this:aws_rds_cluster_instance:SINGLE_NODE_DATA_STORE","kind":"SINGLE_NODE_DATA_STORE","severity":"SECURITY_OBSERVATION","blocking":false,"unit":"module.dependencies.module.orders_rds.aws_rds_cluster.this","node":"module.dependencies.module.orders_rds.aws_rds_cluster_instance.this","attribute":"aws_rds_cluster_instance","address":"stackit_postgresflex_instance.dependencies_orders_rds_this","source":".terraform/modules/dependencies.orders_rds/main.tf:175","presence":"KNOWN_PRESENT","states":"The source cluster module.dependencies.module.orders_rds.aws_rds_cluster.this has one instance (module.dependencies.module.orders_rds.aws_rds_cluster_instance.this): no reader in a second zone to take over, a failure or a maintenance of that instance interrupts the database.","draft":"NOT_VERIFIED","draft_words":"the redundancy of the drafted stackit_postgresflex_instance is its flavor and plan, which the draft states where it can (see the ledger row high availability when the source states standby); this build does not compare it with the source's single instance.","hardening":"choose a target flavor with a replica, or accept the single instance knowingly.","owner":"Security Architect","level":"MEDIUM","waits_for_acceptance":false,"acceptance":"MEDIUM: stays an observation; no acceptance is asked for."},{"id":"convert:module.retail_app_ecs.module.alb.aws_lb.this:listener:80:PLAINTEXT_PUBLIC_LISTENER","kind":"PLAINTEXT_PUBLIC_LISTENER","severity":"SECURITY_OBSERVATION","blocking":false,"unit":"module.retail_app_ecs.module.alb.aws_lb.this","node":"module.retail_app_ecs.module.alb.aws_lb.this","attribute":"listener:80","address":"stackit_application_load_balancer.retail_app_ecs_alb_this","source":".terraform/modules/retail_app_ecs.alb/main.tf:5","presence":"KNOWN_PRESENT","states":"The source load balancer module.retail_app_ecs.module.alb.aws_lb.this is internet-facing and every listener it states is HTTP (port 80 forwards to its targets, no listener is HTTPS or TLS): clients reach the application without transport encryption.","draft":"PRESERVED","draft_words":"the drafted listener of stackit_application_load_balancer.retail_app_ecs_alb_this is plain HTTP on port 80, as the source states it; the public address is kept and no HTTPS listener or certificate is added.","hardening":"serve the application over HTTPS (an HTTPS listener with a certificate, certificate_config in the pinned provider schema) and redirect or close port 80.","owner":"Security Architect","level":"HIGH","waits_for_acceptance":true,"acceptance_step":"MAN/security/accept/module.retail_app_ecs.module.alb.aws_lb.this:plaintext-public-listener","acceptance":"HIGH: waits for security acceptance, because the draft carries the weakness. The cutover decision (GO or ROLLBACK) waits for the step that records who accepted it, when and by what reference, or for the hardening."},{"id":"convert:module.retail_app_ecs.module.carts_service.aws_security_group.this:ingress:tcp:8080-8080:0.0.0.0/0:OPEN_INGRESS_APPLICATION_PORT","kind":"OPEN_INGRESS_APPLICATION_PORT","severity":"SECURITY_OBSERVATION","blocking":false,"unit":"module.retail_app_ecs.module.carts_service.aws_security_group.this","node":"module.retail_app_ecs.module.carts_service.aws_security_group.this","attribute":"ingress:tcp:8080-8080:0.0.0.0/0","address":"stackit_security_group.retail_app_ecs_carts_service_this","source":"../../lib/ecs/service/sg.tf:1","presence":"KNOWN_PRESENT","states":"The source security group module.retail_app_ecs.module.carts_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to.","draft":"NOT_CARRIED","draft_words":"the drafted rule stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION).","hardening":"limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule.","owner":"Security Architect","level":"HIGH","waits_for_acceptance":true,"acceptance_step":"MAN/security/accept/module.retail_app_ecs.module.carts_service.aws_security_group.this:open-ingress-application-port","acceptance":"HIGH: waits for security acceptance, because the drafted rule is written as the source states it and is unenforced until the group is attached, so the weakness is not removed. The cutover decision (GO or ROLLBACK) waits for the step that records who accepted it, when and by what reference, or for the hardening."},{"id":"convert:module.retail_app_ecs.module.catalog_service.aws_security_group.this:ingress:tcp:8080-8080:0.0.0.0/0:OPEN_INGRESS_APPLICATION_PORT","kind":"OPEN_INGRESS_APPLICATION_PORT","severity":"SECURITY_OBSERVATION","blocking":false,"unit":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","node":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","attribute":"ingress:tcp:8080-8080:0.0.0.0/0","address":"stackit_security_group.retail_app_ecs_catalog_service_this","source":"../../lib/ecs/service/sg.tf:1","presence":"KNOWN_PRESENT","states":"The source security group module.retail_app_ecs.module.catalog_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to.","draft":"NOT_CARRIED","draft_words":"the drafted rule stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION).","hardening":"limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule.","owner":"Security Architect","level":"HIGH","waits_for_acceptance":true,"acceptance_step":"MAN/security/accept/module.retail_app_ecs.module.catalog_service.aws_security_group.this:open-ingress-application-port","acceptance":"HIGH: waits for security acceptance, because the drafted rule is written as the source states it and is unenforced until the group is attached, so the weakness is not removed. The cutover decision (GO or ROLLBACK) waits for the step that records who accepted it, when and by what reference, or for the hardening."},{"id":"convert:module.retail_app_ecs.module.checkout_service.aws_security_group.this:ingress:tcp:8080-8080:0.0.0.0/0:OPEN_INGRESS_APPLICATION_PORT","kind":"OPEN_INGRESS_APPLICATION_PORT","severity":"SECURITY_OBSERVATION","blocking":false,"unit":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","node":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","attribute":"ingress:tcp:8080-8080:0.0.0.0/0","address":"stackit_security_group.retail_app_ecs_checkout_service_this","source":"../../lib/ecs/service/sg.tf:1","presence":"KNOWN_PRESENT","states":"The source security group module.retail_app_ecs.module.checkout_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to.","draft":"NOT_CARRIED","draft_words":"the drafted rule stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION).","hardening":"limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule.","owner":"Security Architect","level":"HIGH","waits_for_acceptance":true,"acceptance_step":"MAN/security/accept/module.retail_app_ecs.module.checkout_service.aws_security_group.this:open-ingress-application-port","acceptance":"HIGH: waits for security acceptance, because the drafted rule is written as the source states it and is unenforced until the group is attached, so the weakness is not removed. The cutover decision (GO or ROLLBACK) waits for the step that records who accepted it, when and by what reference, or for the hardening."},{"id":"convert:module.retail_app_ecs.module.orders_service.aws_security_group.this:ingress:tcp:8080-8080:0.0.0.0/0:OPEN_INGRESS_APPLICATION_PORT","kind":"OPEN_INGRESS_APPLICATION_PORT","severity":"SECURITY_OBSERVATION","blocking":false,"unit":"module.retail_app_ecs.module.orders_service.aws_security_group.this","node":"module.retail_app_ecs.module.orders_service.aws_security_group.this","attribute":"ingress:tcp:8080-8080:0.0.0.0/0","address":"stackit_security_group.retail_app_ecs_orders_service_this","source":"../../lib/ecs/service/sg.tf:1","presence":"KNOWN_PRESENT","states":"The source security group module.retail_app_ecs.module.orders_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to.","draft":"NOT_CARRIED","draft_words":"the drafted rule stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION).","hardening":"limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule.","owner":"Security Architect","level":"HIGH","waits_for_acceptance":true,"acceptance_step":"MAN/security/accept/module.retail_app_ecs.module.orders_service.aws_security_group.this:open-ingress-application-port","acceptance":"HIGH: waits for security acceptance, because the drafted rule is written as the source states it and is unenforced until the group is attached, so the weakness is not removed. The cutover decision (GO or ROLLBACK) waits for the step that records who accepted it, when and by what reference, or for the hardening."},{"id":"convert:module.retail_app_ecs.module.ui_service.aws_security_group.this:ingress:tcp:8080-8080:0.0.0.0/0:OPEN_INGRESS_APPLICATION_PORT","kind":"OPEN_INGRESS_APPLICATION_PORT","severity":"SECURITY_OBSERVATION","blocking":false,"unit":"module.retail_app_ecs.module.ui_service.aws_security_group.this","node":"module.retail_app_ecs.module.ui_service.aws_security_group.this","attribute":"ingress:tcp:8080-8080:0.0.0.0/0","address":"stackit_security_group.retail_app_ecs_ui_service_this","source":"../../lib/ecs/service/sg.tf:1","presence":"KNOWN_PRESENT","states":"The source security group module.retail_app_ecs.module.ui_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to.","draft":"NOT_CARRIED","draft_words":"the drafted rule stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION).","hardening":"limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule.","owner":"Security Architect","level":"HIGH","waits_for_acceptance":true,"acceptance_step":"MAN/security/accept/module.retail_app_ecs.module.ui_service.aws_security_group.this:open-ingress-application-port","acceptance":"HIGH: waits for security acceptance, because the drafted rule is written as the source states it and is unenforced until the group is attached, so the weakness is not removed. The cutover decision (GO or ROLLBACK) waits for the step that records who accepted it, when and by what reference, or for the hardening."}],"application_compatibility":[{"contract":"APPLICATION_COMPATIBILITY","unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","task_definition":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this","workload":"carts","manifest":"kubernetes/carts/manifests.yaml","file":"applications/carts.json","cluster":"stackit_ske_cluster.retail_app_ecs_cluster","readiness":"BLOCKED","readiness_reasons":["DATASTORE_PROTOCOL_CHANGE","DATASTORE_PROTOCOL_NOT_ASSESSED","IDENTITY_OPEN","FUNCTIONAL_CHECK_NOT_RUN"],"readiness_words":"A data store this workload reaches changes protocol or has no assessed protocol, and its code migration decision is not answered: StackToIT keeps the workload blocked until the customer answers it in the decisions file.","checklist_sha256":"sha256:4ac4d30a793c5cac007abcd4adcf156d0a43b253131aaa38a0cfc8c0e8c766bd","templates":"applications/carts.templates.yaml","validation_scope":"A kubeconform check or a kubectl apply --dry-run of the manifest establishes YAML validity only, not behaviour: it accepts a REQUIRED_ token in a string field, an empty ConfigMap and a Secret that does not exist, and runs nothing; the checklist of the application compatibility contract and an application smoke test on the target are what show that the workload works.","containers":[{"name":"carts-service","image":"public.ecr.aws/aws-containers/retail-store-sample-cart:1.6.3","image_rebinding":"pulled from where the source pulls it (Amazon ECR image public.ecr.aws/aws-containers/retail-store-sample-cart:1.6.3): decide where the images live on STACKIT, that the cluster can reach the registry, and the pull secret","ports":["8080/TCP"],"probes":["livenessProbe: exec curl -f http://localhost:8080/actuator/health (the ECS health check)","startupProbe: the same check over the start period"],"env":[]}],"endpoints":[{"kind":"SERVICE_CONNECT_ALIAS","source":"carts:80 (the Service Connect alias of port carts-service in the namespace not visible statically)","target":"carts:80 (the Kubernetes Service carts, port 80 → container port 8080, in the namespace the manifests are applied into)","work":"the Kubernetes Service keeps the name and port the clients call: check that they resolve it from their namespace; the Service Connect proxy (its retries, timeouts, TLS and metrics) is not carried"}],"identity":{"task_role":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","target":"open: the decision target.workload.identity (inputs.json) chooses federated_service_account (a Kubernetes ServiceAccount federated to the STACKIT service account of the role), service_account_key (a key of that service account mounted as a Secret) or no_workload_identity","work":"answer target.workload.identity for module.retail_app_ecs.module.carts_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.carts_service.aws_iam_role.task_role fails","service_account_template":"applications/carts.templates.yaml","manual_steps":["answer the input target.workload.identity for module.retail_app_ecs.module.carts_service.aws_ecs_service.this in inputs.json: with federated_service_account the draft writes the stackit_service_account of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role, its federated identity provider for the SKE cluster's service-account issuer and the Kubernetes ServiceAccount carts in the manifest","until then, create a STACKIT service account named after the task role module.retail_app_ecs.module.carts_service.aws_iam_role.task_role and grant it the role assignments the policies of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role give (identity.tf lists them as the architect's variable)","federate it to the SKE cluster's service-account issuer for the subject system:serviceaccount:\u003cnamespace\u003e:carts, and apply the ServiceAccount of applications/carts.templates.yaml (its annotation holds the service account's e-mail) in the namespace of the workload","change the application from the AWS SDK credential chain to the STACKIT SDK, which picks up the projected token: every call the application made with module.retail_app_ecs.module.carts_service.aws_iam_role.task_role fails until it does"]},"datastores":[{"source":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","source_kind":"DynamoDB","protocol":"PROTOCOL_NOT_ASSESSED","evidence":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this references module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","work":"the data store module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled is not drafted: decide its target and check that the application's client library speaks its protocol","code_migration":{"id":"application:carts:code-migration:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","question":"The protocol compatibility of DynamoDB and the target of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled is not assessed: has the application's use of it been checked?","owner":"Application owner (development team)","blocks":"BLOCKED","options":[{"id":"compatibility-verified","title":"the calls the application makes were checked against the target store and found compatible","unblocks":true},{"id":"different-target-store","title":"a target store that speaks the protocol of the source is wanted instead: the draft is regenerated with it, and the workload stays blocked until then","unblocks":false}],"sha256":"sha256:3a3532180fa98f2d9ed6e4008f984102c7dbc1cc657c4380ef955bfe03b89749","state":"OPEN"}},{"source":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore","source_kind":"DynamoDB","protocol":"PROTOCOL_NOT_ASSESSED","evidence":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this references module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore","work":"the data store module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore is not drafted: decide its target and check that the application's client library speaks its protocol","code_migration":{"id":"application:carts:code-migration:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore","question":"The protocol compatibility of DynamoDB and the target of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore is not assessed: has the application's use of it been checked?","owner":"Application owner (development team)","blocks":"BLOCKED","options":[{"id":"compatibility-verified","title":"the calls the application makes were checked against the target store and found compatible","unblocks":true},{"id":"different-target-store","title":"a target store that speaks the protocol of the source is wanted instead: the draft is regenerated with it, and the workload stays blocked until then","unblocks":false}],"sha256":"sha256:0af54169ba070dcc1f111588ed567956c5990aa825440f2e882493d0de204bde","state":"OPEN"}},{"source":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","source_kind":"DynamoDB","target":"stackit_mongodbflex_instance.dynamodb_tables","target_kind":"MongoDB Flex","protocol":"DATASTORE_PROTOCOL_CHANGE","evidence":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this references module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","work":"the application reads DynamoDB through its API and the target stackit_mongodbflex_instance.dynamodb_tables (MongoDB Flex) speaks another protocol: the data access code of the application is rewritten and a new image is built before the manifest is applied; a database engine swap is not an application migration","code_migration":{"id":"application:carts:code-migration:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","question":"The target stackit_mongodbflex_instance.dynamodb_tables speaks another protocol than DynamoDB: what is done about the data access code of carts?","owner":"Application owner (development team)","blocks":"BLOCKED","options":[{"id":"rewrite-data-access-code","title":"the data access code of the application is rewritten to speak the protocol of the target store (the item DATASTORE_CODE_CHANGE is then done when the new image is built)","unblocks":true},{"id":"different-target-store","title":"a target store that speaks the protocol of the source is wanted instead: the draft is regenerated with it, and the workload stays blocked until then","unblocks":false}],"sha256":"sha256:cf8ebb01fe1a077308775e1c4b2ec89f667e1ac098a627ac7e625fdd5351c6b5","state":"OPEN"}}],"dns_dependencies":[{"kind":"SERVICE_CONNECT_ALIAS","name":"carts","source":"a Service Connect alias in the Cloud Map private DNS namespace retailstore.local (module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this): the clients of the namespace resolve it through the Service Connect proxy of their tasks","consumers":[],"provision":"CLUSTER_SERVICE","target":"carts.\u003cnamespace\u003e.svc.cluster.local (the Kubernetes Service carts; carts from a pod of the same namespace)","verification":"resolve, from a pod of a client of carts, carts and carts.\u003cnamespace\u003e.svc.cluster.local: expect the ClusterIP of the Kubernetes Service carts (kubectl get service carts)"}],"checklist":[{"id":"datastore_protocol_check:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","kind":"DATASTORE_PROTOCOL_CHECK","subject":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled","blocking":true,"sha256":"sha256:452434a4541a3db21db09ea0d8d38c5df5b0acc9fa8314701f457a9616481161","state":"OPEN","work":"the data store module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled is not drafted: decide its target and check that the application's client library speaks its protocol"},{"id":"datastore_protocol_check:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore","kind":"DATASTORE_PROTOCOL_CHECK","subject":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore","blocking":true,"sha256":"sha256:1a1c50dc7df3d51f58cabf9784cc227a7645ae0bf7353c7b6e1db8f0da6fffa8","state":"OPEN","work":"the data store module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore is not drafted: decide its target and check that the application's client library speaks its protocol"},{"id":"datastore_code_change:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","kind":"DATASTORE_CODE_CHANGE","subject":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","blocking":true,"sha256":"sha256:aaadfdab94b93db541da5a6041c8afdd8f4258c5f84b5616c6ef55364781ff1a","state":"OPEN","work":"the application reads DynamoDB through its API and the target stackit_mongodbflex_instance.dynamodb_tables (MongoDB Flex) speaks another protocol: the data access code of the application is rewritten and a new image is built before the manifest is applied; a database engine swap is not an application migration"},{"id":"identity:module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","kind":"IDENTITY","subject":"module.retail_app_ecs.module.carts_service.aws_iam_role.task_role","blocking":true,"sha256":"sha256:274e8e9ca7cf47e323b7f1766a4ad8813e7cb2656d5dee693825f58a93bb095a","state":"OPEN","work":"answer target.workload.identity for module.retail_app_ecs.module.carts_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.carts_service.aws_iam_role.task_role fails"},{"id":"smoke_test:carts","kind":"SMOKE_TEST","subject":"carts","blocking":true,"sha256":"sha256:fd73c018a38d3f67ec495c31257e928922819e44e30a49096000f9d2594a7116","state":"OPEN","work":"run an application smoke test on the target: the pods start, answer their clients through the Kubernetes Service carts, reach every dependency above and read and write their data; StackToIT runs nothing on the target"}]},{"contract":"APPLICATION_COMPATIBILITY","unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","task_definition":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this","workload":"catalog","manifest":"kubernetes/catalog/manifests.yaml","file":"applications/catalog.json","cluster":"stackit_ske_cluster.retail_app_ecs_cluster","readiness":"BLOCKED","readiness_reasons":["DATASTORE_PROTOCOL_NOT_ASSESSED","ENGINE_VERSION_DOWNGRADE","IDENTITY_OPEN","FUNCTIONAL_CHECK_NOT_RUN"],"readiness_words":"A data store this workload reaches changes protocol or has no assessed protocol, and its code migration decision is not answered: StackToIT keeps the workload blocked until the customer answers it in the decisions file. StackToIT keeps the workload blocked: the database engine version 3.3 is not offered in the region; the application cannot be verified against a downgraded engine until the decision DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE is answered (the customer answers it in the decisions file).","checklist_sha256":"sha256:9911d17bdb9f71a561c331311f9caddcdbb2785089efffcb2c7d636007be8497","templates":"applications/catalog.templates.yaml","validation_scope":"A kubeconform check or a kubectl apply --dry-run of the manifest establishes YAML validity only, not behaviour: it accepts a REQUIRED_ token in a string field, an empty ConfigMap and a Secret that does not exist, and runs nothing; the checklist of the application compatibility contract and an application smoke test on the target are what show that the workload works.","containers":[{"name":"catalog-service","image":"public.ecr.aws/aws-containers/retail-store-sample-catalog:1.6.3","image_rebinding":"pulled from where the source pulls it (Amazon ECR image public.ecr.aws/aws-containers/retail-store-sample-catalog:1.6.3): decide where the images live on STACKIT, that the cluster can reach the registry, and the pull secret","ports":["8080/TCP"],"probes":["livenessProbe: exec curl -f http://localhost:8080/health (the ECS health check)","startupProbe: the same check over the start period"],"env":[]}],"endpoints":[{"kind":"SERVICE_CONNECT_ALIAS","source":"catalog:80 (the Service Connect alias of port catalog-service in the namespace not visible statically)","target":"catalog:80 (the Kubernetes Service catalog, port 80 → container port 8080, in the namespace the manifests are applied into)","work":"the Kubernetes Service keeps the name and port the clients call: check that they resolve it from their namespace; the Service Connect proxy (its retries, timeouts, TLS and metrics) is not carried"}],"identity":{"task_role":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","target":"open: the decision target.workload.identity (inputs.json) chooses federated_service_account (a Kubernetes ServiceAccount federated to the STACKIT service account of the role), service_account_key (a key of that service account mounted as a Secret) or no_workload_identity","work":"answer target.workload.identity for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role fails","service_account_template":"applications/catalog.templates.yaml","manual_steps":["answer the input target.workload.identity for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this in inputs.json: with federated_service_account the draft writes the stackit_service_account of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role, its federated identity provider for the SKE cluster's service-account issuer and the Kubernetes ServiceAccount catalog in the manifest","until then, create a STACKIT service account named after the task role module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role and grant it the role assignments the policies of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role give (identity.tf lists them as the architect's variable)","federate it to the SKE cluster's service-account issuer for the subject system:serviceaccount:\u003cnamespace\u003e:catalog, and apply the ServiceAccount of applications/catalog.templates.yaml (its annotation holds the service account's e-mail) in the namespace of the workload","change the application from the AWS SDK credential chain to the STACKIT SDK, which picks up the projected token: every call the application made with module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role fails until it does"]},"datastores":[{"source":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","source_kind":"OpenSearch","target":"stackit_opensearch_instance.dependencies_catalog_opensearch_this","target_kind":"OpenSearch","protocol":"PROTOCOL_NOT_ASSESSED","evidence":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this references module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","work":"the protocol compatibility of OpenSearch and stackit_opensearch_instance.dependencies_catalog_opensearch_this (OpenSearch) is not assessed (the source runs 3.3 and the region offers 2, and the REST API, the clients and the plugins differ across major versions): check the calls the application makes against the target before the manifest is applied","code_migration":{"id":"application:catalog:code-migration:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","question":"The protocol compatibility of OpenSearch and the target stackit_opensearch_instance.dependencies_catalog_opensearch_this is not assessed: has the application's use of it been checked?","owner":"Application owner (development team)","blocks":"BLOCKED","options":[{"id":"compatibility-verified","title":"the calls the application makes were checked against the target store and found compatible","unblocks":true},{"id":"different-target-store","title":"a target store that speaks the protocol of the source is wanted instead: the draft is regenerated with it, and the workload stays blocked until then","unblocks":false}],"sha256":"sha256:3e2dadac228fe08cb770a5dadc471d1502b31b102b5668389783fc3d37623053","state":"OPEN"},"engine_downgrade":{"decision":"convert:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this:version:ENGINE_VERSION_DOWNGRADE","state":"OPEN","words":"the database engine version 3.3 is not offered in the region; the application cannot be verified against a downgraded engine until the decision DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE is answered"}},{"source":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","source_kind":"Aurora","target":"stackit_mariadb_instance.dependencies_catalog_rds_this","target_kind":"MariaDB","protocol":"PROTOCOL_NOT_ASSESSED","evidence":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this reads the secret module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db, which is built from module.dependencies.module.catalog_rds.aws_rds_cluster.this","work":"the target stackit_mariadb_instance.dependencies_catalog_rds_this (MariaDB) speaks the MySQL wire protocol, so a setting that selects the MySQL driver stays; MariaDB 10.11 documents incompatibilities with MySQL 8.0 that the application can meet (the authentication plugin of its accounts, the JSON type and operators, the default collation and sql_mode: the findings of the data store), and which of them it uses is not assessed: run the schema and the queries of the application against a MariaDB instance before the manifest is applied","code_migration":{"id":"application:catalog:code-migration:module.dependencies.module.catalog_rds.aws_rds_cluster.this","question":"The protocol compatibility of Aurora and the target stackit_mariadb_instance.dependencies_catalog_rds_this is not assessed: has the application's use of it been checked?","owner":"Application owner (development team)","blocks":"BLOCKED","options":[{"id":"compatibility-verified","title":"the calls the application makes were checked against the target store and found compatible","unblocks":true},{"id":"different-target-store","title":"a target store that speaks the protocol of the source is wanted instead: the draft is regenerated with it, and the workload stays blocked until then","unblocks":false}],"sha256":"sha256:bdb5c39ce78117874f2a8e30f53120b54cf0b076481f246f4dcddb0a2a62cb4e","state":"OPEN"}}],"dns_dependencies":[{"kind":"MANAGED_ENDPOINT","name":"the endpoint host of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch)","source":"the endpoint host AWS assigns OpenSearch module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this when it is applied (not visible statically), answered by AWS DNS (inside a VPC the VPC resolver answers it with a private address)","consumers":["catalog: module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this references module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this"],"provision":"ENDPOINT_ATTRIBUTE","target":"the host name the STACKIT instance stackit_opensearch_instance.dependencies_catalog_opensearch_this (OpenSearch) publishes, read from the instance and its credential after it is applied; the draft holds no value of it","verification":"resolve, from a pod of catalog, the host of stackit_opensearch_instance.dependencies_catalog_opensearch_this and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens"},{"kind":"MANAGED_ENDPOINT","name":"the endpoint host of module.dependencies.module.catalog_rds.aws_rds_cluster.this (Aurora)","source":"the endpoint host AWS assigns Aurora module.dependencies.module.catalog_rds.aws_rds_cluster.this when it is applied (not visible statically), answered by AWS DNS (inside a VPC the VPC resolver answers it with a private address)","consumers":["catalog: module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this reads the secret module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db, which is built from module.dependencies.module.catalog_rds.aws_rds_cluster.this"],"provision":"ENDPOINT_ATTRIBUTE","target":"the host name the STACKIT instance stackit_mariadb_instance.dependencies_catalog_rds_this (MariaDB) publishes, read from the instance and its credential after it is applied; the draft holds no value of it","verification":"resolve, from a pod of catalog, the host of stackit_mariadb_instance.dependencies_catalog_rds_this and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens"},{"kind":"SERVICE_CONNECT_ALIAS","name":"catalog","source":"a Service Connect alias in the Cloud Map private DNS namespace retailstore.local (module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this): the clients of the namespace resolve it through the Service Connect proxy of their tasks","consumers":[],"provision":"CLUSTER_SERVICE","target":"catalog.\u003cnamespace\u003e.svc.cluster.local (the Kubernetes Service catalog; catalog from a pod of the same namespace)","verification":"resolve, from a pod of a client of catalog, catalog and catalog.\u003cnamespace\u003e.svc.cluster.local: expect the ClusterIP of the Kubernetes Service catalog (kubectl get service catalog)"}],"checklist":[{"id":"datastore_protocol_check:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","kind":"DATASTORE_PROTOCOL_CHECK","subject":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","blocking":true,"sha256":"sha256:0680823c09a91d27130e8ccf127fa4b5dc478ac04f9508e6b0be37c8bc6070f7","state":"OPEN","work":"the protocol compatibility of OpenSearch and stackit_opensearch_instance.dependencies_catalog_opensearch_this (OpenSearch) is not assessed (the source runs 3.3 and the region offers 2, and the REST API, the clients and the plugins differ across major versions): check the calls the application makes against the target before the manifest is applied"},{"id":"datastore_protocol_check:module.dependencies.module.catalog_rds.aws_rds_cluster.this","kind":"DATASTORE_PROTOCOL_CHECK","subject":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","blocking":true,"sha256":"sha256:b55a2fd4266b13d853a322d08b2cf3f7972abb26e420dc51108b4ae8c1457459","state":"OPEN","work":"the target stackit_mariadb_instance.dependencies_catalog_rds_this (MariaDB) speaks the MySQL wire protocol, so a setting that selects the MySQL driver stays; MariaDB 10.11 documents incompatibilities with MySQL 8.0 that the application can meet (the authentication plugin of its accounts, the JSON type and operators, the default collation and sql_mode: the findings of the data store), and which of them it uses is not assessed: run the schema and the queries of the application against a MariaDB instance before the manifest is applied"},{"id":"identity:module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","kind":"IDENTITY","subject":"module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role","blocking":true,"sha256":"sha256:7ad5d41f0abdbd255bd24a03b571836ab3550636a04da904568dbf13033258f2","state":"OPEN","work":"answer target.workload.identity for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role fails"},{"id":"smoke_test:catalog","kind":"SMOKE_TEST","subject":"catalog","blocking":true,"sha256":"sha256:c4708d64953c81add11e3f3c7a0f54ecf8233d45bae04d9ffb3631c08f84d106","state":"OPEN","work":"run an application smoke test on the target: the pods start, answer their clients through the Kubernetes Service catalog, reach every dependency above and read and write their data; StackToIT runs nothing on the target"}]},{"contract":"APPLICATION_COMPATIBILITY","unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","task_definition":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this","workload":"checkout","manifest":"kubernetes/checkout/manifests.yaml","file":"applications/checkout.json","cluster":"stackit_ske_cluster.retail_app_ecs_cluster","readiness":"BLOCKED","readiness_reasons":["DATASTORE_PROTOCOL_NOT_ASSESSED","IDENTITY_OPEN","FUNCTIONAL_CHECK_NOT_RUN"],"readiness_words":"A data store this workload reaches changes protocol or has no assessed protocol, and its code migration decision is not answered: StackToIT keeps the workload blocked until the customer answers it in the decisions file.","checklist_sha256":"sha256:4bae9ab778c2772005b360df4f79c52fd5f0a677d0c3003ea84986eb3050cf92","templates":"applications/checkout.templates.yaml","validation_scope":"A kubeconform check or a kubectl apply --dry-run of the manifest establishes YAML validity only, not behaviour: it accepts a REQUIRED_ token in a string field, an empty ConfigMap and a Secret that does not exist, and runs nothing; the checklist of the application compatibility contract and an application smoke test on the target are what show that the workload works.","containers":[{"name":"checkout-service","image":"public.ecr.aws/aws-containers/retail-store-sample-checkout:1.6.3","image_rebinding":"pulled from where the source pulls it (Amazon ECR image public.ecr.aws/aws-containers/retail-store-sample-checkout:1.6.3): decide where the images live on STACKIT, that the cluster can reach the registry, and the pull secret","ports":["8080/TCP"],"probes":["livenessProbe: exec curl -f http://localhost:8080/health (the ECS health check)","startupProbe: the same check over the start period"],"env":[]}],"endpoints":[{"kind":"SERVICE_CONNECT_ALIAS","source":"checkout:80 (the Service Connect alias of port checkout-service in the namespace not visible statically)","target":"checkout:80 (the Kubernetes Service checkout, port 80 → container port 8080, in the namespace the manifests are applied into)","work":"the Kubernetes Service keeps the name and port the clients call: check that they resolve it from their namespace; the Service Connect proxy (its retries, timeouts, TLS and metrics) is not carried"}],"identity":{"task_role":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","target":"open: the decision target.workload.identity (inputs.json) chooses federated_service_account (a Kubernetes ServiceAccount federated to the STACKIT service account of the role), service_account_key (a key of that service account mounted as a Secret) or no_workload_identity","work":"answer target.workload.identity for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role fails","service_account_template":"applications/checkout.templates.yaml","manual_steps":["answer the input target.workload.identity for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this in inputs.json: with federated_service_account the draft writes the stackit_service_account of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role, its federated identity provider for the SKE cluster's service-account issuer and the Kubernetes ServiceAccount checkout in the manifest","until then, create a STACKIT service account named after the task role module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role and grant it the role assignments the policies of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role give (identity.tf lists them as the architect's variable)","federate it to the SKE cluster's service-account issuer for the subject system:serviceaccount:\u003cnamespace\u003e:checkout, and apply the ServiceAccount of applications/checkout.templates.yaml (its annotation holds the service account's e-mail) in the namespace of the workload","change the application from the AWS SDK credential chain to the STACKIT SDK, which picks up the projected token: every call the application made with module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role fails until it does"]},"datastores":[{"source":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","source_kind":"ElastiCache","target":"stackit_valkey_instance.dependencies_checkout_elasticache_redis_default","target_kind":"Key Value Store (Valkey)","protocol":"PROTOCOL_NOT_ASSESSED","evidence":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this references module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","work":"the target stackit_valkey_instance.dependencies_checkout_elasticache_redis_default (Key Value Store, Valkey) speaks the Redis protocol and accepts TLS connections only, so the clients change: the source runs without TLS (transit_encryption_enabled = false), so the scheme redis:// becomes rediss://, the client's TLS option is switched on and the CA certificate of the instance is trusted; check the commands the application sends against the target before the manifest is applied (its credential is no administrator: CONFIG, ACL and MODULE are denied)","code_migration":{"id":"application:checkout:code-migration:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","question":"The protocol compatibility of ElastiCache and the target stackit_valkey_instance.dependencies_checkout_elasticache_redis_default is not assessed: has the application's use of it been checked?","owner":"Application owner (development team)","blocks":"BLOCKED","options":[{"id":"compatibility-verified","title":"the calls the application makes were checked against the target store and found compatible","unblocks":true},{"id":"different-target-store","title":"a target store that speaks the protocol of the source is wanted instead: the draft is regenerated with it, and the workload stays blocked until then","unblocks":false}],"sha256":"sha256:d2632928c6a75f74c14ad8d0b4552ace49e36051cc4e6b5690cc009e40f937b3","state":"OPEN"}}],"dns_dependencies":[{"kind":"MANAGED_ENDPOINT","name":"the endpoint host of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (ElastiCache)","source":"the endpoint host AWS assigns ElastiCache module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default when it is applied (not visible statically), answered by AWS DNS (inside a VPC the VPC resolver answers it with a private address)","consumers":["checkout: module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this references module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default"],"provision":"ENDPOINT_ATTRIBUTE","target":"the host name the STACKIT instance stackit_valkey_instance.dependencies_checkout_elasticache_redis_default (Key Value Store (Valkey)) publishes, read from the instance and its credential after it is applied; the draft holds no value of it","verification":"resolve, from a pod of checkout, the host of stackit_valkey_instance.dependencies_checkout_elasticache_redis_default and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens"},{"kind":"SERVICE_CONNECT_ALIAS","name":"checkout","source":"a Service Connect alias in the Cloud Map private DNS namespace retailstore.local (module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this): the clients of the namespace resolve it through the Service Connect proxy of their tasks","consumers":[],"provision":"CLUSTER_SERVICE","target":"checkout.\u003cnamespace\u003e.svc.cluster.local (the Kubernetes Service checkout; checkout from a pod of the same namespace)","verification":"resolve, from a pod of a client of checkout, checkout and checkout.\u003cnamespace\u003e.svc.cluster.local: expect the ClusterIP of the Kubernetes Service checkout (kubectl get service checkout)"}],"checklist":[{"id":"datastore_protocol_check:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","kind":"DATASTORE_PROTOCOL_CHECK","subject":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","blocking":true,"sha256":"sha256:a426acab1dbc5d4cf073c913f54e7e451c42424ff68fb1e77451a8f9e8907608","state":"OPEN","work":"the target stackit_valkey_instance.dependencies_checkout_elasticache_redis_default (Key Value Store, Valkey) speaks the Redis protocol and accepts TLS connections only, so the clients change: the source runs without TLS (transit_encryption_enabled = false), so the scheme redis:// becomes rediss://, the client's TLS option is switched on and the CA certificate of the instance is trusted; check the commands the application sends against the target before the manifest is applied (its credential is no administrator: CONFIG, ACL and MODULE are denied)"},{"id":"identity:module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","kind":"IDENTITY","subject":"module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role","blocking":true,"sha256":"sha256:584bf44338daf24e3d6bb96626e6681acf2477a2e0c5a9dc94e70a1db07af471","state":"OPEN","work":"answer target.workload.identity for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role fails"},{"id":"smoke_test:checkout","kind":"SMOKE_TEST","subject":"checkout","blocking":true,"sha256":"sha256:6ebcff17abc01e49263b3fcc3a614249619bae82e7733dee1cdd38675a6551cf","state":"OPEN","work":"run an application smoke test on the target: the pods start, answer their clients through the Kubernetes Service checkout, reach every dependency above and read and write their data; StackToIT runs nothing on the target"}]},{"contract":"APPLICATION_COMPATIBILITY","unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","task_definition":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this","workload":"orders","manifest":"kubernetes/orders/manifests.yaml","file":"applications/orders.json","cluster":"stackit_ske_cluster.retail_app_ecs_cluster","readiness":"NOT_READY","readiness_reasons":["ENV_VALUES_REQUIRED","IDENTITY_OPEN","FUNCTIONAL_CHECK_NOT_RUN"],"readiness_words":"Checklist items are open: StackToIT lists the work and counts an item done only when the customer marks it in the decisions file (application_checklists); StackToIT never deploys the application.","checklist_sha256":"sha256:84606ea46e27a1d77d1b805e0ec83551520af522648132df1d86a8be07584f45","templates":"applications/orders.templates.yaml","validation_scope":"A kubeconform check or a kubectl apply --dry-run of the manifest establishes YAML validity only, not behaviour: it accepts a REQUIRED_ token in a string field, an empty ConfigMap and a Secret that does not exist, and runs nothing; the checklist of the application compatibility contract and an application smoke test on the target are what show that the workload works.","containers":[{"name":"orders-service","image":"public.ecr.aws/aws-containers/retail-store-sample-orders:1.6.3","image_rebinding":"pulled from where the source pulls it (Amazon ECR image public.ecr.aws/aws-containers/retail-store-sample-orders:1.6.3): decide where the images live on STACKIT, that the cluster can reach the registry, and the pull secret","ports":["8080/TCP"],"probes":["livenessProbe: exec curl -f http://localhost:8080/actuator/health (the ECS health check)","startupProbe: the same check over the start period"],"env":[{"name":"RETAIL_ORDERS_MESSAGING_PROVIDER","class":"LITERAL","value_copied":false,"work":"set the key in the ConfigMap to the value module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this states for container orders-service (not copied: an environment value can carry a secret under any name); if it names an AWS endpoint, a region or an ARN, give the STACKIT one"},{"name":"RETAIL_ORDERS_PERSISTENCE_NAME","class":"LITERAL","value_copied":false,"work":"set the key in the ConfigMap to the value module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this states for container orders-service (not copied: an environment value can carry a secret under any name); if it names an AWS endpoint, a region or an ARN, give the STACKIT one"},{"name":"RETAIL_ORDERS_PERSISTENCE_PROVIDER","class":"LITERAL","value_copied":false,"work":"set the key in the ConfigMap to the value module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this states for container orders-service (not copied: an environment value can carry a secret under any name); if it names an AWS endpoint, a region or an ARN, give the STACKIT one"}]}],"endpoints":[{"kind":"SERVICE_CONNECT_ALIAS","source":"orders:80 (the Service Connect alias of port orders-service in the namespace not visible statically)","target":"orders:80 (the Kubernetes Service orders, port 80 → container port 8080, in the namespace the manifests are applied into)","work":"the Kubernetes Service keeps the name and port the clients call: check that they resolve it from their namespace; the Service Connect proxy (its retries, timeouts, TLS and metrics) is not carried"}],"identity":{"task_role":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","target":"open: the decision target.workload.identity (inputs.json) chooses federated_service_account (a Kubernetes ServiceAccount federated to the STACKIT service account of the role), service_account_key (a key of that service account mounted as a Secret) or no_workload_identity","work":"answer target.workload.identity for module.retail_app_ecs.module.orders_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.orders_service.aws_iam_role.task_role fails","service_account_template":"applications/orders.templates.yaml","manual_steps":["answer the input target.workload.identity for module.retail_app_ecs.module.orders_service.aws_ecs_service.this in inputs.json: with federated_service_account the draft writes the stackit_service_account of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role, its federated identity provider for the SKE cluster's service-account issuer and the Kubernetes ServiceAccount orders in the manifest","until then, create a STACKIT service account named after the task role module.retail_app_ecs.module.orders_service.aws_iam_role.task_role and grant it the role assignments the policies of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role give (identity.tf lists them as the architect's variable)","federate it to the SKE cluster's service-account issuer for the subject system:serviceaccount:\u003cnamespace\u003e:orders, and apply the ServiceAccount of applications/orders.templates.yaml (its annotation holds the service account's e-mail) in the namespace of the workload","change the application from the AWS SDK credential chain to the STACKIT SDK, which picks up the projected token: every call the application made with module.retail_app_ecs.module.orders_service.aws_iam_role.task_role fails until it does"]},"datastores":[{"source":"module.dependencies.aws_mq_broker.mq","source_kind":"Amazon MQ","target":"stackit_rabbitmq_instance.dependencies_mq","target_kind":"RabbitMQ","protocol":"SAME_PROTOCOL","evidence":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this reads the secret module.retail_app_ecs.aws_secretsmanager_secret_version.mq, which is built from module.dependencies.aws_mq_broker.mq","work":"the target stackit_rabbitmq_instance.dependencies_mq (STACKIT RabbitMQ) is RabbitMQ and speaks AMQP 0-9-1 like the Amazon MQ broker: point the application at the amqp URI of a credential of the instance; AMQP 1.0 (which Amazon MQ serves from RabbitMQ 4), MQTT and STOMP are not assessed (STACKIT's plugin list has the MQTT and STOMP plugins, its documentation does not state AMQP 1.0), nor whether the connection requires TLS (the source's clients use TLS on port 5671): check the scheme and the port the credential names, the plugins the broker uses and the definitions to import"},{"source":"module.dependencies.module.orders_rds.aws_rds_cluster.this","source_kind":"Aurora","target":"stackit_postgresflex_instance.dependencies_orders_rds_this","target_kind":"PostgreSQL Flex","protocol":"SAME_PROTOCOL","evidence":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this reads the secret module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db, which is built from module.dependencies.module.orders_rds.aws_rds_cluster.this","work":"the target stackit_postgresflex_instance.dependencies_orders_rds_this speaks the same protocol: point the application at its endpoint and credentials and check the engine version and the extensions it uses"}],"dns_dependencies":[{"kind":"MANAGED_ENDPOINT","name":"the endpoint host of module.dependencies.aws_mq_broker.mq (Amazon MQ)","source":"the endpoint host AWS assigns Amazon MQ module.dependencies.aws_mq_broker.mq when it is applied (not visible statically), answered by AWS DNS (inside a VPC the VPC resolver answers it with a private address)","consumers":["orders: module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this reads the secret module.retail_app_ecs.aws_secretsmanager_secret_version.mq, which is built from module.dependencies.aws_mq_broker.mq"],"provision":"ENDPOINT_ATTRIBUTE","target":"the host name the STACKIT instance stackit_rabbitmq_instance.dependencies_mq (RabbitMQ) publishes, read from the instance and its credential after it is applied; the draft holds no value of it","verification":"resolve, from a pod of orders, the host of stackit_rabbitmq_instance.dependencies_mq and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens"},{"kind":"MANAGED_ENDPOINT","name":"the endpoint host of module.dependencies.module.orders_rds.aws_rds_cluster.this (Aurora)","source":"the endpoint host AWS assigns Aurora module.dependencies.module.orders_rds.aws_rds_cluster.this when it is applied (not visible statically), answered by AWS DNS (inside a VPC the VPC resolver answers it with a private address)","consumers":["orders: module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this reads the secret module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db, which is built from module.dependencies.module.orders_rds.aws_rds_cluster.this"],"provision":"ENDPOINT_ATTRIBUTE","target":"the host name the STACKIT instance stackit_postgresflex_instance.dependencies_orders_rds_this (PostgreSQL Flex) publishes, read from the instance and its credential after it is applied; the draft holds no value of it","verification":"resolve, from a pod of orders, the host of stackit_postgresflex_instance.dependencies_orders_rds_this and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens"},{"kind":"SERVICE_CONNECT_ALIAS","name":"orders","source":"a Service Connect alias in the Cloud Map private DNS namespace retailstore.local (module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this): the clients of the namespace resolve it through the Service Connect proxy of their tasks","consumers":[],"provision":"CLUSTER_SERVICE","target":"orders.\u003cnamespace\u003e.svc.cluster.local (the Kubernetes Service orders; orders from a pod of the same namespace)","verification":"resolve, from a pod of a client of orders, orders and orders.\u003cnamespace\u003e.svc.cluster.local: expect the ClusterIP of the Kubernetes Service orders (kubectl get service orders)"}],"checklist":[{"id":"env_value:orders-service/RETAIL_ORDERS_MESSAGING_PROVIDER","kind":"ENV_VALUE","subject":"orders-service/RETAIL_ORDERS_MESSAGING_PROVIDER","blocking":true,"sha256":"sha256:d129bad0b42084609a1258577760beaef59dc3857057d30399ec88e78617ba12","state":"OPEN","work":"set the key in the ConfigMap to the value module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this states for container orders-service (not copied: an environment value can carry a secret under any name); if it names an AWS endpoint, a region or an ARN, give the STACKIT one"},{"id":"env_value:orders-service/RETAIL_ORDERS_PERSISTENCE_NAME","kind":"ENV_VALUE","subject":"orders-service/RETAIL_ORDERS_PERSISTENCE_NAME","blocking":true,"sha256":"sha256:42077f28d0241d4e33539948c6eba17b414a92cf587df59fd2f8f645f7f6308e","state":"OPEN","work":"set the key in the ConfigMap to the value module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this states for container orders-service (not copied: an environment value can carry a secret under any name); if it names an AWS endpoint, a region or an ARN, give the STACKIT one"},{"id":"env_value:orders-service/RETAIL_ORDERS_PERSISTENCE_PROVIDER","kind":"ENV_VALUE","subject":"orders-service/RETAIL_ORDERS_PERSISTENCE_PROVIDER","blocking":true,"sha256":"sha256:acfe30323f398a862af97c3ecb12b86ea824fc2f5f475e3e482d33485bb565dc","state":"OPEN","work":"set the key in the ConfigMap to the value module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this states for container orders-service (not copied: an environment value can carry a secret under any name); if it names an AWS endpoint, a region or an ARN, give the STACKIT one"},{"id":"identity:module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","kind":"IDENTITY","subject":"module.retail_app_ecs.module.orders_service.aws_iam_role.task_role","blocking":true,"sha256":"sha256:2f7a3f506b0709db4578c3d47bd9b4c8e48669c22d561fa3a720bd7a9035e2b8","state":"OPEN","work":"answer target.workload.identity for module.retail_app_ecs.module.orders_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.orders_service.aws_iam_role.task_role fails"},{"id":"smoke_test:orders","kind":"SMOKE_TEST","subject":"orders","blocking":true,"sha256":"sha256:2d2c2134f7fcd58edfe984915a6bfcb8018d286f183ba0f961c57fe7ec355026","state":"OPEN","work":"run an application smoke test on the target: the pods start, answer their clients through the Kubernetes Service orders, reach every dependency above and read and write their data; StackToIT runs nothing on the target"}]},{"contract":"APPLICATION_COMPATIBILITY","unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","task_definition":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this","workload":"ui","manifest":"kubernetes/ui/manifests.yaml","file":"applications/ui.json","cluster":"stackit_ske_cluster.retail_app_ecs_cluster","readiness":"NOT_READY","readiness_reasons":["IDENTITY_OPEN","FUNCTIONAL_CHECK_NOT_RUN"],"readiness_words":"Checklist items are open: StackToIT lists the work and counts an item done only when the customer marks it in the decisions file (application_checklists); StackToIT never deploys the application.","checklist_sha256":"sha256:5c46aff10b83e5f4ea394fb87a03c2dc38bca87b58dcc240a84c60226e98d247","templates":"applications/ui.templates.yaml","validation_scope":"A kubeconform check or a kubectl apply --dry-run of the manifest establishes YAML validity only, not behaviour: it accepts a REQUIRED_ token in a string field, an empty ConfigMap and a Secret that does not exist, and runs nothing; the checklist of the application compatibility contract and an application smoke test on the target are what show that the workload works.","containers":[{"name":"ui-service","image":"public.ecr.aws/aws-containers/retail-store-sample-ui:1.6.3","image_rebinding":"pulled from where the source pulls it (Amazon ECR image public.ecr.aws/aws-containers/retail-store-sample-ui:1.6.3): decide where the images live on STACKIT, that the cluster can reach the registry, and the pull secret","ports":["8080/TCP"],"probes":["livenessProbe: exec curl -f http://localhost:8080/actuator/health (the ECS health check)","startupProbe: the same check over the start period"],"env":[]}],"endpoints":[{"kind":"SERVICE_CONNECT_ALIAS","source":"ui:80 (the Service Connect alias of port ui-service in the namespace not visible statically)","target":"ui:80 (the Kubernetes Service ui, port 80 → container port 8080, in the namespace the manifests are applied into)","work":"the Kubernetes Service keeps the name and port the clients call: check that they resolve it from their namespace; the Service Connect proxy (its retries, timeouts, TLS and metrics) is not carried"},{"kind":"LOAD_BALANCER_TARGET","source":"a load balancer target group → container not visible statically port not visible statically","target":"the NodePort Service ui-nodeport (node port 30000 → container port 8080), the target pool of stackit_application_load_balancer.retail_app_ecs_alb_this at the private IPs of the cluster's nodes","work":"set the node IPs of the target pool (an input of the load balancer) and keep them current as the node pool changes, or answer the decision DEC-GEN-DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH-ALIAS-CONVERT-MOD-06557BC6 (aws.ingress.exposure-path) with another exposure path"}],"identity":{"task_role":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","target":"open: the decision target.workload.identity (inputs.json) chooses federated_service_account (a Kubernetes ServiceAccount federated to the STACKIT service account of the role), service_account_key (a key of that service account mounted as a Secret) or no_workload_identity","work":"answer target.workload.identity for module.retail_app_ecs.module.ui_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.ui_service.aws_iam_role.task_role fails","service_account_template":"applications/ui.templates.yaml","manual_steps":["answer the input target.workload.identity for module.retail_app_ecs.module.ui_service.aws_ecs_service.this in inputs.json: with federated_service_account the draft writes the stackit_service_account of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role, its federated identity provider for the SKE cluster's service-account issuer and the Kubernetes ServiceAccount ui in the manifest","until then, create a STACKIT service account named after the task role module.retail_app_ecs.module.ui_service.aws_iam_role.task_role and grant it the role assignments the policies of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role give (identity.tf lists them as the architect's variable)","federate it to the SKE cluster's service-account issuer for the subject system:serviceaccount:\u003cnamespace\u003e:ui, and apply the ServiceAccount of applications/ui.templates.yaml (its annotation holds the service account's e-mail) in the namespace of the workload","change the application from the AWS SDK credential chain to the STACKIT SDK, which picks up the projected token: every call the application made with module.retail_app_ecs.module.ui_service.aws_iam_role.task_role fails until it does"]},"datastores":[],"dns_dependencies":[{"kind":"SERVICE_CONNECT_ALIAS","name":"ui","source":"a Service Connect alias in the Cloud Map private DNS namespace retailstore.local (module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this): the clients of the namespace resolve it through the Service Connect proxy of their tasks","consumers":[],"provision":"CLUSTER_SERVICE","target":"ui.\u003cnamespace\u003e.svc.cluster.local (the Kubernetes Service ui; ui from a pod of the same namespace)","verification":"resolve, from a pod of a client of ui, ui and ui.\u003cnamespace\u003e.svc.cluster.local: expect the ClusterIP of the Kubernetes Service ui (kubectl get service ui)"}],"checklist":[{"id":"identity:module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","kind":"IDENTITY","subject":"module.retail_app_ecs.module.ui_service.aws_iam_role.task_role","blocking":true,"sha256":"sha256:7184de62a9f703854bfef735201ac410813bcb4120d8fd08306cd98b3d186cb7","state":"OPEN","work":"answer target.workload.identity for module.retail_app_ecs.module.ui_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.ui_service.aws_iam_role.task_role fails"},{"id":"smoke_test:ui","kind":"SMOKE_TEST","subject":"ui","blocking":true,"sha256":"sha256:6807f114890547e5a95a35f7650329b48d182fa9c12e17f39b4c559c9ceeb727","state":"OPEN","work":"run an application smoke test on the target: the pods start, answer their clients through the Kubernetes Service ui, reach every dependency above and read and write their data; StackToIT runs nothing on the target"}]}],"equivalence_ledger":{"grain":"UNIT_SEMANTIC_AND_PROPERTY_LISTS","rows_total":980,"by_disposition":{"LEDGER":3,"NOT_APPLICABLE":20,"NOT_CARRIED":209,"OPEN":1,"PRESERVED":23,"REVIEW":684,"TRANSFORMED":10,"UNSUPPORTED":30},"by_proof_kind":{"CASE":289,"CHECK":95,"DRAFT_LEDGER":13,"NOT_PROVEN_OBSERVED_UNKNOWN":3,"NOT_PROVEN_UNENFORCED":22,"NOT_PROVEN_UNVERIFIED_CHECK":1,"NOT_RECORDED":557},"by_vocabulary":{"v1":980},"omitted_not_stated":3898,"limits":["Grain: one row per source unit and semantic of the assessment that the source states or may state (UNIT_SEMANTIC), plus one row per source unit and property for each of three lists the assessment names: properties the draft does not carry, properties no semantic accounts for, and critical properties still open (UNIT_PROPERTY). A property named by more than one list has one row per list. A row for every source property is not possible yet: the assessment does not record which properties a generator reads.","Vocabulary v1: the disposition column prints the words the contracts and the property accounting use today. LEDGER means the contract hands the semantic to the semantic ledger of the draft; PRESERVED and TRANSFORMED appear only where the contract result or the draft's plan ledger states them.","intent_id, target_capability and target_resource are stated only for a semantic that a family written from a plan (security groups, routing tables) carries through the plan's own ledger; for every other row they are not recorded.","target_effective_behavior is NOT_ASSESSED on every row: the behaviour of the target is evidenced per field of a plan resource (units[].behavior_evidence), and a semantic is not a field.","residual_risk, required_action and decision_id are stated only for a critical semantic that is open; they are the sentences and the record that the Decisions section already shows, quoted whole. A sentence that names a record internal to the product is not quoted, and its column is not recorded.","invalidated_by names the inputs of the whole run (manifest.json invalidation) that, when they change, invalidate the row; no row has an invalidation of its own.","evidence_refs name rows of evidence_ledger. Evidence that names a record internal to the product is not listed, and evidence that states no check date and no date to check it again is listed UNDATED, never CURRENT.","3898 semantics of the contracts that the source does not state (it observed no) are not listed: the source has nothing there to carry. The kernel claims of assessment.json count them the same way (absent_claims)."]},"evidence_ledger":{"rows_total":479,"by_state":{"CURRENT":7,"STALE":0,"UNDATED":472},"by_kind":{"OFFICIAL_DOCUMENTED":62,"OTHER":1,"PROVIDER_DOCUMENT":4,"PUBLIC_ISSUE":2,"SOURCE_CODE_VERIFIED":11,"SOURCE_OFFICIAL_DOC":311,"TARGET_API_SPEC":19,"TARGET_OFFICIAL_DOC":67,"TARGET_RELEASE_NOTE":2}},"data_movement":{"state":"DECISION_REQUIRED","statement":"StackToIT never moves data. 6 stateful source units are listed here: a person must choose a data-movement mechanism for each, and none is chosen (the mechanism is UNKNOWN).","units":{"rows_total":6,"by_state":{"DECISION_REQUIRED":6},"by_source_type":{"aws_dynamodb_table":1,"aws_elasticache_replication_group":1,"aws_mq_broker":1,"aws_opensearch_domain":1,"aws_rds_cluster":2}},"limits":["The size of the data, its change rate, the duration of a transfer, the transfer rate and the downtime are never stated: the source does not state them and this build has no way to measure them. A provisioned capacity quoted beside a unit is the size of what was provisioned, not the size of the data.","No mechanism is chosen and nothing is executed: StackToIT is out of scope for actual data movement, and a mechanism class is a recommendation a person makes from the size, the downtime tolerated and the consistency the application needs.","A unit is listed when its catalogue kind holds data of its own (a database, a cache, a search domain, a warehouse, a block volume, a file share, an object store). A queue or topic service, and a system installed on a server's disk, are not read as stateful and are not listed. An Amazon MQ broker is listed, because its definitions (users, exchanges, queues, bindings, policies) and the messages in flight are state that moves with the cutover; the method named beside it is a candidate a person chooses, never a method this build chose or ran. A repository of an AWS ECR registry is listed as well, because its images are data that moves to the target registry; a pull-through cache, a registry of another cloud and a registry-level feature are not.","The data class, RPO and downtime tolerance are the customer's, from the applications file, word for word; without one, or for a unit outside an application, they are NOT_PROVIDED and no default is assumed."]},"resilience":{"requirement":{"state":"BUSINESS_REQUIREMENT_NOT_PROVIDED","statement":"No RTO or RPO was stated (BUSINESS_REQUIREMENT_NOT_PROVIDED): no architecture is called resilient against it, and no value is assumed.","applications":[]},"units":{"rows_total":6,"by_state":{"EVIDENCE_REQUIRED":6},"by_source_type":{"aws_dynamodb_table":1,"aws_elasticache_replication_group":1,"aws_lb":1,"aws_opensearch_domain":1,"aws_rds_cluster":2}},"limits":["No unit is called resilient and no resilience intent is chosen: the intent of every unit is UNKNOWN until a person decides it from a stated requirement and the facts of the source.","No RTO or RPO is defaulted or inferred from a resource name; the requirement is what the applications file states, word for word, or it is not provided.","The zone facts of the source are read by the AWS placement adapter only; for every other source they are NOT_ASSESSED, which does not mean that the source states none.","The availability zones and metro placement of the STACKIT target are NOT_ASSESSED: this build holds no evidence for them, so nothing here compares the source with the target.","A unit is listed when it holds state or states a failure-domain, replication or backup fact; a unit that states none and holds no data is not looked at, and the network a unit stands in (a subnet, a route table, a security group) is not a unit with an intent of its own: 46 of the 52 units present in the source are not listed here, and the block says nothing about them."]},"identity_transition":{"workloads":[{"source_unit":"module.retail_app_ecs.module.carts_service.aws_ecs_service.this","source_type":"aws_ecs_service","bindings":[{"id":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this#execution_role_arn","purpose":"EXECUTION","principal_kind":"ROLE","binding_state":"KNOWN"},{"id":"module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this#task_role_arn","purpose":"TASK","principal_kind":"ROLE","binding_state":"KNOWN"}],"static_credential_state":"NOT_ASSESSED","federation":[],"target_attachment":"OPEN","wif":"NOT_ASSESSED","state":"DECISION_REQUIRED","detail":"The identity plan does not attach a service account to this workload exactly; the attachment is a decision of a person. The plan holds manual actions or open decisions for it; they are listed as items. Privilege delta, break-glass access and human identity are not assessed.","derived_from":["assessment.json#/units/29/result"],"items":["action:stackitsa:facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this#execution_role_arn","action:stackitsa:facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this#task_role_arn"]},{"source_unit":"module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","source_type":"aws_ecs_service","bindings":[{"id":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this#execution_role_arn","purpose":"EXECUTION","principal_kind":"ROLE","binding_state":"KNOWN"},{"id":"module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this#task_role_arn","purpose":"TASK","principal_kind":"ROLE","binding_state":"KNOWN"}],"static_credential_state":"NOT_ASSESSED","federation":[],"target_attachment":"OPEN","wif":"NOT_ASSESSED","state":"DECISION_REQUIRED","detail":"The identity plan does not attach a service account to this workload exactly; the attachment is a decision of a person. The plan holds manual actions or open decisions for it; they are listed as items. Privilege delta, break-glass access and human identity are not assessed.","derived_from":["assessment.json#/units/40/result"],"items":["action:stackitsa:facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this#execution_role_arn","action:stackitsa:facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this#task_role_arn"]},{"source_unit":"module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","source_type":"aws_ecs_service","bindings":[{"id":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this#execution_role_arn","purpose":"EXECUTION","principal_kind":"ROLE","binding_state":"KNOWN"},{"id":"module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this#task_role_arn","purpose":"TASK","principal_kind":"ROLE","binding_state":"KNOWN"}],"static_credential_state":"NOT_ASSESSED","federation":[],"target_attachment":"OPEN","wif":"NOT_ASSESSED","state":"DECISION_REQUIRED","detail":"The identity plan does not attach a service account to this workload exactly; the attachment is a decision of a person. The plan holds manual actions or open decisions for it; they are listed as items. Privilege delta, break-glass access and human identity are not assessed.","derived_from":["assessment.json#/units/42/result"],"items":["action:stackitsa:facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this#execution_role_arn","action:stackitsa:facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this#task_role_arn"]},{"source_unit":"module.retail_app_ecs.module.orders_service.aws_ecs_service.this","source_type":"aws_ecs_service","bindings":[{"id":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this#execution_role_arn","purpose":"EXECUTION","principal_kind":"ROLE","binding_state":"KNOWN"},{"id":"module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this#task_role_arn","purpose":"TASK","principal_kind":"ROLE","binding_state":"KNOWN"}],"static_credential_state":"NOT_ASSESSED","federation":[],"target_attachment":"OPEN","wif":"NOT_ASSESSED","state":"DECISION_REQUIRED","detail":"The identity plan does not attach a service account to this workload exactly; the attachment is a decision of a person. The plan holds manual actions or open decisions for it; they are listed as items. Privilege delta, break-glass access and human identity are not assessed.","derived_from":["assessment.json#/units/41/result"],"items":["action:stackitsa:facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this#execution_role_arn","action:stackitsa:facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this#task_role_arn"]},{"source_unit":"module.retail_app_ecs.module.ui_service.aws_ecs_service.this","source_type":"aws_ecs_service","bindings":[{"id":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this#execution_role_arn","purpose":"EXECUTION","principal_kind":"ROLE","binding_state":"KNOWN"},{"id":"module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this#task_role_arn","purpose":"TASK","principal_kind":"ROLE","binding_state":"KNOWN"}],"static_credential_state":"NOT_ASSESSED","federation":[],"target_attachment":"OPEN","wif":"NOT_ASSESSED","state":"DECISION_REQUIRED","detail":"The identity plan does not attach a service account to this workload exactly; the attachment is a decision of a person. The plan holds manual actions or open decisions for it; they are listed as items. Privilege delta, break-glass access and human identity are not assessed.","derived_from":["assessment.json#/units/43/result"],"items":["action:stackitsa:facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this#execution_role_arn","action:stackitsa:facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this#task_role_arn"]}],"limits":["Workload identity federation is not assessed as an option for any workload. A row states an OIDC issuer where the source names one, as a fact of the source, and never that federation can replace a key.","A static credential is named only where the knowledge base reads a machine user with access keys on the unit. A scan that finds no key cannot say a workload has none, so the absence of a credential is never written.","Privilege delta, break-glass access and human identity are not assessed for any row.","A workload that names no identity in the source has no row, and a run whose draft held no identity intents lists only the units that are an identity themselves.","The block states what the identity plan holds open. It does not attach, grant or federate anything."]},"sovereignty":{"requirement":{"state":"NOT_PROVIDED","statement":"No sovereignty requirement was provided: no applications file gives a tier or constraints. It is not inferred from the location of the company or of the provider.","applications":[]},"dimensions":[{"id":"DATA_LOCATION","name":"Data location","state":"EVIDENCE_REQUIRED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"NOT_ASSESSED","text":"The location of the source resources is not read: this build computes no region or zone placement for the source."},"proposed_target_state":{"state":"STATED","text":"Name resolution: stackit_network.vpc_vpc_private, stackit_network.vpc_vpc_public take the shared variable default_ipv4_nameservers, which defaults to the addresses of the STACKIT DNS Resolver (beta) in eu01 (192.214.161.53, 213.17.17.17, 188.34.111.111), so those name queries go to the resolver STACKIT operates and not to the public resolvers 1.1.1.1, 8.8.8.8 and 9.9.9.9 that STACKIT sets in a public project when none are given. The resolver is a beta product documented for workloads inside STACKIT (docs.stackit.cloud, DNS Resolver, Concepts); no check that it answers from these networks is made here, and who operates it and under which jurisdiction is not assessed here. The capability catalogue lists the STACKIT services of the draft as available in: eu01, eu02. That a service is available in a region is a fact about the service. Region assumed for pricing: eu01 (default; no input chose a region). The catalogue lists the service of 13 units there, but no input or profile has chosen the region, so no resource is tied to it."},"delta":{"state":"NOT_ASSESSED","text":"No source location is established, so no change of location is stated."},"evidence":["workspace.json#/assurance/evidence/4"],"unknowns":["The provider's own statement on data location is a statement of the provider with control shared: STACKIT states that the development of its cloud takes place in Germany, that its servers and data centers are located in Germany and Austria, and that its cloud operates in accordance with European data protection standards. It names no region id, so it does not tie any resource of the draft to a region.","Where backups, logs and replicas are stored is the subject of the backup chain and the telemetry chain."],"actions":[]},{"id":"JURISDICTION","name":"Jurisdiction chain","state":"NOT_ASSESSED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"NOT_ASSESSED","text":"The jurisdiction chain (the legal seat of the provider, of its owners and of its operators, and the legal reach over them) is not assessed. It is not a fact of the Terraform source or of the draft, and legal conclusions stay external."},"proposed_target_state":{"state":"NOT_ASSESSED","text":"No target state is stated: the source state is not established."},"delta":{"state":"NOT_ASSESSED","text":"No change is stated."},"evidence":[],"unknowns":["Which legal order applies to the provider, to its parent organisations and to its operators is a question for counsel, not for this build."],"actions":[]},{"id":"OPERATOR_ACCESS","name":"Operator access","state":"NOT_ASSESSED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"NOT_ASSESSED","text":"Who at the provider or at an operator can reach the resources and the data, and under which conditions, is not assessed. It is not a fact of the Terraform source or of the draft."},"proposed_target_state":{"state":"NOT_ASSESSED","text":"No target state is stated: the source state is not established."},"delta":{"state":"NOT_ASSESSED","text":"No change is stated."},"evidence":[],"unknowns":["The access model of the provider's staff and subcontractors is not a fact of the Terraform source."],"actions":[]},{"id":"KEY_CONTROL","name":"Key control","state":"EVIDENCE_REQUIRED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"STATED","text":"A customer-managed key may be stated, but its value is not visible statically, on: module.retail_app_ecs.aws_secretsmanager_secret.catalog_db, module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch."},"proposed_target_state":{"state":"STATED","text":"A customer-managed key is a separate setting that exists only where the source names a key: no platform encryption stands in for it, and whether the key management of the source is equivalent to the STACKIT key service is not established. Which target services of the draft can use a key of the customer is not established here."},"delta":{"state":"NOT_ASSESSED","text":"Whether key ownership changes is not established: the key of the source and the key of the target are not compared."},"evidence":["assessment.json#/units/35/result/semantics/items/6","assessment.json#/units/9/result/semantics/items/6"],"unknowns":["Who holds the key material and who can use it on the target is not established."],"actions":[]},{"id":"IDENTITY_CHAIN","name":"Identity chain","state":"DECISION_REQUIRED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"STATED","text":"The source names identities for its workloads or states them as units: module.retail_app_ecs.module.carts_service.aws_ecs_service.this, module.retail_app_ecs.module.catalog_service.aws_ecs_service.this, module.retail_app_ecs.module.checkout_service.aws_ecs_service.this, module.retail_app_ecs.module.orders_service.aws_ecs_service.this, module.retail_app_ecs.module.ui_service.aws_ecs_service.this."},"proposed_target_state":{"state":"STATED","text":"The draft attaches a STACKIT service account to a server only where the identity plan attaches it exactly; every other attachment is stated as open. Where the draft writes a project role assignment (for an AWS role, machine user or IAM group it turns into service accounts or members), the role it grants is a variable the architect chooses, because an AWS action is not translated into a STACKIT role: the draft derives no role from the source."},"delta":{"state":"NOT_ASSESSED","text":"Whether the identity dependency changes is not established: the privilege delta and the external identity provider are not assessed."},"evidence":["workspace.json#/identity_transition/workloads/0","workspace.json#/identity_transition/workloads/1","workspace.json#/identity_transition/workloads/2","workspace.json#/identity_transition/workloads/3","workspace.json#/identity_transition/workloads/4"],"unknowns":["Whether an external identity provider is a dependency of the sign-in of people is not assessed.","The privilege delta between the source identities and the target roles is not assessed."],"actions":["action:stackitsa:facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this#execution_role_arn","action:stackitsa:facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this#task_role_arn","action:stackitsa:facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this#execution_role_arn","action:stackitsa:facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this#task_role_arn","action:stackitsa:facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this#execution_role_arn","action:stackitsa:facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this#task_role_arn","action:stackitsa:facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this#execution_role_arn","action:stackitsa:facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this#task_role_arn","action:stackitsa:facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this#execution_role_arn","action:stackitsa:facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this#task_role_arn"]},{"id":"TELEMETRY_CHAIN","name":"Telemetry chain","state":"NOT_ASSESSED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"NOT_ASSESSED","text":"No log sink of the source is read in this run. That is not a finding that no telemetry leaves the estate."},"proposed_target_state":{"state":"STATED","text":"The draft writes log sources as STACKIT Logs instances. Where an export of the source goes is stated in the plan of the log source, not here."},"delta":{"state":"NOT_ASSESSED","text":"Whether the destination of the telemetry changes is not established."},"evidence":["capability:observability.logs"],"unknowns":["Where metrics, traces and agent telemetry go is not read by this build."],"actions":[]},{"id":"BACKUP_CHAIN","name":"Backup chain","state":"EVIDENCE_REQUIRED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"STATED","text":"The contracts of the source observe a backup, retention or geo-replication setting on: module.dependencies.module.catalog_rds.aws_rds_cluster.this, module.dependencies.module.orders_rds.aws_rds_cluster.this."},"proposed_target_state":{"state":"NOT_ASSESSED","text":"Where the backups of the target are stored and who operates the destination is not stated by the draft or by this build."},"delta":{"state":"NOT_ASSESSED","text":"Whether the destination of the backups changes is not established."},"evidence":["assessment.json#/units/32/result/semantics/items/4","assessment.json#/units/34/result/semantics/items/4"],"unknowns":["The destination of the backups and replicas, and the jurisdiction of that destination, are not assessed."],"actions":[]},{"id":"SUPPLY_CHAIN","name":"Supply chain","state":"OBSERVED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"STATED","text":"The source records these Terraform providers, required by its configuration or locked in its lock file: aws, random."},"proposed_target_state":{"state":"STATED","text":"The draft is written for the STACKIT provider 0.121.0."},"delta":{"state":"NOT_ASSESSED","text":"Whether the supply chain of the estate changes is not established."},"evidence":["workspace.json#/header/source_snapshot/providers/0","workspace.json#/header/source_snapshot/providers/1"],"unknowns":["The registries and the build chain of the providers, and the provenance of the modules the source calls, are not assessed."],"actions":[]},{"id":"THIRD_PARTY_PROCESSING","name":"Third-party processing","state":"EVIDENCE_REQUIRED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"STATED","text":"The source depends on providers or resource types the knowledge base holds no schema of: provider random."},"proposed_target_state":{"state":"NOT_ASSESSED","text":"The draft names no STACKIT counterpart for these dependencies."},"delta":{"state":"NOT_ASSESSED","text":"Whether a third party processes the data after the move is not established."},"evidence":["workspace.json#/header/source_snapshot/providers/1"],"unknowns":["What data a third-party provider or service handles is not read from the Terraform source."],"actions":[]},{"id":"OPEN_INTERFACES","name":"Open interfaces","state":"NOT_ASSESSED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"NOT_ASSESSED","text":"Whether the interfaces the source depends on are open standards and whether the target keeps them is not assessed."},"proposed_target_state":{"state":"NOT_ASSESSED","text":"No target state is stated: the source state is not established."},"delta":{"state":"NOT_ASSESSED","text":"No change is stated."},"evidence":[],"unknowns":["Which of the interfaces the source uses are proprietary is not read."],"actions":[]},{"id":"DATA_PORTABILITY","name":"Data portability","state":"NOT_ASSESSED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"NOT_ASSESSED","text":"Whether the data can be exported in a documented format, and by which path, is not assessed."},"proposed_target_state":{"state":"NOT_ASSESSED","text":"No target state is stated: the source state is not established."},"delta":{"state":"NOT_ASSESSED","text":"No change is stated."},"evidence":[],"unknowns":["How the data of each stateful unit leaves its service is not read."],"actions":[]},{"id":"APPLICATION_COUPLING","name":"Application coupling","state":"NOT_ASSESSED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"NOT_ASSESSED","text":"The coupling of application code to the interfaces of the source (SDKs, proprietary protocols) is not assessed: the application code is not scanned."},"proposed_target_state":{"state":"NOT_ASSESSED","text":"No target state is stated: the source state is not established."},"delta":{"state":"NOT_ASSESSED","text":"No change is stated."},"evidence":[],"unknowns":["Which SDKs and protocols the application code uses is not read."],"actions":[]},{"id":"EXITABILITY","name":"Exitability","state":"OBSERVED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"NOT_ASSESSED","text":"The interface, data format, code coupling, replacement complexity, extraction path and alternatives of the source's dependencies are not assessed."},"proposed_target_state":{"state":"STATED","text":"The draft is provider-specific Terraform for the STACKIT provider; that is the only exit fact stated, and it is listed per dependency in the exitability entries."},"delta":{"state":"NOT_ASSESSED","text":"No change of exit cost is stated: no cost, no duration and no complexity is estimated."},"evidence":[],"unknowns":["Every field of the exitability model but the Terraform coupling is not assessed, so no exit path is proven and none is ruled out."],"actions":[]}],"limits":["Legal conclusions remain external. The block provides technical evidence and gaps and does not certify legal compliance.","Sovereignty is not residency: a region of a service is a fact about the service, never a statement about the sovereignty of a workload.","There is no score, no percentage and no count in this block, and no dimension is compared with a requirement in this build.","Jurisdiction, operator access, open interfaces, data portability and application coupling are not assessed, and every field of the exitability model but the Terraform coupling is not assessed.","Dependencies are the units the knowledge base maps to a STACKIT service, the source providers the knowledge base holds no schema of and the source types it does not know. A dependency the draft introduces without a source unit is not listed, and a unit with no STACKIT resource is not listed as removed."]},"sovereignty_rows":{"dependencies":{"rows_total":38,"by_change":{"REPLACED":37,"RETAINED":1},"by_target_service":{"STACKIT Application Load Balancer":1,"STACKIT KMS":1,"STACKIT Key Value Store (Valkey)":1,"STACKIT Kubernetes Engine (SKE)":6,"STACKIT Logs":1,"STACKIT MariaDB":1,"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)":1,"STACKIT OpenSearch":1,"STACKIT PostgreSQL Flex":1,"STACKIT RabbitMQ":1,"STACKIT Secrets Manager":4,"STACKIT project networking / Network Area (SNA)":1,"STACKIT security group":7,"STACKIT service account for the workload":10,"none":1}},"exitability":{"rows_total":37,"by_state":{"PROVIDER_SPECIFIC":37},"by_target_service":{"STACKIT Application Load Balancer":1,"STACKIT KMS":1,"STACKIT Key Value Store (Valkey)":1,"STACKIT Kubernetes Engine (SKE)":6,"STACKIT Logs":1,"STACKIT MariaDB":1,"STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)":1,"STACKIT OpenSearch":1,"STACKIT PostgreSQL Flex":1,"STACKIT RabbitMQ":1,"STACKIT Secrets Manager":4,"STACKIT project networking / Network Area (SNA)":1,"STACKIT security group":7,"STACKIT service account for the workload":10}}},"price_snapshot":{"statement":"These are list prices only: no quantity is read and no total is built from them here; the quantities, amounts and totals of the priced families are in financial/cost-model.json, and no usage and no egress is computed anywhere. This block names the snapshot of the public STACKIT price list the run cites and, for each drafted resource of a kind the price rules list, the list price of the one SKU a tested rule joins it to, or why it has none.","source_url":"https://pim.api.stackit.cloud/v2/skus?pageSize=100\u0026language=en","retrieved_at":"2026-10-26T18:27:45Z","sha256":"94244fec5b573614dcff15f79238ce4a0e60cf197768be287e45092d7e1e61ca","currency":"EUR","price_basis":"net list price","licence_note":"reuse terms not found (U1)","sku_count":1134,"region":"eu01","coverage":{"resources":11,"priced":6,"unpriced":0,"not_assessed":5},"other_drafted_resources":42,"unowned_resources":0,"limits":["A list price is the price of one unit of one SKU. It is not a cost: this block reads no quantity and builds no total; the quantities, amounts and totals of the priced families are in financial/cost-model.json.","A resource is joined to a SKU only where the draft itself names the machine type, performance class or flavor; where the draft leaves that to a person (a variable), no SKU is named and the resource is NOT_ASSESSED.","Prices are net list prices of the public STACKIT price list: excluding taxes, with no contract discount, no savings plan and no other currency. A SKU that is not in the public list, a deprecated SKU and the metro variant of a SKU are never used as a price.","Egress and traffic, support plans, the container registry and every resource of a kind the price rules do not list have no row: nothing is stated about their cost.","Only the region eu01 is looked at: it is the region of the knowledge-base catalogue the draft takes its flavors from.","The row of a volume is the per-hour fee of its performance class; the capacity fee of the disk is a separate SKU that depends on the size, and is a line of the cost model, not a row here."]},"cost_model":{"statement":"An initial infrastructure cost estimate under explicit assumptions (the scenario and the assumption file this model names), not a bill: list prices (net, no discount, no Spot, no savings plan, no private price) times quantities the source or the assumption file states. A total is FULL only when every line of its scope is priced; a line that cannot be priced says why and is never filled in, and an unknown quantity is neither 0 nor 1. A savings percentage is given only for the same scope, in one currency (or with an exchange rate that names its source and date), with every line of both sides priced. No usage, traffic, request, egress, support or one-off migration cost is computed.","file":"financial/cost-model.json","scenario":{"id":"STANDARD_730H","label":"the labelled standard month of 730 hours, the same on both sides","hours":"730"},"price_sources":[{"side":"SOURCE","provider":"aws","status":"NOT_AVAILABLE","reason":"no line has a region the source states, so no offer file was asked for: give the AWS region in review/inputs (source.aws.region)"},{"side":"TARGET","provider":"stackit","status":"USED","retrieved_at":"2026-10-26T18:27:45Z","sha256":"94244fec5b573614dcff15f79238ce4a0e60cf197768be287e45092d7e1e61ca","currency":"EUR","price_basis":"net list price","price_rung":"PRICE_CACHE"}],"assumptions":{},"line_counts":{"total":44,"source":30,"target":14,"by_state":{"AMBIGUOUS":1,"PRICED":5,"PRICE_NOT_FOUND":30,"QUANTITY_UNKNOWN":1,"TARGET_NOT_CHOSEN":7}},"totals":[{"scope":"estate","side":"SOURCE","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":30,"unpriced_by_state":{"PRICE_NOT_FOUND":30},"coverage":17},{"scope":"estate","side":"TARGET","scenario":"STANDARD_730H","currency":"EUR","state":"PARTIAL","min":"878.34","max":"878.34","priced_lines":5,"unpriced_lines":9,"unpriced_by_state":{"AMBIGUOUS":1,"QUANTITY_UNKNOWN":1,"TARGET_NOT_CHOSEN":7},"coverage":19,"target_only_lines":1,"target_only_min":"72.70","target_only_max":"72.70"},{"scope":"service","key":"cache","side":"SOURCE","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":1,"unpriced_by_state":{"PRICE_NOT_FOUND":1},"coverage":1},{"scope":"service","key":"cache","side":"TARGET","scenario":"STANDARD_730H","currency":"EUR","state":"FULL","min":"72.97","max":"72.97","priced_lines":1,"unpriced_lines":0,"coverage":1},{"scope":"service","key":"containers","side":"SOURCE","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":10,"unpriced_by_state":{"PRICE_NOT_FOUND":10},"coverage":5},{"scope":"service","key":"containers","side":"TARGET","scenario":"STANDARD_730H","currency":"EUR","state":"PARTIAL","min":"72.70","max":"72.70","priced_lines":1,"unpriced_lines":1,"unpriced_by_state":{"TARGET_NOT_CHOSEN":1},"coverage":6,"target_only_lines":1,"target_only_min":"72.70","target_only_max":"72.70"},{"scope":"service","key":"database","side":"SOURCE","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":9,"unpriced_by_state":{"PRICE_NOT_FOUND":9},"coverage":5},{"scope":"service","key":"database","side":"TARGET","scenario":"STANDARD_730H","currency":"EUR","state":"PARTIAL","min":"91.97","max":"91.97","priced_lines":1,"unpriced_lines":4,"unpriced_by_state":{"TARGET_NOT_CHOSEN":4},"coverage":3},{"scope":"service","key":"messaging","side":"SOURCE","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":2,"unpriced_by_state":{"PRICE_NOT_FOUND":2},"coverage":1},{"scope":"service","key":"messaging","side":"TARGET","scenario":"STANDARD_730H","currency":"EUR","state":"FULL","min":"621.52","max":"621.52","priced_lines":1,"unpriced_lines":0,"coverage":1},{"scope":"service","key":"messaging_observability","side":"TARGET","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":1,"unpriced_by_state":{"QUANTITY_UNKNOWN":1},"coverage":1},{"scope":"service","key":"network","side":"SOURCE","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":6,"unpriced_by_state":{"PRICE_NOT_FOUND":6},"coverage":4},{"scope":"service","key":"network","side":"TARGET","scenario":"STANDARD_730H","currency":"EUR","state":"FULL","min":"19.18","max":"19.18","priced_lines":1,"unpriced_lines":0,"coverage":1},{"scope":"service","key":"platform","side":"TARGET","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":2,"unpriced_by_state":{"AMBIGUOUS":1,"TARGET_NOT_CHOSEN":1},"coverage":5},{"scope":"service","key":"search","side":"SOURCE","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":2,"unpriced_by_state":{"PRICE_NOT_FOUND":2},"coverage":1},{"scope":"service","key":"search","side":"TARGET","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":1,"unpriced_by_state":{"TARGET_NOT_CHOSEN":1},"coverage":1}],"comparisons":[{"scope":"estate","scenario":"STANDARD_730H","comparability":"TARGET_ONLY","source_state":"NONE","target_state":"PARTIAL","reason":"TARGET_ONLY: the source has no priced component","outside":[{"side":"TARGET","part":"TARGET_ONLY","lines":1,"amount":{"currency":"EUR","min":"72.70","max":"72.70"}}]},{"scope":"service","key":"cache","scenario":"STANDARD_730H","comparability":"TARGET_ONLY","source_state":"NONE","target_state":"FULL","reason":"TARGET_ONLY: the source has no priced component"},{"scope":"service","key":"containers","scenario":"STANDARD_730H","comparability":"SCOPE_UNEQUAL","source_state":"NONE","target_state":"PARTIAL","reason":"SCOPE_UNEQUAL: the sides cover different source units (source [unit:module.retail_app_ecs.module.carts_service.aws_ecs_service.this unit:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this unit:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this unit:module.retail_app_ecs.module.orders_service.aws_ecs_service.this unit:module.retail_app_ecs.module.ui_service.aws_ecs_service.this], target [unit:module.retail_app_ecs.aws_ecs_cluster.cluster unit:module.retail_app_ecs.module.carts_service.aws_ecs_service.this unit:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this unit:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this unit:module.retail_app_ecs.module.orders_service.aws_ecs_service.this unit:module.retail_app_ecs.module.ui_service.aws_ecs_service.this])","outside":[{"side":"TARGET","part":"TARGET_ONLY","lines":1,"amount":{"currency":"EUR","min":"72.70","max":"72.70"}}]},{"scope":"service","key":"database","scenario":"STANDARD_730H","comparability":"TARGET_ONLY","source_state":"NONE","target_state":"PARTIAL","reason":"TARGET_ONLY: the source has no priced component"},{"scope":"service","key":"messaging","scenario":"STANDARD_730H","comparability":"TARGET_ONLY","source_state":"NONE","target_state":"FULL","reason":"TARGET_ONLY: the source has no priced component"},{"scope":"service","key":"messaging_observability","scenario":"STANDARD_730H","comparability":"TARGET_ONLY","target_state":"NONE","reason":"TARGET_ONLY: there is no source total"},{"scope":"service","key":"network","scenario":"STANDARD_730H","comparability":"TARGET_ONLY","source_state":"NONE","target_state":"FULL","reason":"TARGET_ONLY: the source has no priced component"},{"scope":"service","key":"platform","scenario":"STANDARD_730H","comparability":"TARGET_ONLY","target_state":"NONE","reason":"TARGET_ONLY: there is no source total"},{"scope":"service","key":"search","scenario":"STANDARD_730H","comparability":"COMPARABLE","source_state":"NONE","target_state":"NONE","reason":"NONE: neither side has a priced component"}],"modelled":{"resources":10,"source_resources":140},"defaults":{"unconfirmed_lines":3,"unconfirmed_amount":{"currency":"EUR","min":"713.67","max":"713.67"},"unconfirmed_decisions":["DEC-GEN-CONVERT-SIZE-FROM-SOURCE"],"confirmed_lines":0},"coverage":{"billable":{"source_resources":140,"with_price_rule":17,"no_charge_of_its_own":113,"out_of_model":10,"out_of_model_types":[{"type":"aws_secretsmanager_secret","resources":4},{"type":"aws_cloudwatch_log_group","resources":2},{"type":"aws_cloudwatch_event_rule","resources":1},{"type":"aws_cloudwatch_event_target","resources":1},{"type":"aws_kms_key","resources":1},{"type":"aws_service_discovery_private_dns_namespace","resources":1}]},"price":{"lines":44,"found":5,"not_found":39,"not_found_by_state":{"AMBIGUOUS":1,"PRICE_NOT_FOUND":30,"QUANTITY_UNKNOWN":1,"TARGET_NOT_CHOSEN":7},"not_found_by_diagnostic":{"AWS_REGION_NEEDED":30},"by_side":{"SOURCE":{"lines":30,"found":0},"TARGET":{"lines":14,"found":5}}},"usage":{"priced_lines":5,"quantity_known":5,"quantity_assumed":0,"quantity_unknown":0}},"unpriced_causes":[{"diagnostic":"AWS_REGION_NEEDED","lines":30,"families":[{"family":"aws_ecs_service","lines":10},{"family":"aws_rds_cluster","lines":4},{"family":"aws_dynamodb_table","lines":3},{"family":"aws_lb","lines":2},{"family":"aws_mq_broker","lines":2},{"family":"aws_nat_gateway","lines":2},{"family":"aws_opensearch_domain","lines":2},{"family":"aws_rds_cluster_instance","lines":2},{"family":"aws_eip","lines":1},{"family":"aws_elasticache_replication_group","lines":1},{"family":"aws_internet_gateway","lines":1}],"next_action":"AWS region not stated: give it in review/inputs (source.aws.region). A price cache holds the prices of a region: once the region is given, fill the cache for it with `stacktoit prices refresh --provider aws --region \u003cregion\u003e` if the price sources above say it is missing."}],"notes":["module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled: known absent (its count or for_each produces nothing): no component","module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore: known absent (its count or for_each produces nothing): no component","no application totals: the run was given no applications file (--applications), so no unit belongs to an application"],"limits":["Only EC2 instances (aws_instance), EBS volumes (aws_ebs_volume and the root and block devices of an instance), RDS for PostgreSQL instances (aws_db_instance: instance hours, allocated storage, provisioned iops, gp3 throughput), Amazon Aurora (aws_rds_cluster_instance: the instance hours; aws_rds_cluster: the consumed storage and the I/O requests with their price and no quantity) the network families (aws_nat_gateway, aws_lb, aws_eip and the public address an instance asks for, aws_route53_zone, aws_internet_gateway: see the line on the network families below) and the managed-service families (aws_ecs_service on Fargate, aws_mq_broker, aws_elasticache_replication_group and aws_elasticache_cluster, aws_opensearch_domain, aws_dynamodb_table: see the line on them below) have lines on the source side, and only STACKIT servers (each with its boot volume), volumes, PostgreSQL Flex instances (flavor, storage class, storage capacity), public IPs, load balancers, DNS zones, RabbitMQ, Valkey, OpenSearch and MariaDB instances (their plan), MongoDB Flex instances (their flavor), SKE clusters (the cluster hour and each node pool), KMS keys, Secrets Manager and Logs instances on the target side; the other drafted resources have a line that says they have no quantity rule, and every other source resource has no line and is listed in the out-of-model group.","The network families have a line on each side, never a total over a partial set. NAT gateway: the hour of a zonal public NAT gateway is priced and the data it processes has the per-GB price and no quantity; the STACKIT price list holds no SKU for a NAT gateway or for outbound address translation, so its target line is PRICE_NOT_FOUND (a service the list does not price is not free). Load balancer: the hour of an Application or Network Load Balancer is priced and its capacity units have the price and no quantity; the target line is the hour of the plan (plan_id; a Network Load Balancer that states none is read as the default p10 the provider documents). Public IPv4 address: the hour of an Elastic IP, and of the address an instance asks for with associate_public_ip_address = true (not an address its subnet or launch template decides), against the hour of a stackit_public_ip. DNS: the month of a hosted zone (the first tier of the Route 53 price; the tier is the account's) and its queries (no quantity); the STACKIT list prices a zone by the number of records it may hold, which the draft does not state, so its target line is AMBIGUOUS. Data transfer out: the per-GB price of the first tier (every tier is named on the line) on the line of the internet gateway and no quantity; the STACKIT list holds no SKU for it, so its target line is PRICE_NOT_FOUND. A quantity that is a measurement of use (GB, capacity unit hours, queries) is never in a Terraform source and is never made up: such a line has its price and no amount. The prices are the On-Demand rows of the AmazonEC2 (NAT gateway, load balancers), AmazonVPC (public IPv4), AWSDataTransfer and AmazonRoute53 offers of the price cache, which `stacktoit prices refresh --provider aws --region R` fetches (`--offer` names one); a line whose offer the cache does not hold names the offer and the command.","The managed-service families are priced from the On-Demand rows of the AmazonECS (Fargate vCPU and GB hours: the cpu and memory of the task definition times the desired count, which is never taken as zero when it is not stated), AmazonMQ (broker hour by engine, instance type and deployment mode; its storage has the price and no quantity), AmazonElastiCache (node hour by engine and node type times the nodes of a replication group), AmazonES (data and dedicated master node hours, EBS GB-month) and AmazonDynamoDB (provisioned read and write capacity unit hours when the table states them, at the rate beyond the free first tier, which is the whole account's; request units and storage have the price and no quantity) offers, which `stacktoit prices refresh --provider aws --region R` fetches (`--offer` names one); Fargate Spot, ECS on EC2 capacity, Windows tasks, global datastores and non-standard table classes are out of the model. On the target side a RabbitMQ, Valkey (Key Value Store), OpenSearch or MariaDB instance is the hour of the SKU of its plan_name (the SKU is named by the plan, INFERRED from the names of the list, and its nodes and disk are checked against the list's attributes); a plan the draft leaves to a person is TARGET_NOT_CHOSEN. An SKE cluster is the cluster hour, and each node pool it states is a line of its own: the server flavor hours of its machine_type (the join of a server) times its nodes, the range between its minimum and its maximum when they differ, an unknown quantity with the price when the draft states either as a variable, and TARGET_NOT_CHOSEN when the machine type is a variable; the boot volume of each node is not in the line, and the nodes of an EKS node group or of an ECS cluster's capacity have no source line in this build, so a pool is a target-only line (see below). A MongoDB Flex instance is the hour of the SKU MongoDB-Flex-\u003ccpu\u003e.\u003cram\u003e-\u003cSingle|Replica|Sharded\u003e of its flavor.cpu, flavor.ram and options.type (INFERRED from the names of the list, and checked against the SKU's own attributes; the rate of a Replica SKU is read as that of the whole instance with its nodes); a flavor a person sets is TARGET_NOT_CHOSEN, a flavor the list has no SKU of is PRICE_NOT_FOUND, its storage and backups are not computed, and because this build prices no DocumentDB cluster on the source side its line is target only (see below). A software KMS key version and a GB of log ingestion have their list price and no quantity; Secrets Manager is AMBIGUOUS between its tiers (the number of secret versions). A priced target line of a family whose source side has no line for the unit (an SKE cluster and its node pools, a MariaDB instance, a MongoDB Flex instance, a RabbitMQ plan against a source with no priced broker) is target only: it is counted in the STACKIT total, listed apart with its amount (target_only on the line and target_only_lines, target_only_min and target_only_max on the total), and kept out of every comparison and every saving, because no source amount stands against it; each comparison states the lines and the amount it leaves out, on both sides.","The instance hours and the allocated storage of an RDS for PostgreSQL instance are priced from the AmazonRDS offer of the price cache (On-Demand list prices, Single-AZ or Multi-AZ as the source states; `stacktoit prices refresh --provider aws` fetches it with the AmazonEC2 offer); its provisioned IOPS (io1, io2, gp3) and the provisioned throughput of gp3 storage come from the same offer, gp3 only above the performance its allocated storage includes (a baseline of 12,000 IOPS and 500 MiB/s from 400 GiB, nothing more can be provisioned below it: Amazon RDS User Guide, DB instance storage); without that offer the lines are PRICE_SOURCE_ABSENT and the instance is never in the computed subtotal. An Aurora instance (engine aurora-mysql or aurora-postgresql) is the instance hour of its engine, its instance class and the storage configuration of its cluster, from the same offer (rules version 3 of its narrowing): Aurora Standard when the cluster states no storage_type (the provider's documented default), Aurora I/O-Optimized for storage_type = \"aurora-iopt1\", and both prices open (AMBIGUOUS) when the source does not state it as a fact or the instance's cluster is not a resource of the source; the cluster's consumed storage (a GB-month) and, on Standard, its I/O requests are measurements of use and have their price and no quantity. An Aurora Serverless v2 instance (db.serverless), an instance of a Multi-AZ DB cluster, backup storage beyond the free allocation, Global Database and the Data API are not computed. An offer narrowed before the Aurora rows were kept answers PRICE_SOURCE_ABSENT with the refresh command on each Aurora line. A PostgreSQL Flex Replica flavor is priced once per instance: the list gives its SKU 3 nodes and a higher rate than the Single SKU (1.6 to 2.0 times it, never 3 times), and the rate is read as that of the whole instance (evidence class INFERRED from the price list; each such line says so); how much of its storage is billed (once or per node) the list does not say, so its storage lines have the SKU and no quantity.","The PostgreSQL Flex storage class premium-perf\u003cn\u003e-stackit is priced as the SKU \"Block Storage for PostgreSQL Premium-Performance \u003cn\u003e\" per disk and its capacity as \"Block Storage for PostgreSQL Premium-Capacity\" per GB (evidence class INFERRED from the names of the price list; each such line says so). The IOPS and throughput shown for the class in the technical mapping are the attributes maxIOPerSec and maxTroughInMB of that performance SKU in the price list (the catalogue states none for a PostgreSQL Flex class); whether the class covers what the source provisions is a comparison of those figures, not a statement that the two perform alike.","The lines fall into three groups: the computed subtotal (only the source units every line of which is priced on both sides, so both subtotals cover the same units), the lines whose price is known and whose quantity is not (the quantity that is needed is named), and what is not computed (a unit of a type out of the model, a unit with no line on one side, or a line without a price), listed by resource and never zero.","Source prices are the On-Demand list prices of the AWS offer file in the price cache (USD, net, region of the resource); Spot, Reserved, Savings Plans, Dedicated Host, capacity reservation and private prices are never used. The operating system and licence come from the assumption file: the source does not state them.","The offer file bills an EBS volume per GB-month; this build reads it as GiB-month, the unit a volume is sized in: the Amazon EBS pricing page states \"on this page, GB = 1024^3 bytes\" (OFFICIAL_DOCUMENTED for that page; applying it to the offer file's unit is INFERRED). The IOPS and throughput of a gp3 volume are priced only above the baseline included in the price of its storage (3,000 IOPS, 125 MiB/s: Amazon EBS User Guide, OFFICIAL_DOCUMENTED), per volume; io2 IOPS are priced in tiers whose edges the offer file carries in descriptions only, and are not priced.","Target prices are the net EUR list prices of the public STACKIT price list in the price cache (region eu01). A machine type or performance class the draft leaves to a person is TARGET_NOT_CHOSEN; the metro variant of a SKU is never substituted.","The target capacity price of a volume is the capacity SKU of its performance class's tier (evidence class INFERRED from the structure of the price list).","One month is the 730 hours of the scenario; a per-month rate is applied as the file gives it. Snapshots, backups, support plans and every other cost of usage, traffic or requests that this build has no line for are not computed.","A saving is compared only for the same source units on both sides and in one currency (an exchange rate from the assumption file, with its source and date, converts one side)."]},"migration_execution":{"verdict":"PARTIALLY_EXECUTABLE","verdict_words":"Partially executable migration package","steps_now":"48 of the 57 automated steps (OpenTofu or a script) can run now (1 waits for a manual prerequisite, 8 require a design decision) · 9 of those 48 rest on a default you have not confirmed (public endpoint, size derived from the source); a person can start 114 of the 254 manual steps now (4 wait for a manual prerequisite, 71 require a design decision, 65 are not executable as the plan stands); 3 steps are permanently unsupported (refused); 1 step has its verification incomplete: it carries critical settings of the source that no check validates, which a person confirms in the draft.","meaning":"Some steps cannot be carried out as the plan stands, whatever is decided. Execution completeness: COMPLETE (each of the 254 manual steps states what it is, why, who carries it out and when it is done, and the input it needs where it depends on one).","migration_ready":"Migration ready: NO — 307 critical settings of 48 source resources have manual or refused steps open (293 manual, 14 refused); 147 steps cannot be carried out now (79 wait only for a decision, 65 are not executable whatever is decided, 3 are refused).","steps":314,"terraform":53,"stackit_api":4,"manual":254,"refused":3,"executable":167,"after_manual":5,"waiting":79,"stuck":65,"decisions":[{"id":"DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","steps":66},{"id":"DEC-GEN-CONVERT-API-OPT-IN","steps":74},{"id":"DEC-GEN-CONVERT-DATA-MOVEMENT","steps":114},{"id":"DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","steps":84},{"id":"DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH","steps":66},{"id":"DEC-GEN-CONVERT-POD-SEGMENTATION","steps":96},{"id":"DEC-GEN-CONVERT-WORKLOAD-PLACEMENT","steps":3},{"id":"DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST","steps":8},{"id":"DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS","steps":2}],"unrecorded":0,"draft":{"blocks":53,"without_step":0,"complete":true},"work_packages":[{"id":"WP-01","title":"Answer the decisions the plan asks as steps (prepare)","owner":"Network Architect","steps":1,"resources":1,"decisions":["DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions"},{"id":"WP-02","title":"Set up the identities and access (prepare)","owner":"Identity Architect","steps":10,"resources":5,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"a person can start it now"},{"id":"WP-03","title":"Carry the routing the draft does not write (prepare)","owner":"Network Architect","steps":2,"resources":2,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"a person can start it now"},{"id":"WP-04","title":"Write the security group rules the draft does not write (prepare)","owner":"Security Architect","steps":2,"resources":1,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"a person can start it now"},{"id":"WP-05","title":"Routing architecture review (foundation)","owner":"Network Architect","steps":2,"resources":2,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"decisions to take: a person answers them, no change is made"},{"id":"WP-06","title":"Decide and set the critical settings (foundation)","owner":"Network Architect","steps":6,"resources":6,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"decisions to take: a person answers them, no change is made"},{"id":"WP-07","title":"Decide and set the critical settings (foundation)","owner":"Platform Architect","steps":3,"resources":3,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"decisions to take: a person answers them, no change is made"},{"id":"WP-08","title":"Write the security group rules the draft does not write (security)","owner":"Security Architect","steps":13,"resources":12,"decisions":["DEC-GEN-CONVERT-POD-SEGMENTATION"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions (10 of 13 steps)"},{"id":"WP-09","title":"Decide and set the critical settings (security)","owner":"Identity Architect","steps":11,"resources":11,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"decisions to take: a person answers them, no change is made"},{"id":"WP-10","title":"Decide and set the critical settings (security)","owner":"Network Architect","steps":12,"resources":12,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"decisions to take: a person answers them, no change is made"},{"id":"WP-11","title":"Decide and set the critical settings (security)","owner":"Platform Architect","steps":4,"resources":4,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"decisions to take: a person answers them, no change is made"},{"id":"WP-12","title":"Decide and set the critical settings (security)","owner":"Security Architect","steps":4,"resources":4,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"decisions to take: a person answers them, no change is made"},{"id":"WP-13","title":"Decide and set the critical settings (data services)","owner":"Data Architect","steps":4,"resources":4,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"decisions to take: a person answers them, no change is made"},{"id":"WP-14","title":"Decide and set the critical settings (data services)","owner":"Identity Architect","steps":3,"resources":3,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"decisions to take: a person answers them, no change is made"},{"id":"WP-15","title":"Decide and set the critical settings (data services)","owner":"Network Architect","steps":4,"resources":4,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"decisions to take: a person answers them, no change is made"},{"id":"WP-16","title":"Decide and set the critical settings (data services)","owner":"Platform Architect","steps":5,"resources":5,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"decisions to take: a person answers them, no change is made"},{"id":"WP-17","title":"Decide and set the critical settings (data services)","owner":"Security Architect","steps":5,"resources":5,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"decisions to take: a person answers them, no change is made"},{"id":"WP-18","title":"Move the data and the objects to the target","owner":"Data Architect","steps":2,"resources":1,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"a person can start it now"},{"id":"WP-19","title":"Set up the log delivery and its labels (platform services)","owner":"Platform Architect","steps":3,"resources":1,"decisions":["DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions (1 of 3 steps)"},{"id":"WP-20","title":"Decide and set the critical settings (platform services)","owner":"Identity Architect","steps":6,"resources":6,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"decisions to take: a person answers them, no change is made"},{"id":"WP-21","title":"Decide and set the critical settings (platform services)","owner":"Network Architect","steps":7,"resources":7,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"decisions to take: a person answers them, no change is made"},{"id":"WP-22","title":"Decide and set the critical settings (platform services)","owner":"Platform Architect","steps":7,"resources":7,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"decisions to take: a person answers them, no change is made"},{"id":"WP-23","title":"Decide and set the critical settings (platform services)","owner":"Security Architect","steps":6,"resources":6,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"decisions to take: a person answers them, no change is made"},{"id":"WP-24","title":"Set up by hand the resources the draft writes nothing for (platform services)","owner":"Platform Architect","steps":3,"resources":3,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"a person can start it now"},{"id":"WP-25","title":"Cluster access (platform services)","owner":"Platform Architect","steps":1,"resources":6,"decisions":[],"unrecorded":0,"state":"EXECUTABLE","state_words":"a person can start it now"},{"id":"WP-26","title":"Move the data and the objects to the target","owner":"Data Architect","steps":6,"resources":2,"decisions":["DEC-GEN-CONVERT-DATA-MOVEMENT"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions (2 of 6 steps)"},{"id":"WP-27","title":"Kubernetes apply (workloads)","owner":"Platform Architect","steps":5,"resources":5,"decisions":["DEC-GEN-CONVERT-POD-SEGMENTATION"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for the TODOs its manifests still hold: the application contracts of the workloads are not ready"},{"id":"WP-28","title":"Move the data and the objects to the target","owner":"Data Architect","steps":22,"resources":5,"decisions":["DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions"},{"id":"WP-29","title":"Move the data and the objects to the target","owner":"Migration Owner","steps":10,"resources":5,"decisions":["DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions"},{"id":"WP-30","title":"Switch the data consumers to the target","owner":"Data Architect","steps":4,"resources":4,"decisions":["DEC-GEN-CONVERT-DATA-MOVEMENT"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions"},{"id":"WP-31","title":"Switch the data consumers to the target","owner":"Identity Architect","steps":4,"resources":4,"decisions":["DEC-GEN-CONVERT-API-OPT-IN","DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","DEC-GEN-CONVERT-POD-SEGMENTATION"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions"},{"id":"WP-32","title":"Confirm that the cutover can start and that it is complete","owner":"Migration Owner","steps":2,"resources":0,"decisions":["DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","DEC-GEN-CONVERT-API-OPT-IN","DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH","DEC-GEN-CONVERT-POD-SEGMENTATION"],"unrecorded":0,"state":"NOT_EXECUTABLE","state_words":"not executable as the plan stands (1 of 2 steps)"},{"id":"WP-33","title":"Switch the clients to the target","owner":"Network Architect","steps":3,"resources":3,"decisions":["DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH","DEC-GEN-CONVERT-POD-SEGMENTATION"],"unrecorded":0,"state":"NOT_EXECUTABLE","state_words":"not executable as the plan stands (1 of 3 steps)"},{"id":"WP-34","title":"Switch the message producers and consumers to the target","owner":"Platform Architect","steps":2,"resources":1,"decisions":["DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","DEC-GEN-CONVERT-POD-SEGMENTATION"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions"},{"id":"WP-35","title":"Check the migrated estate and decide go or rollback","owner":"Data Architect","steps":5,"resources":5,"decisions":["DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","DEC-GEN-CONVERT-API-OPT-IN","DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH","DEC-GEN-CONVERT-POD-SEGMENTATION"],"unrecorded":0,"state":"NOT_EXECUTABLE","state_words":"not executable as the plan stands"},{"id":"WP-36","title":"Check the migrated estate and decide go or rollback","owner":"Migration Owner","steps":1,"resources":0,"decisions":["DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","DEC-GEN-CONVERT-API-OPT-IN","DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH","DEC-GEN-CONVERT-POD-SEGMENTATION"],"unrecorded":0,"state":"NOT_EXECUTABLE","state_words":"not executable as the plan stands"},{"id":"WP-37","title":"Check the migrated estate and decide go or rollback","owner":"Network Architect","steps":8,"resources":8,"decisions":["DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","DEC-GEN-CONVERT-API-OPT-IN","DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH","DEC-GEN-CONVERT-POD-SEGMENTATION"],"unrecorded":0,"state":"NOT_EXECUTABLE","state_words":"not executable as the plan stands (1 of 8 steps)"},{"id":"WP-38","title":"Retire the source resources","owner":"Data Architect","steps":9,"resources":5,"decisions":["DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","DEC-GEN-CONVERT-API-OPT-IN","DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH","DEC-GEN-CONVERT-POD-SEGMENTATION"],"unrecorded":0,"state":"NOT_EXECUTABLE","state_words":"not executable as the plan stands"},{"id":"WP-39","title":"Retire the source resources","owner":"Identity Architect","steps":15,"resources":15,"decisions":["DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","DEC-GEN-CONVERT-API-OPT-IN","DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH","DEC-GEN-CONVERT-POD-SEGMENTATION"],"unrecorded":0,"state":"NOT_EXECUTABLE","state_words":"not executable as the plan stands"},{"id":"WP-40","title":"Retire the source resources","owner":"Network Architect","steps":21,"resources":21,"decisions":["DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","DEC-GEN-CONVERT-API-OPT-IN","DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH","DEC-GEN-CONVERT-POD-SEGMENTATION","DEC-GEN-CONVERT-WORKLOAD-PLACEMENT","DEC-NET-STACKITROUTE-NAT-FIXED-EGRESS-ADDRESS-LOST"],"unrecorded":0,"state":"NOT_EXECUTABLE","state_words":"not executable as the plan stands"},{"id":"WP-41","title":"Retire the source resources","owner":"Platform Architect","steps":11,"resources":11,"decisions":["DEC-GEN-CONVERT-AMBIGUOUS-INSTANCE-SELECTION","DEC-GEN-CONVERT-API-OPT-IN","DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE","DEC-GEN-CONVERT-INGRESS-EXPOSURE-PATH","DEC-GEN-CONVERT-POD-SEGMENTATION","DEC-OPS-STACKITLOGS-RETENTION-OVER-180-DAYS"],"unrecorded":0,"state":"NOT_EXECUTABLE","state_words":"not executable as the plan stands"}],"stackit_api_states":[{"state":"OFFLINE_TESTED","words":"generated, tested offline","steps":4}],"stackit_api_steps":[{"step":"API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","label":"API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","call":"secrets-manager-vault WriteSecret","capability":"identity.secret","state":"OFFLINE_TESTED","words":"generated, tested offline","meaning":"A test of StackToIT ran a script of this call under a real shell against a local stub that answers as the API is documented to; it was not run against the live STACKIT API."},{"step":"API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","label":"API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","call":"secrets-manager-vault WriteSecret","capability":"identity.secret","state":"OFFLINE_TESTED","words":"generated, tested offline","meaning":"A test of StackToIT ran a script of this call under a real shell against a local stub that answers as the API is documented to; it was not run against the live STACKIT API."},{"step":"API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq","label":"API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.mq","call":"secrets-manager-vault WriteSecret","capability":"identity.secret","state":"OFFLINE_TESTED","words":"generated, tested offline","meaning":"A test of StackToIT ran a script of this call under a real shell against a local stub that answers as the API is documented to; it was not run against the live STACKIT API."},{"step":"API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db","label":"API/secrets-manager-vault/WriteSecret/module.retail_app_ecs.aws_secretsmanager_secret.orders_db","call":"secrets-manager-vault WriteSecret","capability":"identity.secret","state":"OFFLINE_TESTED","words":"generated, tested offline","meaning":"A test of StackToIT ran a script of this call under a real shell against a local stub that answers as the API is documented to; it was not run against the live STACKIT API."}],"progress_split":{"steps":314,"decide":89,"now":73,"waiting":149,"refused":3},"open_fields":[{"step":"MAN/security/accept/module.retail_app_ecs.module.alb.aws_lb.this:plaintext-public-listener","subject":"module.retail_app_ecs.module.alb.aws_lb.this","fields":[{"field":"accepted by / date / reference","kind":"VALIDATION","owner":"Security Architect","required":true,"closes_when":"the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it","words":"accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.alb.aws_lb.this that the draft carries: The source load balancer module.retail_app_ecs.module.alb.aws_lb.this is internet-facing and every listener it states is HTTP (port 80 forwards to its targets, no listener is HTTPS or TLS): clients reach the application without transport encryption. In the draft: the drafted listener of stackit_application_load_balancer.retail_app_ecs_alb_this is plain HTTP on port 80, as the source states it; the public address is kept and no HTTPS listener or certificate is added. Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)"}]},{"step":"MAN/security/accept/module.retail_app_ecs.module.carts_service.aws_security_group.this:open-ingress-application-port","subject":"module.retail_app_ecs.module.carts_service.aws_security_group.this","fields":[{"field":"accepted by / date / reference","kind":"VALIDATION","owner":"Security Architect","required":true,"closes_when":"the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it","words":"accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.carts_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.carts_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)"}]},{"step":"MAN/security/accept/module.retail_app_ecs.module.catalog_service.aws_security_group.this:open-ingress-application-port","subject":"module.retail_app_ecs.module.catalog_service.aws_security_group.this","fields":[{"field":"accepted by / date / reference","kind":"VALIDATION","owner":"Security Architect","required":true,"closes_when":"the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it","words":"accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.catalog_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.catalog_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)"}]},{"step":"MAN/security/accept/module.retail_app_ecs.module.checkout_service.aws_security_group.this:open-ingress-application-port","subject":"module.retail_app_ecs.module.checkout_service.aws_security_group.this","fields":[{"field":"accepted by / date / reference","kind":"VALIDATION","owner":"Security Architect","required":true,"closes_when":"the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it","words":"accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.checkout_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.checkout_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)"}]},{"step":"MAN/security/accept/module.retail_app_ecs.module.orders_service.aws_security_group.this:open-ingress-application-port","subject":"module.retail_app_ecs.module.orders_service.aws_security_group.this","fields":[{"field":"accepted by / date / reference","kind":"VALIDATION","owner":"Security Architect","required":true,"closes_when":"the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it","words":"accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.orders_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.orders_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)"}]},{"step":"MAN/security/accept/module.retail_app_ecs.module.ui_service.aws_security_group.this:open-ingress-application-port","subject":"module.retail_app_ecs.module.ui_service.aws_security_group.this","fields":[{"field":"accepted by / date / reference","kind":"VALIDATION","owner":"Security Architect","required":true,"closes_when":"the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it","words":"accepted by / date / reference: UNKNOWN — supplied by Security Architect (who accepts the weakness of module.retail_app_ecs.module.ui_service.aws_security_group.this that the draft carries: The source security group module.retail_app_ecs.module.ui_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to. In the draft: the drafted rule stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION). Or the hardening that replaces the acceptance, with the date and the reference of the change; closed when the Security Architect records who accepted the weakness, the date and a reference (a ticket, a risk register entry), or the hardening that removed it)"}]},{"step":"MAN/data/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default/preflight","subject":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","shape":"OFS-127c12e6a92b"},{"step":"MAN/data/module.dependencies.module.catalog_rds.aws_rds_cluster.this/preflight","subject":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","shape":"OFS-127c12e6a92b"},{"step":"MAN/data/module.dependencies.module.orders_rds.aws_rds_cluster.this/preflight","subject":"module.dependencies.module.orders_rds.aws_rds_cluster.this","shape":"OFS-127c12e6a92b"},{"step":"MAN/cutover/connection/module.dependencies.module.catalog_rds.aws_rds_cluster.this","subject":"module.dependencies.module.catalog_rds.aws_rds_cluster.this","shape":"OFS-256ca1b0e2b2"},{"step":"MAN/cutover/connection/module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","subject":"module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default","shape":"OFS-256ca1b0e2b2"},{"step":"MAN/data/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this/export/own-tool","subject":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","shape":"OFS-127c12e6a92b"},{"step":"MAN/cutover/connection/module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","subject":"module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this","shape":"OFS-256ca1b0e2b2"},{"step":"MAN/cutover/connection/module.dependencies.module.orders_rds.aws_rds_cluster.this","subject":"module.dependencies.module.orders_rds.aws_rds_cluster.this","shape":"OFS-256ca1b0e2b2"},{"step":"MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","subject":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_db","shape":"OFS-b76758028570"},{"step":"MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","subject":"module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch","shape":"OFS-b76758028570"},{"step":"MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.mq","subject":"module.retail_app_ecs.aws_secretsmanager_secret.mq","shape":"OFS-b76758028570"},{"step":"MAN/cutover/connection/module.retail_app_ecs.aws_secretsmanager_secret.orders_db","subject":"module.retail_app_ecs.aws_secretsmanager_secret.orders_db","shape":"OFS-b76758028570"},{"step":"MAN/cutover/module.dependencies.aws_mq_broker.mq","subject":"module.dependencies.aws_mq_broker.mq","shape":"OFS-035504467a53"},{"step":"MAN/cutover/messaging-consumers/module.dependencies.aws_mq_broker.mq","subject":"module.dependencies.aws_mq_broker.mq","fields":[{"field":"source retention","kind":"ROLLBACK","owner":"Migration Owner","required":true,"closes_when":"the date until which module.dependencies.aws_mq_broker.mq is kept is recorded","words":"source retention: UNKNOWN — supplied by Migration Owner (module.dependencies.aws_mq_broker.mq is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which module.dependencies.aws_mq_broker.mq is kept is recorded)"},{"field":"rollback trigger","kind":"ROLLBACK","owner":"Migration Owner","required":true,"closes_when":"the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover","words":"rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)"},{"field":"data written to the target","kind":"ROLLBACK","owner":"Platform Architect","required":true,"closes_when":"the choice is recorded before the cutover","words":"data written to the target: UNKNOWN — supplied by Platform Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to module.dependencies.aws_mq_broker.mq before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)"}]},{"step":"MAN/cutover/module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","subject":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this","shape":"OFS-035504467a53"},{"step":"MAN/cutover/module.retail_app_ecs.module.alb.aws_lb.this","subject":"module.retail_app_ecs.module.alb.aws_lb.this","shape":"OFS-035504467a53"},{"step":"MAN/verify/dns/module.retail_app_ecs.module.carts_service.aws_ecs_service.this","fields":[{"field":"resolve carts","kind":"VALIDATION","owner":"Network Architect","required":true,"closes_when":"the address the name resolves to is recorded and the application connects through it","words":"resolve carts: UNKNOWN — supplied by Network Architect (the address carts resolves to from a pod of carts, compared with what stands for it on STACKIT: carts.\u003cnamespace\u003e.svc.cluster.local (the Kubernetes Service carts; carts from a pod of the same namespace). resolve, from a pod of a client of carts, carts and carts.\u003cnamespace\u003e.svc.cluster.local: expect the ClusterIP of the Kubernetes Service carts (kubectl get service carts); closed when the address the name resolves to is recorded and the application connects through it)"}]},{"step":"MAN/verify/dns/module.retail_app_ecs.module.catalog_service.aws_ecs_service.this","fields":[{"field":"resolve the endpoint host of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch)","kind":"VALIDATION","owner":"Network Architect","required":true,"closes_when":"the address the name resolves to is recorded and the application connects through it","words":"resolve the endpoint host of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch) resolves to from a pod of catalog, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_opensearch_instance.dependencies_catalog_opensearch_this (OpenSearch) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of catalog, the host of stackit_opensearch_instance.dependencies_catalog_opensearch_this and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it)"},{"field":"resolve the endpoint host of module.dependencies.module.catalog_rds.aws_rds_cluster.this (Aurora)","kind":"VALIDATION","owner":"Network Architect","required":true,"closes_when":"the address the name resolves to is recorded and the application connects through it","words":"resolve the endpoint host of module.dependencies.module.catalog_rds.aws_rds_cluster.this (Aurora): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.module.catalog_rds.aws_rds_cluster.this (Aurora) resolves to from a pod of catalog, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_mariadb_instance.dependencies_catalog_rds_this (MariaDB) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of catalog, the host of stackit_mariadb_instance.dependencies_catalog_rds_this and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it)"},{"field":"resolve catalog","kind":"VALIDATION","owner":"Network Architect","required":true,"closes_when":"the address the name resolves to is recorded and the application connects through it","words":"resolve catalog: UNKNOWN — supplied by Network Architect (the address catalog resolves to from a pod of catalog, compared with what stands for it on STACKIT: catalog.\u003cnamespace\u003e.svc.cluster.local (the Kubernetes Service catalog; catalog from a pod of the same namespace). resolve, from a pod of a client of catalog, catalog and catalog.\u003cnamespace\u003e.svc.cluster.local: expect the ClusterIP of the Kubernetes Service catalog (kubectl get service catalog); closed when the address the name resolves to is recorded and the application connects through it)"}]},{"step":"MAN/verify/dns/module.retail_app_ecs.module.checkout_service.aws_ecs_service.this","fields":[{"field":"resolve the endpoint host of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (ElastiCache)","kind":"VALIDATION","owner":"Network Architect","required":true,"closes_when":"the address the name resolves to is recorded and the application connects through it","words":"resolve the endpoint host of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (ElastiCache): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (ElastiCache) resolves to from a pod of checkout, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_valkey_instance.dependencies_checkout_elasticache_redis_default (Key Value Store (Valkey)) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of checkout, the host of stackit_valkey_instance.dependencies_checkout_elasticache_redis_default and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it)"},{"field":"resolve checkout","kind":"VALIDATION","owner":"Network Architect","required":true,"closes_when":"the address the name resolves to is recorded and the application connects through it","words":"resolve checkout: UNKNOWN — supplied by Network Architect (the address checkout resolves to from a pod of checkout, compared with what stands for it on STACKIT: checkout.\u003cnamespace\u003e.svc.cluster.local (the Kubernetes Service checkout; checkout from a pod of the same namespace). resolve, from a pod of a client of checkout, checkout and checkout.\u003cnamespace\u003e.svc.cluster.local: expect the ClusterIP of the Kubernetes Service checkout (kubectl get service checkout); closed when the address the name resolves to is recorded and the application connects through it)"}]},{"step":"MAN/verify/dns/module.retail_app_ecs.module.orders_service.aws_ecs_service.this","fields":[{"field":"resolve the endpoint host of module.dependencies.aws_mq_broker.mq (Amazon MQ)","kind":"VALIDATION","owner":"Network Architect","required":true,"closes_when":"the address the name resolves to is recorded and the application connects through it","words":"resolve the endpoint host of module.dependencies.aws_mq_broker.mq (Amazon MQ): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.aws_mq_broker.mq (Amazon MQ) resolves to from a pod of orders, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_rabbitmq_instance.dependencies_mq (RabbitMQ) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of orders, the host of stackit_rabbitmq_instance.dependencies_mq and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it)"},{"field":"resolve the endpoint host of module.dependencies.module.orders_rds.aws_rds_cluster.this (Aurora)","kind":"VALIDATION","owner":"Network Architect","required":true,"closes_when":"the address the name resolves to is recorded and the application connects through it","words":"resolve the endpoint host of module.dependencies.module.orders_rds.aws_rds_cluster.this (Aurora): UNKNOWN — supplied by Network Architect (the address the endpoint host of module.dependencies.module.orders_rds.aws_rds_cluster.this (Aurora) resolves to from a pod of orders, compared with what stands for it on STACKIT: the host name the STACKIT instance stackit_postgresflex_instance.dependencies_orders_rds_this (PostgreSQL Flex) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. resolve, from a pod of orders, the host of stackit_postgresflex_instance.dependencies_orders_rds_this and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opens; closed when the address the name resolves to is recorded and the application connects through it)"},{"field":"resolve orders","kind":"VALIDATION","owner":"Network Architect","required":true,"closes_when":"the address the name resolves to is recorded and the application connects through it","words":"resolve orders: UNKNOWN — supplied by Network Architect (the address orders resolves to from a pod of orders, compared with what stands for it on STACKIT: orders.\u003cnamespace\u003e.svc.cluster.local (the Kubernetes Service orders; orders from a pod of the same namespace). resolve, from a pod of a client of orders, orders and orders.\u003cnamespace\u003e.svc.cluster.local: expect the ClusterIP of the Kubernetes Service orders (kubectl get service orders); closed when the address the name resolves to is recorded and the application connects through it)"}]},{"step":"MAN/verify/dns/module.retail_app_ecs.module.ui_service.aws_ecs_service.this","fields":[{"field":"resolve ui","kind":"VALIDATION","owner":"Network Architect","required":true,"closes_when":"the address the name resolves to is recorded and the application connects through it","words":"resolve ui: UNKNOWN — supplied by Network Architect (the address ui resolves to from a pod of ui, compared with what stands for it on STACKIT: ui.\u003cnamespace\u003e.svc.cluster.local (the Kubernetes Service ui; ui from a pod of the same namespace). resolve, from a pod of a client of ui, ui and ui.\u003cnamespace\u003e.svc.cluster.local: expect the ClusterIP of the Kubernetes Service ui (kubectl get service ui); closed when the address the name resolves to is recorded and the application connects through it)"}]}],"open_field_shapes":[{"id":"OFS-035504467a53","fields":[{"field":"source retention","kind":"ROLLBACK","owner":"Migration Owner","required":true,"closes_when":"the date until which {subject} is kept is recorded","words":"source retention: UNKNOWN — supplied by Migration Owner ({subject} is not retired until the GO recorded at the rollback decision step; how long it is kept after that is the owner's; closed when the date until which {subject} is kept is recorded)"},{"field":"rollback trigger","kind":"ROLLBACK","owner":"Migration Owner","required":true,"closes_when":"the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover","words":"rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)"},{"field":"data written to the target","kind":"ROLLBACK","owner":"Network Architect","required":true,"closes_when":"the owner of the application records whether the clients write and, if they do, whether their writes are copied back to AWS on a rollback or accepted as lost","words":"data written to the target: UNKNOWN — supplied by Network Architect (the switch moves requests, not data: whether the switched clients write through the STACKIT address, and where those writes are stored; closed when the owner of the application records whether the clients write and, if they do, whether their writes are copied back to AWS on a rollback or accepted as lost)"}]},{"id":"OFS-127c12e6a92b","fields":[{"field":"copy volume","kind":"DATA_MOVE","owner":"Data Architect","required":true,"closes_when":"the measured amount and the date of the measurement are recorded","words":"copy volume: UNKNOWN — supplied by Data Architect (the amount of data of {subject} to copy: the used space measured on the source; the provisioned capacity of the source is not the amount of data; closed when the measured amount and the date of the measurement are recorded)"},{"field":"change rate","kind":"DATA_MOVE","owner":"Data Architect","required":true,"closes_when":"the rate measured over a representative period is recorded, with the time a final pass needs at that rate","words":"change rate: UNKNOWN — supplied by Data Architect (how much data the writers of {subject} change per hour; closed when the rate measured over a representative period is recorded, with the time a final pass needs at that rate)"},{"field":"write-freeze window","kind":"DATA_MOVE","owner":"Data Architect","required":true,"closes_when":"the owner of the application agrees the start and the end of the window and it is recorded","words":"write-freeze window: UNKNOWN — supplied by Data Architect (the window in which the writers of {subject} stop for the final pass; closed when the owner of the application agrees the start and the end of the window and it is recorded)"},{"field":"last sync","kind":"DATA_MOVE","owner":"Data Architect","required":true,"closes_when":"the time of the final pass and the result of its checks are recorded","words":"last sync: UNKNOWN — supplied by Data Architect (the time the final pass ends and its checks hold; closed when the time of the final pass and the result of its checks are recorded)"},{"field":"return point","kind":"DATA_MOVE","owner":"Data Architect","required":true,"closes_when":"the return point is recorded with its time and how it is restored","words":"return point: UNKNOWN — supplied by Data Architect (the state of {subject} the migration returns to on a rollback: the source as it was at the write freeze, or a named snapshot or backup; closed when the return point is recorded with its time and how it is restored)"},{"field":"consistency check","kind":"CONSISTENCY","owner":"Data Architect","required":true,"closes_when":"the method is agreed and its result after the final pass is recorded","words":"consistency check: UNKNOWN — supplied by Data Architect (how the copy of {subject} is shown complete and unchanged after the final pass: the used space and a checksum of the data (of the files, or the row counts of the tables) agree with the source; closed when the method is agreed and its result after the final pass is recorded)"},{"field":"validation on the target","kind":"VALIDATION","owner":"Migration Owner","required":true,"closes_when":"the test passes on the target and its result is recorded","words":"validation on the target: UNKNOWN — supplied by Migration Owner (the test the application that uses {subject} passes on STACKIT with the copied data before the cutover, agreed with the owner of the application; closed when the test passes on the target and its result is recorded)"},{"field":"source retention","kind":"ROLLBACK","owner":"Migration Owner","required":true,"closes_when":"the date until which {subject} is kept is recorded","words":"source retention: UNKNOWN — supplied by Migration Owner ({subject} is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which {subject} is kept is recorded)"},{"field":"rollback trigger","kind":"ROLLBACK","owner":"Migration Owner","required":true,"closes_when":"the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover","words":"rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)"},{"field":"data written to the target","kind":"ROLLBACK","owner":"Data Architect","required":true,"closes_when":"the choice is recorded before the cutover","words":"data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to {subject} before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)"}]},{"id":"OFS-256ca1b0e2b2","fields":[{"field":"source retention","kind":"ROLLBACK","owner":"Migration Owner","required":true,"closes_when":"the date until which {subject} is kept is recorded","words":"source retention: UNKNOWN — supplied by Migration Owner ({subject} is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which {subject} is kept is recorded)"},{"field":"rollback trigger","kind":"ROLLBACK","owner":"Migration Owner","required":true,"closes_when":"the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover","words":"rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)"},{"field":"data written to the target","kind":"ROLLBACK","owner":"Data Architect","required":true,"closes_when":"the choice is recorded before the cutover","words":"data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to {subject} before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)"}]},{"id":"OFS-b76758028570","fields":[{"field":"source retention","kind":"ROLLBACK","owner":"Migration Owner","required":true,"closes_when":"the date until which {subject} is kept is recorded","words":"source retention: UNKNOWN — supplied by Migration Owner ({subject} is not retired until the GO recorded at the rollback decision step; how long it and its final backup are kept after that is the owner's; closed when the date until which {subject} is kept is recorded)"},{"field":"rollback trigger","kind":"ROLLBACK","owner":"Migration Owner","required":true,"closes_when":"the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover","words":"rollback trigger: UNKNOWN — supplied by Migration Owner (the ROLLBACK recorded at the rollback decision step; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)"},{"field":"data written to the target","kind":"ROLLBACK","owner":"Identity Architect","required":true,"closes_when":"the choice is recorded before the cutover","words":"data written to the target: UNKNOWN — supplied by Identity Architect (what is written on STACKIT after the switch is not in AWS: it is copied back to {subject} before AWS serves again, or accepted as lost; closed when the choice is recorded before the cutover)"}]}]},"machine_files":[{"path":"assessment.json","description":"The full assessment: every unit, finding and count, machine-readable. Every number in this workspace is read from it.","present":true},{"path":"engineering/architect-report.md","description":"The assessment in words: the run status and its checks, and for each unit the class, the confidence and the STACKIT target proposed.","present":true},{"path":"engineering/analysis-details.md","description":"The working behind engineering/architect-report.md: the relations and combinations the engine evaluated for the decisions that depend on them. Nothing here is a second decision.","present":true},{"path":"architecture/dependencies.mmd","description":"The source and the target architecture as a diagram in Mermaid text, for tools that draw it. The Architecture section of this page draws the same units itself.","present":true},{"path":"migration/technical-sequencing.md","description":"A draft order of work: waves computed from the dependencies between units. A starting point for the architect's plan, not a schedule.","present":true},{"path":"engineering/review.csv","description":"One row per unit for spreadsheet review.","present":true},{"path":"engineering/review-edges.csv","description":"One row per dependency between units, for the architect to confirm, correct or complete.","present":true},{"path":"workspace.json","description":"The compact model the pages show, machine-readable. No page embeds it: the pages are complete without it, and a tool reads the model from this file.","present":true},{"path":"index.html","description":"The front page: the header, the navigation and the Overview. The other sections are the pages in pages/.","present":true},{"path":"pages/applications.html","description":"The Applications section as a page of its own, with the same header and navigation. Which application each unit belongs to, and each application's migration strategy.","present":true},{"path":"pages/architecture.html","description":"The Architecture section as a page of its own, with the same header and navigation. The units of the estate and what the assessment decided for each.","present":true},{"path":"pages/decisions.html","description":"The Decisions section as a page of its own, with the same header and navigation. The decisions people must take, aggregated, with their options, owners and deadlines.","present":true},{"path":"pages/target-fit.html","description":"The Target Fit section as a page of its own, with the same header and navigation. How well each STACKIT target fits: service, interface, Terraform, region, maturity, quota, lifecycle, operability, support and security.","present":true},{"path":"pages/migration.html","description":"The Migration Plan section as a page of its own, with the same header and navigation. Waves, prerequisites, data movement and the order of work.","present":true},{"path":"pages/security-assurance.html","description":"The Security \u0026 Resilience section as a page of its own, with the same header and navigation. What has been proven about security and resilience, what has not, and what needs evidence from outside; the resilience of each unit, where this run assesses it, is on the Operations page.","present":true},{"path":"pages/sovereignty.html","description":"The Sovereignty section as a page of its own, with the same header and navigation. Dependencies, jurisdiction, data placement, key control and exit paths, source against target.","present":true},{"path":"pages/operations.html","description":"The Operations section as a page of its own, with the same header and navigation. Whether the target can be run: identity, audit, observability, backup, restore, support and lifecycle.","present":true},{"path":"pages/cost.html","description":"The Costs section as a page of its own, with the same header and navigation. Priced and unpriced coverage, and the inputs a cost estimate needs.","present":true},{"path":"pages/evidence.html","description":"The Evidence section as a page of its own, with the same header and navigation. The counts, versions and sources behind every statement in this workspace.","present":true},{"path":"pages/engineering.html","description":"The Engineering Evidence section as a page of its own, with the same header and navigation. The machine-readable files and the Terraform draft.","present":true},{"path":"pages/work-board.html","description":"The Work Board section as a page of its own, with the same header and navigation. Every job of the migration in one list, in four queues: who does it, what it waits for, what closes it and which file it carries out.","present":true},{"path":"pages/decisions/","description":"The group pages of the Decisions section: the full cards of the records the page does not hold, one page per work package (the page of the section lists the groups), and, for a very large estate, its long lists cut into pages of a size a browser opens. Present only when the register has more records than the page holds cards.","present":true},{"path":"decisions.json","description":"The decision register, machine-readable, with a template of the decisions file to fill in.","present":true},{"path":"migration/decisions.csv","description":"The decision records as rows for a spreadsheet.","present":true},{"path":"executive/decisions.md","description":"The decision records in words.","present":true},{"path":"executive/brief.md","description":"The five-minute answer as a document: the run summary, what holds the estate back, what people must decide, the shape of the target and what has and has not been established. It restates numbers this file holds and scores nothing.","present":true},{"path":"migration/applications.csv","description":"One row per application of the applications file you gave, with the values as you wrote them (a value you did not write is marked not provided), and one row per unit claimed by several applications. Header only without an applications file.","present":true},{"path":"migration/waves.csv","description":"The dependency order of the units, one row per unit: the wave, WITHHELD when a part of the source was not read in full, or REFUSED for a unit the partial draft refuses for a missing input (in no wave). An order of work, not a schedule.","present":true},{"path":"migration/actions.csv","description":"The register of what a person has to do, decide or establish before the draft is deployed, one typed row per item: gaps in the reading of the source, critical semantics left open, open decisions and manual actions of the plans, workload items that wait for evidence, and validation rows not yet established. Every member of decisions.json is a row; each row names the decision record that holds it. It lists what is open and decides nothing.","present":true},{"path":"migration/work-board.csv","description":"The Work Board as a sheet: one row per job of the migration, in one of four queues (provide information, approve a design, perform migration work, verify), with its owner, priority, what it waits for, what closes it, its evidence, the files it carries out and the steps of the execution plan it holds. Every step of the plan is in exactly one job, or listed as not taken; pages/work-board.html shows the same jobs. Header only when the run wrote no execution plan.","present":true},{"path":"migration/source-target.csv","description":"Each source unit beside its STACKIT target, one row per unit: the target service and its resources, or in words that there is none, that the unit is refused or that the source switches it off, and how many of its settings are kept (PRESERVED), changed (TRANSFORMED), accepted (ACCEPTED_*) or still to do (everything else, including anything not known). Counted from the rows of assurance/equivalence-ledger.csv; a unit with no ledger row has four zeros, which says nothing was counted, not that nothing is left to do. Header only when the Workspace holds no counts.","present":true},{"path":"migration/application-chain.csv","description":"The drill-down from each application of the customer's file and each group the run suggested (PROPOSED: a reading of the source, not confirmed by anyone), one row per member unit: the AWS resource, the STACKIT target in the words of migration/source-target.csv, the ids of the decisions that still ask something about the unit, the steps of the execution plan that carry it with the number an answer leaves not taken, the Kubernetes manifest objects that tie to it by an exact literal match, and what the code scan says of the application. A run that read no plan or built no register marks those cells as not assessed, which is not an empty list. Header only when the Workspace holds none.","present":true},{"path":"migration/prerequisites.md","description":"For each unit, the open decisions and manual actions that stand between its draft and its deployment, as its plan states them.","present":true},{"path":"migration/data-movement.csv","description":"One row per stateful source unit (a database, a cache, a volume, a file share, an object store): its source and target service, the data class, RPO and downtime tolerance you stated (or marked not provided), the provisioned capacity the source states (not the size of the data) and the cutover dependency. The mechanism of every unit is UNKNOWN: StackToIT never moves data.","present":true},{"path":"migration/data-movement.md","description":"The same units in words, with what the source and the plans do and do not state about each. No size, change rate, duration, transfer rate or downtime is ever stated, and no mechanism is chosen.","present":true},{"path":"migration/data-movement.json","description":"The data_movement block of workspace.json with every stateful source unit (the facets, the unknowns, the provisioned capacity and where each fact is read from), as a file of its own, with the run it belongs to. workspace.json carries the tally of the units.","present":true},{"path":"architecture/current.mmd","description":"The units of the estate and the dependencies among them as a Mermaid flowchart, with the units of each application drawn together.","present":true},{"path":"architecture/target.mmd","description":"The same units with the STACKIT service proposed for each, its class and confidence, as a Mermaid flowchart.","present":true},{"path":"architecture/delta.mmd","description":"The same units with what the move changes for each: its class, whether it has a target, and how many properties the draft names as not carried.","present":true},{"path":"architecture/current.svg","description":"The drawing of the source architecture of the Architecture section, as a file of its own, without the links of the page.","present":true},{"path":"architecture/target.svg","description":"The drawing of the proposed STACKIT target of the Architecture section, as a file of its own.","present":true},{"path":"architecture/delta.svg","description":"The drawing of what the move changes, as a file of its own.","present":true},{"path":"assurance/safety.md","description":"What has and has not been established about the draft, row by row, with the global invariants. It approves nothing and asserts neither equivalence nor that the draft is safe to apply.","present":true},{"path":"assurance/source-compatibility.md","description":"How much of the source was read, the source providers the assessment saw and the source types the knowledge base does not know.","present":true},{"path":"assurance/target-readiness.md","description":"How the STACKIT targets of the units stand in the capability catalogue and in the pinned provider (maturity, lifecycle), and the readiness dimensions.","present":true},{"path":"assurance/operational-readiness.md","description":"The workload readiness of the units (installation, source artifacts, target preconditions, cutover, day 2) and the support options STACKIT evidences. Terraform generated is not workload ready.","present":true},{"path":"assurance/compliance-evidence.md","description":"For each STACKIT service of the draft and each framework in scope, the state of the provider's own evidence. It says nothing about the compliance of your workload.","present":true},{"path":"assurance/compliance-evidence.csv","description":"The cells of compliance-evidence.md as rows for a spreadsheet.","present":true},{"path":"assurance/equivalence-ledger.csv","description":"The equivalence ledger: one row per unit and semantic of the assessment that the source states (workspace.json counts those it does not state), and one row per unit and property for the properties the draft does not carry, no semantic accounts for or that are critical and still open. Each row says how the source states the value, what proves the disposition, where the draft carries it and what stays open. Dispositions are the words the assessment uses today; PRESERVED appears only where the assessment or the draft's plan states it.","present":true},{"path":"assurance/evidence-ledger.csv","description":"The evidence the ledger and the other blocks cite, one row per document, with what it backs, the date it was checked, the date after which it is to be checked again and its state. Evidence that states no such dates is UNDATED, never CURRENT.","present":true},{"path":"assurance/critical-semantics.json","description":"The open critical semantics, one row per unit and semantic, with the disposition the contract result gives, the cause code, the sentences that say why the semantic is open and what would close it, the instances of a repeated unit and the alarm card where there is one. These are the rows the decision records name as their members; workspace.json carries the tally of them, with the run it belongs to.","present":true},{"path":"assurance/resilience.md","description":"The RTO and RPO you stated (or that none was stated) and, for each unit that holds state or states a zone, replication or backup fact, what the source states. No unit is called resilient and no intent is chosen.","present":true},{"path":"assurance/resilience.json","description":"The resilience block of workspace.json with every unit that states a failure-domain, replication or backup fact or holds state (the quoted source facts, the state and where each fact is read from), as a file of its own, with the run it belongs to. workspace.json carries the tally of the units.","present":true},{"path":"assurance/identity-transition.md","description":"For each unit that runs as an identity or is one: the identities the source names, the static credential the knowledge base reads, the federation facts, the attachment the identity plan holds and its state. It makes no claim that federation is an option; privilege delta, break-glass access and human identity are not assessed.","present":true},{"path":"assurance/sovereignty.md","description":"The sovereignty requirement (not provided unless your applications file states one), the dimensions of sovereignty with what the source shows and what the target is proposed to be, the dependencies and the exitability. Sovereignty is not residency; it holds no score and certifies no legal compliance.","present":true},{"path":"assurance/sovereignty.json","description":"The sovereignty block of workspace.json as a file of its own, with the run it belongs to.","present":true},{"path":"financial/price-snapshot.json","description":"The price_snapshot block of workspace.json as a file of its own, with the run it belongs to: which snapshot of the public STACKIT price list this run cites (source, retrieval date, sha256, currency, net list price) and how many of the drafted resources it priced. It holds list prices only: no quantity is read, no total is built, and no usage and no egress is computed.","present":true},{"path":"financial/cost-model.json","description":"The cost model of the run, line by line: for each component of the AWS source (EC2 instances and EBS volumes) and of the STACKIT target (servers and volumes) its quantity (a value, a range or unknown, and where it comes from), its price record or the reason there is none, its pricing state and its amount; then the totals of the estate and of each service for each side (full, partial or none), the comparison of source and target with the reason a saving is or is not given, the price sources (the local price cache) and the assumptions the figures rest on. An estimate under one labelled scenario, not a bill.","present":true},{"path":"financial/priced-resources.csv","description":"One row for each line of the cost model (financial/cost-model.json), source and target: the quantity with its provenance, the price record (SKU, rate, unit, the date it is valid from, the snapshot it comes from) or the state and the reason there is none, and the amount of a priced line. An empty amount is a line that is not priced, never a zero.","present":true},{"path":"financial/mapping.csv","description":"The technical mapping beside the prices: for each server, boot disk, disk and database whose source and target are both in the computed group of the cost model, what each side states about vCPU, memory, CPU model, disk capacity, IOPS, throughput and high availability. The source side is read from the attributes of the source resource, the target side from the catalogue snapshot of the region; a fact a side does not state is the words not stated. A machine type is one of the types of the catalogue with at least the vCPUs and memory of the source (a burstable source may be offered shared types); a storage class is the one the draft names (the customer's answer or the variable's default), shown with the catalogue's own IOPS and throughput. The table states sizes; it is not a statement about the performance of the target against the source (no benchmark was run, and a CPU model that a side does not state is shown as not stated). The last six columns add, for a disk, the fee of the selected performance class (the cost model's own amount) with the assumption behind the class, whether the class covers the IOPS and throughput of the source volume, and the smaller classes of the catalogue that still cover them with their fee and change (an alternative with the same or better figures than the source; not a recommendation), and, for a server, whether the flavor is with or without CPU overprovisioning (the documentation's terms, by the overcommit the catalogue states) and what STACKIT states of its lifecycle (a deprecated type says so, with the sentence of the documentation). The size match columns state the comparison of a server's machine type with the source instance and of a database's PostgreSQL Flex flavor with the RDS instance class (vCPUs, memory and the kind, single node or replica set, against Multi-AZ) as proven, to review, not met or unknown, with the sentence that says what was compared; a basis names a size only where the size match is proven.","present":true},{"path":"financial/cost-coverage.md","description":"What the cost model covers: the price sources it looked at, the lines by pricing state for each side, the totals with their state (full, partial or none), the comparison of source and target and why a saving is or is not given, the assumptions, and what the list prices of the STACKIT snapshot cover, with what is known of the terms of reuse of the price data.","present":true},{"path":"engineering/not-carried.csv","description":"One row per property the draft names as not carried: the unit, the node and the property, what the assessment states about it (the class and closure of the critical-property gate, the draft's own reason, the contract semantic that reads it, what closes that semantic while it is open) and the place of the node in the source. A cell the assessment states nothing for is empty.","present":true},{"path":"engineering/not-carried-summary.csv","description":"The units for which the draft names properties as not carried, with how many, and the units that have no count (their draft block was not accounted, or they need no resource of their own).","present":true},{"path":"engineering/evidence-index.json","description":"The reverse table of the evidence index: one entry per block of the draft, with the units it comes from, whether it is an HCL block, a comment or not placed, and its file and line, with the hop table and the checks over the draft. workspace.json carries the tally of the entries and, on each unit, the forward hops; this file is the mirror of them, with the run it belongs to.","present":true},{"path":"engineering/trace/","description":"The full comment of each block of the Terraform draft that has one: the draft keeps a one-paragraph comment above the block (where it comes from, why its values are what they are, what is not carried, which decision is open) and a `# trace: TR-...` line, and the section of this folder that line names holds the whole comment the generators wrote, unabridged: the rule and knowledge-base stamp, the references with their digests, the evidence of each chosen value and the reason of each attribute that is not written. One file for each file of the draft that has such a block, named after it with the extension .md, one section for each block under an anchor that is its trace id; the blocks are linked to their file by `trace_file` and their anchor `trace_id` in engineering/evidence-index.json. This run wrote 8 files with 48 sections.","present":true},{"path":"engineering/trace-index.csv","description":"One row per block with a trace: the trace id, the block, the draft file, the source units, the lines of the comment as the generators wrote it and the lines the draft keeps, and the pointer of the block (the trace file and the anchor of its section).","present":true,"bytes":11125},{"path":"terraform/","description":"The proposed STACKIT Terraform. A draft: architect review is required before any use. Present only when the run produced it.","present":true},{"path":"terraform/README.md","description":"How to read the draft: what was generated, what is left to a person, and how to check it with OpenTofu.","present":true,"bytes":45081},{"path":"terraform/applications/carts.json","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":13666},{"path":"terraform/applications/carts.templates.yaml","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":1370},{"path":"terraform/applications/catalog.json","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":15487},{"path":"terraform/applications/catalog.templates.yaml","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":1386},{"path":"terraform/applications/checkout.json","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":11130},{"path":"terraform/applications/checkout.templates.yaml","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":1394},{"path":"terraform/applications/orders.json","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":13896},{"path":"terraform/applications/orders.templates.yaml","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":1958},{"path":"terraform/applications/ui.json","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":6912},{"path":"terraform/applications/ui.templates.yaml","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":1346},{"path":"terraform/data.tf","description":"Proposed STACKIT resources of one area of the target (data).","present":true,"bytes":40322},{"path":"terraform/handover/cache-dependencies_checkout_elasticache_redis_default/data-move.md","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":30132},{"path":"terraform/handover/cluster-access/kubeconfig.md","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":5269},{"path":"terraform/handover/database-dependencies_catalog_rds_this/data-move.md","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":30820},{"path":"terraform/handover/database-dependencies_orders_rds_this/data-move.md","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":23836},{"path":"terraform/handover/search-dependencies_catalog_opensearch_this/data-move.md","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":16387},{"path":"terraform/handover/table-dependencies_dynamodb_carts_this/data-move.md","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":16273},{"path":"terraform/identity.tf","description":"Proposed STACKIT resources of one area of the target (identity).","present":true,"bytes":35863},{"path":"terraform/kubernetes.tf","description":"Proposed STACKIT resources of one area of the target (kubernetes).","present":true,"bytes":9091},{"path":"terraform/kubernetes/carts/manifests.yaml","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":9388},{"path":"terraform/kubernetes/catalog/manifests.yaml","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":9675},{"path":"terraform/kubernetes/checkout/manifests.yaml","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":9459},{"path":"terraform/kubernetes/orders/manifests.yaml","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":10784},{"path":"terraform/kubernetes/ui/manifests.yaml","description":"A file of the proposed STACKIT Terraform.","present":true,"bytes":10834},{"path":"terraform/loadbalancing.tf","description":"Proposed STACKIT resources of one area of the target (loadbalancing).","present":true,"bytes":6549},{"path":"terraform/messaging.tf","description":"Proposed STACKIT resources of one area of the target (messaging).","present":true,"bytes":6499},{"path":"terraform/network.tf","description":"Proposed STACKIT resources of one area of the target (network).","present":true,"bytes":12996},{"path":"terraform/observability.tf","description":"Proposed STACKIT resources of one area of the target (observability).","present":true,"bytes":5182},{"path":"terraform/security.tf","description":"Proposed STACKIT resources of one area of the target (security).","present":true,"bytes":50469},{"path":"terraform/terraform.tf","description":"The OpenTofu and provider version requirements of the draft.","present":true,"bytes":439},{"path":"terraform/variables.tf","description":"The input variables of the draft: the values a person fills in.","present":true,"bytes":39928},{"path":"target-plan.json","description":"The canonical TargetPlans the draft was generated from, machine-readable: one plan for each family of the draft that is written from a plan (the security groups of each source cloud, routing, identity, log sources, servers), each with how the draft wrote every resource of it (a resource, a comment only, or a statement about a block another generator writes). The run read it back against the draft before it was published: every resource of a plan is, or is not, a block of the draft as the file says. Present only when the run produced the draft.","present":true},{"path":"execution/","description":"The execution package: execution/README.md is the entry point for carrying the migration out (the verdict for the resources with a typed plan and the draft files it does not cover, what is created, what is not migrated, the decisions, the credentials, the order of the steps, the OpenTofu and API commands, the manual steps, the checks and the rollback); execution/terraform/apply.md, one request file and one script per STACKIT API call under execution/api/, execution/manual/actions.md and execution/verify/checks.md beside it. A rendering of execution-plan.json and of nothing else; nothing in it has been run, and a script stops before it calls anything when its step waits for a decision. Present only when the run produced the draft.","present":true},{"path":"migration/execution-actions.csv","description":"One row per step of execution-plan.json for a spreadsheet: id, phase, mode, source, target, dependencies, owner, status, file, risks, rollback, whether it is executable and the decisions it waits for. The steps to carry out, not the register of open items (migration/actions.csv). Present only when the run produced the draft.","present":true},{"path":"migration/work-packages.csv","description":"One row per work package of the manual steps of execution-plan.json for a spreadsheet: the steps of one phase, one owner role and one kind of work that one person carries out together, with their number, the resources they touch, the decisions they rest on and wait for, the strictest state among them, their success conditions and the ids of the steps. Every manual step is in exactly one package; execution/README.md lists the same packages. Present only when the run produced the draft.","present":true},{"path":"architecture/network-security.mmd","description":"The network and security view as a Mermaid flowchart, or, in an estate with more than 120 units in it, the partition map of the files under architecture/partitions/ (one box for each partition, the arrows between partitions counted, every unknown edge accounted for). Drawn from the TargetPlans of the draft and the assessment: the internet, public IPs, load balancers, networks, subnets, servers, databases, security groups and their rules, network ACLs and routing. A path the sources do not state is a dashed edge labelled unknown with its reason, never a connection that was not read. Present only when the run produced the draft.","present":true},{"path":"architecture/identity.mmd","description":"The identity view as a Mermaid flowchart (an estate with more principals than a drawing keeps legible gets one sentence that names assurance/identity-transition.md, which lists every identity, instead of a drawing): the AWS principal, the decision the assessment and the plan hold for it, the STACKIT identity it moves to, the role assignment and its scope. A step the typed plan does not hold (the role assignment) is drawn as manual, and a step it leaves open is a dashed edge labelled unknown. Present only when the run produced the draft.","present":true},{"path":"architecture/data-flows.mmd","description":"The data flows as a Mermaid flowchart, or, in an estate with more than 120 units in it, the partition map of the files under architecture/partitions/ (one box for each partition, the arrows between partitions counted, every unknown edge accounted for): clients, load balancers, applications, databases, object storage and registries, with the protocol and port of each flow where the source states them, public or private, and the migration effect on the unit that carries it; what the source does not state is written unknown. The flows are the paths the listeners and security group rules permit, not observed traffic. Present only when the run produced the draft.","present":true},{"path":"architecture/network-security.svg","description":"The network and security view drawn offline: the same boxes and arrows as architecture/network-security.mmd, each arrow numbered, with a key that gives its two ends in the direction of the arrow and its words (protocol, port and direction of a rule; the attribute of a reference). Source links, target links (what a rule, route or listener of the draft permits), links an answer of the inputs file changed and unknowns are drawn apart and named in the legend. A view that is not drawn whole (a partition map above 120 units) is one sentence. Present only when the run produced the draft.","present":true},{"path":"architecture/data-flows.svg","description":"The data flow view drawn offline: the same boxes and arrows as architecture/data-flows.mmd, each flow numbered, with a key that gives its two ends in the direction of the flow, its protocol and port, public or private, and the migration effect. Source links, target links and unknowns are drawn apart and named in the legend. A view that is not drawn whole (a partition map above 120 units) is one sentence. Present only when the run produced the draft.","present":true},{"path":"migration/roadmap.md","description":"The execution plan laid out in ten waves: wave 0 the decisions some step waits for, then the landing zone, network and security, data services, platform, workloads, data migration, cutover, verification and decommission. Each step names what it does, the AWS resource, the mode, what it depends on and whether it is ready, blocked by a decision, not ready or refused. It holds the steps of execution-plan.json only. Present only when the run produced the draft.","present":true},{"path":"migration/landing-zone-requirements.md","description":"What the STACKIT organization and project have to provide before the first apply: organization and project, network area and region, address ranges, routing, DNS, identity, service enablement, quotas to check, API access, Terraform permissions, external dependencies and the customer decisions. Read from the TargetPlans, the execution plan and the assessment; what they do not state is written as unknown and no limit or role name is invented. Present only when the run produced the draft.","present":true},{"path":"engineering/explain-index.json","description":"Where, in this folder's files, the entries and ledger rows of each unit sit, as byte offsets: the explain command (stacktoit explain) reads a unit's chain from it without parsing the whole files. Machine-only: it is not an exchange document and states nothing the files it points into do not state; without it, or when it does not fit the files, explain reads them in full and prints the same answer.","present":true},{"path":"manifest.json","description":"The run's identity (run id, source digest) and the list of the files it published, each with its sha256 and size; its status says whether the run is COMPLETE, PARTIAL or FAILED.","present":true},{"path":"migration/strategies.csv","description":"Not produced in this build: a migration strategy for each application. No run writes this file, and nothing links to it.","present":false,"not_produced":true},{"path":"assurance/preflight.md","description":"Not produced in this build: the preflight checks in words. No run writes this file, and nothing links to it.","present":false,"not_produced":true},{"path":"assurance/terraform-operability.md","description":"Not produced in this build: how the draft is operated with OpenTofu. No run writes this file, and nothing links to it.","present":false,"not_produced":true},{"path":"financial/business-case.md","description":"Not produced in this build: a business case. No run writes this file, and nothing links to it.","present":false,"not_produced":true},{"path":"financial/finops-readiness.md","description":"Not produced in this build: the FinOps readiness. No run writes this file, and nothing links to it.","present":false,"not_produced":true}],"trace_texts":{"TL-00a39791a5cf":"block in the draft: stackit_secretsmanager_user.migration","TL-00a58746651a":"known issue: backend-security-group-rule-port-range-min-zero-rejected","TL-00ce63da408d":"constraint relied on: stateful-default-true (DEFAULT_RULE, stackit_security_group.stateful)","TL-00e5e7b98a35":"binding: module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.{name}#execution_role_arn (EXECUTION_ROLE, EXECUTION, KNOWN)","TL-011591a42dd0":"NOT CARRIED ({subject}): master_password — the source password is not copied: stackit_mariadb_credential has no password input, STACKIT generates it (the password is computed and sensitive, pinned provider) — hand the new one to the application.","TL-014cbc99261a":"5 kept as it is","TL-01522a3dfc24":"recorded: rule line: rule aws.subnet/subnet · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required","TL-017ff5f204a8":"trace: TR-e48f32c8ead8","TL-018d41cd4d94":"WebSocket: an AWS Application Load Balancer proxies WebSocket upgrades (ws, wss) on every listener and rule without a setting; a STACKIT Application Load Balancer enables them per rule (rules[].web_socket, pinned provider; docs.stackit.cloud, Application Load Balancer, create: \"Enable only if your …","TL-01bef12d20ec":"knowledge base rule: aws.route_table","TL-02276117e89a":"The table has 0 instances","TL-02646755b7db":"stackit_security_group.retail_app_ecs_alb_{name}: A name the source does not give is derived by StackToIT from the source address; check it before use.","TL-02f88fa4c485":"knowledge base case: kms","TL-035c2079cbd6":"109 further statements that the source does not make (nothing to carry)","TL-036fb02331b3":"field: stackit_security_group.retail_app_ecs_carts_service_{name}.project_id = VARIABLE_REQUIRED: the STACKIT project the group belongs to (a group is project-scoped)","TL-03ccb0b69489":"NOT CARRIED ({subject}): kms_key_id — the source encrypts with a customer-managed key that the draft does not set on the Secrets Manager instance: the instance also holds module.retail_app_ecs.aws_secretsmanager_secret.mq, which states no …","TL-03eaba90355e":"The plan of this unit relies on 8 evidenced facts about STACKIT:","TL-046334aeb37b":"Open: parameters.sgw_acl is set from var.dependencies_checkout_elasticache_redis_{name}_allowed_cidrs, which has no {name}: without a list STACKIT applies its {name} ACL, every STACKIT customer's addresses. List the clients' CIDRs before planning.","TL-0472544a1a16":"claim: listeners = KNOWN, CRITICAL, TRANSFORMED","TL-04832d479da2":"field: stackit_security_group.retail_app_ecs_alb_{name}.project_id = VARIABLE_REQUIRED: the STACKIT project the group belongs to (a group is project-scoped)","TL-053254794d54":"protection against deletion: decided by a variable or only when OpenTofu plans","TL-05a460adc0a6":"field: stackit_security_group.retail_app_ecs_checkout_service_{name}.project_id = VARIABLE_REQUIRED: the STACKIT project the group belongs to (a group is project-scoped)","TL-05f865868127":"warning: PRIVATE_EGRESS_EQUIVALENCE_UNPROVEN (IPv4, not proven).","TL-06223ef1858b":"a step to the application's identity inside a container task: refers to module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role, proven by a direct reference","TL-064e616475f0":"manual action: stackitsa:facts:{subject}:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.{name}#execution_role_arn (BEFORE_PILOT): Decide how {subject} pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach","TL-06755e954f06":"3 left to a person to review","TL-068bb51be77b":"block in the draft: terraform/identity.tf:123-126","TL-06924eba095a":"NOT CARRIED ({subject}): cluster_config — the plan (plan_name) sets the size of a stackit_opensearch_instance (pinned provider): the cluster's instance types and counts, dedicated masters and zone awareness are not carried — choose the …","TL-072f5f71f9ab":"the application's identity inside a container task: runs as module.retail_app_ecs.module.carts_service.aws_iam_role.task_role (a role)","TL-07d8d2aeaf77":"decision: convert:{subject}:target_pools:INGRESS_EXPOSURE_PATH","TL-08a95b3f5942":"egress any protocol to 0.0.0.0/0, ::/0","TL-090a4fa98fb4":"constraint relied on: ip-range-family-must-match-ether-type (REJECTS, stackit_security_group_rule.ip_range)","TL-0953fa1a9317":"field: stackit_security_group.retail_app_ecs_ui_service_{name}.labels = SAFE_OMISSION: the source group sets no tags, so there are no labels to write","TL-096a5d5a224f":"trace: TR-60af0bd02bd2","TL-0a4640271be1":"knowledge base case: rt-local-only","TL-0abd27847217":"trace: TR-cf173263597f","TL-0ac4a51e0129":"claim: tc-database-name = KNOWN, CRITICAL, REVIEW","TL-0ad44400508d":"block in the draft: terraform/data.tf:128-133","TL-0af72abf060e":"a route resource: 0.0.0.0/0 to a NAT gateway","TL-0b15254327de":"field: stackit_security_group.retail_app_ecs_checkout_service_{name}.tags_all = SAFE_OMISSION: tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags)","TL-0b1b15d4f38f":"incomplete set: {subject}[0] module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules (group-choice)","TL-0b1eb5e49e49":"residual: stackit_security_group.retail_app_ecs_catalog_service_{name} vpc_id [project-scoped on STACKIT]: source: the group belongs to one VPC and can be attached only to resources in it; target: the group is project-scoped and can be attached to network interfaces of any network of the project","TL-0b45138271ec":"stackit_security_group.retail_app_ecs_checkout_service_{name}: name needs a value you supply","TL-0b62c421a92a":"from {subject} (.terraform/modules/vpc.vpc/main.tf:131) — RECONFIGURE / MEDIUM","TL-0b734eb4a3ea":"intent family: IDENTITY","TL-0b7af830628b":"Open: PRIVATE_EGRESS_EQUIVALENCE_UNPROVEN — whether the source gives this subnet an IPv4 route to the internet is not proven (table-not-proven (selects-collapsed)); the network drafted here keeps STACKIT's default gateway with its outbound source NAT, and the draft leaves its routing and gateway settings …","TL-0bdd0466eac4":"stackit_security_group.retail_app_ecs_ui_service_{name}: vpc_id has no STACKIT equivalent","TL-0bdd23c293a2":"block in the draft: terraform/identity.tf:65-70","TL-0bea6969aa69":"trace: TR-8e7b4456f29a","TL-0c0c72bb0310":"claim: linked-dependency:aws_secretsmanager_secret = KNOWN, CRITICAL, REVIEW","TL-0c599a894c69":"trace: TR-089026082d6f","TL-0c770e347b36":"warning: The source engine is MySQL 8 and its accounts do not move.","TL-0d1dd7ac458b":"trace: TR-71c158d59d3e","TL-0df924a96f5b":"106 further statements that the source does not make (nothing to carry)","TL-0e001b3993f2":"NOT CARRIED ({subject}): availability_zone, availability_zone_id — stackit_network has no availability zone (pinned provider): the network serves the region; servers and volumes choose their zone.","TL-0e0c31cd1ecb":"recorded: trace: TR-6003c14a24b3","TL-0e431aae8253":"retention key: retention_in_days","TL-0e88d05b6081":"claim: standalone-rule-not-generated = KNOWN, CRITICAL, REVIEW","TL-0efaf456d064":"block in the draft: terraform/security.tf:325-330","TL-0f6d1239a13d":"Service: partial","TL-0fb430301b58":"recorded: trace: TR-2eebb342bc5c","TL-0fd6a6d386f5":"residual: stackit_security_group.retail_app_ecs_alb_sg_{name} module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules [rules beyond the known set]: source: the source allows more than the entries that are visible statically; target: only the known entries are produced; an unknown number of unknown entries of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules are not (group-choice)","TL-0ff5a208ce3d":"proof: UNRESOLVED/NONE at module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress source_security_group_id","TL-1004ae21f674":"claim: network-placement = UNKNOWN, CRITICAL, REVIEW","TL-1011fd90cf52":"knowledge base case: rabbitmq","TL-1034cce06dc5":"field: stackit_security_group_rule.retail_app_ecs_orders_service_{name}_ingress_1.project_id = VARIABLE_REQUIRED: the STACKIT project the rule belongs to","TL-107d8f9fc953":"{subject}: A setting of the source has no STACKIT counterpart and is not carried (the longest period a Logs instance keeps is 180 days).","TL-108e5cc2dfb2":"warning: The source cache runs without TLS (transit_encryption_enabled = false).","TL-111f9fe4f567":"proof: DIRECT_REFERENCE/EXACT at module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.{name} task_role_arn","TL-11694f78ab8d":"claim: member-engine = KNOWN, CRITICAL, REVIEW","TL-1195d0701687":"field: stackit_security_group.retail_app_ecs_orders_service_{name}.vpc_id = UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried","TL-11c73f76534f":"constraint relied on: ether-type-default-ipv4 (DEFAULT_RULE, stackit_security_group_rule.ether_type)","TL-11dd3a15924a":"the platform agent's identity that starts the workload (it pulls images, injects secrets and writes logs): runs as module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role (a role)","TL-122d52c83478":"the group of the rule resource module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress[0]: refers to {subject}[0], proven by a reference to one instance","TL-123f10a121d2":"claim: service-load-balancer-target = UNKNOWN, CRITICAL, REVIEW","TL-1265c3a92ae8":"field: stackit_security_group.retail_app_ecs_checkout_service_{name}.stateful = SAFE_OMISSION: the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written","TL-1303b65c357c":"NOT CARRIED ({subject}): snapshot_window = 06:30-07:30 — the snapshot time is not carried: stackit_valkey_instance takes parameters.snapshot (pinned provider), not generated — decide it.","TL-13504f3fe56a":"stackit_logs_instance.logs_retention_180d: node[{subject}].retention_in_days has no STACKIT equivalent","TL-13aa992cabfa":"proof: INDEXED_REFERENCE/EXACT at module.vpc.module.vpc.aws_route.{name}_nat_gateway nat_gateway_id","TL-13b1e42def63":"stackit_service_account.retail_app_ecs_carts_service_{name}: written as an active resource (terraform/identity.tf, lines 32-35); the whole comment of the block is in engineering/trace/identity.md","TL-13c01e85b33e":"Group {subject}: 0 rules","TL-13e6d7686b1e":"AWS key material cannot be exported: data encrypted with the old key is re-encrypted during migration.","TL-14a22cd3a75b":"trace: TR-b9a8861fdbd3","TL-14a4f258dd05":"knowledge base case: rt-default-only","TL-159c865b095c":"and 1 further properties the draft does not carry; the trace file of the block holds all of them","TL-15a0d97ac21c":"3 kept in another form","TL-15c36abcfb95":"claim: client-restriction = KNOWN, CRITICAL, REVIEW","TL-15c3b8f244cb":"field: stackit_security_group.retail_app_ecs_orders_service_{name}.timeouts = SAFE_OMISSION: NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL)","TL-15f8c4da915a":"claim: tcp-vpc-security-group-ids = KNOWN, CRITICAL, REVIEW","TL-1646e3f29bb9":"2 carried into the draft and listed in the ledger","TL-164b373d0ac3":"recorded: trace: TR-d39d5b78739a","TL-16c8035e9a6a":"stackit_security_group.retail_app_ecs_catalog_service_{name}: name needs a value you supply","TL-17125e854394":"Open: the name of {subject} is \"retail-app-ecs-orders-service-task-role\": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of the same name is …","TL-17bd32f2135b":"claim: td-task-role-arn = KNOWN, CRITICAL, REVIEW","TL-1815e9268bea":"ingress tcp port 3306 from a security group that is not resolved: no resource could be named, so the reference is not resolved","TL-185c870bf3cc":"6 left to a person to review","TL-1886eb40d6a0":"residual: {subject} (LOG_GROUP) [group not produced]: source: a log group with its own name, settings and facets; target: its logs go to the Logs instance stackit_logs_instance.logs_retention_180d, a label-based store with no group or stream object","TL-191d3affeeb5":"proof: DIRECT_REFERENCE/EXACT at module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.{name} execution_role_arn","TL-1935467c5b80":"validation requirement: awssg:security-equivalence (SECURITY_EQUIVALENCE)","TL-19e2cf13ec7d":"  2 about how it behaves","TL-1a29763879fc":"claim: tc-elasticache-replication-group-replication-group-id = KNOWN, CRITICAL, REVIEW","TL-1a5ce4b43e91":"knowledge base case: rt-default-only-nat","TL-1a713e4cf1fd":"block in the draft: terraform/loadbalancing.tf:21-62","TL-1ade7c863b11":"constraint relied on: display-name-pattern (LIMIT, stackit_logs_instance.display_name)","TL-1af7965085f7":"Open: the name of {subject} is \"retail-app-ecs-checkout-service-task-execution-role\": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of …","TL-1b1968a516f2":"the application's identity inside a container task: runs as module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role (a role)","TL-1b44204222d7":"ALTERNATIVE, NOT AN EQUIVALENT: DynamoDB (1 table(s)) → one MongoDB Flex instance, each table a collection — rule aws.dynamodb_table/dynamodb · REDESIGN / MEDIUM · KB 0.384.0 · review required.","TL-1b6bb75769f1":"evidence of the stateful assumption: docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html","TL-1bc7bbad61e6":"trace: TR-364b2c550bbd","TL-1c94866fbc17":"the application's identity inside a container task: runs as module.retail_app_ecs.module.ui_service.aws_iam_role.task_role (a role)","TL-1cc52a87c19f":"claim: tcf-rds-cluster-instance--identifier = KNOWN, CRITICAL, REVIEW","TL-1d2b82676a42":"claim: log-exports-none = KNOWN, CRITICAL, PRESERVED","TL-1d4ef35ce684":"recorded: trace: TR-cf63149db4be","TL-1d5e56205390":"claim: admin-username-not-carried = KNOWN, CRITICAL, REVIEW","TL-1d93a4f94ae4":"field: stackit_security_group.retail_app_ecs_carts_service_{name}.revoke_rules_on_delete = SAFE_OMISSION: NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL)","TL-1dadc674b680":"the name logs are written under: decided by a variable or only when OpenTofu plans","TL-1dbf3bcfa067":"manual action: stackitsa:facts:{subject}:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.{name}#execution_role_arn (BEFORE_PILOT): Decide how {subject} pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach","TL-1dc42e8e4189":"source type: aws_kms_key","TL-1de287234081":"claim: td-container-definitions = KNOWN, CRITICAL, REVIEW","TL-1deb9236882e":"claim: engine = KNOWN, CRITICAL, TRANSFORMED","TL-1e06158053e5":"trace: TR-9aa24821e695","TL-1e21f64ac66b":"block in the draft: stackit_service_account.retail_app_ecs_orders_service_{name}","TL-1e49a0bffe90":"stackit_security_group.retail_app_ecs_alb_{name}: Whether the members of one group can reach each other over IPv6 without a rule was not observed on STACKIT (IPv6 networks could not be created in a STACKIT project tested on 2026-10-08); IPv4 needs an explicit rule, which the draft writes where the source has one.","TL-1e799fd40ce8":"field: stackit_security_group.retail_app_ecs_alb_sg_{name}.timeouts = SAFE_OMISSION: NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL)","TL-1ea84acb5dc6":"block in the draft: terraform/data.tf:204-212","TL-1ebe631ffe4a":"resource address: stackit_logs_instance.logs_retention_180d","TL-1f7c1f6e2dd7":"stackit_service_account.retail_app_ecs_carts_service_{name}: written as an active resource (terraform/identity.tf, lines 9-12); the whole comment of the block is in engineering/trace/identity.md","TL-2027e9b9e261":"AWS actions do not translate into STACKIT roles one to one: the roles are var.retail_app_ecs_orders_service_{name}_project_roles, chosen by the architect.","TL-204333615fe6":"claim: tc-user--password = KNOWN, CRITICAL, REVIEW","TL-204a56dd2cc7":"block in the draft: terraform/identity.tf:200-205","TL-20634673194c":"stackit_service_account.retail_app_ecs_orders_service_{name}: written as an active resource (terraform/identity.tf, lines 169-172); the whole comment of the block is in engineering/trace/identity.md","TL-212502079f8a":"block in the draft: stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_{name}","TL-219dad209a84":"from {subject} (../../lib/ecs/{name}.tf:1) — REPLATFORM / MEDIUM","TL-21d9d0ea3c79":"field: stackit_security_group.retail_app_ecs_carts_service_{name}.name_prefix = SAFE_OMISSION: NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL)","TL-220060326aaa":"recorded: trace: TR-c243e261bc0d","TL-226f0fce8177":"field: stackit_security_group.retail_app_ecs_alb_sg_{name}.tags_all = SAFE_OMISSION: tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags)","TL-22b025834358":"recorded: trace: TR-759ef9228645","TL-22bb8c0bf3aa":"field: stackit_security_group_rule.retail_app_ecs_carts_service_{name}_ingress_1.project_id = VARIABLE_REQUIRED: the STACKIT project the rule belongs to","TL-22ec5635c5bb":"field: stackit_security_group.retail_app_ecs_alb_sg_{name}.default_egress.ipv4 = SAFE_OMISSION: the source restricts IPv4 egress, and STACKIT creates an allow-all IPv4 egress rule on this group that the draft does not manage; that rule acts on the network interface that lists the group, and no block of the draft lists this one (its members are module.retail_app_ecs.module.alb.aws_lb.this (aws_lb, written without a security group)), so there is no effect to decide about; if you attach the group to an interface by hand, that rule applies to the interface until it is deleted (stackit security-group rule list, then delete with the security group id): decide then","TL-22f04b52372e":"trace: TR-7bc47518665f","TL-2301444bea61":"field: stackit_security_group.retail_app_ecs_ui_service_{name}.revoke_rules_on_delete = SAFE_OMISSION: NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL)","TL-243b72c99df8":"stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_{name}: written as an active resource (terraform/identity.tf, lines 156-161); the whole comment of the block is in engineering/trace/identity.md","TL-2445c6df2977":"Default route for IPv6 addresses: the table has none","TL-244a2016199c":"The source states no retention; the source then keeps its logs for ever","TL-249e79742d0a":"NOT CARRIED ({subject}): snapshot_arns — the instance is created empty: seeding it from an ElastiCache snapshot is not generated — migrate the data (e.g. RDB export and import, or replication).","TL-24a85fb39f57":"stackit_mariadb_instance.dependencies_catalog_rds_{name}: written as an active resource (terraform/data.tf, lines 35-43); the whole comment of the block is in engineering/trace/data.md","TL-2504dbf62e2c":"56 further statements that the source does not make (nothing to carry)","TL-25ab2858b6d9":"claim: fine-grained-access = KNOWN, CRITICAL, REVIEW","TL-260f11e31eb6":"recorded: finding: aurora-mysql-mariadb-sql-mode","TL-2617e179fc00":"3 open decisions of the converter wait for a person: the unit is not ready to deploy until each is decided","TL-26417faaa574":"  4 about how it behaves","TL-2736732baae9":"claim: tcp-deployment-mode = KNOWN, CRITICAL, REVIEW","TL-2768a5344a38":"ingress tcp port 5671 from a security group that is not resolved: no resource could be named, so the reference is not resolved","TL-27824026467c":"claim: tcp-elasticache-replication-group-transit-encryption-enabled = KNOWN, CRITICAL, REVIEW","TL-279a6ed89982":"capability: observability.logs","TL-27ab4b800f9c":"claim: lb-subnets = UNKNOWN, CRITICAL, REVIEW","TL-27e760ebc57b":"warning: This unit names module.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch (aws_secretsmanager_secret), whose own decision the target does not carry (it is RECONFIGURE, but the converter does not draft this aws_secretsmanager_secret (the generator skips this case, or only records …","TL-27f3a4627dfd":"2 kept as it is","TL-284959e4857a":"Group {subject}[0]: 2 rules","TL-287f714a8ff5":"How many instances of the table exist is that is not visible statically","TL-288500fdf0da":"2 sets whose members are not all visible statically","TL-2945a65f89ac":"plan rule: stackitlogs.instance","TL-2958ffb82c48":"field: stackit_security_group.retail_app_ecs_alb_{name}.labels = VARIABLE_REQUIRED: the source reads a variable for its tags; the labels are a variable of the draft with the scan's reading as default","TL-2992e16dab5f":"field: stackit_security_group.retail_app_ecs_alb_{name}.default_egress.ipv4 = SAFE_OMISSION: the source restricts IPv4 egress, and STACKIT creates an allow-all IPv4 egress rule on {name} group that the draft does not manage; that rule acts on the network interface that lists the group, and no block of the draft lists {name} one (its members are module.retail_app_ecs.module.alb.aws_lb.{name} (aws_lb, written without a security group)), so there is no effect to decide about; if you attach the group to an interface by hand, that rule applies to the interface until it is deleted (stackit security-group rule list, then delete with the security group id): decide then","TL-29e91686883f":"108 further statements that the source does not make (nothing to carry)","TL-2a20977a9a0c":"the group of the rule resource module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed[\"in#in#sg#0\"]: no resource could be named, so the reference is not resolved","TL-2a851b837f05":"stackit_security_group.retail_app_ecs_ui_service_{name}: On STACKIT a security group belongs to a project, not to a network; the source's network membership is not carried.","TL-2a90f2ff934e":"claim: aurora-extras = KNOWN, CRITICAL, PRESERVED","TL-2ac9d38cc968":"from {subject} (.terraform/modules/dependencies.orders_rds/main.tf:61) — REPLATFORM / MEDIUM","TL-2ada6ff8b4b4":"Open: how many instances {subject} creates is not visible statically (its count/for_each is not known): count is var.vpc_vpc_{name}_count — set it to the real number and check each instance's settings.","TL-2b66ea1992ac":"claim: tc-lb-name = KNOWN, CRITICAL, REVIEW","TL-2b91fa380a69":"stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_{name}: written as an active resource (terraform/identity.tf, lines 65-70); the whole comment of the block is in engineering/trace/identity.md","TL-2be1cd272f7e":"claim: tc-user--username = KNOWN, CRITICAL, REVIEW","TL-2bef4b9999eb":"stackit_security_group.retail_app_ecs_carts_service_{name}: Whether the members of one group can reach each other over IPv6 without a rule was not observed on STACKIT (IPv6 networks could not be created in a STACKIT project tested on 2026-10-08); IPv4 needs an explicit rule, which the draft writes where the source has one.","TL-2c414d177d91":"  4 about values the API rejects","TL-2c5b33ff8558":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_rds_cluster_instance.{name}): identifier = (reads a variable; its default is not printed), db_subnet_group_name, preferred_maintenance_window = sun:05:00-sun:06:00, db_parameter_group_name — cluster members are not separate STACKIT resources — …","TL-2c6893b3f43c":"claim: engine = KNOWN, CRITICAL, REVIEW","TL-2cbc6b8897fa":"claim: tcp-db-cluster-parameter-group-name = KNOWN, CRITICAL, REVIEW","TL-2cca75e8282d":"block in the draft: terraform/identity.tf:222-227","TL-2d12b413e08a":"11 left to a person to review","TL-2d5fc1411520":"recorded: trace: TR-71c158d59d3e","TL-2db900f2149c":"1 set whose members are not all visible statically","TL-2e2145f25c54":"known issue: provider-experimental-features-disabled-by-default","TL-2e4739c4ef16":"claim: private-endpoint = KNOWN, CRITICAL, REVIEW","TL-2e7d45151ab9":"manual action: stackitsa:facts:{subject}:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.{name}#task_role_arn (BEFORE_PILOT): Decide how {subject} gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it","TL-2eaf6e2e22e3":"block in the draft: stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_{name}","TL-2ef5e9032fe9":"the network of {subject}[0]: refers to module.vpc.module.vpc.aws_vpc.{name}, named but not proven (an expression that selects one resource)","TL-2f55ae9bb015":"manual action: awssg:unplaced:{subject}:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] (BEFORE_PILOT): Place the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] on the security group it belongs to and write it","TL-2f5f781a3aac":"from {subject} (.terraform/modules/vpc.vpc/main.tf:267) — RECONFIGURE / MEDIUM","TL-2fd740bb0601":"claim: service-execute-command = KNOWN, CRITICAL, REVIEW","TL-302d2ee2cacd":"claim: cross-zone = KNOWN, CRITICAL, PRESERVED","TL-30386d54dd5c":"stackit_mongodbflex_instance.dynamodb_tables: written as an active resource (terraform/data.tf, lines 242-261); the whole comment of the block is in engineering/trace/data.md","TL-308bd8bc6afb":"  2 about rules or values it creates by default","TL-309a55930b10":"trace: TR-b77494749ed2","TL-30a6fc555da6":"binding: module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.{name}#execution_role_arn (EXECUTION_ROLE, EXECUTION, KNOWN)","TL-30dc9f7fd9b2":"SECURITY_OBSERVATION Plaintext public listener of {subject}, port 80 (non-blocking): The source load balancer {subject} is internet-facing and every listener it states is HTTP (port 80 forwards to its targets, no listener is …","TL-30dd0797cd2d":"NOT CARRIED ({subject}): setting — an ECS {name} setting (container insights, execute-command logging, Service Connect defaults, tags) has no stackit_ske_{name} attribute (pinned provider): observability and the Service Connect namespace are decided on the …","TL-3126679bc953":"constraint relied on: no-log-group-or-stream-object (SEMANTIC, stackit_logs_instance)","TL-31639eeaae74":"block in the draft: terraform/data.tf:242-261","TL-3176bb3bd560":"block in the draft: stackit_opensearch_credential.dependencies_catalog_opensearch_{name}","TL-31d59c4e066e":"the target of a route resource: 0.0.0.0/0 to an internet gateway: refers to module.vpc.module.vpc.aws_internet_gateway.this[0], named but not proven (a reference to one instance)","TL-32293da86636":"claim: nat-fixed-egress-address = KNOWN, CRITICAL, REVIEW","TL-323a6cb4d367":"DEFAULT: reachable on STACKIT from the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients of {name} service, and from no other address; change the list with var.dependencies_orders_rds_{name}_allowed_cidrs or answer the decision DEC-GEN-CONVERT-EXPOSURE-WIDENED …","TL-3262cdcd6533":"{subject}: No STACKIT group is produced for this unit.","TL-32d8108ffe03":"claim: subnet-association-target = KNOWN, CRITICAL, REVIEW","TL-3320850cf578":"the group of the rule resource module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress[0]: refers to {subject}[0], proven by a reference to one instance","TL-3344b6e287d5":"NOT CARRIED ({subject}): maintenance_window = wed:03:00-wed:04:00, notification_topic_arn = \"\", data_tiering_enabled = false — stackit_valkey_instance has no maintenance window, minor-upgrade switch, notification …","TL-33b2fef377dc":"setting: {subject} kms_key_id (KEY) = CONDITIONAL","TL-33b6b02be1fc":"NOT CARRIED (module.retail_app_ecs.module.alb.aws_lb_target_group.main): deregistration_delay = 30 — a STACKIT target pool has name, target_port, targets, active_health_check and tls_config only (pinned provider): no connection draining delay, slow start or load-balancing algorithm — not generated; …","TL-3431d6c38ce9":"knowledge base rule: aws.subnet","TL-34658b5f706f":"a step to the application's identity inside a container task: refers to module.retail_app_ecs.module.orders_service.aws_iam_role.task_role, proven by a direct reference","TL-34980800dffa":"block in the draft: stackit_kms_keyring.migrated","TL-349c21e22eb4":"Private DNS parity not established: STACKIT documents no private DNS zone or internal name resolution (STACKIT DNS serves {name} zones only; the DNS Resolver product is in beta); names only the VPC resolver answers need a DNS server of your own.","TL-34b5974f0ddc":"proof: DIRECT_REFERENCE/EXACT at module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.{name} task_role_arn","TL-34f7834374a1":"DNS: the source uses the AWS VPC resolver, which answers internal EC2 host names (module.vpc.module.vpc.aws_vpc.this enable_dns_hostnames = true); ipv4_nameservers = var.default_ipv4_nameservers resolves public names only.","TL-350d58f88680":"claim: tcfp-lb-listener--default-action--type = KNOWN, CRITICAL, REVIEW","TL-3545a21a7bd6":"1 not supported on STACKIT","TL-363d3ec284eb":"check: rule-has-one-remote ok=true: 1 rule block(s) written as resources, each with a direction, its group and exactly one remote","TL-369891143868":"warning: MariaDB stores JSON as text, not in a binary format as MySQL: its JSON data type is an alias for LONGTEXT, so the JSON columns of the source become text columns and JSON values are compared as strings, where MySQL compares them as JSON values.","TL-37407e100e63":"claim: prefix = UNKNOWN, CRITICAL, REVIEW","TL-37465a3da0e4":"field: stackit_security_group.retail_app_ecs_alb_{name}.vpc_id = UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried","TL-37d10d9f6067":"Default route for IPv4 addresses: the table has none","TL-381830e6019f":"the platform agent's identity that starts the workload (it pulls images, injects secrets and writes logs): runs as module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role (a role)","TL-384370564772":"1 open decision of the converter wait for a person: the unit is not ready to deploy until each is decided","TL-384871c6acaf":"AWS actions do not translate into STACKIT roles one to one: the roles are var.retail_app_ecs_carts_service_{name}_project_roles, chosen by the architect.","TL-384df1309576":"block in the draft: terraform/security.tf:207-220","TL-387d940bc647":"claim: associations = KNOWN, CRITICAL, REVIEW","TL-38b853b52b93":"claim: tc-dynamodb-table-name = KNOWN, CRITICAL, REVIEW","TL-3901c57591f8":"field: stackit_security_group.retail_app_ecs_alb_sg_{name}.revoke_rules_on_delete = SAFE_OMISSION: NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL)","TL-3933b6fc76cc":"recorded: finding: aurora-storage-encrypted-mariadb","TL-39506feb1c20":"constraint relied on: protocol-name-xor-number (REJECTS, stackit_security_group_rule.protocol.name)","TL-39b6fdb8ce76":"recorded: trace: TR-be8af2d2983d","TL-39be9bf3a654":"stackit_security_group_rule.retail_app_ecs_carts_service_{name}_ingress_1: written as an active resource (terraform/security.tf, lines 79-92)","TL-39d75a5bd17b":"Checked: the Logs instances of the files that were finally written, read back, still say exactly what the plan says, after the draft was assembled","TL-39e14a8dce13":"field: stackit_security_group.retail_app_ecs_carts_service_{name}.default_egress.ipv6 = SAFE_OMISSION: the network has no IPv6 prefix (its VPC module.vpc.module.vpc.aws_vpc.{name} assigns no IPv6 CIDR block and the estate associates none), and the drafted STACKIT network has none either, so the allow-all IPv6 egress rule STACKIT creates on every new group acts on no traffic, whatever IPv6 egress rules the source lists; if an IPv6 prefix is added to the network later, delete that rule (stackit security-group rule list, then delete with the security group id) or write the equivalent rules of the source: decide then","TL-3a5fc23a9688":"recorded: trace: TR-7bc47518665f","TL-3a75229b86dc":"recorded: trace: TR-6212f52df434","TL-3a933e103335":"stackit_security_group.retail_app_ecs_alb_{name}: written as an active resource (terraform/security.tf, lines 53-60)","TL-3aeaea77c5b3":"provider version: 0.121.0","TL-3b71b9a35b2d":"Checked: the security group resources of the files that were finally written, read back, still say exactly what the plan says, after the draft was assembled","TL-3b851e958629":"The data access layer is rewritten against the MongoDB API; move the data with an export (DynamoDB export to S3 → mongoimport) — nothing replicates it.","TL-3ba0e93eaca8":"binding: module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.{name}#task_role_arn (TASK_ROLE, TASK, KNOWN)","TL-3c249da4e020":"Open: the name of {subject} is \"retail-app-ecs-orders-service-task-execution-role\": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of the …","TL-3c2c6e9b3b4d":"stackit_security_group_rule.retail_app_ecs_orders_service_{name}_ingress_1: written as an active resource (terraform/security.tf, lines 175-188)","TL-3c9305418af2":"validation requirement: stackitlogs:round-trip (ROUND_TRIP)","TL-3c9de85de43c":"stackit_service_account.retail_app_ecs_catalog_service_{name}: written as an active resource (terraform/identity.tf, lines 56-59); the whole comment of the block is in engineering/trace/identity.md","TL-3d1b0927de6c":"constraint relied on: group-description-length (LIMIT, stackit_security_group.description)","TL-3d2c7216b0dd":"recorded: trace: TR-6a8844a36ea2","TL-3d578ef6b602":"NOT CARRIED (module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress): source_security_group_id — the members of a security group the scan cannot name reach the source listener (port 3306) through {name} rule; the access list is a list of strings with no security-group …","TL-3d74093c6a04":"Service: available","TL-3d7fb343c06c":"check: final-artifact ok=true: the Logs instances of the written files read back as the plan (1 written resources, 3 attributes and 0 references compared in the final files)","TL-3d810afe81f5":"plan rule: awssg.rule","TL-3d94a77c7c96":"stackit_security_group.retail_app_ecs_alb_{name}: vpc_id has no STACKIT equivalent","TL-3d976e9314c0":"proof: INDEXED_REFERENCE/EXACT at module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress security_group_id","TL-3dc8bdb9b179":"source type: aws_opensearch_domain","TL-3df646002eb3":"block in the draft: terraform/network.tf:23-29","TL-3f1231158ad4":"Region: not established","TL-3f89d52abb85":"plan producer: stacktoit-stackitsa 0.1.0","TL-3fe12d970b09":"recorded: finding: topology-vpc-unproven","TL-3fe644d9705b":"Whether the routes listed are all the table has: the routes listed are all the table has","TL-3ffd7cd0916f":"residual: stackit_security_group.retail_app_ecs_alb_{name} ingress [intra-group IPv6 traffic not established]: source: the members of the group reach each other only where a rule of the group allows it; target: IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08 (capability ipv6-network-creation-not-implemented); IPv4 needs an explicit rule and has one wherever the source has a self rule","TL-401a230315b0":"Behind the network ACL module.vpc.module.vpc.aws_default_network_acl.this (no STACKIT resource, so nothing here refuses what it refuses): not every rule of it could be read, so a deny rule may be among them (see module.vpc.module.vpc.aws_default_network_acl.this).","TL-4083d70dae3e":"recorded: trace: TR-0054e8101f59","TL-417b01463a91":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret_version.{name}): secret_id, secret_string — a setting of {subject}: the API step …","TL-417d81a7b596":"89 further statements that the source does not make (nothing to carry)","TL-423fb583f3e4":"Internet-facing: an ephemeral public address is requested; use external_address with a stackit_public_ip for a fixed one.","TL-424117e74f30":"16 left to a person to review","TL-425a537adfcb":"proof: UNRESOLVED/NONE at module.dependencies.aws_security_group_rule.allow_https_from_client source_security_group_id","TL-42fe756579e0":"recorded: rule line: rule aws.lb/alb · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required","TL-431505b338cb":"claim: domain-settings = KNOWN, CRITICAL, REVIEW","TL-4336899ace7d":"proof: DIRECT_REFERENCE/EXACT at module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.{name} execution_role_arn","TL-43529225d4b4":"constraint relied on: retention-is-per-instance (SEMANTIC, stackit_logs_instance.retention_days)","TL-43dcb95461e2":"manual action: stackitlogs:token:stackit_logs_instance.logs_retention_180d (CUTOVER_PREREQUISITE): Before any log source writes to stackit_logs_instance.logs_retention_180d: create a write access token for the instance (stackit_logs_access_token with the permission write), set the access control list of the instance, and point the shipper at the instance's ingest_url (Loki API) or ingest_otlp_url (OpenTelemetry)","TL-444d4e87e36c":"claim: inbound-none = KNOWN, CRITICAL, PRESERVED","TL-44d09e204bbc":"proof cause: not-a-reference at module.dependencies.aws_security_group_rule.allow_https_from_client source_security_group_id","TL-44d209aec5a7":"block in the draft: terraform/identity.tf:147-150","TL-44e42ceaf736":"manual action: stackitsa:facts:{subject}:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.{name}#task_role_arn (BEFORE_PILOT): Decide how {subject} gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it","TL-4554971a02d4":"proof: DIRECT_REFERENCE/EXACT at module.dependencies.aws_security_group_rule.allow_https_from_client security_group_id","TL-4562bafbaee7":"trace: TR-0054e8101f59","TL-4578a99565f4":"stackit_network.vpc_vpc_{name}: written as an active resource (terraform/network.tf, lines 46-52); the whole comment of the block is in engineering/trace/network.md","TL-458b5639e0da":"field: stackit_security_group.retail_app_ecs_ui_service_{name}.name = VARIABLE_REQUIRED: the source value comes from an overridable root variable (var.environment_name)","TL-458d6f17bb3f":"Open: the name of {subject} is \"retail-app-ecs-ui-service-task-execution-role\": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of the same …","TL-45a01683ffd6":"claim: tcp-security-groups = KNOWN, CRITICAL, REVIEW","TL-463c00929f65":"block in the draft: terraform/identity.tf:132-137","TL-464dbe55e0dd":"recorded: trace: TR-ca04594a2ad9","TL-46ec0bd8733b":"proof: PROVEN_JOIN_ONE/NOT_EXACT at {subject} vpc_id","TL-476821345c5f":"from {subject} (.terraform/modules/retail_app_ecs.alb/main.tf:5) — RECONFIGURE / MEDIUM","TL-4780a99f6a42":"field: stackit_security_group.retail_app_ecs_carts_service_{name}.stateful = SAFE_OMISSION: the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written","TL-4791bf500eb0":"replicas = 3 / Replica: DynamoDB replicates every table across several availability zones of its region; a 3-member replica set keeps redundancy within the STACKIT region.","TL-47a82709c47e":"incomplete set: {subject}[0] module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules (group-choice)","TL-47ae68e37780":"block in the draft: terraform/data.tf:221-224","TL-47cc6580450d":"field: stackit_security_group.retail_app_ecs_ui_service_{name}.default_egress.ipv4 = SAFE_OMISSION: the source allows all IPv4 egress, which is the allow-all IPv4 egress rule STACKIT creates on every new group: it is covered by the STACKIT default egress rules and not produced (a duplicate is rejected with HTTP 409)","TL-47da26c08725":"block in the draft: stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_{name}","TL-47e9bb2358c5":"Checked: the Terraform that was written, read back, says exactly what the plan says: nothing missing, nothing added","TL-4827bf09e90d":"STACKIT OpenSearch issues credentials with full access and has no per-principal or per-index permission: the access policy, the fine-grained users and the roles of the source are not copied; who may connect is the network list parameters.sgw_acl and whoever holds {name} credential.","TL-483c7d87fb22":"residual: {subject} rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] [rule withheld]: source: an allow rule of the unit's security group; target: no rule is produced: it cannot be attributed to a group (group-choice)","TL-488012de1e76":"claim: td-container-secret-references = UNKNOWN, CRITICAL, REVIEW","TL-490106a05b5a":"recorded: trace: TR-e47c9c2d3326","TL-490515fe3ba2":"block in the draft: terraform/kubernetes.tf:36-46","TL-4971b66d604a":"claim: member-engine = KNOWN, CRITICAL, PRESERVED","TL-49c8926884db":"claim: tcp-db-subnet-group-name = UNKNOWN, CRITICAL, REVIEW","TL-49e5e7afd23c":"field: stackit_security_group.retail_app_ecs_ui_service_{name}.tags_all = SAFE_OMISSION: tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags)","TL-49f4d75dbc78":"claim: permissions = KNOWN, CRITICAL, REVIEW","TL-4a40dba056a8":"residual: {subject} [group not produced]: source: an aws_security_group unit with 1 ingress, 0 egress and 0 other rules; target: no stackit_security_group and no rule is produced: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.orders_rds.aws_rds_cluster.{name} (stackit_postgresflex_instance, access list network.acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried","TL-4aac3bbd8bdb":"REVIEW: the source is not proven publicly accessible, so the connectivity of the STACKIT instance is a decision: its endpoint is public and limited by the list you give — an accepted change in exposure, not a preserved property.","TL-4abbfc31b2d4":"claim: iam-managed-customer-policy = KNOWN, CRITICAL, REVIEW","TL-4ad56580aeaa":"proof: INDEXED_REFERENCE/NOT_EXACT at module.vpc.module.vpc.aws_route.{name}_internet_gateway route_table_id","TL-4ade1f323433":"block in the draft: stackit_network.vpc_vpc_{name}","TL-4b1903a35141":"a step to the platform agent's identity that starts the workload (it pulls images, injects secrets and writes logs): refers to module.retail_app_ecs.module.catalog_service.aws_iam_role.task_execution_role, proven by a direct reference","TL-4b2d107e499a":"the platform agent's identity that starts the workload (it pulls images, injects secrets and writes logs): runs as module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role (a role)","TL-4b447cc4d595":"2 rules cannot be placed on one of the groups","TL-4b553da908fe":"trace: TR-be8af2d2983d","TL-4b81265cdce8":"backup_schedule is a default (02:00 daily): DynamoDB on-demand backups and AWS Backup plans do not map one to one.","TL-4ba2ebd49fc9":"resource address: stackit_security_group_rule.retail_app_ecs_catalog_service_{name}_ingress_1","TL-4bc841e93412":"recorded: trace: TR-5efbbe752c59","TL-4c095a1e26f5":"TABLE {subject} (.terraform/modules/dependencies.dynamodb_carts/main.tf:1) → collection \"retail-store-ecs-carts\": key id → _id (or a unique index on id); GSI idx_global_customerId {customerId: 1} → secondary index (strongly consistent in …","TL-4c9765f744f7":"Retention: the source states a retention that is stated","TL-4cd2b58fcf4d":"The plan of this unit relies on 4 evidenced facts about STACKIT:","TL-4cf4d335bf4e":"claim: routes = KNOWN, CRITICAL, REVIEW","TL-4d67b041df06":"keeping the logs when the resource is destroyed: decided by a variable or only when OpenTofu plans","TL-4d72d8d89f61":"decision: convert:{subject}:exposure:EXPOSURE_WIDENED","TL-4d7f6def36b6":"Still to show: every rendered stackit_logs_instance reads back from the text as the plan states it: its project, its display name and its retention_days, the variable of an instance whose period is not visible, and no instance the plan does not carry","TL-4d992a6cae8d":"claim: task-definition = KNOWN, CRITICAL, REVIEW","TL-4da6daaadabc":"proof: UNRESOLVED/NONE at module.vpc.module.vpc.aws_route.{name}_nat_gateway route_table_id","TL-4db86159d497":"claim: member-settings = UNKNOWN, CRITICAL, REVIEW","TL-4ddd30e71d2e":"block in the draft: terraform/data.tf:89-104","TL-4eb1fb7ecda2":"host, hosts, port, scheme, username, password and uri are computed attributes of {name} credential (password and uri are sensitive); the provider schema gives host and hosts no description, so read both.","TL-4edd66897c94":"field: stackit_security_group.retail_app_ecs_alb_{name}.timeouts = SAFE_OMISSION: NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL)","TL-4ee006bab9e2":"trace: TR-6003c14a24b3","TL-4f0b4857b0ce":"warning: Storage is encrypted at rest with an AWS-managed key; the PostgreSQL Flex encryption block covers customer keys only (the pinned STACKIT provider) and STACKIT does not state the default without it: no STACKIT fact is documented, so at-rest encryption is UNKNOWN until the PostgreSQL Flex …","TL-4f39a4e019f1":"recorded: trace: TR-101825075cda","TL-4f605cd7bcb3":"block in the draft: stackit_valkey_credential.dependencies_checkout_elasticache_redis_{name}","TL-4f8a4e291b3e":"  2 about limits","TL-50683c538a06":"manual action: stackitsa:facts:{subject}:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.{name}#task_role_arn (BEFORE_PILOT): Decide how {subject} gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it","TL-515a49648e47":"module.dependencies.module.catalog_opensearch.aws_opensearch_outbound_connection.{name}: switched off in the source (for_each = 0); nothing of it is migrated unless it is switched on","TL-52099c14b2e9":"resource address: stackit_security_group.retail_app_ecs_checkout_service_{name}","TL-5210aff621a2":"claim: ttl = KNOWN, CRITICAL, REVIEW","TL-5260e0ef58bd":"check: round-trip ok=true: the rendered files read back as the plan (12 written resources, 57 attributes and 10 references compared in the draft)","TL-52c6f7761b44":"stackit_security_group.retail_app_ecs_ui_service_{name}: name needs a value you supply","TL-52ea5713b1a8":"module.dependencies.module.catalog_opensearch.aws_opensearch_package_association.{name}: switched off in the source (for_each = 0); nothing of it is migrated unless it is switched on","TL-5305e27ff93b":"claim: frontend-http2 = KNOWN, NON_CRITICAL, UNSUPPORTED","TL-532e1d43ad0e":"block in the draft: terraform/identity.tf:191-194","TL-5330ff391a83":"12 left to a person to review","TL-535f19d6d071":"{subject}: No STACKIT group is produced for {name} unit.","TL-538d398e051d":"block in the draft: terraform/messaging.tf:34-37","TL-539c54ebdc4c":"block in the draft: stackit_application_load_balancer.retail_app_ecs_alb_{name}","TL-53b7d4603887":"field: stackit_security_group.retail_app_ecs_carts_service_{name}.default_egress.ipv4 = SAFE_OMISSION: the source allows all IPv4 egress, which is the allow-all IPv4 egress rule STACKIT creates on every new group: it is covered by the STACKIT default egress rules and not produced (a duplicate is rejected with HTTP 409)","TL-540fb0b16884":"claim: admin-password = UNKNOWN, CRITICAL, REVIEW","TL-541cb2d8d0af":"recorded: trace: TR-14c0a005bdbf","TL-542e75ae1c2a":"stackit_mariadb_credential.dependencies_catalog_rds_{name}: written as an active resource (terraform/data.tf, lines 49-52); the whole comment of the block is in engineering/trace/data.md","TL-543c0ed0a751":"module.dependencies.module.catalog_rds.aws_appautoscaling_target.{name}: switched off in the source (count = 0); nothing of it is migrated unless it is switched on","TL-548a1aa887c5":"Still to show: every rendered stackit_security_group_rule allows no more than the source rule it derives from, and the plan's open decisions are not rendered as if decided","TL-548c946b5195":"the credential of the clients of stackit_valkey_instance.dependencies_checkout_elasticache_redis_{name}: the instance has no host, port, user or password attribute (pinned provider).","TL-54df3111b41c":"stackit_kms_keyring.migrated: written as an active resource (terraform/security.tf, lines 274-277); the whole comment of the block is in engineering/trace/security.md","TL-5570bfbb8c05":"87 further statements that the source does not make (nothing to carry)","TL-55732a0f65a8":"warning: Storage is encrypted at rest with an AWS-managed key.","TL-5578c4e3dabb":"a step to the platform agent's identity that starts the workload (it pulls images, injects secrets and writes logs): refers to module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role, proven by a direct reference","TL-55e3b8c3d3c7":"proof: INDEXED_REFERENCE/NOT_EXACT at module.vpc.module.vpc.aws_route.{name}_internet_gateway gateway_id","TL-55f2ecd48291":"block in the draft: terraform/data.tf:49-52","TL-560312b2a515":"plan rule: awssg.group","TL-562ea286a100":"recorded: trace: TR-58f6779c70bf","TL-56a0803735a9":"claim: standalone-rule-empty-sources = KNOWN, CRITICAL, REVIEW","TL-56e190234335":"stackit_rabbitmq_credential.dependencies_mq: written as an active resource (terraform/messaging.tf, lines 34-37); the whole comment of the block is in engineering/trace/messaging.md","TL-575bf4f58d76":"field: stackit_security_group.retail_app_ecs_carts_service_{name}.timeouts = SAFE_OMISSION: NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL)","TL-5810ce5eec15":"residual: {subject} [group not produced]: source: an aws_security_group unit with 1 ingress, 1 egress and 0 other rules; target: no stackit_security_group and no rule is produced: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (stackit_valkey_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried","TL-5815d2c8b7cd":"claim: cluster-layout-settings = KNOWN, CRITICAL, REVIEW","TL-581ea56292b3":"proof cause: not-a-reference at module.dependencies.aws_security_group_rule.mq source_security_group_id","TL-5824683fa834":"residual: {subject} [group not produced]: source: an aws_security_group unit with 1 ingress, 0 egress and 0 other rules; target: no stackit_security_group and no rule is produced: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.aws_mq_broker.mq (stackit_rabbitmq_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried","TL-58553fed50a0":"claim: customer-managed-key = KNOWN, CRITICAL, REVIEW","TL-5891c8af6337":"claim: lb-routing-and-addressing = KNOWN, CRITICAL, REVIEW","TL-58b6204ed6fb":"resource address: stackit_security_group_rule.retail_app_ecs_orders_service_{name}_ingress_1","TL-58d8a240f554":"claim: db-network-placement = UNKNOWN, CRITICAL, REVIEW","TL-59a5d301688c":"recorded: trace: TR-af9e2a025af8","TL-5a268f66d0ef":"field: stackit_security_group.retail_app_ecs_carts_service_{name}.name = VARIABLE_REQUIRED: the source value comes from an overridable root variable (var.environment_name)","TL-5a2c075c134f":"field: stackit_security_group.retail_app_ecs_catalog_service_{name}.tags_all = SAFE_OMISSION: tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags)","TL-5a32e51c72e5":"stackit_security_group.retail_app_ecs_checkout_service_{name}: Whether the members of one group can reach each other over IPv6 without a rule was not observed on STACKIT (IPv6 networks could not be created in a STACKIT project tested on 2026-10-08); IPv4 needs an explicit rule, which the draft writes where the source has one.","TL-5a38cf8ed5a0":"field: stackit_security_group.retail_app_ecs_alb_{name}.tags_all = SAFE_OMISSION: tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags)","TL-5a40757f96ac":"claim: tcfp-lb-listener--default-action--target-group-arn = UNKNOWN, CRITICAL, REVIEW","TL-5a5733e45abc":"claim: lb-type = KNOWN, CRITICAL, TRANSFORMED","TL-5a72d657029c":"claim: service-desired-count = KNOWN, CRITICAL, REVIEW","TL-5a936243c67f":"block in the draft: stackit_postgresflex_user.dependencies_orders_rds_{name}","TL-5a9d8a049920":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret_version.mq): secret_id, secret_string — a setting of {subject}: the API step API/secrets-manager-vault/WriteSecret/{subject} writes it into the Secrets …","TL-5aa1787fe669":"residual: stackit_security_group.retail_app_ecs_alb_sg_{name} module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules [rules beyond the known set]: source: the source allows more than the entries that are visible statically; target: only the known entries are produced; an unknown number of unknown entries of module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules are not (group-choice)","TL-5acc71b16e18":"constraint relied on: stateful-return-traffic (SEMANTIC, stackit_security_group.stateful)","TL-5b0f2a762b02":"trace: TR-58f6779c70bf","TL-5b3b5d89523a":"field: stackit_security_group.retail_app_ecs_alb_{name}.name_prefix = SAFE_OMISSION: NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL)","TL-5b70db005647":"NOT CARRIED ({subject}): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions …","TL-5b8978a2eec7":"recorded: rule line: rule aws.elasticache/redis-valkey · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required","TL-5be43e20e944":"field: stackit_security_group.retail_app_ecs_orders_service_{name}.default_egress.ipv4 = SAFE_OMISSION: the source allows all IPv4 egress, which is the allow-all IPv4 egress rule STACKIT creates on every new group: it is covered by the STACKIT default egress rules and not produced (a duplicate is rejected with HTTP 409)","TL-5c0e817b83e7":"field: stackit_security_group.retail_app_ecs_alb_sg_{name}.stateful = SAFE_OMISSION: the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written","TL-5c63eab97a64":"Lifecycle: not established","TL-5c8a3fa7ad0e":"a step to the application's identity inside a container task: refers to module.retail_app_ecs.module.ui_service.aws_iam_role.task_role, proven by a direct reference","TL-5cc1fbc3b2ef":"NOT CARRIED (module.dependencies.module.catalog_opensearch.aws_opensearch_domain_policy.{name}): access_policies — the access policy of the domain: Statement[0] allows any principal es:* (with a condition or a part that is not visible statically): a stackit_opensearch_instance grants access by …","TL-5ce834a2bf21":"check: renders ok=true: the rendered files parse as HCL","TL-5ceb916b409a":"knowledge base case: secret","TL-5d2aede31605":"NOT CARRIED (module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress): source_security_group_id — the members of a security group the scan cannot name reach the source listener (port 5432) through {name} rule; the access list is a list of strings with no security-group reference …","TL-5d3fd7a7ba83":"field: stackit_security_group.retail_app_ecs_checkout_service_{name}.vpc_id = UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried","TL-5d4b69294c34":"warning: No lock file entry pins aws (\u003e= 3.0, \u003e= 3.29, \u003e= 4.18, \u003e= 4.30, \u003e= 4.59, \u003e= 5.64, \u003e= 5.79, ~\u003e 5.0): the version the plan would use is not proven (stated once for the whole estate)","TL-5d6d4862b95d":"file the plan renders into: security.tf","TL-5db7a125537b":"proof: UNRESOLVED/NONE at module.dependencies.aws_security_group_rule.mq source_security_group_id","TL-5dc94b642647":"proof: DIRECT_REFERENCE/EXACT at module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.{name} execution_role_arn","TL-5dcd902e61f1":"field: stackit_security_group.retail_app_ecs_alb_sg_{name}.labels = VARIABLE_REQUIRED: the source reads a variable for its tags; the labels are a variable of the draft with the scan's reading as default","TL-5e69f4e67a61":"trace: TR-101825075cda","TL-5ec3f2a49a68":"NOT CARRIED ({subject}): name — the API step API/secrets-manager-vault/WriteSecret/{subject} writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a …","TL-5eff18d636d5":"trace: TR-e7d38d4bcda5","TL-5fcc73b473a9":"proof cause: selects-collapsed at module.vpc.module.vpc.aws_route.{name}_nat_gateway route_table_id","TL-5fe7de8e49d0":"what the association module.vpc.module.vpc.aws_route_table_association.{name} attaches the table to: no resource could be named, so the reference is not resolved","TL-603724baa087":"claim: ingress-sources = KNOWN, CRITICAL, LEDGER","TL-603b3243b53e":"the table of the route resource module.vpc.module.vpc.aws_route.{name}_internet_gateway: refers to {subject}[count.index], named but not proven (a reference to one instance)","TL-603ba3262d9b":"the group of the rule resource module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed[\"_allow_all_egress_\"]: no resource could be named, so the reference is not resolved","TL-607176ccc586":"source rule: module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress[0]","TL-60baf7ccd117":"claim: tcfp-iam-role-policy-attachment--policy-arn = KNOWN, CRITICAL, REVIEW","TL-60d467065f78":"Maturity: ga","TL-6141a0c90f07":"trace: TR-af9e2a025af8","TL-6143b5b5c8ef":"A RabbitMQ credential is a user of the whole instance: the broker users of the source (and their tags and permissions) are not copied, and the vhosts, queues and exchanges of the broker are created in the instance outside Terraform.","TL-61c36de98f97":"the application's identity inside a container task: runs as module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role (a role)","TL-625cb7eb6db1":"claim: stateful = KNOWN, CRITICAL, REVIEW","TL-627a42ab209e":"block in the draft: terraform/security.tf:274-277","TL-62aebdbc63f9":"NOT CARRIED (module.dependencies.module.orders_rds.aws_rds_cluster_instance.{name}): identifier = (reads a variable; its default is not printed), db_subnet_group_name, preferred_maintenance_window = sun:05:00-sun:06:00, db_parameter_group_name — cluster members are not separate STACKIT resources — …","TL-62c42524fb55":"Open: PRIVATE_EGRESS_EQUIVALENCE_UNPROVEN — whether the source gives this subnet an IPv4 route to the internet is not proven (the route table association module.vpc.module.vpc.aws_route_table_association.{name} names the subnet {subject} but the scan cannot show that it …","TL-62d0cad26635":"STACKIT has no MySQL; test the application against MariaDB before cutover.","TL-633fcf9fd15d":"field: stackit_security_group.retail_app_ecs_carts_service_{name}.tags_all = SAFE_OMISSION: tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags)","TL-6364d1a93c94":"NOT CARRIED ({subject}): tags — the tags are not visible statically (a variable without a value, a computed value, a module output or an expression the scan cannot evaluate): no label is written for them. Set the labels of the stackit_network yourself where they are …","TL-63913ce1cf74":"claim: {name}-egress-ipv4 = KNOWN, CRITICAL, REVIEW","TL-63b013143929":"field: stackit_security_group.retail_app_ecs_ui_service_{name}.name_prefix = SAFE_OMISSION: NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL)","TL-64cdc3fd9c4d":"binding: module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.{name}#task_role_arn (TASK_ROLE, TASK, KNOWN)","TL-6582443e588c":"binding: module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.{name}#task_role_arn (TASK_ROLE, TASK, KNOWN)","TL-660fdbc25888":"knowledge base rule: aws.cloudwatch_log_group","TL-663204adb7b7":"NOT CARRIED ({subject}): enable_http2 = true, desync_mitigation_mode = defensive, xff_header_processing_mode = append, enable_xff_client_port = true — no attribute for it on the STACKIT load balancers (pinned provider).","TL-664045145910":"trace: TR-2fa350496480","TL-66470f630e5e":"recorded: trace: TR-c392beafd341","TL-664af43895bb":"trace: TR-c392beafd341","TL-66e8815b34e5":"stackit_security_group.retail_app_ecs_alb_sg_{name}: vpc_id has no STACKIT equivalent","TL-677f2c309663":"check: route-complete ok=true: 0 route block(s) written as resources, each with its table, a cidrv4 destination and a next hop","TL-6785e7e25823":"36 further statements that the source does not make (nothing to carry)","TL-67a43548b632":"field: stackit_security_group.retail_app_ecs_catalog_service_{name}.timeouts = SAFE_OMISSION: NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL)","TL-67d8eaf6c330":"unplaced rule: module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] (group-choice)","TL-6839053132bf":"Ledger: network exposure: internet-facing → public address (ASSUMPTION: the unmanaged default network ACL of the subnets of {subject} is taken as unrestricted, not verified) (SECURITY_OBSERVATION Plaintext public listener of {subject}, …","TL-68dd9e2d2f02":"decision: stackitlogs:{subject}:retention_over_180_days","TL-68f684ebfbac":"claim: listener-protocol = KNOWN, CRITICAL, TRANSFORMED","TL-695bfb19cce8":"field: stackit_security_group.retail_app_ecs_checkout_service_{name}.name = VARIABLE_REQUIRED: the source value comes from an overridable root variable (var.environment_name)","TL-697ef16383d0":"block in the draft: terraform/identity.tf:100-103","TL-69a6a9d3838d":"3 manual actions, due before the cutover","TL-69b55dc1db18":"resource address: stackit_security_group.retail_app_ecs_ui_service_{name}","TL-69b9fd6e3f88":"stackit_security_group.retail_app_ecs_alb_sg_{name}: On STACKIT a security group belongs to a project, not to a network; the source's network membership is not carried.","TL-69bb6515283d":"block in the draft: terraform/identity.tf:18-23","TL-6a9deb0feace":"112 further statements that the source does not make (nothing to carry)","TL-6ac0fec5b9de":"manual action: stackitlogs:label-convention:{subject} (CUTOVER_PREREQUISITE): Choose a static label and send the name of {subject} (and of its streams) from its log producers as the value of that label","TL-6adaaf0952ec":"stackit_security_group.retail_app_ecs_catalog_service_{name}: Whether the members of one group can reach each other over IPv6 without a rule was not observed on STACKIT (IPv6 networks could not be created in a STACKIT project tested on 2026-10-08); IPv4 needs an explicit rule, which the draft writes where the source has one.","TL-6aeddbbb224d":"knowledge base rule: aws.iam_role","TL-6b313e133238":"recorded: trace: TR-31aa12c1dfa8","TL-6c237fed88b6":"source type: aws_rds_cluster","TL-6c5a3b5b6653":"no target: NOT_DRAFTED: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.aws_mq_broker.mq (stackit_rabbitmq_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried","TL-6c72c30b6fa0":"stackit_secretsmanager_instance.migrated_secrets: written as an active resource (terraform/security.tf, lines 317-320); it also stands for 3 other units; the whole comment of the block is in engineering/trace/security.md","TL-6c9eed03f527":"claim: standalone-rule-values = KNOWN, CRITICAL, REVIEW","TL-6ce259dabf9d":"2 open decisions of the converter wait for a person: the unit is not ready to deploy until each is decided","TL-6cf2ec48891a":"recorded: trace: TR-8e7b4456f29a","TL-6d5dc8740566":"block in the draft: stackit_service_account.retail_app_ecs_checkout_service_{name}","TL-6d6d224d0414":"knowledge base rule: aws.security_group","TL-6d7438fd76fa":"  3 about rules or values it creates by default","TL-6dc2d0c95747":"block in the draft: terraform/data.tf:175-178","TL-6dd055a909f4":"proof: UNRESOLVED/NONE at module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed security_group_id","TL-6e1051723f2f":"Role assignments of service account retail_app_ecs_catalog_service_{name} (from the policies of {subject}); provider experiment \"iam\".","TL-6e53ac82df81":"warning: Engine version UPGRADE: the source runs Valkey 4.0.10 (engine_version); STACKIT Valkey in eu01 offers 8 (service catalogue of eu01, read 2026-10-18), none of them the source's version.","TL-6e5d2f0ca383":"claim: availability-zone = UNKNOWN, CRITICAL, REVIEW","TL-6f72f0cb39aa":"block in the draft: terraform/identity.tf:109-114","TL-6f93e8cdd442":"proof: DIRECT_REFERENCE/EXACT at module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.{name} task_role_arn","TL-6fb677204748":"decision: convert:{subject}:version:ENGINE_VERSION_DOWNGRADE","TL-7016884ea3b7":"stackit_logs_instance.logs_retention_180d: written as an active resource (terraform/observability.tf, lines 19-23)","TL-701749b3d3d8":"block in the draft: terraform/data.tf:35-43","TL-702e5a5ee812":"knowledge base case: alb","TL-7049d986efc2":"stackit_security_group.retail_app_ecs_checkout_service_{name}: written as an active resource (terraform/security.tf, lines 138-141)","TL-70ac65554c6c":"claim: broker-users = KNOWN, CRITICAL, REVIEW","TL-7166e3a71e2a":"residual: stackit_security_group.retail_app_ecs_alb_{name} vpc_id [project-scoped on STACKIT]: source: the group belongs to one VPC and can be attached only to resources in it; target: the group is project-scoped and can be attached to network interfaces of any network of the project","TL-716797b6aba6":"block in the draft: terraform/identity.tf:56-59","TL-71db89378ca6":"known issue: backend-security-group-rule-port-range-zero-zero-normalised","TL-71e86be88451":"claim: snapshots-off = KNOWN, CRITICAL, REVIEW","TL-720e0ca96a1b":"field: stackit_security_group.retail_app_ecs_checkout_service_{name}.default_egress.ipv4 = SAFE_OMISSION: the source allows all IPv4 egress, which is the allow-all IPv4 egress rule STACKIT creates on every new group: it is covered by the STACKIT default egress rules and not produced (a duplicate is rejected with HTTP 409)","TL-720e7aa8c6b2":"host, hosts, port, username, password, uri, uris, management, http_api_uri and http_api_uris are computed attributes of this credential (password and uri are sensitive); the provider schema describes none of them.","TL-72253f1e960c":"NOT CARRIED ({subject}): port = 5432 — stackit_postgresflex_instance has no port setting (pinned provider): clients use the port of the STACKIT endpoint.","TL-726673a98119":"proof cause: target-presence:instances-not-visible at module.vpc.module.vpc.aws_route.{name}_internet_gateway route_table_id","TL-726954b3c382":"claim: tcp-engine-version = KNOWN, CRITICAL, REVIEW","TL-727c41b31ebf":"A rule that belongs to none of the groups of this unit: ingress tcp port 80 from 0.0.0.0/0","TL-72d48d3c8867":"stackit_security_group.retail_app_ecs_checkout_service_{name}: On STACKIT a security group belongs to a project, not to a network; the source's network membership is not carried.","TL-72f338f2bbfc":"stackit_security_group.retail_app_ecs_carts_service_{name}: name needs a value you supply","TL-732e4f980183":"claim: standalone-rule-other-sources = KNOWN, CRITICAL, REVIEW","TL-7338c48d6ad3":"Checked: the plan was written as Terraform that parses","TL-738e770415b4":"stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_{name}: written as an active resource (terraform/identity.tf, lines 109-114); the whole comment of the block is in engineering/trace/identity.md","TL-739be2ecda06":"block in the draft: terraform/observability.tf:19-23","TL-73a30fcb289b":"resource address: stackit_security_group.retail_app_ecs_alb_sg_{name}","TL-73c168cf3773":"decision: stackitroute:{subject}:NAT_FIXED_EGRESS_ADDRESS_LOST","TL-73d3e111d3c3":"The unit is a log group (a named store of log events with a retention of its own)","TL-74483ed6528c":"NOT CARRIED ({subject}): skip_final_snapshot = true — stackit_postgresflex_instance has no final-snapshot or delete-time backup-retention setting (pinned provider): the instance is deleted immediately (and its automated backups may be removed …","TL-74763f6fc26a":"stackit_security_group.retail_app_ecs_alb_{name}: labels needs a value you supply","TL-74a5f8d035ee":"field: stackit_logs_instance.logs_retention_180d.node[{subject}].retention_in_days = UNSUPPORTED: the source keeps its logs for ever (it states no period, or 0); a Logs instance keeps at most 180 days, so the logs of this source are kept for 180 days here and anything older has to be archived elsewhere (for example in Object Storage) if it must be kept","TL-750b3fbf1f7f":"claim: network-topology-boundary = KNOWN, CRITICAL, REVIEW","TL-750de73feffd":"88 further statements that the source does not make (nothing to carry)","TL-751981886de9":"stackit_authorization_project_role_assignment.retail_app_ecs_catalog_service_{name}: written as an active resource (terraform/identity.tf, lines 87-92); the whole comment of the block is in engineering/trace/identity.md","TL-75300c338213":"stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_{name}: written as an active resource (terraform/identity.tf, lines 41-46); the whole comment of the block is in engineering/trace/identity.md","TL-753576a9ee70":"recorded: finding: aurora-mysql-mariadb-json","TL-7564588e5e07":"binding: module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.{name}#task_role_arn (TASK_ROLE, TASK, KNOWN)","TL-7611bf3eaa3e":"field: stackit_security_group.retail_app_ecs_alb_sg_{name}.vpc_id = UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried","TL-7625fd0f4a60":"claim: engine-version = KNOWN, CRITICAL, REVIEW","TL-765f2c8e4b62":"2 not applicable here","TL-76bc7ffd4655":"DEFAULT: reachable on STACKIT from the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients of {name} service, and from no other address; change the list with var.dependencies_catalog_rds_{name}_allowed_cidrs or answer the decision DEC-GEN-CONVERT-EXPOSURE-WIDENED …","TL-76c9cd3f4352":"NOT CARRIED ({subject}): auto_minor_version_upgrade = true — the minor-version upgrade policy is not carried: Amazon MQ upgrades the broker to new minor versions as it releases them when auto_minor_version_upgrade is true (aws provider 6.66.0, aws_mq_broker), while …","TL-77390cf041b0":"setting: {subject} deletion_protection_enabled (DELETION_PROTECTION) = CONDITIONAL","TL-779e3b0f817e":"Checked: every rule written as a resource names exactly one source or destination, a direction and its group","TL-779f2ac8c04a":"field: stackit_security_group.retail_app_ecs_ui_service_{name}.stateful = SAFE_OMISSION: the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written","TL-787da01c5236":"recorded: trace: TR-eb88a52a7e37","TL-79e6cdf60076":"listeners[listener-1].port from module.retail_app_ecs.module.alb.aws_lb_listener.frontend_http_tcp.port","TL-79efcb2b8ddb":"the credential of the clients of stackit_rabbitmq_instance.dependencies_mq: the instance has no host, port, user or password attribute (pinned provider).","TL-7a16dfa621a3":"field: stackit_security_group.retail_app_ecs_orders_service_{name}.project_id = VARIABLE_REQUIRED: the STACKIT project the group belongs to (a group is project-scoped)","TL-7a8994db68f8":"claim: tcfp-rds-cluster-instance--engine = KNOWN, CRITICAL, REVIEW","TL-7a9d5c59572e":"4 left to a person to review","TL-7aaad50961f3":"source type: aws_cloudwatch_log_group","TL-7ac65d727937":"claim: failover-off = KNOWN, CRITICAL, REVIEW","TL-7afdbfe6f6fb":"claim: tcfp-security-group-rule--from-port = KNOWN, CRITICAL, REVIEW","TL-7b680798b142":"Open: EXPOSURE PATH: pool retail-app-ecs-alb-main forwards to the ECS service module.retail_app_ecs.module.ui_service.aws_ecs_service.{name}, drafted as the workload ui on SKE (kubernetes/ui/manifests.yaml): the pool reaches it through the NodePort Service ui-nodeport of the manifest (node port 30000 → …","TL-7b7164bbe060":"residual: stackit_security_group.retail_app_ecs_checkout_service_{name} vpc_id [project-scoped on STACKIT]: source: the group belongs to one VPC and can be attached only to resources in it; target: the group is project-scoped and can be attached to network interfaces of any network of the project","TL-7c3ef89c8f99":"residual: stackit_security_group.retail_app_ecs_catalog_service_{name} ingress [intra-group IPv6 traffic not established]: source: the members of the group reach each other only where a rule of the group allows it; target: IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08 (capability ipv6-network-creation-not-implemented); IPv4 needs an explicit rule and has one wherever the source has a self rule","TL-7c5773385279":"field: stackit_security_group.retail_app_ecs_orders_service_{name}.labels = SAFE_OMISSION: the source group sets no tags, so there are no labels to write","TL-7c5b8dee254e":"trace: TR-ca04594a2ad9","TL-7c60a5045337":"claim: index-projection-and-name = KNOWN, CRITICAL, REVIEW","TL-7c6c90552a0f":"21 further statements that the source does not make (nothing to carry)","TL-7d2073800c6a":"recorded: rule line: rule aws.iam_role/role-workload-execution · KB 0.384.0 · target maturity EXPERIMENTAL · lifecycle active · mapping maturity beta · evidence internal · review required","TL-7d335f19f5bf":"field: stackit_security_group.retail_app_ecs_alb_{name}.revoke_rules_on_delete = SAFE_OMISSION: NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL)","TL-7d3b1fce19f9":"claim: iam-trust-service-workload = KNOWN, CRITICAL, REVIEW","TL-7d962b3e1941":"block in the draft: stackit_opensearch_instance.dependencies_catalog_opensearch_{name}","TL-7dd0066f7517":"manual action: awssg:unplaced:{subject}:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] (BEFORE_PILOT): Place the source rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] on the security group it belongs to and write it","TL-7e1a16cb1615":"claim: domain-credentials-and-keys = KNOWN, CRITICAL, UNSUPPORTED","TL-7e68fa105180":"warning: The defaults of the character set and the collation differ: MySQL 8.0 uses utf8mb4 and utf8mb4_0900_ai_ci, MariaDB 10.11 uses latin1 or utf8 and latin1_swedish_ci or utf8_general_ci, and MariaDB names utf8mb4_uca1400_ai_ci as the counterpart default only from 11.4.","TL-7ebdd3dd35a4":"claim: service-connect-values = KNOWN, CRITICAL, REVIEW","TL-7ed9b4f5c253":"proof: UNRESOLVED/NONE at module.vpc.module.vpc.aws_route_table_association.{name} route_table_id","TL-7f107ea4b136":"NOT CARRIED ({subject}): idle_timeout = 60 — the STACKIT Application Load Balancer has no idle timeout; Network Load Balancer listeners take tcp.idle_timeout — not generated (pinned provider).","TL-7f2b7ddbdb25":"claim: security-groups = UNKNOWN, CRITICAL, REVIEW","TL-7f5b55933a44":"residual: {subject} retention_in_days [no equivalent on STACKIT]: source: keeps its logs for ever; target: the instance keeps its logs for 180 days at most; older logs are not kept","TL-8065d96ddfaf":"AWS actions do not translate into STACKIT roles one to one: the roles are var.retail_app_ecs_catalog_service_{name}_project_roles, chosen by the architect.","TL-812c351c2405":"from {subject} (../../lib/ecs/service/iam.tf:14) — RECONFIGURE / MEDIUM","TL-815001719671":"claim: broker-network = UNKNOWN, CRITICAL, REVIEW","TL-827b61da25f3":"recorded: trace: TR-02dcd9e3db54","TL-82f379bc48ea":"critical: Engine version DOWNGRADE: the source runs OpenSearch 3.3 (engine_version); STACKIT OpenSearch in eu01 offers 2 (service catalogue of eu01, read 2026-10-18), older than the source.","TL-83166b265daa":"binding: module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.{name}#execution_role_arn (EXECUTION_ROLE, EXECUTION, KNOWN)","TL-834c58fa0764":"stackit_security_group.retail_app_ecs_orders_service_{name}: vpc_id has no STACKIT equivalent","TL-8392c7fc96fc":"stackit_security_group.retail_app_ecs_orders_service_{name}: On STACKIT a security group belongs to a project, not to a network; the source's network membership is not carried.","TL-8419133c155c":"block in the draft: stackit_mariadb_instance.dependencies_catalog_rds_{name}","TL-842fac63454c":"the credential of the clients of stackit_opensearch_instance.dependencies_catalog_opensearch_{name}: the instance has no host, port, user or password attribute (pinned provider).","TL-843857e1d8c5":"stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_{name}: written as an active resource (terraform/identity.tf, lines 222-227); the whole comment of the block is in engineering/trace/identity.md","TL-848eafc5caa3":"warning: Engine version UPGRADE: the source runs RabbitMQ 3.13 (engine_version); STACKIT RabbitMQ in eu01 offers 4.1 (service catalogue of eu01, read 2026-10-18), none of them the source's version.","TL-8497a148ba31":"trace: TR-759ef9228645","TL-84b27480518b":"proof: DIRECT_REFERENCE/EXACT at module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.{name} execution_role_arn","TL-84daded010e4":"source type: aws_route_table","TL-8551a479a85d":"claim: tcfp-security-group-rule--to-port = KNOWN, CRITICAL, REVIEW","TL-85acb00d97b2":"a customer-managed encryption key: decided by a variable or only when OpenTofu plans","TL-85af714214c1":"stackit_security_group.retail_app_ecs_orders_service_{name}: name needs a value you supply","TL-85f323530bb2":"claim: tcfp-rds-cluster-instance--engine-version = KNOWN, CRITICAL, REVIEW","TL-867ec8fe17e6":"block in the draft: stackit_mariadb_credential.dependencies_catalog_rds_{name}","TL-86a24047dc82":"knowledge base case: aurora-mysql","TL-86b5045bb7aa":"Role assignments of service account retail_app_ecs_checkout_service_{name} (from the policies of {subject}); provider experiment \"iam\".","TL-86bcadf10a2b":"2 not supported on STACKIT","TL-86e88012d122":"STACKIT generates the password; the sensitive output dependencies_catalog_opensearch_{name}_opensearch_credential_password exposes it (a reference to {name} resource, never a value).","TL-87180479e250":"field: stackit_security_group.retail_app_ecs_alb_sg_{name}.project_id = VARIABLE_REQUIRED: the STACKIT project the group belongs to (a group is project-scoped)","TL-871d4c9b23bb":"check: round-trip ok=true: the rendered files read back as the plan (0 written resources, 0 attributes and 0 references compared in the draft)","TL-871f6e06a31c":"stackit_authorization_project_role_assignment.retail_app_ecs_carts_service_{name}: written as an active resource (terraform/identity.tf, lines 18-23); the whole comment of the block is in engineering/trace/identity.md","TL-873d11581e43":"knowledge base rule: aws.lb","TL-874b3a844f62":"claim: seed-snapshot = KNOWN, CRITICAL, REVIEW","TL-875a1ea82642":"stackit_security_group.retail_app_ecs_orders_service_{name}: written as an active resource (terraform/security.tf, lines 170-173)","TL-8764278834b7":"stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_{name}: written as an active resource (terraform/identity.tf, lines 200-205); the whole comment of the block is in engineering/trace/identity.md","TL-87a2bfc89a83":"Open: the name of {subject} is \"retail-app-ecs-catalog-service-task-role\": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of the same name is …","TL-87c82dac6d26":"recorded: finding: linked-dependency-unread","TL-880aed537304":"stackit_security_group_rule.retail_app_ecs_catalog_service_{name}_ingress_1: written as an active resource (terraform/security.tf, lines 111-124)","TL-882768799a16":"block in the draft: terraform/identity.tf:32-35","TL-884236b97950":"claim: td-network-mode = KNOWN, CRITICAL, REVIEW","TL-88567a96060b":"manual action: stackitroute:precondition-outside-area:{subject} (BEFORE_PILOT): Create the target project outside a Network Area: {subject} is replaced by STACKIT's default routing, which was observed to give a routed network the same reachability only in a project outside a Network Area","TL-8868ae99392b":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret_version.{name}): secret_id, secret_string — a setting of {subject}: the API step API/secrets-manager-vault/WriteSecret/{subject} writes …","TL-8874f9dd9484":"trace: TR-a77098085913","TL-88f9492bbb73":"claim: tc-mq-broker-broker-name = KNOWN, CRITICAL, REVIEW","TL-8931c2124903":"recorded: finding: source-provider-unpinned","TL-89442424e442":"residual: stackit_security_group.retail_app_ecs_alb_sg_{name} ingress [intra-group IPv6 traffic not established]: source: the members of the group reach each other only where a rule of the group allows it; target: IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08 (capability ipv6-network-creation-not-implemented); IPv4 needs an explicit rule and has one wherever the source has a self rule","TL-896e11b91680":"block in the draft: terraform/security.tf:106-109","TL-899fd28c3b9c":"plan producer: stacktoit-awssg 0.1.0","TL-89b9a0e2d5e4":"claim: trust = KNOWN, CRITICAL, REVIEW","TL-89bd5732af76":"The unit has 0 instances","TL-89c646ac815b":"field: stackit_security_group.retail_app_ecs_catalog_service_{name}.name_prefix = SAFE_OMISSION: NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL)","TL-8a193578cd87":"claim: tcp-elasticache-replication-group-at-rest-encryption-enabled = KNOWN, CRITICAL, REVIEW","TL-8a4bf5123640":"API: write supported","TL-8b0b3c50a6e9":"AWS actions do not translate into STACKIT roles one to one: the roles are var.retail_app_ecs_ui_service_{name}_project_roles, chosen by the architect.","TL-8b210a68db05":"binding: module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.{name}#execution_role_arn (EXECUTION_ROLE, EXECUTION, KNOWN)","TL-8b79cd35ff17":"stackit_security_group.retail_app_ecs_alb_sg_{name}: Whether the members of one group can reach each other over IPv6 without a rule was not observed on STACKIT (IPv6 networks could not be created in a STACKIT project tested on 2026-10-08); IPv4 needs an explicit rule, which the draft writes where the source has one.","TL-8b7cc812905b":"knowledge base rule: aws.ecs","TL-8b9d06ef3e68":"field: stackit_security_group.retail_app_ecs_ui_service_{name}.default_egress.ipv6 = SAFE_OMISSION: the network has no IPv6 prefix (its VPC module.vpc.module.vpc.aws_vpc.{name} assigns no IPv6 CIDR block and the estate associates none), and the drafted STACKIT network has none either, so the allow-all IPv6 egress rule STACKIT creates on every new group acts on no traffic, whatever IPv6 egress rules the source lists; if an IPv6 prefix is added to the network later, delete that rule (stackit security-group rule list, then delete with the security group id) or write the equivalent rules of the source: decide then","TL-8bb3f12f6950":"block in the draft: stackit_valkey_instance.dependencies_checkout_elasticache_redis_{name}","TL-8befe47c267a":"recorded: trace: TR-a77098085913","TL-8c4262af1202":"host, hosts, load_balanced_host, port, username, password and uri are computed attributes of this credential; the provider schema gives host and load_balanced_host no description, so read both.","TL-8c5983e0bf8a":"block in the draft: terraform/security.tf:175-188","TL-8caf9748ba72":"field: stackit_security_group.retail_app_ecs_catalog_service_{name}.revoke_rules_on_delete = SAFE_OMISSION: NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL)","TL-8ce3e6f657a2":"1 kept as it is","TL-8d5e93917570":"4 manual actions, due before the pilot","TL-8dbb73faf140":"AWS actions do not translate into STACKIT roles one to one: the roles are var.retail_app_ecs_checkout_service_{name}_project_roles, chosen by the architect.","TL-8e11a858712b":"listeners[listener-1].protocol from module.retail_app_ecs.module.alb.aws_lb_listener.frontend_http_tcp.protocol","TL-8e18c3a363e3":"field: stackit_security_group.retail_app_ecs_alb_sg_{name}.name_prefix = SAFE_OMISSION: NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL)","TL-8e4d39fcf8ec":"claim: service-public-ip-setting = KNOWN, CRITICAL, REVIEW","TL-8e65e42312a8":"Role assignments of service account retail_app_ecs_carts_service_{name} (from the policies of {subject}); provider experiment \"iam\".","TL-8e66521ce803":"no target: MANUAL_REVIEW: {subject} is a container service: its 2 identity binding(s) are facts only, and no service account is attached for it (the draft writes service accounts for servers (the EC2 family); the identities of containers, functions and clusters are stated as facts and left to a person)","TL-8e6bbc7e79ec":"claim: storage-settings = KNOWN, CRITICAL, REVIEW","TL-8e95ac518439":"How many instances of the unit exist is decided by a variable or only when OpenTofu plans","TL-8f0b8bc9c445":"Open: the source load balancer names every instance of the repeated subnet module.vpc.module.vpc.aws_subnet.public, each a network of its own on STACKIT; the draft places the load balancer in one network (its layout choice; other layouts are a redesign): which instance is the placement is a decision; …","TL-8f4b0c90afc3":"source type: aws_mq_broker","TL-9090ba3ec94f":"stackit_postgresflex_instance.dependencies_orders_rds_{name}: written as an active resource (terraform/data.tf, lines 89-104); the whole comment of the block is in engineering/trace/data.md","TL-91032e216128":"trace: TR-14c0a005bdbf","TL-914c9777aa95":"trace: TR-935427f3024d","TL-91644b931b8d":"the network of {subject}: refers to module.vpc.module.vpc.aws_vpc.{name}, named but not proven (an expression that selects one resource)","TL-917c58adbbbf":"trace: TR-31aa12c1dfa8","TL-919e17423375":"and 5 further explanations of the values of the block; the trace file of the block holds all of them","TL-91ac87ca3a51":"constraint relied on: port-range-bounds (LIMIT, stackit_security_group_rule.port_range)","TL-91dd162cc6fb":"ingress tcp port 80 from 0.0.0.0/0","TL-9241b1f91636":"residual: stackit_security_group.retail_app_ecs_alb_sg_{name} name [derived]: source: the source group has no name of its own: AWS names it from the name_prefix \"retail-store-ecs-ui-\" and a random suffix (the draft does not use the prefix as the name); target: name retail-app-ecs-alb-sg-this-name-prefix derived from the address {subject}[0]","TL-924a6e48f42e":"29 further statements that the source does not make (nothing to carry)","TL-926d91287f39":"recorded: trace: TR-74ede57c41f1","TL-9283d89e8cd4":"DEFAULT plan_name: var.dependencies_checkout_elasticache_redis_{name}_plan_name defaults to stackit-keyvalue-1.4.10-single (node type cache.t3.micro has 2 vCPU and 0.5 GiB (AWS price list, cache_node_sizes.json), and the source is a single node: the smallest single-node Key Value Store plan of the …","TL-934b89757ef9":"block in the draft: terraform/security.tf:170-173","TL-93878f6ca4f3":"block in the draft: terraform/identity.tf:41-46","TL-938a72d0233d":"field: stackit_security_group.retail_app_ecs_catalog_service_{name}.labels = SAFE_OMISSION: the source group sets no tags, so there are no labels to write","TL-93afdda91a72":"claim: security-group-vpc-membership = KNOWN, CRITICAL, UNSUPPORTED","TL-93cae41c9248":"NOT CARRIED ({subject}): preferred_maintenance_window = sun:05:00-sun:06:00, allow_major_version_upgrade = true, db_cluster_parameter_group_name — stackit_mariadb_instance has no maintenance window, version-upgrade policy, extended-support, …","TL-942a3220b1ea":"warning: This unit names module.retail_app_ecs.aws_secretsmanager_secret.catalog_db (aws_secretsmanager_secret), whose own decision the target does not carry (it is RECONFIGURE, but the converter does not draft this aws_secretsmanager_secret (the generator skips this case, or only records it …","TL-942dbe8cd334":"claim: linked-dependency:aws_dynamodb_table = KNOWN, CRITICAL, REVIEW","TL-94607050289f":"ingress tcp port 5432 from a security group that is not resolved: no resource could be named, so the reference is not resolved","TL-94a5a7b9f318":"binding: module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.{name}#execution_role_arn (EXECUTION_ROLE, EXECUTION, KNOWN)","TL-94c59a08ef5d":"proof cause: source-not-present at {subject} vpc_id","TL-94fffdc633e3":"field: stackit_security_group.retail_app_ecs_alb_{name}.default_egress.ipv6 = SAFE_OMISSION: the source restricts IPv6 egress, and STACKIT creates an allow-all IPv6 egress rule on {name} group that the draft does not manage; that rule acts on the network interface that lists the group, and no block of the draft lists {name} one (its members are module.retail_app_ecs.module.alb.aws_lb.{name} (aws_lb, written without a security group)), so there is no effect to decide about; if you attach the group to an interface by hand, that rule applies to the interface until it is deleted (stackit security-group rule list, then delete with the security group id): decide then","TL-9507b31b1f39":"stackit_security_group.retail_app_ecs_alb_sg_{name}: project_id needs a value you supply","TL-95876fd15cbf":"stackit_opensearch_credential.dependencies_catalog_opensearch_{name}: written as an active resource (terraform/data.tf, lines 221-224); the whole comment of the block is in engineering/trace/data.md","TL-95c682104778":"REVIEW: reachable on STACKIT from the addresses of var.dependencies_checkout_elasticache_redis_{name}_allowed_cidrs instead of only from the private subnets (module.vpc.module.vpc.aws_subnet.private) — an accepted change in exposure, not a preserved property: decide it with the decision …","TL-95f73fae754f":"source type: aws_ecs_{name}","TL-964869bde1d0":"unit: {subject}","TL-967595b1a760":"block in the draft: stackit_postgresflex_instance.dependencies_orders_rds_{name}","TL-968a5b34c942":"Open: the name of {subject} is \"retail-app-ecs-ui-service-task-role\": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of the same name is refused), so …","TL-96b2b4dffee0":"DEFAULT: reachable on STACKIT from the egress addresses of stackit_ske_cluster.retail_app_ecs_cluster (its pods), the clients of this service, and from no other address; change the list with var.dependencies_mq_allowed_cidrs or answer the decision DEC-GEN-CONVERT-EXPOSURE-WIDENED (alias …","TL-96fb8b671269":"recorded: finding: aurora-mysql-mariadb-auth","TL-971ca5e62f2e":"block in the draft: stackit_service_account.retail_app_ecs_carts_service_{name}","TL-9753196a8780":"access_scope is var.kms_access_scope, which has no default: without it the STACKIT API makes the key PUBLIC, a choice the source does not state. PUBLIC or SNA is yours.","TL-97ccea328e8c":"recorded: finding: subnet-route-table-undecided","TL-97d60707e486":"claim: engine-version = KNOWN, CRITICAL, TRANSFORMED","TL-98117649104a":"knowledge base case: role-workload-execution","TL-981f57277e1b":"constraint relied on: group-name-validator (REJECTS, stackit_security_group.name)","TL-9829b8818e37":"stackit_security_group.retail_app_ecs_alb_{name}: On STACKIT a security group belongs to a project, not to a network; the source's network membership is not carried.","TL-983bffe35aec":"field: stackit_security_group.retail_app_ecs_catalog_service_{name}.project_id = VARIABLE_REQUIRED: the STACKIT project the group belongs to (a group is project-scoped)","TL-984149b7cd63":"recorded: trace: TR-8ede34dda579","TL-985bcd360e90":"field: stackit_security_group.retail_app_ecs_orders_service_{name}.stateful = SAFE_OMISSION: the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written","TL-9861dc42113c":"recorded: trace: TR-b9a8861fdbd3","TL-98aa55dee3f2":"claim: egress-restriction = KNOWN, CRITICAL, REVIEW","TL-98eaf60ea4d2":"8 left to a person to review","TL-98fa11e400a6":"knowledge base rule: aws.secretsmanager_secret","TL-990e3616a997":"a step to the application's identity inside a container task: refers to module.retail_app_ecs.module.carts_service.aws_iam_role.task_role, proven by a direct reference","TL-9935a1d0524d":"the network of {subject}[0]: refers to module.vpc.module.vpc.aws_vpc.this, named but not proven (an expression that selects one resource)","TL-9935e773c8b2":"stackit_security_group.retail_app_ecs_carts_service_{name}: written as an active resource (terraform/security.tf, lines 74-77)","TL-993a90249cdf":"constraint relied on: remote-security-group-by-id (SEMANTIC, stackit_security_group_rule.remote_security_group_id)","TL-995719e6081c":"claim: deletion-protection = KNOWN, CRITICAL, PRESERVED","TL-995a8b5caea3":"claim: final-snapshot = KNOWN, CRITICAL, REVIEW","TL-9972c13728dd":"the platform agent's identity that starts the workload (it pulls images, injects secrets and writes logs): runs as module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role (a role)","TL-999d2147fc39":"knowledge base case: redis-valkey","TL-99ae9a67bdc8":"manual action: stackitsa:facts:{subject}:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.{name}#task_role_arn (BEFORE_PILOT): Decide how {subject} gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it","TL-99e29c8aa0dc":"residual: stackit_security_group.retail_app_ecs_carts_service_{name} vpc_id [project-scoped on STACKIT]: source: the group belongs to one VPC and can be attached only to resources in it; target: the group is project-scoped and can be attached to network interfaces of any network of the project","TL-99e869fe09b9":"intent: identity:{subject}","TL-9a51869d142b":"Retention: the source states a retention that is decided by a variable or only when OpenTofu plans","TL-9a779b7a6b36":"stackit_postgresflex_user.dependencies_orders_rds_{name}: written as an active resource (terraform/data.tf, lines 110-115); the whole comment of the block is in engineering/trace/data.md","TL-9b340e19f00f":"1 kept in another form","TL-9b4918ae0f89":"The clients are module.retail_app_ecs.module.catalog_service.aws_ecs_service.{name}, the members of module.retail_app_ecs.module.catalog_service.aws_security_group.{name} (named by module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress[0]), the only clients the source admitted; …","TL-9ba58f23da6a":"proof cause: target-presence:instances-not-visible at module.vpc.module.vpc.aws_route.{name}_internet_gateway gateway_id","TL-9bc15de8e8dc":"claim: tc-secretsmanager-secret-name = KNOWN, CRITICAL, REVIEW","TL-9c15f6843395":"claim: tcp-backup-retention-period = KNOWN, CRITICAL, REVIEW","TL-9d1216c1c1c8":"check: final-artifact ok=true: the service account resources of the written files read back as the plan (0 written resources, 0 attributes and 0 references compared in the final files)","TL-9d3a00290cfc":"recorded: trace: TR-935427f3024d","TL-9d3a7bf5fd7e":"no target: NOT_DRAFTED: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (stackit_valkey_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried","TL-9d66b9ddceaa":"DNS: the source uses the AWS VPC resolver, which answers internal EC2 host names (module.vpc.module.vpc.aws_vpc.this enable_dns_hostnames = true); ipv4_nameservers = var.default_ipv4_nameservers resolves {name} names only.","TL-9dbb5f8333d6":"PITR on PostgreSQL Flex restores into a new cloned instance; backups are kept 32–90 days.","TL-9dc9bf2d25bd":"binding: module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.{name}#task_role_arn (TASK_ROLE, TASK, KNOWN)","TL-9dcbf713776e":"claim: permissions = UNKNOWN, CRITICAL, REVIEW","TL-9ded5f4a9b15":"stackit_security_group.retail_app_ecs_alb_sg_{name}: labels needs a value you supply","TL-9e089191f346":"claim: service-network-placement = KNOWN, CRITICAL, REVIEW","TL-9e1b871ca606":"options.ephemeral_address from {subject}.internal","TL-9e54e51d38bd":"10 left to a person to review","TL-9e63551bc994":"residual: stackit_security_group.retail_app_ecs_ui_service_{name} vpc_id [project-scoped on STACKIT]: source: the group belongs to one VPC and can be attached only to resources in it; target: the group is project-scoped and can be attached to network interfaces of any network of the project","TL-9f0e74bef300":"97 further statements that the source does not make (nothing to carry)","TL-9f241609c525":"The permissions of the source policies become the project role assignments below (provider experiment \"iam\").","TL-9f447c7bf066":"constraint relied on: retention-1-to-180-days (LIMIT, stackit_logs_instance.retention_days)","TL-9f4a4663060f":"claim: rule-ports = KNOWN, CRITICAL, REVIEW","TL-9f6fb4dc741d":"residual: stackit_security_group.retail_app_ecs_ui_service_{name} ingress [intra-group IPv6 traffic not established]: source: the members of the group reach each other only where a rule of the group allows it; target: IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08 (capability ipv6-network-creation-not-implemented); IPv4 needs an explicit rule and has one wherever the source has a self rule","TL-9f77adebca24":"source type: aws_elasticache_replication_group","TL-a025e2b14ef2":"30 further statements that the source does not make (nothing to carry)","TL-a04300ee85f1":"proof: DIRECT_REFERENCE/EXACT at module.dependencies.aws_security_group_rule.mq security_group_id","TL-a05a641fdcc9":"no target: NOT_DRAFTED: the source creates no instance of the log source (count or for_each yields none, or it is switched off): no stackit_logs_instance is drafted","TL-a06d1105d447":"NOT CARRIED ({subject}): deletion_window_in_days = 7 — STACKIT KMS deletes a key scheduled for deletion after 30 days; stackit_kms_key has no deletion window (pinned provider).","TL-a0b0b1aba9a4":"Open: the name of {subject} is \"retail-app-ecs-carts-service-task-execution-role\": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of the …","TL-a0b6743aac67":"intent family: SECURITY_POLICY","TL-a124fb19fe25":"claim: subnet-vpc-membership = KNOWN, CRITICAL, REVIEW","TL-a1347beabd08":"recorded: finding: redis-transit-encryption-off","TL-a1780a7183ce":"source rule: module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress[0]","TL-a1eade33c8b0":"107 further statements that the source does not make (nothing to carry)","TL-a222001be325":"knowledge base rule: aws.mq_broker","TL-a28e5a16c9b6":"stackit_security_group.retail_app_ecs_alb_sg_{name}: A name the source does not give is derived by StackToIT from the source address; check it before use.","TL-a291587bece7":"claim: secret-value = KNOWN, CRITICAL, REVIEW","TL-a373afa47bdd":"NOT CARRIED ({subject}): parameter_group_name — the parameter group is not translated: stackit_valkey_instance takes selected settings under parameters (maxmemory_policy, maxclients, notify_keyspace_events, …; …","TL-a37fa27cada2":"source type: aws_subnet","TL-a39cdd3e9206":"no target: NOT_DRAFTED: STACKIT's default routing replaces the table, with a loss: a route of the table sends traffic to a NAT gateway (the others, if any, to an internet gateway), and the reachability is observed on the target for a project outside a Network Area, which this draft does not write. Observed in one sandbox project outside a Network Area (probe 16, 2026-10-10; routing tables are refused there, cap:network.routing/routing-tables-not-supported-for-sandbox-project): a routed network reaches the internet with no route and no routing table configured, a server without a public IP through the network's shared SNAT address and a server with a public IP through its own (cap:network.public-ip-and-egress/snat-egress-address-is-network-publicip, cap:network.public-ip-and-egress/public-ip-one-to-one-on-nic); nothing initiated from the internet reached a server behind the network address (cap:network.public-ip-and-egress/snat-implicit-egress); egress is restricted by the egress rules of security groups, not by a route (cap:network.security-group/egress-allow-list-restricts-outbound); routed networks reach each other with no table (cap:network.routing/internal-routing-without-table-sandbox). No stackit_routing_table is drafted. A NAT gateway adds what an internet route does not. Its fixed egress address is LOST (observed, cap:network.public-ip-and-egress/snat-egress-address-is-network-publicip): the address a routed STACKIT network leaves by is the network's publicIp, one address for every routed network of the project, not fixed (it changed twice when every network of the project was deleted) and not settable (a PATCH of it answers 202 and is ignored), so a third party's allow-list on the NAT gateway's address does not survive; a STACKIT public IP per server keeps its address, the only one the probe saw stay fixed (cap:network.public-ip-and-egress/public-ip-one-to-one-on-nic). The egress restriction (the gateway as the only way out of a {name} subnet) is carried by the egress rules of security groups, not by a route (observed, cap:network.security-group/egress-allow-list-restricts-outbound); whether the source restricts egress that way is for the architect. The absence of inbound paths of a {name} subnet is observed for a server without a public IP (tcp 22, 80 and 8080 on the network address, cap:network.public-ip-and-egress/snat-implicit-egress). Not observed: a Network Area and its default routing table (cap:network.routing/default-routing-table, cap:network.routing/probe-needed-default-route-internet). The outbound address of the servers an allow-list names is the architect's choice: keep the changing address, or give each server that an allow-list names a STACKIT public IP","TL-a4029f22afff":"field: stackit_logs_instance.logs_retention_180d.node[{subject}].name = MANUAL_ACTION: the name the source writes to has no object on the target that can hold it","TL-a42c63da1a36":"stackit_security_group.retail_app_ecs_ui_service_{name}: Whether the members of one group can reach each other over IPv6 without a rule was not observed on STACKIT (IPv6 networks could not be created in a STACKIT project tested on 2026-10-08); IPv4 needs an explicit rule, which the draft writes where the source has one.","TL-a434bc9a56e0":"warning: This unit names module.dependencies.module.dynamodb_carts.aws_dynamodb_table.this (aws_dynamodb_table), whose own decision the target does not carry (it is REDESIGN), and the semantic contract of aws_iam_role does not read aws_dynamodb_table, so what the reference becomes is not assessed.","TL-a4d3f937ca56":"constraint relied on: duplicate-default-egress-rule-rejected (REJECTS, stackit_security_group_rule)","TL-a57737aba736":"the application's identity inside a container task: runs as module.retail_app_ecs.module.orders_service.aws_iam_role.task_role (a role)","TL-a5a67e3efe48":"recorded: rule line: rule aws.rds_cluster/aurora-postgres · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required","TL-a5d9a92f75cd":"field: stackit_security_group.retail_app_ecs_catalog_service_{name}.name = VARIABLE_REQUIRED: the source value comes from an overridable root variable (var.environment_name)","TL-a5fc3b814f37":"claim: multiaz-network-exposure = KNOWN, CRITICAL, NOT_APPLICABLE","TL-a6049371b3d3":"recorded: trace: TR-9aa24821e695","TL-a630e5a2d1f6":"Open: the name of {subject} is \"retail-app-ecs-checkout-service-task-role\": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of the same name is …","TL-a64baa4f1c90":"NOT CARRIED (module.retail_app_ecs.aws_secretsmanager_secret_version.{name}): secret_id, secret_string — a setting of {subject}: the API step API/secrets-manager-vault/WriteSecret/{subject} writes it …","TL-a64ef62aaef3":"known issue: provider-github-1751-network-area-region-route-stale-state","TL-a67bc5ed2fae":"field: stackit_security_group.retail_app_ecs_checkout_service_{name}.timeouts = SAFE_OMISSION: NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL)","TL-a6813d1e4e1d":"proof: DIRECT_REFERENCE/EXACT at module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.{name} execution_role_arn","TL-a6d7abc53432":"stackit_service_account.retail_app_ecs_checkout_service_{name}: written as an active resource (terraform/identity.tf, lines 100-103); the whole comment of the block is in engineering/trace/identity.md","TL-a6e80c38069e":"The plan of {name} unit relies on 14 evidenced facts about STACKIT:","TL-a79af3172fe3":"block in the draft: terraform/identity.tf:9-12","TL-a7c4401bd895":"from {subject} (.terraform/modules/dependencies.catalog_rds/main.tf:61) — REPLATFORM / LOW","TL-a7fb71a085e3":"2 known issues recorded for these resource types","TL-a808280131f4":"field: stackit_security_group.retail_app_ecs_checkout_service_{name}.revoke_rules_on_delete = SAFE_OMISSION: NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL)","TL-a8b04486f7f0":"block in the draft: terraform/identity.tf:87-92","TL-a8b80e481488":"stackit_application_load_balancer.retail_app_ecs_alb_{name}: written as an active resource (terraform/loadbalancing.tf, lines 21-62); the whole comment of the block is in engineering/trace/loadbalancing.md","TL-a8bb64db774c":"recorded: rule line: rule aws.kms_key/kms · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required","TL-a8d8bb17db66":"recorded: trace: TR-2fa350496480","TL-a8f0a4cb1f58":"knowledge base case: sg","TL-a8ffeaa88e16":"resource address: stackit_security_group_rule.retail_app_ecs_ui_service_{name}_ingress_1","TL-a9008b2e818b":"claim: route-destinations = KNOWN, CRITICAL, REVIEW","TL-a9898b1d90e1":"  3 about limits","TL-a9bc98856cd2":"knowledge base rule: aws.kms_key","TL-a9cbf5fd9753":"claim: standalone-rule-remote-not-resolved = UNKNOWN, CRITICAL, REVIEW","TL-aa70c5f93a78":"and 8 settings of the block with the source attribute each is written from; the trace file of the block holds all of them","TL-aa88ca128b42":"block in the draft: stackit_ske_{name}.retail_app_ecs_{name}","TL-aa92cf1fd974":"NOT CARRIED ({subject}): vpc_id — the source VPC is not generated: the network is created in the project (stackit_network also takes a vpc_id of the experimental STACKIT VPC feature, pinned provider — not used by this draft).","TL-aa94f4bce90e":"from {subject} (.terraform/modules/dependencies.catalog_opensearch/main.tf:29) — REPLATFORM / LOW","TL-ab2664af5ba0":"NOT CARRIED ({subject}): subnet_group_name, security_group_ids — stackit_valkey_instance has no subnet, security-group, zone or IP-family attribute (pinned provider); the draft limits access with …","TL-abaced7ba3ec":"proof: DIRECT_REFERENCE/EXACT at module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.{name} task_role_arn","TL-acc90ceaeeaf":"Open: {subject}: which instance of stackit_network.vpc_vpc_public the networks of {name} block means is not visible in the source (it is repeated); set var.retail_app_ecs_alb_{name}_network_id_target to its index — no instance is assumed (open decision …","TL-acde938eb848":"NOT CARRIED ({subject}): port = 3306 — stackit_mariadb_instance has no port setting (pinned provider): clients use the port of the STACKIT endpoint.","TL-aceb91f4c363":"trace: TR-d39d5b78739a","TL-ad1065332d19":"claim: {name}-ip-on-launch = KNOWN, CRITICAL, PRESERVED","TL-ad298e461c90":"trace: TR-eb88a52a7e37","TL-ad77bfd2606b":"claim: subnet-association-target = KNOWN, CRITICAL, NOT_APPLICABLE","TL-ad851bfabb74":"knowledge base case: opensearch","TL-af0b67ca104d":"claim: storage-encryption = KNOWN, CRITICAL, REVIEW","TL-af1b6af93bf9":"proof: UNRESOLVED/NONE at module.vpc.module.vpc.aws_route_table_association.{name} subnet_id","TL-af274b5a8258":"claim: engine-type = KNOWN, CRITICAL, PRESERVED","TL-af41f8705c3a":"9 left to a person to review","TL-af7d2497cec2":"warning: This unit names module.retail_app_ecs.aws_secretsmanager_secret.mq (aws_secretsmanager_secret), whose own decision the target does not carry (it is RECONFIGURE, but the converter does not draft this aws_secretsmanager_secret (the generator skips this case, or only records it against a …","TL-aff113a40e67":"check: round-trip ok=true: the rendered files read back as the plan (1 written resources, 3 attributes and 0 references compared in the draft)","TL-b00148e1eafe":"networks[0].network_id SOURCE_UNPROVEN: the load balancer spans several subnets of the source, or a repeated one, and the network the draft places it in is a variable or a choice of the placement, not a setting of the source","TL-b041cdc5ee67":"proof cause: not-a-reference at module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed security_group_id","TL-b06270d4bcd5":"recorded: trace: TR-cf173263597f","TL-b0725865d4c2":"NOT CARRIED ({subject}): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. …","TL-b0f34bc79dbc":"stackit_logs_instance.logs_retention_180d: node[{subject}].name needs a manual action","TL-b11d4184ae32":"NOT CARRIED ({subject}): assume_role_policy, name = (reads a variable; its default is not printed) — stackit_service_account has a name and a project only (pinned provider): no trust policy, path, session duration or permissions boundary. The …","TL-b1b9b940f39d":"the target of a route resource: 0.0.0.0/0 to a NAT gateway: refers to module.vpc.module.vpc.aws_nat_gateway.this[0], proven by a reference to one instance","TL-b1bbbaec7332":"Terraform: resource available","TL-b1c1e9b968e8":"manual action: stackitsa:facts:{subject}:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.{name}#execution_role_arn (BEFORE_PILOT): Decide how {subject} pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach","TL-b1df1f96e3e1":"stackit_valkey_credential.dependencies_checkout_elasticache_redis_{name}: written as an active resource (terraform/data.tf, lines 175-178); the whole comment of the block is in engineering/trace/data.md","TL-b2a8afa68433":"stackit_security_group.retail_app_ecs_alb_sg_{name}: The source may allow more rules than are visible statically; only the visible ones are planned. (2 times)","TL-b2aac30072ef":"Group {subject}[0]: 0 rules","TL-b30766a80738":"field: stackit_security_group.retail_app_ecs_catalog_service_{name}.default_egress.ipv4 = SAFE_OMISSION: the source allows all IPv4 egress, which is the allow-all IPv4 egress rule STACKIT creates on every new group: it is covered by the STACKIT default egress rules and not produced (a duplicate is rejected with HTTP 409)","TL-b33949aaa668":"claim: network-exposure = KNOWN, CRITICAL, LEDGER","TL-b37cbe043e79":"DEFAULT: STACKIT generates the password of {name} user (stackit_mariadb_credential.password is computed and sensitive, pinned provider; no STACKIT user takes a password) and the sensitive output dependencies_catalog_rds_{name}_admin_password exposes it; the source password and its Secrets Manager …","TL-b3c5f384d94c":"  2 about values the API rejects","TL-b3c7984e8072":"resource address: stackit_security_group.retail_app_ecs_catalog_service_{name}","TL-b3cae517f600":"stackit_service_account.retail_app_ecs_orders_service_{name}: written as an active resource (terraform/identity.tf, lines 147-150); the whole comment of the block is in engineering/trace/identity.md","TL-b3decd31fd30":"One keyring for the migrated keys.","TL-b42f1855452e":"Entitlement: not established","TL-b42f61333e6b":"from {subject} (.terraform/modules/dependencies.checkout_elasticache_redis/main.tf:115) — RECONFIGURE / MEDIUM","TL-b42fc8fe3628":"display_name made a name the STACKIT KMS API takes (1 to 64 characters of letters, digits, underscores and hyphens); source text: retail-store-ecs CMK","TL-b43036bd87a0":"source rule: {subject}#ingress#0#3d8f71de8dab","TL-b432c72310fd":"  it has 0 instances","TL-b449e06df0f6":"trace: TR-cf63149db4be","TL-b460c9a12f81":"Maturity: not established","TL-b4df207ee84d":"recorded: rule line: rule aws.opensearch/opensearch · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required","TL-b50dcb9af871":"field: stackit_security_group.retail_app_ecs_orders_service_{name}.name = VARIABLE_REQUIRED: the source value comes from an overridable root variable (var.environment_name)","TL-b5b97b9044b0":"claim: service-discovery = KNOWN, CRITICAL, REVIEW","TL-b5f13fa502d3":"claim: td-execution-role-arn = KNOWN, CRITICAL, REVIEW","TL-b624e4e24859":"claim: route-set-completeness = KNOWN, CRITICAL, PRESERVED","TL-b657e20901a7":"flavor_id 2.4 = 2 vCPU / 4 GiB, single-node (eu01 catalogue 2026-10-18).","TL-b6a7ab14d50b":"residual: stackit_security_group.retail_app_ecs_carts_service_{name} ingress [intra-group IPv6 traffic not established]: source: the members of the group reach each other only where a rule of the group allows it; target: IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08 (capability ipv6-network-creation-not-implemented); IPv4 needs an explicit rule and has one wherever the source has a self rule","TL-b6b320f1e9c7":"claim: nbr-aws-opensearch-domain-policy = KNOWN, CRITICAL, REVIEW","TL-b76e2142be7e":"claim: request-header-options = KNOWN, CRITICAL, REVIEW","TL-b7d0788a9866":"trace: TR-5efbbe752c59","TL-b7dad88686a5":"setting: {subject} name_prefix (NAME) = CONDITIONAL","TL-b801052d81ab":"7 left to a person to review","TL-b85bc2536920":"stackit_secretsmanager_user.migration: written as an active resource (terraform/security.tf, lines 325-330); it also stands for 3 other units; the whole comment of the block is in engineering/trace/security.md","TL-b8dcaad7eb2a":"5 left to a person to review","TL-b953ad72b045":"field: stackit_security_group_rule.retail_app_ecs_ui_service_{name}_ingress_1.project_id = VARIABLE_REQUIRED: the STACKIT project the rule belongs to","TL-b96566e5b3e4":"claim: backup-retention = KNOWN, CRITICAL, LEDGER","TL-b965e925fff4":"Checked: the plan is internally consistent","TL-b98dc7b63973":"Group {subject}: 1 rule","TL-b9a1cc50acd4":"field: stackit_security_group.retail_app_ecs_checkout_service_{name}.labels = SAFE_OMISSION: the source group sets no tags, so there are no labels to write","TL-b9c4dbea1c42":"stackit_security_group_rule.retail_app_ecs_ui_service_{name}_ingress_1: written as an active resource (terraform/security.tf, lines 207-220)","TL-ba5176ad4315":"manual action: stackitsa:facts:{subject}:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.{name}#execution_role_arn (BEFORE_PILOT): Decide how {subject} pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach","TL-ba9a92878482":"source type: aws_secretsmanager_secret","TL-baa0729dab6a":"warning: This unit names module.retail_app_ecs.aws_secretsmanager_secret.orders_db (aws_secretsmanager_secret), whose own decision the target does not carry (it is RECONFIGURE, but the converter does not draft this aws_secretsmanager_secret (the generator skips this case, or only records it against …","TL-bab1a734312c":"block in the draft: terraform/identity.tf:213-216","TL-bab29f416c71":"block in the draft: terraform/security.tf:317-320","TL-bad803821ffc":"claim: route-targets = KNOWN, CRITICAL, REVIEW","TL-bb61208f625a":"source type: aws_lb","TL-bb7b14f411f4":"module.dependencies.module.orders_rds.aws_appautoscaling_policy.{name}: switched off in the source (count = 0); nothing of it is migrated unless it is switched on","TL-bb960af062d5":"claim: multiaz-high-availability = KNOWN, CRITICAL, NOT_APPLICABLE","TL-bbaa2374b7cf":"The source states a retention that is decided by a variable or only when OpenTofu plans","TL-bbc56b6870d6":"claim: td-container-plaintext-secret-env = UNKNOWN, CRITICAL, REVIEW","TL-bc046f5db37e":"claim: ip-address-type = KNOWN, CRITICAL, PRESERVED","TL-bc04cf6aecbc":"field: stackit_logs_instance.logs_retention_180d.project_id = VARIABLE_REQUIRED: the instance belongs to a STACKIT project","TL-bc257d3dfa83":"Role assignments of service account retail_app_ecs_ui_service_{name} (from the policies of {subject}); provider experiment \"iam\".","TL-bcabc81573ee":"field: stackit_security_group_rule.retail_app_ecs_checkout_service_{name}_ingress_1.project_id = VARIABLE_REQUIRED: the STACKIT project the rule belongs to","TL-bcd1629bac49":"project_id needs a value you supply (on 2 resources)","TL-bcd2cb137506":"module.dependencies.module.catalog_opensearch.aws_opensearch_domain_saml_options.{name}: switched off in the source (count = 0); nothing of it is migrated unless it is switched on","TL-bdd2eb0c6912":"block in the draft: terraform/messaging.tf:17-25","TL-bdf43443dac8":"from {subject} (../../lib/ecs/service/iam.tf:14) — RECONFIGURE / LOW","TL-bdfca9295228":"decision: convert:{subject}:security-group:POD_SEGMENTATION","TL-be2e9593649f":"claim: access-and-encryption-settings = KNOWN, CRITICAL, REVIEW","TL-be3743195cdc":"claim: lb-connection-timeouts = KNOWN, CRITICAL, REVIEW","TL-be94f74dd70b":"trace: TR-02dcd9e3db54","TL-bec244aa1644":"field: stackit_security_group.retail_app_ecs_alb_{name}.stateful = SAFE_OMISSION: the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written","TL-bef3cf429ba6":"proof cause: not-a-reference at module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress source_security_group_id","TL-bf1127382e01":"recorded: trace: TR-089026082d6f","TL-bfa981755ba3":"trace: TR-e47c9c2d3326","TL-bff1dfa5e357":"claim: egress-sources = KNOWN, CRITICAL, REVIEW","TL-c04695a5e2b9":"recorded: trace: TR-60af0bd02bd2","TL-c075bc81dfd1":"{subject}: A rule or a related resource is not written, because writing it as it is would allow more than the source does or its values are not visible; a person re-creates or checks it. (2 times)","TL-c0a43bf32f50":"Routes that reach the table at run time: nothing propagates routes into the table","TL-c0c1204c2958":"block in the draft: terraform/security.tf:53-60","TL-c0c729a47b2a":"claim: credentials-and-keys-settings = KNOWN, CRITICAL, UNSUPPORTED","TL-c117988b793a":"source rule: module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0]","TL-c1a96aaec49b":"claim: point-in-time-recovery = KNOWN, CRITICAL, REVIEW","TL-c22fc28b70ad":"trace: TR-8ede34dda579","TL-c2451757a208":"block in the draft: stackit_rabbitmq_credential.dependencies_mq","TL-c2c0aacc31d3":"Checked: every instance written as a resource names a project, a display name the API accepts and a retention of 1 to 180 days or a variable","TL-c3094c377b8f":"Routes learned at run time: nothing propagates routes into the table","TL-c34289edf7b8":"block in the draft: stackit_kms_key.retail_app_ecs_{name}","TL-c3708697f6d5":"The plan of {name} unit relies on 7 evidenced facts about STACKIT:","TL-c38f5d7fd7ea":"block in the draft: terraform/identity.tf:78-81","TL-c3f18e26eaee":"stackit_service_account.retail_app_ecs_catalog_service_{name}: written as an active resource (terraform/identity.tf, lines 78-81); the whole comment of the block is in engineering/trace/identity.md","TL-c5281bb6f1f0":"proof: INDEXED_REFERENCE/EXACT at module.dependencies.module.catalog_rds.aws_security_group_rule.default_ingress security_group_id","TL-c54bd24a1d5a":"stackit_service_account.retail_app_ecs_ui_service_{name}: written as an active resource (terraform/identity.tf, lines 213-216); the whole comment of the block is in engineering/trace/identity.md","TL-c58757b38cbc":"ingress tcp port 443 from a security group that is not resolved: no resource could be named, so the reference is not resolved","TL-c59ff702359b":"trace: TR-2eebb342bc5c","TL-c5b62e23bf42":"manual action: stackitlogs:archive:{subject} (CUTOVER_PREREQUISITE): Configure a cold-storage log flow for {subject}: send a copy of its logs, in parallel to the Logs instance stackit_logs_instance.logs_retention_180d, to a long-term store (for example a separate Object Storage bucket) that keeps them for the retention beyond 180 days","TL-c5b8f167a62a":"knowledge base rule: aws.dynamodb_table","TL-c5c32314dcb2":"block in the draft: terraform/security.tf:286-294","TL-c5d5b7d8dd53":"NOT CARRIED ({subject}): num_cache_clusters = 1 — the plan (plan_name) defines the nodes and replicas of a STACKIT Valkey instance (pinned provider).","TL-c623eeb96ddb":"no target: NOT_DRAFTED: the source creates no instance of the table (count or for_each yields none, or it is switched off): no stackit_routing_table is drafted","TL-c639a00c46d7":"The decision DEC-GEN-CONVERT-SIZE-FROM-SOURCE (alias `convert:{subject}:dependencies_checkout_elasticache_redis_{name}_plan_name:SIZE_FROM_SOURCE`) stays open: check it, and answer choose-the-size in …","TL-c675628d0724":"decision: convert:{subject}:dependencies_mq_plan_name:SIZE_FROM_SOURCE","TL-c6c0b60e18ad":"15 left to a person to review","TL-c6c4a8483f3c":"source type: aws_security_group","TL-c747e769619f":"field: stackit_security_group.retail_app_ecs_orders_service_{name}.tags_all = SAFE_OMISSION: tags_all is the tags merged with the provider's default tags and is computed by the AWS provider; a STACKIT group has no such attribute, and the effective tags are written as its labels (the tags that are not labels are named on the statement tags)","TL-c76b053585e3":"DEFAULT plan_name: var.dependencies_mq_plan_name defaults to stackit-rabbitmq-8.16.50-replica (broker instance type mq.m5.large has 2 vCPU and 8 GiB (AWS price list, mq_broker_sizes.json), and the broker is a single instance: the smallest replica (three nodes, high availability) RabbitMQ plan of …","TL-c80e8619ea1f":"stackit_kms_key.retail_app_ecs_{name}: written as an active resource (terraform/security.tf, lines 286-294); the whole comment of the block is in engineering/trace/security.md","TL-c822f81761f0":"source type: aws_dynamodb_table","TL-c848f0501964":"claim: tc-opensearch-domain-domain-name = KNOWN, CRITICAL, REVIEW","TL-c878f9bc4d03":"claim: tcp-engine-type = KNOWN, CRITICAL, REVIEW","TL-c87b59f72fe8":"stackit_security_group.retail_app_ecs_carts_service_{name}: vpc_id has no STACKIT equivalent","TL-c8b47bfd43e9":"resource address: stackit_security_group.retail_app_ecs_carts_service_{name}","TL-c93fbdc19c96":"block in the draft: stackit_service_account.retail_app_ecs_catalog_service_{name}","TL-c96f77c86adc":"The clients are module.retail_app_ecs.module.orders_service.aws_ecs_service.{name}, the members of module.retail_app_ecs.module.orders_service.aws_security_group.{name} (named by module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress[0]), the only clients the source admitted; the …","TL-c9e9a6fa4297":"proof cause: selects-collapsed at module.vpc.module.vpc.aws_route_table_association.{name} route_table_id","TL-c9f67b8f22fe":"claim: network-exposure = KNOWN, CRITICAL, REVIEW","TL-ca7ff57c86cf":"Open: the name of {subject} is \"retail-app-ecs-carts-service-task-role\": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of the same name is …","TL-caa1c3eef1d4":"stackit_security_group.retail_app_ecs_orders_service_{name}: Whether the members of one group can reach each other over IPv6 without a rule was not observed on STACKIT (IPv6 networks could not be created in a STACKIT project tested on 2026-10-08); IPv4 needs an explicit rule, which the draft writes where the source has one.","TL-caa1f26656e0":"CLIENT ACCESS: public on source, public on target — the rules of module.retail_app_ecs.module.alb.aws_security_group.{name}, module.retail_app_ecs.module.alb_sg.aws_security_group.{name}_name_prefix admit every IPv4 address on the listener port(s) 80, and the load balancer drafted here is public and …","TL-cad6310f071e":"stackit_valkey_instance.dependencies_checkout_elasticache_redis_{name}: written as an active resource (terraform/data.tf, lines 158-166); the whole comment of the block is in engineering/trace/data.md","TL-cae700457220":"stackit_authorization_project_role_assignment.retail_app_ecs_orders_service_{name}: written as an active resource (terraform/identity.tf, lines 178-183); the whole comment of the block is in engineering/trace/identity.md","TL-cb90fe7d6716":"NOT CARRIED ({subject}): master_password — the source password is not copied: stackit_postgresflex_user has no password input, STACKIT generates it (the password is computed and sensitive, pinned provider) — hand the new one to the application.","TL-cbaa7222643b":"claim: key-schema = KNOWN, CRITICAL, REVIEW","TL-cc043135a6e3":"a route resource: 0.0.0.0/0 to an internet gateway","TL-cc460a90eb96":"recorded: finding: aurora-storage-encrypted","TL-cc6179d848f5":"NOT CARRIED ({subject}): port = 6379 — the port is the one stackit_valkey_credential returns (port is computed, pinned provider); clients switch to it.","TL-cc8921b42e42":"A service key authenticates fully against the instance; a test on a STACKIT project on 2026-09-24 found it denied CONFIG, ACL and MODULE (docs.stackit.cloud, Key Value Store, credentials). The AUTH token, the users and the ACL of the source are not copied: limits a client relied on move to …","TL-cc90c346c091":"intent: security:{subject}","TL-ccaeb41a7e67":"Group {subject}[0]: 1 rule","TL-ccda799a3b8d":"residual: {subject} [group not produced]: source: an aws_security_group unit with 1 ingress, 0 egress and 0 other rules; target: no stackit_security_group and no rule is produced: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.catalog_rds.aws_rds_cluster.{name} (stackit_mariadb_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried","TL-ccdd0432dac5":"resource address: stackit_security_group_rule.retail_app_ecs_carts_service_{name}_ingress_1","TL-cd3dd578f82e":"residual: stackit_security_group.retail_app_ecs_checkout_service_{name} ingress [intra-group IPv6 traffic not established]: source: the members of the group reach each other only where a rule of the group allows it; target: IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08 (capability ipv6-network-creation-not-implemented); IPv4 needs an explicit rule and has one wherever the source has a self rule","TL-cd465a05b885":"Drafted, consumers not placed: decision DEC-GEN-CONVERT-WORKLOAD-PLACEMENT (alias `convert:{subject}:network:WORKLOAD_PLACEMENT`). Nothing in the draft is placed in this network, although the source places module.dependencies.aws_mq_broker.mq, …","TL-cd4b1f2bacd5":"decision: convert:{subject}:dependencies_checkout_elasticache_redis_{name}_plan_name:SIZE_FROM_SOURCE","TL-cd5358aba689":"STACKIT generates the password; the sensitive output dependencies_checkout_elasticache_redis_{name}_valkey_credential_password exposes it (a reference to this resource, never a value).","TL-cd5b2a69446f":"manual action: stackitsa:facts:{subject}:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.{name}#execution_role_arn (BEFORE_PILOT): Decide how {subject} pulls images, injects secrets and writes logs: the platform agent's role has no STACKIT counterpart to attach","TL-cda7c6ee5f1c":"stackit_security_group.retail_app_ecs_alb_{name}: project_id needs a value you supply","TL-cde32939042c":"block in the draft: stackit_service_account.retail_app_ecs_ui_service_{name}","TL-ce1f9d88a1e0":"constraint relied on: protocol-name-values (LIMIT, stackit_security_group_rule.protocol.name)","TL-ce71694d7554":"decision: convert:{subject}:network_id:AMBIGUOUS_INSTANCE_SELECTION","TL-ce970354a860":"from {subject} (../../lib/dependencies/mq.tf:12) — RECONFIGURE / MEDIUM","TL-cecbc297c624":"knowledge base case: log-group","TL-ceeebc3a4ae7":"REVIEW: the source is not proven publicly accessible, so the connectivity of the STACKIT instance is a decision: stackit_mariadb_instance has no private-network option in the pinned provider, its endpoint is public and limited by var.dependencies_catalog_rds_{name}_allowed_cidrs — an accepted change …","TL-cef409da4821":"NOT CARRIED ({subject}): advanced_options, advanced_security_options, domain_endpoint_options, ebs_options, encrypt_at_rest, engine_version = OpenSearch_3.3, node_to_node_encryption, vpc_options — a stackit_opensearch_instance takes a …","TL-cf0a695af244":"field: stackit_security_group.retail_app_ecs_catalog_service_{name}.vpc_id = UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried","TL-cf281cc11bb2":"stackit_network.vpc_vpc_{name}: written as an active resource (terraform/network.tf, lines 23-29); the whole comment of the block is in engineering/trace/network.md","TL-cf39a3da1ee6":"claim: capacity-mode = KNOWN, NON_CRITICAL, UNSUPPORTED","TL-cffc21fa1051":"Route set: the routes listed are all the table has","TL-d00848cc1ab4":"manual action: awssg:incomplete:{subject}:group {subject}[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules (BEFORE_PILOT): Re-create the rules beyond the known set of group {subject}[0] (rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules)","TL-d016b4d54504":"from {subject} (../../lib/ecs/service/iam.tf:31) — RECONFIGURE / LOW","TL-d042d4d0d608":"recorded: finding: aurora-mysql-mariadb-collation","TL-d04ec02d07c2":"knowledge base case: dynamodb","TL-d04f343580e7":"stackit_security_group.retail_app_ecs_alb_sg_{name}: written as an active resource (terraform/security.tf, lines 31-39)","TL-d05ba3641b72":"NOT CARRIED ({subject}): db_subnet_group_name — stackit_mariadb_instance has no subnet, availability-zone or IP-family attribute (pinned provider): clients reach the instance at the endpoint STACKIT assigns.","TL-d067abf0fcf3":"and 2 further findings; the trace file of the block holds all of them","TL-d06bbf0a703a":"recorded: trace: TR-e7d38d4bcda5","TL-d07896f591f6":"Open: the node pool's machine type, minimum and maximum replace the capacity of {subject} (Fargate has no nodes): they are variables because the source does not state a node size — size them from the requests in kubernetes/\u003cservice\u003e/manifests.yaml. An SKE node pool's …","TL-d0b5284a5f5a":"block in the draft: terraform/identity.tf:178-183","TL-d1154369b0c7":"proof cause: selects-collapsed at module.vpc.module.vpc.aws_route_table_association.{name} subnet_id","TL-d1167884884b":"block in the draft: terraform/network.tf:46-52","TL-d155c07d75d6":"stackit_security_group.retail_app_ecs_catalog_service_{name}: On STACKIT a security group belongs to a project, not to a network; the source's network membership is not carried.","TL-d197300eb63b":"knowledge base case: subnet","TL-d1a104cfbb3e":"no target: NOT_DRAFTED: the source creates no instance of the group (count or for_each yields none, or it is switched off): no stackit_security_group is drafted","TL-d2221d61a7c7":"a step to the platform agent's identity that starts the workload (it pulls images, injects secrets and writes logs): refers to module.retail_app_ecs.module.checkout_service.aws_iam_role.task_execution_role, proven by a direct reference","TL-d23fd6528266":"stackit_postgresflex_database.dependencies_orders_rds_{name}_orders: written as an active resource (terraform/data.tf, lines 128-133); the whole comment of the block is in engineering/trace/data.md","TL-d2696a4e7bf2":"claim: tc-subnet-enable-resource-name-dns-aaaa-record-on-launch = KNOWN, CRITICAL, PRESERVED","TL-d295ba2b301a":"field: stackit_security_group_rule.retail_app_ecs_catalog_service_{name}_ingress_1.project_id = VARIABLE_REQUIRED: the STACKIT project the rule belongs to","TL-d2eba4e4303f":"setting: {subject} skip_destroy (KEEP_ON_DESTROY) = CONDITIONAL","TL-d2f2ffe993f5":"claim: parameter-group = UNKNOWN, CRITICAL, REVIEW","TL-d325015c1bfd":"claim: tcr-route-table-vpc-id = KNOWN, CRITICAL, REVIEW","TL-d32b21b09626":"no target: NOT_DRAFTED: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (stackit_opensearch_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried","TL-d369de530541":"and 3 further explanations of the values of the block; the trace file of the block holds all of them","TL-d37fef6eaafe":"source rule: module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed[\"in#in#sg#0\"]","TL-d3824da0a207":"field: stackit_security_group.retail_app_ecs_checkout_service_{name}.default_egress.ipv6 = SAFE_OMISSION: the network has no IPv6 prefix (its VPC module.vpc.module.vpc.aws_vpc.{name} assigns no IPv6 CIDR block and the estate associates none), and the drafted STACKIT network has none either, so the allow-all IPv6 egress rule STACKIT creates on every new group acts on no traffic, whatever IPv6 egress rules the source lists; if an IPv6 prefix is added to the network later, delete that rule (stackit security-group rule list, then delete with the security group id) or write the equivalent rules of the source: decide then","TL-d3a23909d906":"source rule: {subject}#egress#0#909db684902e","TL-d3b74bb7bd2a":"block in the draft: terraform/security.tf:138-141","TL-d3cadd9abc4a":"claim: ipv6 = KNOWN, CRITICAL, PRESERVED","TL-d3e99ffd8edd":"proof: UNRESOLVED/NONE at module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress source_security_group_id","TL-d3eb105c9b5c":"recorded: finding: engine-version-upgrade","TL-d41311b8b67f":"field: stackit_security_group.retail_app_ecs_checkout_service_{name}.name_prefix = SAFE_OMISSION: NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL)","TL-d44b198f7a4a":"residual: stackit_security_group.retail_app_ecs_alb_{name} name [derived]: source: the source group has no name of its own: AWS names it from the name_prefix \"retail-store-ecs-ui-\" and a random suffix (the draft does not use the prefix as the name); target: name retail-app-ecs-alb-{name} derived from the address {subject}[0]","TL-d45160aea2ac":"no target: NOT_DRAFTED: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.catalog_rds.aws_rds_cluster.{name} (stackit_mariadb_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried","TL-d46f02e929c7":"source type: aws_ecs_service","TL-d477c31ae16d":"check: plan-valid ok=true: the plan satisfies targetplan.Validate","TL-d4825bec16b6":"block in the draft: stackit_rabbitmq_instance.dependencies_mq","TL-d50841142838":"warning: The project can be taken as one VPC's boundary only if every resource that names a VPC provably names the estate's one, and this estate does not show it: the VPC this subnet names, or the VPC another resource of the estate names (a network ACL, a flow log, a peering connection, a Cloud …","TL-d50bc41a68a5":"  1 about limits","TL-d5182041757a":"CLIENT ACCESS (assumed): the network ACLs of the subnets of {subject} is not managed by {name} source and is taken as unrestricted — not verified; the client access stated for stackit_application_load_balancer.retail_app_ecs_alb_{name} is an assumption about it and …","TL-d623ca25320b":"claim: tcfp-lb-listener--protocol = KNOWN, CRITICAL, REVIEW","TL-d63fca72026c":"trace: TR-6212f52df434","TL-d689a7f8f4f9":"stackit_security_group.retail_app_ecs_ui_service_{name}: written as an active resource (terraform/security.tf, lines 202-205)","TL-d6ac55ef30e3":"claim: rule-ports = KNOWN, CRITICAL, LEDGER","TL-d6b53adc609a":"block in the draft: terraform/security.tf:111-124","TL-d7009cd177d9":"Terraform: resource available, data source available","TL-d70d70f815d4":"constraint relied on: group-labels-format (LIMIT, stackit_security_group.labels)","TL-d738a1efaa39":"field: stackit_security_group.retail_app_ecs_ui_service_{name}.project_id = VARIABLE_REQUIRED: the STACKIT project the group belongs to (a group is project-scoped)","TL-d77a925325c6":"no target: NOT_DRAFTED: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.orders_rds.aws_rds_cluster.{name} (stackit_postgresflex_instance, access list network.acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried","TL-d7ec1cee7472":"Attached to a subnet: a value that is not visible statically","TL-d821186c5899":"the network of the table: refers to module.vpc.module.vpc.aws_vpc.this, named but not proven (an expression that selects one resource)","TL-d821bd14334d":"plan producer: stacktoit-stackitlogs 0.1.0","TL-d8280c94a459":"NOT CARRIED ({subject}): security_groups — a STACKIT Application Load Balancer is in no security group, so the attachment of module.retail_app_ecs.module.alb.aws_security_group.{name}, module.retail_app_ecs.module.alb_sg.aws_security_group.{name}_name_prefix is not …","TL-d8484a84799b":"unplaced rule: module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0] (group-choice)","TL-d87f8408f0bf":"a storage or access class: decided by a variable or only when OpenTofu plans","TL-d88062febb16":"decision: convert:{subject}:data:DATA_MOVEMENT","TL-d880af0f41c4":"source rule: module.dependencies.aws_security_group_rule.mq[0]","TL-d8cd2b6539da":"claim: parameter-and-option-groups = UNKNOWN, CRITICAL, REVIEW","TL-d948417c6b00":"stackit_security_group.retail_app_ecs_catalog_service_{name}: written as an active resource (terraform/security.tf, lines 106-109)","TL-d9c1a1f307f3":"stackit_rabbitmq_instance.dependencies_mq: written as an active resource (terraform/messaging.tf, lines 17-25); the whole comment of the block is in engineering/trace/messaging.md","TL-d9f0a41cd244":"NOT CARRIED ({subject}): name — the API step API/secrets-manager-vault/WriteSecret/{subject} writes it into the Secrets Manager instance from a document you supply (the path is its name when the source …","TL-da1f396eaad3":"listeners[listener-1].http.hosts[*].rules[*].target_pool (default route) from module.retail_app_ecs.module.alb.aws_lb_listener.frontend_http_tcp.default_action","TL-da1f8992cf91":"Terraform: resource available, data source available, experimental","TL-da2e68bcc2b5":"claim: service-task-definition = KNOWN, CRITICAL, REVIEW","TL-da8ab18e216a":"claim: readable-standbys = KNOWN, CRITICAL, NOT_APPLICABLE","TL-da92f5545dab":"Default route for IPv4 addresses: the table has one","TL-daad3b0e838c":"NOT CARRIED ({subject}): name — the API step API/secrets-manager-vault/WriteSecret/{subject} writes it into the Secrets Manager instance from a document you supply (the path is its name …","TL-db04248efd43":"resource address: stackit_security_group.retail_app_ecs_alb_{name}","TL-db1bbaf0a0a0":"knowledge base rule: aws.rds_cluster","TL-db488a755ee8":"stackit_security_group_rule.retail_app_ecs_checkout_service_{name}_ingress_1: written as an active resource (terraform/security.tf, lines 143-156)","TL-db91b2d63856":"residual: stackit_security_group.retail_app_ecs_alb_sg_{name} vpc_id [project-scoped on STACKIT]: source: the group belongs to one VPC and can be attached only to resources in it; target: the group is project-scoped and can be attached to network interfaces of any network of the project","TL-dbae16bc1236":"Private DNS parity not established: STACKIT documents no {name} DNS zone or internal name resolution (STACKIT DNS serves public zones only; the DNS Resolver product is in beta); names only the VPC resolver answers need a DNS server of your own.","TL-dbe97d4df687":"capability: network.security-group","TL-dc6bfa12fa59":"block in the draft: stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_{name}","TL-dd44bcb7bce4":"The decision DEC-GEN-CONVERT-SIZE-FROM-SOURCE (alias `convert:{subject}:dependencies_mq_plan_name:SIZE_FROM_SOURCE`) stays open: check it, and answer choose-the-size in decisions.yaml if the plan is wrong; the next run then writes no default.","TL-ddd75ed5ef6e":"plan producer: stacktoit-stackitroute 0.1.0","TL-de390d10576f":"field: stackit_security_group.retail_app_ecs_alb_sg_{name}.default_egress.ipv6 = SAFE_OMISSION: the source restricts IPv6 egress, and STACKIT creates an allow-all IPv6 egress rule on this group that the draft does not manage; that rule acts on the network interface that lists the group, and no block of the draft lists this one (its members are module.retail_app_ecs.module.alb.aws_lb.this (aws_lb, written without a security group)), so there is no effect to decide about; if you attach the group to an interface by hand, that rule applies to the interface until it is deleted (stackit security-group rule list, then delete with the security group id): decide then","TL-de5037a6961b":"claim: tcp-elasticache-replication-group-num-cache-clusters = KNOWN, CRITICAL, REVIEW","TL-de87e1e59bed":"NOT CARRIED ({subject}): preferred_maintenance_window = sun:05:00-sun:06:00, allow_major_version_upgrade = false, db_cluster_parameter_group_name — stackit_postgresflex_instance has no maintenance window, version-upgrade policy, extended-support, …","TL-deff206ee5a4":"residual: stackit_security_group.retail_app_ecs_orders_service_{name} ingress [intra-group IPv6 traffic not established]: source: the members of the group reach each other only where a rule of the group allows it; target: IPv6 intra-group behaviour was not observed: an IPv6 network could not be created in the STACKIT project tested on 2026-10-08 (capability ipv6-network-creation-not-implemented); IPv4 needs an explicit rule and has one wherever the source has a self rule","TL-df25ff4f04ac":"and 6 further explanations of the values of the block; the trace file of the block holds all of them","TL-df6e1c6ce7f0":"claim: iam-managed-ecs = KNOWN, CRITICAL, REVIEW","TL-df95e598be34":"field: stackit_security_group.retail_app_ecs_carts_service_{name}.labels = SAFE_OMISSION: the source group sets no tags, so there are no labels to write","TL-df96e33983ac":"residual: stackit_security_group.retail_app_ecs_orders_service_{name} vpc_id [project-scoped on STACKIT]: source: the group belongs to one VPC and can be attached only to resources in it; target: the group is project-scoped and can be attached to network interfaces of any network of the project","TL-e01daf44bce1":"block in the draft: terraform/data.tf:110-115","TL-e07bdfe1d608":"knowledge base rule: aws.elasticache","TL-e092da48ce26":"resource address: stackit_security_group.retail_app_ecs_orders_service_{name}","TL-e0b8a3656b5d":"recorded: rule line: rule aws.rds_cluster/aurora-mysql · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required","TL-e0e4e6c7eb18":"knowledge base rule: aws.opensearch","TL-e0e9c2cb4c62":"residual: {subject} rule module.retail_app_ecs.module.alb_sg.aws_security_group_rule.ingress_rules[0] [rule withheld]: source: an allow rule of the unit's security group; target: no rule is produced: it cannot be attributed to a group (group-choice)","TL-e133e8f74491":"NOT CARRIED ({subject}): skip_final_snapshot = true — stackit_mariadb_instance has no final-snapshot or delete-time backup-retention setting (pinned provider): the instance is deleted immediately (and its automated backups may be removed …","TL-e1a7e1889f79":"claim: at-rest-encryption-off = KNOWN, CRITICAL, REVIEW","TL-e1a889878673":"trace: TR-6a8844a36ea2","TL-e205ee2ade59":"claim: linked-dependency:aws_secretsmanager_secret_version = KNOWN, CRITICAL, REVIEW","TL-e2250f928144":"plan_id SOURCE_UNPROVEN: a STACKIT Application Load Balancer plan has no setting in the source: it is chosen from the catalogue of the target","TL-e2561ba5bd07":"resource address: stackit_security_group_rule.retail_app_ecs_checkout_service_{name}_ingress_1","TL-e2beab721b43":"block in the draft: terraform/security.tf:143-156","TL-e2cba8df4bae":"claim: engine-version = KNOWN, CRITICAL, PRESERVED","TL-e34d811b9bc3":"setting: {subject} log_group_class (CLASS) = CONDITIONAL","TL-e358bede7239":"trace: TR-c243e261bc0d","TL-e37b2e685a4d":"target_pools[retail-app-ecs-alb-main].active_health_check.healthy_threshold from module.retail_app_ecs.module.alb.aws_lb_target_group.main.health_check.healthy_threshold","TL-e3d9704fb87f":"Open: the name of {subject} is \"retail-app-ecs-catalog-service-task-execution-role\": a STACKIT service account name has at most 20 characters (lowercase letters, digits and single dashes) and is unique in a project (a second account of …","TL-e409176b66c5":"115 further statements that the source does not make (nothing to carry)","TL-e40deead9910":"a step to the application's identity inside a container task: refers to module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role, proven by a direct reference","TL-e4511b0b541c":"warning: The scan cannot say which route table this subnet follows: a route table association may name it through a value the scan cannot resolve (a variable, a literal ID, a conditional, a value from a module call), an association names only some of its instances or repeats by a count or for_each …","TL-e497ce17d5ae":"from {subject} (../../lib/ecs/service/iam.tf:31) — RECONFIGURE / MEDIUM","TL-e4d60c1731c8":"check: rule-has-one-remote ok=true: 0 rule block(s) written as resources, each with a direction, its group and exactly one remote","TL-e4fdae196847":"claim: parameter-group-{name} = UNKNOWN, CRITICAL, REVIEW","TL-e5065cc37a7a":"no target: NOT_DRAFTED: STACKIT's default routing replaces the table: every route of the table sends traffic to an internet gateway, and the equivalence is observed on the target for a project outside a Network Area, which this draft does not write. Observed in one sandbox project outside a Network Area (probe 16, 2026-10-10; routing tables are refused there, cap:network.routing/routing-tables-not-supported-for-sandbox-project): a routed network reaches the internet with no route and no routing table configured, a server without a {name} IP through the network's shared SNAT address and a server with a {name} IP through its own (cap:network.{name}-ip-and-egress/snat-egress-address-is-network-publicip, cap:network.{name}-ip-and-egress/{name}-ip-one-to-one-on-nic); nothing initiated from the internet reached a server behind the network address (cap:network.{name}-ip-and-egress/snat-implicit-egress); egress is restricted by the egress rules of security groups, not by a route (cap:network.security-group/egress-allow-list-restricts-outbound); routed networks reach each other with no table (cap:network.routing/internal-routing-without-table-sandbox). No stackit_routing_table is drafted. Observed in one project of one region on one day, so not HIGH; not observed: a Network Area and its default routing table (cap:network.routing/default-routing-table, cap:network.routing/probe-needed-default-route-internet), where this would be open again","TL-e5277af9f12c":"block in the draft: terraform/security.tf:74-77","TL-e52d6bdf8245":"name from {subject}.name","TL-e55740d24a58":"constraint relied on: group-is-project-scoped (SEMANTIC, stackit_security_group.project_id)","TL-e578adf43042":"claim: encryption-at-rest = KNOWN, CRITICAL, REVIEW","TL-e5aee84c7c11":"{subject}: STACKIT Logs has no log group, workspace or sink object: the source is not created as such, and its logs go to the Logs instance of its retention.","TL-e5f0797d55fa":"NOT CARRIED: capacity modes (provisioned/on-demand, auto scaling — size the flavor instead), DynamoDB Streams (use change streams or an outbox), transaction semantics (TransactWriteItems limits; MongoDB multi-document transactions behave differently), conditional-write expressions, PartiQL, table …","TL-e5fa9372b1a5":"API: partial","TL-e6082d3e0453":"the table of the route resource module.vpc.module.vpc.aws_route.{name}_nat_gateway[0]: no resource could be named, so the reference is not resolved","TL-e6970c0aa0a5":"Checked: the Terraform that was written, read back, says exactly what the plan says: nothing missing, nothing added, no rule written that the plan leaves open","TL-e6b8e9f1d2f6":"claim: opensearch-domain-policy-resource = KNOWN, CRITICAL, REVIEW","TL-e6d0fb6f80e7":"field: stackit_security_group.retail_app_ecs_ui_service_{name}.timeouts = SAFE_OMISSION: NOT CARRIED when the source sets it: the timeouts of the AWS provider for creating and deleting the group; a STACKIT group has none, and they state nothing the group allows (NON_CRITICAL)","TL-e6d83acc492f":"Read it after the apply and give it to every client before the cutover; the state holds it in plain text and the draft creates no secret for it.","TL-e6e0237bf142":"block in the draft: terraform/security.tf:79-92","TL-e709e41174b6":"setting: {subject} name (NAME) = CONDITIONAL","TL-e71977ad9aed":"field: stackit_security_group.retail_app_ecs_orders_service_{name}.revoke_rules_on_delete = SAFE_OMISSION: NOT CARRIED when the source sets it: it makes AWS revoke the rules of a group before deleting it; a STACKIT group has no such attribute and no revoke-rules step (the pinned provider), and it states nothing the group allows (NON_CRITICAL)","TL-e719f7a8dede":"claim: effective-route-table = KNOWN, CRITICAL, REVIEW","TL-e796886b33ed":"stackit_security_group.retail_app_ecs_catalog_service_{name}: vpc_id has no STACKIT equivalent","TL-e85816503b5e":"file the plan renders into: observability.tf","TL-e879ced2a842":"claim: revoke-rules-on-delete = KNOWN, NON_CRITICAL, NOT_APPLICABLE","TL-e8c14af06fc7":"source rule: module.dependencies.aws_security_group_rule.allow_https_from_client","TL-e8c434043da6":"claim: associations = KNOWN, CRITICAL, NOT_APPLICABLE","TL-e9660e7873c5":"block in the draft: terraform/data.tf:158-166","TL-e9cf89058493":"block in the draft: stackit_postgresflex_database.dependencies_orders_rds_{name}_orders","TL-e9ea8334f765":"claim: tcp-subnet-ids = KNOWN, CRITICAL, REVIEW","TL-ea3f5ee8f3ba":"recorded: trace: TR-b77494749ed2","TL-ea57cd0cb4cd":"stackit_service_account.retail_app_ecs_ui_service_{name}: written as an active resource (terraform/identity.tf, lines 191-194); the whole comment of the block is in engineering/trace/identity.md","TL-eb4d03549aa7":"the credential's username and password are computed by STACKIT (pinned provider); the source master username is not set.","TL-eb51d0f2f615":"stackit_authorization_project_role_assignment.retail_app_ecs_checkout_service_{name}: written as an active resource (terraform/identity.tf, lines 132-137); the whole comment of the block is in engineering/trace/identity.md","TL-eb6969879f57":"stackit_security_group.retail_app_ecs_checkout_service_{name}: vpc_id has no STACKIT equivalent","TL-eb6e69766287":"knowledge base case: ecs-to-ske","TL-ebd04774484c":"claim: egress-rule-protocol = KNOWN, CRITICAL, REVIEW","TL-ec07138f4b5e":"the group of the rule resource module.dependencies.aws_security_group_rule.mq[0]: refers to {subject}, proven by a direct reference","TL-ec3313ecf936":"proof: DIRECT_REFERENCE/EXACT at module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.{name} task_role_arn","TL-ec3e7a0847fa":"intent family: OBSERVABILITY","TL-ec4d2aafd6c8":"claim: secondary-indexes = KNOWN, CRITICAL, REVIEW","TL-ec559f03bc2c":"claim: td-container-image-registry = UNKNOWN, CRITICAL, REVIEW","TL-ec727dee66a7":"1 not applicable here","TL-ecd5e0c38318":"recorded: finding: engine-version-downgrade","TL-ed10391cb980":"proof: UNRESOLVED/NONE at {subject} vpc_id","TL-ed1bb454360c":"block in the draft: terraform/security.tf:31-39","TL-ed3a90932174":"trace: TR-822b8a98ff0d","TL-ed3f5cf2ae49":"block in the draft: stackit_mongodbflex_instance.dynamodb_tables","TL-ed4cf778c0f2":"85 further statements that the source does not make (nothing to carry)","TL-ee1fb4388ac7":"source rule: module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules[0]","TL-ee96ad845f27":"module.dependencies.module.catalog_rds.aws_appautoscaling_policy.{name}: switched off in the source (count = 0); nothing of it is migrated unless it is switched on","TL-ee9a578f3cec":"field: stackit_security_group.retail_app_ecs_orders_service_{name}.default_egress.ipv6 = SAFE_OMISSION: the network has no IPv6 prefix (its VPC module.vpc.module.vpc.aws_vpc.{name} assigns no IPv6 CIDR block and the estate associates none), and the drafted STACKIT network has none either, so the allow-all IPv6 egress rule STACKIT creates on every new group acts on no traffic, whatever IPv6 egress rules the source lists; if an IPv6 prefix is added to the network later, delete that rule (stackit security-group rule list, then delete with the security group id) or write the equivalent rules of the source: decide then","TL-ef1c3ea92106":"stackit_ske_{name}.retail_app_ecs_{name}: written as an active resource (terraform/kubernetes.tf, lines 36-46); it also stands for 5 other units; the whole comment of the block is in engineering/trace/kubernetes.md","TL-ef35caeece4a":"source rule: module.dependencies.module.checkout_elasticache_redis.module.aws_security_group.aws_security_group_rule.keyed[\"_allow_all_egress_\"]","TL-ef7556a3d3e2":"field: stackit_security_group.retail_app_ecs_carts_service_{name}.vpc_id = UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried","TL-efa1fc4dca0a":"recorded: finding: subnet-egress-ipv4-unproven","TL-f0225bd35ccc":"check: final-artifact ok=true: the routing table resources of the written files read back as the plan (0 written resources, 0 attributes and 0 references compared in the final files)","TL-f03ddce8b025":"check: instance-complete ok=true: 1 instance block(s) written as resources, each with a project, a display name the API accepts and a retention_days of 1 to 180 days or a variable","TL-f080eee9565a":"NOT CARRIED ({subject}): user — the broker users are not copied: the draft writes one stackit_rabbitmq_credential for the instance, a user whose username and password STACKIT generates (both computed, pinned provider) — clients get new credentials.","TL-f0b1dc10d313":"manual action: awssg:incomplete:{subject}:group {subject}[0]:rules:module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules (BEFORE_PILOT): Re-create the rules beyond the known set of group {subject}[0] (rules, module.retail_app_ecs.module.alb_sg.aws_security_group_rule.egress_rules)","TL-f104f4612c00":"decision: convert:{subject}:dependencies_orders_rds_{name}_flavor_id:SIZE_FROM_SOURCE","TL-f18f2e6ae7c4":"stackit_opensearch_instance.dependencies_catalog_opensearch_{name}: written as an active resource (terraform/data.tf, lines 204-212); the whole comment of the block is in engineering/trace/data.md","TL-f19c330ab5dd":"NOT CARRIED ({subject}): database_name = catalog — stackit_mariadb_instance has no database attribute (pinned provider): create the database after connecting.","TL-f1ea08c67233":"claim: request-handling = KNOWN, CRITICAL, REVIEW","TL-f1ec41938106":"1 carried into the draft and listed in the ledger","TL-f1f07e52ad07":"Group {subject}: 2 rules","TL-f2eb19ea1d78":"check: final-artifact ok=true: the security group resources of the written files read back as the plan (12 written resources, 57 attributes and 10 references compared in the final files)","TL-f3099aace307":"manual action: stackitsa:facts:{subject}:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.{name}#task_role_arn (BEFORE_PILOT): Decide how {subject} gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it","TL-f35035518166":"block in the draft: stackit_secretsmanager_instance.migrated_secrets","TL-f3bde1d8d49f":"Ledger: backup retention: 7 days → service-managed backups, retention not set in {name} draft — REVIEW","TL-f43e935c11f7":"owner: the generated master user — the source states no database owner; check that the application expects {name} one.","TL-f47e2790bbaa":"A rule that belongs to none of the groups of this unit: egress any protocol to 0.0.0.0/0, ::/0","TL-f4bdc86495d2":"proof cause: kind-not-exact:PROVEN_JOIN_ONE at {subject} vpc_id","TL-f51db642f584":"field: stackit_security_group.retail_app_ecs_catalog_service_{name}.default_egress.ipv6 = SAFE_OMISSION: the network has no IPv6 prefix (its VPC module.vpc.module.vpc.aws_vpc.{name} assigns no IPv6 CIDR block and the estate associates none), and the drafted STACKIT network has none either, so the allow-all IPv6 egress rule STACKIT creates on every new group acts on no traffic, whatever IPv6 egress rules the source lists; if an IPv6 prefix is added to the network later, delete that rule (stackit security-group rule list, then delete with the security group id) or write the equivalent rules of the source: decide then","TL-f526766584fc":"the network of {subject}: no resource could be named, so the reference is not resolved","TL-f5563745ba53":"recorded: trace: TR-822b8a98ff0d","TL-f55858fd4118":"stackit_security_group.retail_app_ecs_carts_service_{name}: On STACKIT a security group belongs to a project, not to a network; the source's network membership is not carried.","TL-f575989be228":"capability: network.routing","TL-f5814e14d85c":"block in the draft: terraform/identity.tf:156-161","TL-f5f2bdee6019":"NOT CARRIED ({subject}): apply_immediately = true — when a change reaches the broker is not carried: Amazon MQ applies a change in the next maintenance window unless apply_immediately applies it at once, with a brief downtime as the broker reboots (aws provider 6.66.0, …","TL-f6130d78ba30":"claim: private-egress-ipv4 = KNOWN, CRITICAL, REVIEW","TL-f61ceb9cfdbd":"26 further statements that the source does not make (nothing to carry)","TL-f6e48092b146":"1 value that a variable or the instances decide","TL-f7605a58cf76":"the table of the association module.vpc.module.vpc.aws_route_table_association.{name}: no resource could be named, so the reference is not resolved","TL-f7daa124273c":"claim: network-settings = KNOWN, CRITICAL, REVIEW","TL-f7fc3a88733d":"STACKIT generates the password; the sensitive output dependencies_mq_rabbitmq_credential_password exposes it (a reference to this resource, never a value).","TL-f836b0fdd546":"claim: dns64 = KNOWN, CRITICAL, PRESERVED","TL-f84257ef3652":"the owner is a user with the login role only: STACKIT accepted that at create (observed on a STACKIT project on 2026-10-15), but its API does not show a database's owner (the database list returns options: null, reading one database is a 404), so whether the owner is applied in the database is …","TL-f847d01c9c7c":"19 left to a person to review","TL-f859c52cd624":"claim: drop-invalid-headers = KNOWN, CRITICAL, PRESERVED","TL-f86bdbb3af47":"NOT CARRIED (module.dependencies.module.orders_rds.aws_rds_cluster_instance.{name}): monitoring_role_arn — Enhanced Monitoring, Performance Insights and Database Insights have no stackit_postgresflex_instance attribute (pinned provider) — decide how the database is monitored.","TL-f8b0a06c08cf":"Role assignments of service account retail_app_ecs_orders_service_{name} (from the policies of {subject}); provider experiment \"iam\".","TL-f8e1ea4a0f12":"knowledge base case: aurora-postgres","TL-f90eecd227ee":"block in the draft: terraform/identity.tf:169-172","TL-f94aae57c6cb":"the platform agent's identity that starts the workload (it pulls images, injects secrets and writes logs): runs as module.retail_app_ecs.module.carts_service.aws_iam_role.task_execution_role (a role)","TL-f9607b378898":"ingress tcp port 6379 from a source that is not visible statically","TL-f9afe3060cd0":"recorded: rule line: rule aws.mq_broker/rabbitmq · KB 0.384.0 · target maturity GA · lifecycle active · mapping maturity beta · evidence internal · review required","TL-f9bb8b42afc0":"block in the draft: terraform/security.tf:202-205","TL-f9bd06a906cf":"Open: the name of {subject} is \"retail-store-ecs-{name}\": an SKE {name} name has 1 to 11 characters (lowercase letters, digits and hyphens) and is distinct in the draft (stackit-api-specifications ske/v2), so the draft names the {name} \"reta-7b7ce2\" — set the name …","TL-f9c365ffe93f":"the network of {subject}: refers to module.vpc.module.vpc.aws_vpc.this, named but not proven (an expression that selects one resource)","TL-f9c3c1e88738":"constraint relied on: default-egress-rules (DEFAULT_RULE, api:SecurityGroup.rules)","TL-f9f2ed7fc164":"residual: {subject} [group not produced]: source: an aws_security_group unit with 1 ingress, 0 egress and 0 other rules; target: no stackit_security_group and no rule is produced: every unit that names the group is a managed data service of STACKIT, and a STACKIT data service has no security group (the pinned provider schema has no attribute that names one) and takes its clients from an access list of its own: module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (stackit_opensearch_instance, access list parameters.sgw_acl). The group would be listed by no resource, so no stackit_security_group and no rule is drafted for it. What the group admitted reaches the access lists as addresses only, on the one endpoint port of the service: whether the clients of a rule are in the default of a list is stated on the block of the service (its DEFAULT line or its NOT CARRIED lines), and who may connect is the open decision EXPOSURE_WIDENED of the service; a rule whose clients no address names, or that reaches another port, is not carried. The egress rules of the group are about the outbound traffic of the instance itself, which a managed data service exposes no filter for: they are not carried","TL-f9f867eabdfb":"trace: TR-a2c77bb1d7ef","TL-f9fcf89a4351":"proof cause: not-a-reference at module.dependencies.module.orders_rds.aws_security_group_rule.default_ingress source_security_group_id","TL-fa1c8393519e":"TARGET MATURITY: EXPERIMENTAL — stackit_authorization_project_role_assignment is part of the experimental feature \"iam\" of the pinned STACKIT provider: \"likely going to undergo significant changes or be removed in the future\" (enabled in terraform.tf experiments).","TL-fa52c624b02d":"field: stackit_security_group.retail_app_ecs_ui_service_{name}.vpc_id = UNSUPPORTED: a STACKIT security group belongs to a project, not to a network: the resource has no network attribute, so the source's VPC membership is not carried","TL-facb23e1471b":"a step to the platform agent's identity that starts the workload (it pulls images, injects secrets and writes logs): refers to module.retail_app_ecs.module.orders_service.aws_iam_role.task_execution_role, proven by a direct reference","TL-fad2122c85a9":"3 not applicable here","TL-fae6d5a39721":"Retention: the source states no retention; the source then keeps its logs for ever","TL-fb283641d321":"source type: aws_iam_role","TL-fb91e685e455":"claim: facet-link-role = KNOWN, CRITICAL, NOT_APPLICABLE","TL-fc09cb714260":"the group of the rule resource module.dependencies.aws_security_group_rule.allow_https_from_client: refers to {subject}, proven by a direct reference","TL-fc0ec3bf809b":"trace: TR-74ede57c41f1","TL-fc76211e5aa7":"stackit_service_account.retail_app_ecs_checkout_service_{name}: written as an active resource (terraform/identity.tf, lines 123-126); the whole comment of the block is in engineering/trace/identity.md","TL-fc84ee1d9bf2":"intent: logs:{subject}","TL-fc8533223ee0":"claim: tc-subnet-enable-resource-name-dns-a-record-on-launch = KNOWN, CRITICAL, PRESERVED","TL-fd3d4c0f86ad":"recorded: trace: TR-e48f32c8ead8","TL-fd57920efaf7":"NOT CARRIED ({subject}): master_username = root — stackit_mariadb_credential takes no username: the username and the password are computed by STACKIT (pinned provider) — clients get new credentials.","TL-fd7f761fd278":"block in the draft: stackit_authorization_project_role_assignment.retail_app_ecs_ui_service_{name}","TL-fdd97dbd2829":"a step to the platform agent's identity that starts the workload (it pulls images, injects secrets and writes logs): refers to module.retail_app_ecs.module.ui_service.aws_iam_role.task_execution_role, proven by a direct reference","TL-fe449536e3d2":"and 10 further explanations of the values of the block; the trace file of the block holds all of them","TL-feaba4f52477":"4 kept as it is","TL-fed32ab36cf0":"check: attach-complete ok=true: 0 attachment block(s) written as resources, each with a project, a region, a server and a written account","TL-ff878e7837d7":"field: stackit_security_group.retail_app_ecs_orders_service_{name}.name_prefix = SAFE_OMISSION: NOT CARRIED when the source sets it: AWS makes a unique name from the prefix; the STACKIT group takes the name field (the source's name, or one derived from the address), and a name allows nothing (NON_CRITICAL)","TL-ff9188d1ca14":"NOT CARRIED ({subject}): db_subnet_group_name — stackit_postgresflex_instance has no subnet, availability-zone or IP-family attribute (pinned provider): clients reach the instance at the endpoint STACKIT assigns.","TL-ffb90f82ea67":"NOT CARRIED ({subject}): backup_retention_period = 7, preferred_backup_window = 02:00-03:00 — stackit_mariadb_instance has no backup setting (pinned provider).","TL-ffea000e11cd":"field: stackit_security_group.retail_app_ecs_catalog_service_{name}.stateful = SAFE_OMISSION: the source group is stateful (AWS tracks connections) and a STACKIT group created without stateful is stateful: the attribute is not written","TL-fffcb79b3f06":"constraint relied on: port-range-is-destination-port (SEMANTIC, stackit_security_group_rule.port_range)","TT-0263dd1d5363":"The source states 2 rules for this unit. 2 rules are stated exactly.","TT-0475c1513230":"This workload is not made of servers, so no service account is attached to it: the identities it names are stated as facts and left to a person.","TT-057cd0075aff":"5 references are resolved for this unit: 0 proven, 3 named but not proven, 2 not resolved. Only a proven reference selects a resource; the others stay open and are never guessed.","TT-078f3d301edb":"The unit stands for one log group and what the source states of it; the model says nothing about the target.","TT-09e44fcd9ff2":"The engine made no statement about this unit: no semantic contract is available for it.","TT-0a8ebf90122f":"The engine read 3 statements the source makes about this resource and decided what happens to each; 3 of them are critical settings, 3 of those still open.","TT-1110fbc911ec":"1 reference is resolved for this unit: 0 proven, 1 named but not proven. Only a proven reference selects a resource; the others stay open and are never guessed.","TT-1154e805410e":"The draft states, for this unit: 3 properties it does not carry, 2 findings, 3 open decisions of the converter. That is what the draft states, not a proof that the block and the source are equivalent.","TT-12a52cf74293":"The engine read 24 statements the source makes about this resource and decided what happens to each; 24 of them are critical settings, 20 of those still open.","TT-157dcc58b082":"The generator that writes this unit's block states, above the block, why its values are what they are. These are the generator's own statements in the draft, not checks of the draft.","TT-1600f1039cd4":"The target is the STACKIT routing table (stackit_routing_table and stackit_routing_table_route): a routing table of a Network Area and, separately, each of its routes.","TT-16134c43658f":"The draft states, for this unit: 1 property it does not carry, 2 open items. That is what the draft states, not a proof that the block and the source are equivalent.","TT-16c262c1abf7":"The draft states, for this unit: 1 property it does not carry, 1 finding. That is what the draft states, not a proof that the block and the source are equivalent.","TT-1d5e6f67637a":"The draft states, for this unit: 1 property it does not carry, 1 finding, 1 open item. That is what the draft states, not a proof that the block and the source are equivalent.","TT-1f41049665ca":"The engine read 1 statement the source makes about this log source and decided what happens to each; 1 of them are critical settings, 1 of those still open.","TT-203b3c44b616":"The draft states, for this unit: 3 properties it does not carry, 2 findings, 2 open decisions of the converter. That is what the draft states, not a proof that the block and the source are equivalent.","TT-2486dd6166e3":"The draft states, for this unit: 2 properties it does not carry, 1 finding, 1 open decision of the converter. That is what the draft states, not a proof that the block and the source are equivalent.","TT-28cf18b349f1":"1 reference is resolved for this unit: 0 proven, 1 not resolved. Only a proven reference selects a resource; the others stay open and are never guessed.","TT-29cd92e9c29b":"The draft holds 3 blocks for this unit, written as active Terraform.","TT-2c6efe20f724":"5 references are resolved for this unit: 1 proven, 1 named but not proven, 3 not resolved. Only a proven reference selects a resource; the others stay open and are never guessed.","TT-2eed2fdcdabc":"Every check over the draft of this unit was met. The plan also asks for 1 thing to be shown on STACKIT, which only a plan or apply there can do.","TT-307504e27a6c":"3 references are resolved for this unit: 0 proven, 1 named but not proven, 2 not resolved. Only a proven reference selects a resource; the others stay open and are never guessed.","TT-34a576f1b514":"The draft states, for this unit: 7 properties it does not carry, 3 findings, 1 open item, 3 open decisions of the converter. That is what the draft states, not a proof that the block and the source are equivalent.","TT-3921a774bd0d":"The target is the STACKIT security group (stackit_security_group and stackit_security_group_rule): a project-scoped group and, separately, each of its rules.","TT-3ae2580b0162":"The target is a STACKIT service account (stackit_service_account) attached to a server: a server takes one service account, and the account holds the roles the workload needs.","TT-3b5e65e15264":"The plan holds 1 group and 0 rules for this unit. Of their 12 fields: 2 carried exactly, 2 needing a value you supply, 7 left out on purpose, 1 without a STACKIT equivalent.","TT-3e30d829ac91":"The identity plan writes no STACKIT resource for this unit, so nothing is rendered from it. The blocks the draft holds for the workload itself are written by another generator, which records no plan.","TT-3e49a186cd7f":"2 references are resolved for this unit: 2 proven. Only a proven reference selects a resource; the others stay open and are never guessed.","TT-3fe35cb0b112":"The draft states, for this unit: 4 properties it does not carry, 1 open ledger row, 1 finding, 3 open items, 2 open decisions of the converter. That is what the draft states, not a proof that the block and the source are equivalent.","TT-41d8d4e38188":"The target is the STACKIT Logs instance (stackit_logs_instance): one instance for each retention period, because the retention is one setting of the instance.","TT-48469437839e":"The block stands for several units, so the generator's explanations of its values are not attributed to this unit; the trace file of the block holds them. These are the generator's own statements in the draft, not checks of the draft.","TT-48bf2e2fcef2":"The source states 2 rules for this unit. 1 rule is stated exactly; 1 has a value that is not visible statically and is never read as permissive.","TT-497b799e87f5":"The draft states, for this unit: 1 property it does not carry, 2 findings, 1 open item. That is what the draft states, not a proof that the block and the source are equivalent.","TT-4acac22c263b":"The source states the retention and 6 settings and parts of this log group.","TT-4d77dff3b0a8":"The draft states, for this unit: 8 properties it does not carry, 2 findings, 3 open decisions of the converter. That is what the draft states, not a proof that the block and the source are equivalent.","TT-52b420636513":"The engine read 4 statements the source makes about this group and decided what happens to each; 4 of them are critical settings, 4 of those still open.","TT-557f00fb0718":"The unit stands for one routing table with 1 static route and 1 attachment. The routes are read as AWS reads them: the most specific destination wins, and the network's own ranges are always reachable.","TT-55e837a80499":"3 references are resolved for this unit: 1 proven, 1 named but not proven, 1 not resolved. Only a proven reference selects a resource; the others stay open and are never guessed.","TT-5bd4122ee9c6":"The plan records 1 remaining difference between this unit and its STACKIT target. None is accepted yet.","TT-5cb9f071fb3a":"The unit stands for one routing table with 0 static routes and 0 attachments. The routes are read as AWS reads them: the most specific destination wins, and the network's own ranges are always reachable.","TT-5cd8347618b1":"The engine read 15 statements the source makes about this workload and decided what happens to each; 15 of them are critical settings, 15 of those still open.","TT-5ef6ab8adb80":"The draft states, for this unit: 11 properties it does not carry, 1 open ledger row, 6 findings, 2 open decisions of the converter. That is what the draft states, not a proof that the block and the source are equivalent.","TT-5ff6734b3839":"The engine read 14 statements the source makes about this resource and decided what happens to each; 14 of them are critical settings, 14 of those still open.","TT-63fa53d1e665":"No reference to another resource has to be resolved for this unit: the model reads the settings of the unit and of the streams and filters that belong to it.","TT-661d402aa522":"The source states the retention and 0 settings and parts of this log group.","TT-6a07761f0aee":"The draft writes no resource for this unit, so the checks over the draft compared nothing of it.","TT-6bc754902840":"The engine read 10 statements the source makes about this group and decided what happens to each; 9 of them are critical settings, 9 of those still open.","TT-6c7a4aac6c88":"The source states 1 rule for this unit. 0 rules are stated exactly; 1 rule names a security group that is not proven.","TT-6ee5af4c829c":"The draft states, for this unit: 3 properties it does not carry, 4 findings, 2 open items. That is what the draft states, not a proof that the block and the source are equivalent.","TT-6f83b385fe74":"The plan holds 1 group and 1 rule for this unit. Of their 19 fields: 7 carried exactly, 3 needing a value you supply, 8 left out on purpose, 1 without a STACKIT equivalent.","TT-7128875253f6":"The plan records no remaining difference between this unit and its STACKIT target. That is what the plan states, not a proof that the two are equivalent.","TT-722f9eb3a9f2":"The unit stands for 1 security group with 0 rules in all. The policy is read as AWS reads it: groups are stateful, so the answer to an allowed flow is allowed too.","TT-772b328040bb":"The generator that writes this unit's block states, above the block, why its values are what they are and which source attribute each setting is written from. These are the generator's own statements in the draft, not checks of the draft.","TT-7d4d2bc1d7f5":"The identity plan writes no resource for this unit, so the checks over the identity part of the draft compared nothing of it.","TT-7f623649c3bf":"The engine read 14 statements the source makes about this resource and decided what happens to each; 14 of them are critical settings, 12 of those still open.","TT-86e01f7c90fe":"The engine read 11 statements the source makes about this resource and decided what happens to each; 11 of them are critical settings, 6 of those still open.","TT-87d27e00854a":"The engine read 8 statements the source makes about this group and decided what happens to each; 8 of them are critical settings, 8 of those still open.","TT-8a7c11272ea8":"The plan records 3 remaining differences between this unit and its STACKIT target. None is accepted yet.","TT-906c4459ecba":"The source makes no statement about this resource that is carried anywhere.","TT-92cc4e7d95d8":"The engine read 2 statements the source makes about this resource and decided what happens to each; 2 of them are critical settings, 2 of those still open.","TT-94ce5f17da1a":"The plan records 7 remaining differences between this unit and its STACKIT target. None is accepted yet.","TT-959c48ef01bf":"The draft states, for this unit: 1 property it does not carry, 1 finding, 1 open decision of the converter. That is what the draft states, not a proof that the block and the source are equivalent.","TT-980cbdfba22b":"The engine read 8 statements the source makes about this resource and decided what happens to each; 7 of them are critical settings, 7 of those still open.","TT-9dcba97134cc":"No STACKIT resource is planned for this unit: STACKIT's default routing replaces it (observed for a project outside a Network Area), but the NAT gateway's fixed egress address is lost - the network leaves by its project's shared address, which is not fixed - so an architect decides how an allow-list on that address is kept.","TT-9e42df036afd":"The draft states, for this unit: 3 properties it does not carry, 3 findings, 2 open items, 1 open decision of the converter. That is what the draft states, not a proof that the block and the source are equivalent.","TT-a174ac90c814":"The plan holds 1 Logs instance for this unit. Of their 5 fields: 2 carried exactly, 1 needing a value you supply, 1 needing a manual action, 1 without a STACKIT equivalent.","TT-a3b301ee2f73":"The engine read 1 statement the source makes about this resource and decided what happens to each; 1 of them are critical settings, 1 of those still open.","TT-a49c64dea1a4":"The engine read 19 statements the source makes about this resource and decided what happens to each; 18 of them are critical settings, 11 of those still open.","TT-a61797f03d0d":"The plan holds 1 group and 0 rules for this unit. Of their 11 fields: 1 carried exactly, 2 needing a value you supply, 7 left out on purpose, 1 without a STACKIT equivalent.","TT-ab5aa9dd429f":"The engine read 9 statements the source makes about this resource and decided what happens to each; 9 of them are critical settings, 5 of those still open.","TT-ae8e73203e01":"The engine read 7 statements the source makes about this resource and decided what happens to each; 7 of them are critical settings, 6 of those still open.","TT-af554fedc610":"The engine read 8 statements the source makes about this routing table and decided what happens to each; 8 of them are critical settings, 5 of those still open.","TT-bb60e90a49bc":"The plan records 2 remaining differences between this unit and its STACKIT target. None is accepted yet.","TT-c093d281e9b6":"No STACKIT resource is planned for this unit: the source creates no instance of it, switches it off, or states a destination that STACKIT Logs does not take, so nothing is drafted.","TT-c5508c270aa7":"The draft holds 2 blocks for this unit, written as active Terraform.","TT-cffaa762f020":"The unit stands for 1 security group with 2 rules in all. The policy is read as AWS reads it: groups are stateful, so the answer to an allowed flow is allowed too.","TT-d130b98cad63":"The draft holds 1 block for this unit, written as active Terraform.","TT-d43161aa7b39":"The engine read 6 statements the source makes about this resource and decided what happens to each; 6 of them are critical settings, 5 of those still open.","TT-d654b6ebf000":"The draft writes no STACKIT resource for this unit, so nothing is rendered for it.","TT-d8ff8e19cb07":"The engine read 25 statements the source makes about this resource and decided what happens to each; 25 of them are critical settings, 16 of those still open.","TT-dcac5ec2521c":"The engine read 12 statements the source makes about this resource and decided what happens to each; 12 of them are critical settings, 11 of those still open.","TT-dcf856f90df6":"No STACKIT resource is planned for this unit: STACKIT's default routing replaces it (observed on a routed network of a project outside a Network Area; the default table of a Network Area was never read) or the source creates no instance of it, so nothing is drafted.","TT-de6015241030":"The engine read 7 statements the source makes about this group and decided what happens to each; 7 of them are critical settings, 7 of those still open.","TT-e72b9c31a2bd":"The draft states, for this unit: 1 property it does not carry, 3 findings, 1 open item. That is what the draft states, not a proof that the block and the source are equivalent.","TT-e7ee3a947433":"The source states 1 static route for this unit. 1 route is stated exactly.","TT-f02f3db4ed00":"The draft states, for this unit: 3 properties it does not carry, 1 finding, 1 open decision of the converter. That is what the draft states, not a proof that the block and the source are equivalent.","TT-f0a8d4e9043a":"The engine read 16 statements the source makes about this workload and decided what happens to each; 16 of them are critical settings, 16 of those still open.","TT-f47803034718":"The unit stands for 1 security group with 1 rule in all. The policy is read as AWS reads it: groups are stateful, so the answer to an allowed flow is allowed too.","TT-f6447023ae07":"The engine read 11 statements the source makes about this routing table and decided what happens to each; 11 of them are critical settings, 9 of those still open.","TT-fa16fbf56fab":"The source states the retention and 1 setting or part of this log group.","TT-fc0024522eee":"No STACKIT service account is attached to this workload: it is not made of servers (the draft writes service accounts for servers, and the identity of a container, a function or a cluster is stated as a fact), or the source does not decide which identity it runs as, so nothing is attached and a person decides.","TT-ffa2d19dc7f9":"No STACKIT resource is planned for this unit: the source creates no instance of it, so nothing is drafted."}}