{"schema_version":"0.24.0","producer":{"tool":"stacktoit","version":"0.6.0-13076-ga19ea28c64","commit":"a19ea28c64","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","stackit_provider":"0.121.0"},"run":{"run_id":"6f8f72b2-1c34-4cfc-8483-344c41245364","source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000"},"generated_at":"2026-11-07T04:24:17Z","source":"gcp-candidates/terraform-dynamic-python-webapp/infra","summary":{"files":18,"resources":37,"units":11,"instances":11,"unknown_count":5,"disabled":0,"presence":{"known_present":11,"conditional":5,"absent":0,"uncertain_facets":0,"instances_known":11,"instances_open":5,"units_with_conditional_facets":0,"conditional_by_state":{"present_on_defaults":5,"disabled_on_defaults_but_overridable":0,"runtime_data_unknown":0,"variable_unknown":0,"undecided_other_cause":0}},"conditional_units":[{"id":"google_cloudbuild_trigger.activategcb","source_type":"google_cloudbuild_trigger","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.init ? 1 : 0","variables":["var.init"]},"would_be_class":"REDESIGN","would_be_confidence":"MEDIUM","target":"a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD","state":"PRESENT_ON_DEFAULTS","state_inputs":["var.init"],"overridden_by":["-var-file","-var","TF_VAR_init"]},{"id":"google_cloudbuild_trigger.init","source_type":"google_cloudbuild_trigger","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.init ? 1 : 0","variables":["var.init"]},"would_be_class":"REDESIGN","would_be_confidence":"LOW","target":"a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD","state":"PRESENT_ON_DEFAULTS","state_inputs":["var.init"],"overridden_by":["-var-file","-var","TF_VAR_init"]},{"id":"google_cloudbuild_trigger.placeholder","source_type":"google_cloudbuild_trigger","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.init ? 1 : 0","variables":["var.init"]},"would_be_class":"REDESIGN","would_be_confidence":"LOW","target":"a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD","state":"PRESENT_ON_DEFAULTS","state_inputs":["var.init"],"overridden_by":["-var-file","-var","TF_VAR_init"]},{"id":"google_firebase_hosting_site.client","source_type":"google_firebase_hosting_site","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.random_suffix ? 1 : 0","variables":["var.random_suffix"]},"would_be_class":"REDESIGN","would_be_confidence":"LOW","target":"STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain","depended_on_by":["google_cloudbuild_trigger.init","google_cloudbuild_trigger.placeholder"],"state":"PRESENT_ON_DEFAULTS","state_inputs":["var.random_suffix"],"overridden_by":["-var-file","-var","TF_VAR_random_suffix"]},{"id":"google_service_account.init","source_type":"google_service_account","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.init ? 1 : 0","variables":["var.init"]},"would_be_class":"RECONFIGURE","would_be_confidence":"MEDIUM","target":"STACKIT service account","depended_on_by":["google_cloudbuild_trigger.activategcb","google_cloudbuild_trigger.init","google_cloudbuild_trigger.placeholder"],"state":"PRESENT_ON_DEFAULTS","state_inputs":["var.init"],"overridden_by":["-var-file","-var","TF_VAR_init"]}],"module_rollups":[{"address":"module.project_services","source":"terraform-google-modules/project-factory/google//modules/project_services","source_kind":"other","version_constraint":"18.0.0","version_resolved":"18.0.0","dir":".terraform/modules/project_services/modules/project_services","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","resources":3,"support":3,"by_presence":{"known_present":0,"conditional":0,"absent":0,"uncertain_facets":0},"units":0,"by_class":{},"by_confidence":{},"production_eligible":0,"automation_eligible":0}],"dependencies":29,"by_class":{"CONTAINERIZE":2,"MANUAL_REVIEW":1,"RECONFIGURE":6,"REPLATFORM":2},"by_confidence":{"LOW":1,"MEDIUM":10},"source_status":"RUNTIME_TOPOLOGY_PARTIAL","source_gaps":["RUNTIME_TOPOLOGY_PARTIAL"],"source_status_reason":"5 unit(s) have a count/for_each that is not known statically; whether and how often they exist is decided at plan time","source_validation":{"status":"SOURCE_VALID","validated_by":["BUILT_IN_CHECKS"],"checks":[{"id":"hcl-syntax","status":"OK"},{"id":"declarations","status":"OK"},{"id":"files-read","status":"OK"},{"id":"module-sources","status":"OK"},{"id":"inputs","status":"OK"},{"id":"loader-warnings","status":"OK"}],"native":{"status":"NOT_RUN","reason":"LOCK_FILE","engine":"OpenTofu","engine_version":"1.13.1","platform":"darwin_arm64","snapshot_id":"keyed-sha256:27f08efd6a6c8c2594e03248cad2d4ef49a03efdd16289e514ae03524eefd07d","input_digest":"keyed-sha256:dbf59e851d17338634de35dfc0b41dfe977e6f6d36aa0b55e2ac6cc365a2aec6"}},"support":{"nodes":13,"tooling":5,"generated_secrets":["random_password.database_user_password","random_password.django_admin_password","random_password.django_secret_key"],"accounted":6,"critical_open":20},"property_accounting":{"units":11,"units_not_generated":5,"units_with_unaccounted":0,"set":79,"excluded":10,"excluded_by":{"facet-link":8,"google-labels":2},"meaningful":69,"by_status":{"CONSUMED":5,"CONTRACT":20,"NOT_CARRIED":40,"PLACEMENT":4,"RELATION":0,"UNACCOUNTED":0},"by_source_type":{"google_cloud_run_v2_job":{"nodes":1,"meaningful":13,"unaccounted":0},"google_cloud_run_v2_service":{"nodes":1,"meaningful":17,"unaccounted":0},"google_pubsub_topic":{"nodes":1,"meaningful":1,"unaccounted":0},"google_secret_manager_secret":{"nodes":2,"meaningful":4,"unaccounted":0},"google_secret_manager_secret_iam_binding":{"nodes":2,"meaningful":4,"unaccounted":0},"google_secret_manager_secret_version":{"nodes":2,"meaningful":2,"unaccounted":0},"google_service_account":{"nodes":4,"meaningful":8,"unaccounted":0},"google_sql_database":{"nodes":1,"meaningful":2,"unaccounted":0},"google_sql_database_instance":{"nodes":1,"meaningful":7,"unaccounted":0},"google_sql_user":{"nodes":1,"meaningful":3,"unaccounted":0},"google_storage_bucket":{"nodes":1,"meaningful":4,"unaccounted":0},"google_storage_bucket_iam_member":{"nodes":2,"meaningful":4,"unaccounted":0}},"top_unaccounted":[]},"root_issues":[{"id":"source-provider-unverified:google","check_id":"source-provider-unverified","impact":"ROOT_BLOCKER","severity":"warning","provider":"google","message":"no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint \"\u003e= 6, \u003c 8\" excludes it (pinned 8.4.0). Affects 16 units (confidence at most MEDIUM).","affected_units":16}]},"units":[{"id":"google_firebase_project.default","source_type":"google_firebase_project","category":"platform","kind":"app_platform_project","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","configuration_completeness":"COMPLETE","wave":1,"provenance":{"file":"firebase.tf","line":17,"end_line":22},"result":{"rule_id":"gcp.firebase_project","case_id":"app-platform-project","class":"MANUAL_REVIEW","confidence":"LOW","reason":"The enabling of Firebase on a Google Cloud project. Once Firebase has been added to a project it cannot be removed from it. Firebase is Google's backend platform for mobile and web apps. A Firebase project and the registration of an Android or Apple app in it hold the identity of the app (package name or bundle id, signing hashes, team id) and the API key through which the app reaches Firebase services. STACKIT has no mobile or web application backend platform: none of the 115 resource types of the pinned STACKIT provider is one (0 hits for firebase in resource names, descriptions and attributes, checked 2026-11-05), and the product list at docs.stackit.cloud/products/ (read 2026-11-05) names none. The registration itself therefore has nothing to move to; a person decides, app by app, which backend replaces the Firebase services the app uses.","review":["List the Firebase services each app uses (authentication, database, storage, messaging, remote config); each needs its own replacement.","The signing keys and store listings stay with Google Play and the Apple App Store; only the backend the app talks to moves."],"evidence":["https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/firebase_project","https://docs.stackit.cloud/products/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/"],"validated_against":"terraform-provider-stackit@0.121.0 (provider schema: none of its 115 resource types is a mobile or web application backend platform; 0 hits for firebase in resource names, descriptions and attributes, checked 2026-11-05); docs.stackit.cloud product list read 2026-11-05 (nearest: Kubernetes Engine and the managed databases (the parts a replacement backend is built from)); hashicorp/google 8.4.0 schema and docs of the type","findings":[{"check_id":"source-provider-unverified","severity":"warning","message":"root: source-provider-unverified:google","root":"source-provider-unverified:google","impact":"PROPAGATED_IMPACT"}],"lifecycle":"internal","production_eligible":false,"semantics":{"contract":"gcp.firebase_project","expected":2,"observed":2,"accounted":2,"unaccounted":0,"critical_unaccounted":[],"critical_open":["tc-firebase-project-project"],"items":[{"id":"migration-decision","critical":false,"observed":"yes","disposition":"REVIEW","by":"case:app-platform-project"},{"id":"tc-firebase-project-project","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:app-platform-project"}]},"axes":{"feasibility":"UNKNOWN","motion":"","change_types":[],"blocker_categories":["UNKNOWN"],"target_platform":"","confidence":"LOW"}},"property_accounting":{"set":0,"excluded":0,"meaningful":0,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":0,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"critical":[{"node":"google_firebase_project.default","attribute":"project","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"gcp.firebase_project/tc-firebase-project-project:REVIEW"}],"automation_eligible":false,"gate_blockers":[{"source_type":"google_firebase_project","attribute":"project","closure":"CLOSED:REVIEW"},{"source_type":"google_firebase_project","closure":"NOT_AUTOMATABLE_CLASS:MANUAL_REVIEW"},{"target":"provider:google","closure":"PROVIDER:UNVERIFIED"}],"unit_class":"MANUAL_REVIEW"}},{"id":"google_pubsub_topic.faux","source_type":"google_pubsub_topic","category":"messaging","kind":"topic","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","configuration_completeness":"COMPLETE","wave":1,"provenance":{"file":"postdeployment.tf","line":32,"end_line":34},"result":{"rule_id":"gcp.pubsub_topic","case_id":"pubsub","class":"REPLATFORM","confidence":"MEDIUM","target":{"service":"STACKIT RabbitMQ","resources":["stackit_rabbitmq_instance","stackit_rabbitmq_credential"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): rabbitmq lists 15 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): rabbitmq lists 15 offerings"}]},"reason":"A topic maps to a RabbitMQ exchange and each subscription to a bound queue. Publishers and subscribers switch from the Pub/Sub client to AMQP; acknowledgement deadlines, retries and dead-letter topics map to acknowledgements, requeueing and dead-letter exchanges. STACKIT also publishes a PubSub API (beta) with topics and pull subscriptions, for which the STACKIT provider has no resource: the draft states it as the candidate beside the RabbitMQ instance, behind the opt-in of the beta API, as calls of the execution plan, and what the API has no field for (push delivery, filters, dead-letter topics, ordering, a customer-managed key) is a step of its own. The RabbitMQ instance is the path carried out until that opt-in is accepted; accepting it makes PubSub the target of the topic instead, never both.","evidence":["https://docs.stackit.cloud/products/messaging/rabbitmq/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/rabbitmq_instance","https://github.com/stackitcloud/stackit-api-specifications/tree/main/services/pubsub/v1beta"],"validated_against":"terraform-provider-stackit@0.116.0; docs messaging/rabbitmq 2026-09-23; STACKIT catalogue eu01 2026-09-24 (RabbitMQ 4.1); checked 2026-11-05: the pinned provider schema 0.121.0 holds no pubsub resource (0 hits), stackit-api-specifications services/pubsub holds v1alpha and v1beta (the repository embeds v1beta in data/stackit/api-specs/pubsub_v1beta.json: topics, pull subscriptions, publishers and subscribers; no push, filter, dead-letter, ordering or encryption field)","findings":[{"check_id":"source-provider-unverified","severity":"warning","message":"root: source-provider-unverified:google","root":"source-provider-unverified:google","impact":"PROPAGATED_IMPACT"}],"lifecycle":"internal","production_eligible":false,"semantics":{"contract":"gcp.pubsub_topic","expected":48,"observed":2,"accounted":2,"unaccounted":0,"critical_unaccounted":[],"critical_open":["tc-name"],"items":[{"id":"facet-delivery-deadline","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"facet-delivery-retry-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"push-oidc-token-audience","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"push-oidc-token-service-account","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"project-residency","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"messaging-model","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:pubsub"},{"id":"ordering-exactly-once","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"message-retention","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"customer-managed-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"subscription-filter","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"push-delivery","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"export-subscriptions","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"dead-lettering","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"storage-regions","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"storage-and-subscription-settings","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"topic-iam-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"topic-iam-project","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"subscription-iam-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"kms-key-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingestion-sources","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"transforms-and-transit","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingestion-source-selection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingestion-format-selection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingestion-text-delimiter","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"topic-schema-validation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"topic-message-transforms","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"subscription-bigquery-representation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"subscription-storage-format","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"subscription-avro-options","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"subscription-destination","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"subscription-push-wire-format","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"subscription-push-metadata-headers","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"subscription-message-transforms","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-pubsub-subscription--deletion-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-pubsub-subscription--message-transforms--ai-inference--service-account-email","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-pubsub-subscription--tags","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-pubsub-subscription--bigquery-config--service-account-email","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-pubsub-subscription--cloud-storage-config--service-account-email","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-pubsub-subscription-iam-binding--condition--expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-pubsub-subscription-iam-member--condition--expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-pubsub-topic-iam-binding--condition--expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-pubsub-topic-iam-member--condition--expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:pubsub"},{"id":"tcf-pubsub-subscription--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-pubsub-subscription--enable-exactly-once-delivery","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-pubsub-subscription--enable-message-ordering","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-kms-crypto-key--name","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REPLATFORM","change_types":["CONFIG"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"STACKIT RabbitMQ","confidence":"MEDIUM"}},"property_accounting":{"set":1,"excluded":0,"meaningful":1,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":1,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"google_pubsub_topic.faux","attribute":"name"}],"class_counts":{"CRITICAL":1},"critical":[{"node":"google_pubsub_topic.faux","attribute":"name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_pubsub_topic.faux): name — the topic becomes an exchange and its subscriptions queues of the shared RabbitMQ instance, created in RabbitMQ by hand (not by this draft): names, delivery, retention and push settings are not generated. (contract gcp.pubsub_topic/tc-name:REVIEW)"}],"automation_eligible":false,"gate_blockers":[{"source_type":"google_pubsub_topic","attribute":"name","closure":"CLOSED:NC+REVIEW"},{"target":"provider:google","closure":"PROVIDER:UNVERIFIED"}]}},{"id":"google_service_account.automation","source_type":"google_service_account","category":"identity","kind":"workload_identity","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","configuration_completeness":"COMPLETE","wave":1,"provenance":{"file":"iam.tf","line":54,"end_line":58},"result":{"rule_id":"gcp.service_account","case_id":"service-account","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT service account","resources":["stackit_service_account","stackit_authorization_project_role_assignment","stackit_authorization_folder_role_assignment","stackit_authorization_organization_role_assignment","stackit_authorization_service_account_role_assignment"],"maturity":"experimental","lifecycle":"active"},"reason":"A Google service account becomes a STACKIT service account named after its account ID (shortened to the STACKIT name rules, so its e-mail address changes and every reference to it is updated). What the account may do is what the IAM resources of the estate grant it, and the draft carries that where it can show the mapping: a grant to the account on a project, a folder or an organisation becomes a STACKIT role assignment of the account. The role is written as it is only where the Google role has a STACKIT role with the same permissions or fewer on a project; every other role is an input without a default that names the candidates and how they differ, because a wider role is never a default. A grant that lets another account act as this one becomes an Act-As assignment. Grants that cannot be written are listed in the draft with the reason: a condition (a STACKIT role assignment has none), a policy document, a repeated grant, a role or a member that is not visible statically, and a member that is a person, a group or the identity of a Kubernetes workload. An additive grant (a member) adds one member and removes none, as a role assignment does; a binding or a policy removes every member of its role that it does not list, a role assignment never removes anyone, and the draft marks each such grant. The workloads that ran as the account are not attached to it by this block; workloads that got credentials from the metadata server or GKE Workload Identity need explicit STACKIT credentials or a federated identity. Keys are never carried.","evidence":["https://docs.stackit.cloud/platform/resource-manager/basics/access-control/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"],"validated_against":"terraform-provider-stackit@0.116.0 (authorization_*_role_assignment requires experiment iam)","findings":[{"check_id":"sa-account-id-not-visible","severity":"info","message":"The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"]},{"check_id":"source-provider-unverified","severity":"warning","message":"root: source-provider-unverified:google","root":"source-provider-unverified:google","impact":"PROPAGATED_IMPACT"}],"lifecycle":"internal","production_eligible":false,"semantics":{"contract":"gcp.service_account","expected":12,"observed":3,"accounted":3,"unaccounted":0,"critical_unaccounted":[],"critical_open":["role-bindings","account-name"],"items":[{"id":"project-residency","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"workload-identity","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:service-account"},{"id":"long-lived-keys","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"role-bindings","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:service-account"},{"id":"disabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"account-name","critical":true,"observed":"unknown","disposition":"REVIEW","by":"check:sa-account-id-not-visible"},{"id":"deletion-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--deletion-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--key-algorithm","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--private-key-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--public-key-data","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--public-key-type","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT service account","confidence":"MEDIUM"}},"property_accounting":{"set":2,"excluded":0,"meaningful":2,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"google_service_account.automation","attribute":"account_id"},{"node":"google_service_account.automation","attribute":"display_name"}],"class_counts":{"CRITICAL":1,"NON_CRITICAL":1},"critical":[{"node":"google_service_account.automation","attribute":"account_id","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_service_account.automation): account_id — the account ID is not visible statically, or the account is declared several times: the STACKIT account is named after the source address. (contract gcp.service_account/account-name:REVIEW)"}],"automation_eligible":false,"open_critical_without_read_set":["role-bindings"],"gate_blockers":[{"source_type":"google_service_account","attribute":"account_id","closure":"CLOSED:NC+REVIEW"},{"target":"type:stackit_authorization_folder_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"type:stackit_authorization_organization_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"type:stackit_authorization_project_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"type:stackit_authorization_service_account_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"provider:google","closure":"PROVIDER:UNVERIFIED"},{"semantic":"role-bindings","closure":"open-critical-without-read-set"}]}},{"id":"google_service_account.client","source_type":"google_service_account","category":"identity","kind":"workload_identity","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","configuration_completeness":"COMPLETE","wave":1,"provenance":{"file":"iam.tf","line":48,"end_line":52},"result":{"rule_id":"gcp.service_account","case_id":"service-account","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT service account","resources":["stackit_service_account","stackit_authorization_project_role_assignment","stackit_authorization_folder_role_assignment","stackit_authorization_organization_role_assignment","stackit_authorization_service_account_role_assignment"],"maturity":"experimental","lifecycle":"active"},"reason":"A Google service account becomes a STACKIT service account named after its account ID (shortened to the STACKIT name rules, so its e-mail address changes and every reference to it is updated). What the account may do is what the IAM resources of the estate grant it, and the draft carries that where it can show the mapping: a grant to the account on a project, a folder or an organisation becomes a STACKIT role assignment of the account. The role is written as it is only where the Google role has a STACKIT role with the same permissions or fewer on a project; every other role is an input without a default that names the candidates and how they differ, because a wider role is never a default. A grant that lets another account act as this one becomes an Act-As assignment. Grants that cannot be written are listed in the draft with the reason: a condition (a STACKIT role assignment has none), a policy document, a repeated grant, a role or a member that is not visible statically, and a member that is a person, a group or the identity of a Kubernetes workload. An additive grant (a member) adds one member and removes none, as a role assignment does; a binding or a policy removes every member of its role that it does not list, a role assignment never removes anyone, and the draft marks each such grant. The workloads that ran as the account are not attached to it by this block; workloads that got credentials from the metadata server or GKE Workload Identity need explicit STACKIT credentials or a federated identity. Keys are never carried.","evidence":["https://docs.stackit.cloud/platform/resource-manager/basics/access-control/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"],"validated_against":"terraform-provider-stackit@0.116.0 (authorization_*_role_assignment requires experiment iam)","findings":[{"check_id":"sa-account-id-not-visible","severity":"info","message":"The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"]},{"check_id":"source-provider-unverified","severity":"warning","message":"root: source-provider-unverified:google","root":"source-provider-unverified:google","impact":"PROPAGATED_IMPACT"}],"lifecycle":"internal","production_eligible":false,"semantics":{"contract":"gcp.service_account","expected":12,"observed":3,"accounted":3,"unaccounted":0,"critical_unaccounted":[],"critical_open":["role-bindings","account-name"],"items":[{"id":"project-residency","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"workload-identity","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:service-account"},{"id":"long-lived-keys","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"role-bindings","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:service-account"},{"id":"disabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"account-name","critical":true,"observed":"unknown","disposition":"REVIEW","by":"check:sa-account-id-not-visible"},{"id":"deletion-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--deletion-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--key-algorithm","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--private-key-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--public-key-data","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--public-key-type","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT service account","confidence":"MEDIUM"}},"property_accounting":{"set":2,"excluded":0,"meaningful":2,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"google_service_account.client","attribute":"account_id"},{"node":"google_service_account.client","attribute":"display_name"}],"class_counts":{"CRITICAL":1,"NON_CRITICAL":1},"critical":[{"node":"google_service_account.client","attribute":"account_id","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_service_account.client): account_id — the account ID is not visible statically, or the account is declared several times: the STACKIT account is named after the source address. (contract gcp.service_account/account-name:REVIEW)"}],"automation_eligible":false,"open_critical_without_read_set":["role-bindings"],"gate_blockers":[{"source_type":"google_service_account","attribute":"account_id","closure":"CLOSED:NC+REVIEW"},{"target":"type:stackit_authorization_folder_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"type:stackit_authorization_organization_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"type:stackit_authorization_project_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"type:stackit_authorization_service_account_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"provider:google","closure":"PROVIDER:UNVERIFIED"},{"semantic":"role-bindings","closure":"open-critical-without-read-set"}]}},{"id":"google_service_account.server","source_type":"google_service_account","category":"identity","kind":"workload_identity","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","configuration_completeness":"COMPLETE","wave":1,"provenance":{"file":"iam.tf","line":42,"end_line":46},"result":{"rule_id":"gcp.service_account","case_id":"service-account","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT service account","resources":["stackit_service_account","stackit_authorization_project_role_assignment","stackit_authorization_folder_role_assignment","stackit_authorization_organization_role_assignment","stackit_authorization_service_account_role_assignment"],"maturity":"experimental","lifecycle":"active"},"reason":"A Google service account becomes a STACKIT service account named after its account ID (shortened to the STACKIT name rules, so its e-mail address changes and every reference to it is updated). What the account may do is what the IAM resources of the estate grant it, and the draft carries that where it can show the mapping: a grant to the account on a project, a folder or an organisation becomes a STACKIT role assignment of the account. The role is written as it is only where the Google role has a STACKIT role with the same permissions or fewer on a project; every other role is an input without a default that names the candidates and how they differ, because a wider role is never a default. A grant that lets another account act as this one becomes an Act-As assignment. Grants that cannot be written are listed in the draft with the reason: a condition (a STACKIT role assignment has none), a policy document, a repeated grant, a role or a member that is not visible statically, and a member that is a person, a group or the identity of a Kubernetes workload. An additive grant (a member) adds one member and removes none, as a role assignment does; a binding or a policy removes every member of its role that it does not list, a role assignment never removes anyone, and the draft marks each such grant. The workloads that ran as the account are not attached to it by this block; workloads that got credentials from the metadata server or GKE Workload Identity need explicit STACKIT credentials or a federated identity. Keys are never carried.","evidence":["https://docs.stackit.cloud/platform/resource-manager/basics/access-control/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"],"validated_against":"terraform-provider-stackit@0.116.0 (authorization_*_role_assignment requires experiment iam)","findings":[{"check_id":"sa-account-id-not-visible","severity":"info","message":"The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"]},{"check_id":"source-provider-unverified","severity":"warning","message":"root: source-provider-unverified:google","root":"source-provider-unverified:google","impact":"PROPAGATED_IMPACT"}],"lifecycle":"internal","production_eligible":false,"semantics":{"contract":"gcp.service_account","expected":12,"observed":3,"accounted":3,"unaccounted":0,"critical_unaccounted":[],"critical_open":["role-bindings","account-name"],"items":[{"id":"project-residency","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"workload-identity","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:service-account"},{"id":"long-lived-keys","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"role-bindings","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:service-account"},{"id":"disabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"account-name","critical":true,"observed":"unknown","disposition":"REVIEW","by":"check:sa-account-id-not-visible"},{"id":"deletion-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--deletion-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--key-algorithm","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--private-key-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--public-key-data","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--public-key-type","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT service account","confidence":"MEDIUM"}},"property_accounting":{"set":2,"excluded":0,"meaningful":2,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"google_service_account.server","attribute":"account_id"},{"node":"google_service_account.server","attribute":"display_name"}],"class_counts":{"CRITICAL":1,"NON_CRITICAL":1},"critical":[{"node":"google_service_account.server","attribute":"account_id","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_service_account.server): account_id — the account ID is not visible statically, or the account is declared several times: the STACKIT account is named after the source address. (contract gcp.service_account/account-name:REVIEW)"}],"automation_eligible":false,"open_critical_without_read_set":["role-bindings"],"gate_blockers":[{"source_type":"google_service_account","attribute":"account_id","closure":"CLOSED:NC+REVIEW"},{"target":"type:stackit_authorization_folder_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"type:stackit_authorization_organization_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"type:stackit_authorization_project_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"type:stackit_authorization_service_account_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"provider:google","closure":"PROVIDER:UNVERIFIED"},{"semantic":"role-bindings","closure":"open-critical-without-read-set"}]}},{"id":"google_sql_database_instance.postgres","source_type":"google_sql_database_instance","category":"data","kind":"relational_database","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","facets":["google_sql_database.database","google_sql_user.django"],"configuration_completeness":"COMPLETE","wave":1,"provenance":{"file":"database.tf","line":25,"end_line":38},"result":{"rule_id":"gcp.sql_instance","case_id":"sql-postgres","class":"REPLATFORM","confidence":"MEDIUM","target":{"service":"STACKIT PostgreSQL Flex","resources":["stackit_postgresflex_instance","stackit_postgresflex_database","stackit_postgresflex_user"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): postgresflex lists 23 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): postgresflex lists 9 offerings"}]},"reason":"Managed PostgreSQL to managed PostgreSQL: data moves with pg_dump/pg_restore or logical replication, the tier becomes a Flex flavor, and authorized networks / private IP become the instance ACL.","evidence":["https://docs.stackit.cloud/products/databases/postgresql-flex/","https://docs.stackit.cloud/products/databases/mariadb/","https://docs.stackit.cloud/products/databases/sqlserver-flex/reference/supported-and-unsupported-features-in-sqlserver-flex/"],"validated_against":"terraform-provider-stackit@0.116.0; docs postgresql-flex/mariadb/sqlserver-flex 2026-09-23; sql-deletion-protection re-checked 2026-10-07 against provider schema 0.117.0 (stackit_postgresflex_instance / stackit_sqlserverflex_instance: no protection attribute), the postgres-flex / sqlserverflex v3 API specs (POST .../protections isDeletable) and the PostgreSQL Flex instance-protection docs","findings":[{"check_id":"sql-pg-version-supported","severity":"info","message":"The PostgreSQL major version is one PostgreSQL Flex offers (14–18).","evidence":["https://docs.stackit.cloud/products/databases/postgresql-flex/"]},{"check_id":"sql-user-not-generated","severity":"info","message":"Not verifiable statically (name of facet `google_sql_user.django` not visible): A database user is an IAM user (or its name or type is not visible statically); the draft generates password users only — create the others as password users after review.","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/postgresflex_user"]},{"check_id":"source-provider-unverified","severity":"warning","message":"root: source-provider-unverified:google","root":"source-provider-unverified:google","impact":"PROPAGATED_IMPACT"}],"lifecycle":"internal","production_eligible":false,"semantics":{"contract":"gcp.sql_instance","expected":71,"observed":11,"accounted":11,"unaccounted":0,"critical_unaccounted":[],"critical_open":["database-users","user-and-database-settings","region-residency","project-scope","tcfp-sql-user--name","tc-name","tcf-sql-database--name"],"items":[{"id":"replica-connection-retry","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"engine","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:sql-postgres"},{"id":"engine-version","critical":true,"observed":"yes","disposition":"PRESERVED","by":"check:sql-pg-version-supported"},{"id":"backup-retention","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"point-in-time-recovery","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"high-availability","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"network-exposure","critical":true,"observed":"yes","disposition":"LEDGER","by":"ledger:network exposure"},{"id":"customer-managed-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-authentication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-protection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"terraform-destroy-guard","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"terraform-destroy-guard-off","critical":true,"observed":"yes","disposition":"PRESERVED","by":"case:sql-postgres"},{"id":"tls-enforcement","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"read-replica","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"database-flags","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"private-connectivity","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"authorized-network-names","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"server-certificate","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"backup-location","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"backup-on-delete","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"activation-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"connector-enforcement","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"database-users","critical":true,"observed":"unknown","disposition":"REVIEW","by":"unverified-check:sql-user-not-generated"},{"id":"user-and-database-settings","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sql-postgres"},{"id":"client-certificates","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"root-and-password-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"replica-failover-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"private-network-unset","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"server-certificate-sans-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"replica-failover-target-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"region-residency","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sql-postgres"},{"id":"project-scope","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sql-postgres"},{"id":"create-from-source","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"directory-authentication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"private-service-connect","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"sql-server-audit","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"engine-tuning-without-counterpart","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"final-backup","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"placement-and-failover","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"server-certificate-rotation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"external-primary-replication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"primary-not-replica","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"instance-type-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"activation-policy-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"availability-type-other","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"backup-retention-unit-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"backup-location-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"connector-enforcement-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"allocated-ip-range-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"authorized-network-name-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"server-ca-mode-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"server-ca-pool-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ssl-mode-other","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-sql-user--database-roles","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-sql-user--password-policy--allowed-failed-attempts","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-sql-user--password-policy--enable-failed-attempts-check","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-sql-user--password-policy--enable-password-verification","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-sql-user--password-policy--password-expiration-duration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-sql-user--password-wo","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-settings--ip-configuration--authorized-networks--expiration-time","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-sql-user--name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sql-postgres","withdrawn_by":["database-users"]},{"id":"tcfp-sql-user--type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-maintenance-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sql-postgres"},{"id":"tcf-sql-database--name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:sql-postgres"},{"id":"facet-sql-provision-script-database","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"facet-sql-provision-script-deletion-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"facet-sql-provision-script-secret","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"facet-sql-provision-script-project","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"facet-sql-provision-script-script","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"facet-sql-provision-script-user","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REPLATFORM","change_types":["CONFIG","DATA"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"STACKIT PostgreSQL Flex","confidence":"MEDIUM"}},"property_accounting":{"set":14,"excluded":2,"meaningful":12,"by_status":{"CONSUMED":1,"CONTRACT":3,"NOT_CARRIED":6,"PLACEMENT":2,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"google_sql_database_instance.postgres","attribute":"settings.user_labels"},{"node":"google_sql_database.database","attribute":"deletion_policy"},{"node":"google_sql_database.database","attribute":"name"},{"node":"google_sql_user.django","attribute":"deletion_policy"},{"node":"google_sql_user.django","attribute":"name"},{"node":"google_sql_user.django","attribute":"password"}],"class_counts":{"CRITICAL":10,"NON_CRITICAL":2},"critical":[{"node":"google_sql_database_instance.postgres","attribute":"name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"gcp.sql_instance/tc-name:REVIEW"},{"node":"google_sql_database_instance.postgres","attribute":"project","class":"CRITICAL","category":"identity-access","closure":"OPEN:placement-only","by":"google-project-region"},{"node":"google_sql_database_instance.postgres","attribute":"region","class":"CRITICAL","category":"residency-compliance","closure":"OPEN:placement-only","by":"google-project-region"},{"node":"google_sql_database.database","attribute":"deletion_policy","class":"CRITICAL","category":"deletion-protection","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_sql_database.database): deletion_policy — stackit_postgresflex_database is deleted directly (pinned provider): ABANDON (keep the Cloud SQL database, drop it from state only) has no counterpart. (contract gcp.sql_instance/user-and-database-settings:REVIEW)"},{"node":"google_sql_database.database","attribute":"name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_sql_database.database): name — a database name (or the number of databases) is not visible statically: create that database with stackit_postgresflex_database. (contract gcp.sql_instance/tcf-sql-database--name:REVIEW)"},{"node":"google_sql_user.django","attribute":"deletion_policy","class":"CRITICAL","category":"deletion-protection","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_sql_user.django): deletion_policy — stackit_postgresflex_user is deleted directly (pinned provider): ABANDON (keep the Cloud SQL user, drop it from state only) has no counterpart. (contract gcp.sql_instance/user-and-database-settings:REVIEW)"},{"node":"google_sql_user.django","attribute":"name","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_sql_user.django): name — a user name is not visible statically: create that user with stackit_postgresflex_user. (contract gcp.sql_instance/database-users:REVIEW)"},{"node":"google_sql_user.django","attribute":"password","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_sql_user.django): password — the source password is not copied: STACKIT generates the user's password (stackit_postgresflex_user.password is computed, pinned provider) — hand the new one to the application. (contract gcp.sql_instance/user-and-database-settings:REVIEW)"}],"automation_eligible":false,"gate_blockers":[{"source_type":"google_sql_database","attribute":"deletion_policy","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_sql_database","attribute":"name","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_sql_user","attribute":"deletion_policy","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_sql_user","attribute":"name","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_sql_user","attribute":"password","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_sql_database_instance","attribute":"name","closure":"CLOSED:REVIEW"},{"source_type":"google_sql_database_instance","semantic":"convert:google_sql_database_instance.postgres:data:DATA_MOVEMENT","closure":"CONVERT:open-decision"},{"source_type":"google_sql_database_instance","attribute":"project","closure":"OPEN:placement-only"},{"source_type":"google_sql_database_instance","attribute":"region","closure":"OPEN:placement-only"},{"target":"provider:google","closure":"PROVIDER:UNVERIFIED"}]}},{"id":"google_secret_manager_secret.django_admin_password","source_type":"google_secret_manager_secret","category":"identity","kind":"secret","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","facets":["google_secret_manager_secret_iam_binding.django_admin_password","google_secret_manager_secret_version.django_admin_password"],"configuration_completeness":"COMPLETE","depends_on":["google_service_account.automation"],"wave":2,"provenance":{"file":"secrets.tf","line":25,"end_line":37},"result":{"rule_id":"gcp.secret","case_id":"secret","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT Secrets Manager","resources":["stackit_secretsmanager_instance","stackit_secretsmanager_user"],"maturity":"ga","lifecycle":"active"},"reason":"Secrets move to STACKIT Secrets Manager (a Vault-compatible KV store). Applications switch from the Secret Manager client to a Vault client or to injection by the platform (e.g. External Secrets Operator on SKE); IAM accessors become Secrets Manager users (read-only or read-write for the whole instance) or, narrower and experimental, role bindings on a secret group.","evidence":["https://docs.stackit.cloud/products/security/secrets-manager/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/secretsmanager_instance"],"validated_against":"terraform-provider-stackit@0.116.0; docs security/secrets-manager 2026-09-23","findings":[{"check_id":"secret-iam-access","severity":"warning","message":"The secret has grants for individual principals. Access on STACKIT Secrets Manager is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for the whole secrets engine of its instance, with no scope to one secret or path. Narrower access exists only as role bindings on the instance or on a secret group (a named list of secrets) in the alpha API of the service, and the pinned provider offers them as resources of its experimental IAM feature (stackit_secretsmanager_instance_role_binding_v1 and stackit_secretsmanager_secret_group_role_binding_v1), which its documentation says may change or be removed; the specification does not list the roles a secret group accepts. A grant of one Google principal on one secret therefore cannot be carried one to one: decide per principal whether it gets a user of the whole instance, a role binding on a secret group of the secrets it may read, or a separate Secrets Manager instance.","evidence":["https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/secrets-manager/v1/secrets-manager.json","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/secrets-manager/v1alpha/secrets-manager.json","https://registry.terraform.io/providers/stackitcloud/stackit/0.121.0/docs/resources/secretsmanager_user","https://registry.terraform.io/providers/stackitcloud/stackit/0.121.0/docs/resources/secretsmanager_secret_group_role_binding_v1","https://registry.terraform.io/providers/stackitcloud/stackit/0.121.0/docs/resources/secretsmanager_instance_role_binding_v1"],"blocker_category":"IDENTITY"},{"check_id":"source-provider-unverified","severity":"warning","message":"root: source-provider-unverified:google","root":"source-provider-unverified:google","impact":"PROPAGATED_IMPACT"}],"lifecycle":"internal","production_eligible":false,"semantics":{"contract":"gcp.secret","expected":18,"observed":4,"accounted":4,"unaccounted":0,"critical_unaccounted":[],"critical_open":["secret-value","secret-settings","tcr-secret-id"],"items":[{"id":"secret-manager-secret-deletion-protection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"secret-values","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:secret"},{"id":"customer-managed-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cmek-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"replication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rotation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"expiry","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"secret-value","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:secret"},{"id":"secret-settings","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:secret"},{"id":"secret-iam-project","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-deletion-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-deletion-protection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-topics--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secret-manager-secret-iam-binding--condition--expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secret-manager-secret-iam-member--condition--expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secret-manager-secret-version--secret-data-wo","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-version-aliases","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcr-secret-id","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:secret"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT Secrets Manager","confidence":"MEDIUM"}},"property_accounting":{"set":7,"excluded":2,"meaningful":5,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":5,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"google_secret_manager_secret.django_admin_password","attribute":"replication.user_managed.replicas.location"},{"node":"google_secret_manager_secret.django_admin_password","attribute":"secret_id"},{"node":"google_secret_manager_secret_iam_binding.django_admin_password","attribute":"members"},{"node":"google_secret_manager_secret_iam_binding.django_admin_password","attribute":"role"},{"node":"google_secret_manager_secret_version.django_admin_password","attribute":"secret_data"}],"class_counts":{"CRITICAL":5},"critical":[{"node":"google_secret_manager_secret.django_admin_password","attribute":"replication.user_managed.replicas.location","class":"CRITICAL","category":"residency-compliance","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_secret_manager_secret.django_admin_password): replication, secret_id — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied. (contract gcp.secret/secret-settings:REVIEW)"},{"node":"google_secret_manager_secret.django_admin_password","attribute":"secret_id","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_secret_manager_secret.django_admin_password): replication, secret_id — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied. (contract gcp.secret/tcr-secret-id:REVIEW)"},{"node":"google_secret_manager_secret_iam_binding.django_admin_password","attribute":"members","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_secret_manager_secret_iam_binding.django_admin_password): members, role = roles/secretmanager.secretAccessor — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied. Proposed, switched off until it is decided: proposals/proposal_django_admin_password, switch proposal_django_admin_password_enabled. (contract gcp.secret/secret-settings:REVIEW)"},{"node":"google_secret_manager_secret_iam_binding.django_admin_password","attribute":"role","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_secret_manager_secret_iam_binding.django_admin_password): members, role = roles/secretmanager.secretAccessor — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied. Proposed, switched off until it is decided: proposals/proposal_django_admin_password, switch proposal_django_admin_password_enabled. (contract gcp.secret/secret-settings:REVIEW)"},{"node":"google_secret_manager_secret_version.django_admin_password","attribute":"secret_data","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_secret_manager_secret_version.django_admin_password): secret_data — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied. (contract gcp.secret/secret-value:REVIEW)"}],"automation_eligible":false,"gate_blockers":[{"source_type":"google_secret_manager_secret","attribute":"replication.user_managed.replicas.location","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_secret_manager_secret","attribute":"secret_id","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_secret_manager_secret_iam_binding","attribute":"members","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_secret_manager_secret_iam_binding","attribute":"role","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_secret_manager_secret_version","attribute":"secret_data","closure":"CLOSED:NC+REVIEW"},{"target":"provider:google","closure":"PROVIDER:UNVERIFIED"}]}},{"id":"google_storage_bucket.media","source_type":"google_storage_bucket","category":"storage","kind":"object_bucket","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","facets":["google_storage_bucket_iam_member.automation","google_storage_bucket_iam_member.server"],"configuration_completeness":"COMPLETE","depends_on":["google_service_account.automation","google_service_account.server"],"wave":2,"provenance":{"file":"storage.tf","line":17,"end_line":25},"result":{"rule_id":"gcp.storage_bucket","case_id":"gcs","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT Object Storage","resources":["stackit_objectstorage_bucket","stackit_objectstorage_credentials_group","stackit_objectstorage_credential"],"maturity":"ga","lifecycle":"active"},"reason":"A bucket maps to a STACKIT Object Storage bucket. Clients already using the S3-compatible XML API with HMAC keys only change endpoint and keys; clients using the Google Cloud Storage libraries (JSON API) switch to an S3 SDK. Data is copied with rclone.","review":["Find which applications use the Google client libraries or signed URLs — those need a code change."],"evidence":["https://docs.stackit.cloud/products/storage/object-storage/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/objectstorage_bucket","https://docs.cloud.google.com/storage/docs/interoperability"],"validated_against":"terraform-provider-stackit@0.116.0; docs object-storage 2026-09-23 (S3-compatible, object lock since 2026-04); GCS XML API interoperability; docs object-storage supported operations and bucket policies 2026-09-27","findings":[{"check_id":"gcs-iam","severity":"info","message":"Bucket access is granted with IAM bindings or ACL entries; on STACKIT it becomes bucket policies and Object Storage credentials."},{"check_id":"gcs-public","severity":"info","message":"Not verifiable statically (member of facet `google_storage_bucket_iam_member.automation`, member of facet `google_storage_bucket_iam_member.server` not visible): The bucket is readable by anyone (allUsers or allAuthenticatedUsers). STACKIT Object Storage expresses this as a bucket policy (documented sample: \"Effect\": \"Allow\", \"Principal\": \"*\", \"Action\": \"s3:GetObject\" on the bucket's objects); \"*\" is anonymous access, which also covers allAuthenticatedUsers. Re-create it only if still intended, or serve the content through the CDN.","evidence":["https://docs.stackit.cloud/products/storage/object-storage/how-tos/manage-bucket-policies/","https://docs.stackit.cloud/products/storage/object-storage/reference/supported-permissions-in-bucket-policies/"]},{"check_id":"gcs-force-destroy","severity":"warning","message":"force_destroy lets Terraform delete the bucket together with its objects. STACKIT has no such override: stackit_objectstorage_bucket (the pinned STACKIT provider) \"cannot be destroyed if the bucket contains objects\" — empty the bucket (or migrate its objects) before destroying it.","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/objectstorage_bucket"]},{"check_id":"source-provider-unverified","severity":"warning","message":"root: source-provider-unverified:google","root":"source-provider-unverified:google","impact":"PROPAGATED_IMPACT"}],"lifecycle":"internal","production_eligible":false,"semantics":{"contract":"gcp.storage_bucket","expected":63,"observed":7,"accounted":7,"unaccounted":0,"critical_unaccounted":[],"critical_open":["geo-replication","bucket-region","iam-access","iam-grant","public-access","force-destroy","tc-storage-bucket-name"],"items":[{"id":"facet-storage-bucket-acl-identity-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"facet-storage-bucket-acl-network-exposure","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"facet-storage-bucket-acl-deletion-protection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"project-residency","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"geo-replication","critical":true,"observed":"unknown","disposition":"REVIEW","by":"variable-default:case:gcs"},{"id":"bucket-region","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:gcs"},{"id":"customer-managed-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"encryption-enforcement","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"versioning","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"versioning-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"soft-delete","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"soft-delete-off","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"retention-lock","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"notifications","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-access","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:gcs-iam"},{"id":"notification-config","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-grant","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:gcs-iam"},{"id":"iam-policy-data","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"acl-deletion-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"acl-grant","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"public-access","critical":true,"observed":"unknown","disposition":"REVIEW","by":"unverified-check:gcs-public"},{"id":"website","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"access-logging","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"storage-classes","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"lifecycle","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cors","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"force-destroy","critical":true,"observed":"yes","disposition":"UNSUPPORTED","by":"check:gcs-force-destroy"},{"id":"uniform-access","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"public-access-prevention","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"default-event-based-hold","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"turbo-replication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"public-access-prevention-other","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"kms-key-empty","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"custom-dual-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ip-filter","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"object-retention","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"retention-policy-lock","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-storage-bucket-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:gcs"},{"id":"tcf-kms-crypto-key--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"default-object-access-control-entity","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"default-object-access-control-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"default-object-access-control-object","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"default-object-access-control-delete-guard","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"object-access-control-entity","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"object-access-control-role","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"object-access-control-object","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"object-access-control-delete-guard","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"object-acl-role-entity","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"object-acl-object","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"object-acl-predefined-acl","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"object-acl-delete-guard","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"folder-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"folder-force-destroy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"folder-delete-guard","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"managed-folder-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"managed-folder-force-destroy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"managed-folder-delete-guard","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"anywhere-cache-zone","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"anywhere-cache-delete-guard","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"neighbour-transfer-job","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"neighbour-batch-operations-job","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"neighbour-insights-report-config","critical":true,"observed":"no","disposition":"NOT_STATED"}],"default_variables":{"geo-replication":["region"]}},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG","DATA"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"STACKIT Object Storage","confidence":"MEDIUM"}},"property_accounting":{"set":11,"excluded":3,"meaningful":8,"by_status":{"CONSUMED":0,"CONTRACT":2,"NOT_CARRIED":6,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"google_storage_bucket.media","attribute":"force_destroy"},{"node":"google_storage_bucket.media","attribute":"storage_class"},{"node":"google_storage_bucket_iam_member.automation","attribute":"member"},{"node":"google_storage_bucket_iam_member.automation","attribute":"role"},{"node":"google_storage_bucket_iam_member.server","attribute":"member"},{"node":"google_storage_bucket_iam_member.server","attribute":"role"}],"class_counts":{"CRITICAL":7,"NON_CRITICAL":1},"critical":[{"node":"google_storage_bucket.media","attribute":"force_destroy","class":"CRITICAL","category":"deletion-protection","closure":"CLOSED:NC+UNSUPPORTED","by":"NOT CARRIED (google_storage_bucket.media): force_destroy = true — stackit_objectstorage_bucket has no force-destroy override (pinned provider): deleting a bucket that still holds objects behaves as STACKIT's Object Storage API defines it — empty the bucket (or migrate its objects) before it is destroyed. (contract gcp.storage_bucket/force-destroy:UNSUPPORTED)"},{"node":"google_storage_bucket.media","attribute":"location","class":"CRITICAL","category":"residency-compliance","closure":"CLOSED:REVIEW","by":"gcp.storage_bucket/bucket-region:REVIEW"},{"node":"google_storage_bucket.media","attribute":"name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"gcp.storage_bucket/tc-storage-bucket-name:REVIEW"},{"node":"google_storage_bucket_iam_member.automation","attribute":"member","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_storage_bucket_iam_member.automation): member, role = roles/storage.admin — the draft of google_storage_bucket.media does not carry this one member's role on the Cloud Storage bucket. Proposed, switched off until it is decided: proposals/proposal_automation, switch proposal_automation_enabled. (contract gcp.storage_bucket/iam-grant:REVIEW)"},{"node":"google_storage_bucket_iam_member.automation","attribute":"role","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_storage_bucket_iam_member.automation): member, role = roles/storage.admin — the draft of google_storage_bucket.media does not carry this one member's role on the Cloud Storage bucket. Proposed, switched off until it is decided: proposals/proposal_automation, switch proposal_automation_enabled. (contract gcp.storage_bucket/iam-grant:REVIEW)"},{"node":"google_storage_bucket_iam_member.server","attribute":"member","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_storage_bucket_iam_member.server): member, role = roles/storage.admin — the draft of google_storage_bucket.media does not carry this one member's role on the Cloud Storage bucket. Proposed, switched off until it is decided: proposals/proposal_server, switch proposal_server_enabled. (contract gcp.storage_bucket/iam-grant:REVIEW)"},{"node":"google_storage_bucket_iam_member.server","attribute":"role","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_storage_bucket_iam_member.server): member, role = roles/storage.admin — the draft of google_storage_bucket.media does not carry this one member's role on the Cloud Storage bucket. Proposed, switched off until it is decided: proposals/proposal_server, switch proposal_server_enabled. (contract gcp.storage_bucket/iam-grant:REVIEW)"}],"automation_eligible":false,"gate_blockers":[{"source_type":"google_storage_bucket_iam_member","attribute":"member","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_storage_bucket_iam_member","attribute":"role","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_storage_bucket","attribute":"force_destroy","closure":"CLOSED:NC+UNSUPPORTED"},{"source_type":"google_storage_bucket","attribute":"location","closure":"CLOSED:REVIEW"},{"source_type":"google_storage_bucket","attribute":"name","closure":"CLOSED:REVIEW"},{"target":"provider:google","closure":"PROVIDER:UNVERIFIED"}]}},{"id":"google_secret_manager_secret.django_settings","source_type":"google_secret_manager_secret","category":"identity","kind":"secret","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","facets":["google_secret_manager_secret_iam_binding.django_settings","google_secret_manager_secret_version.django_settings"],"configuration_completeness":"COMPLETE","depends_on":["google_service_account.automation","google_service_account.server","google_sql_database_instance.postgres","google_storage_bucket.media"],"wave":3,"provenance":{"file":"secrets.tf","line":56,"end_line":68},"result":{"rule_id":"gcp.secret","case_id":"secret","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT Secrets Manager","resources":["stackit_secretsmanager_instance","stackit_secretsmanager_user"],"maturity":"ga","lifecycle":"active"},"reason":"Secrets move to STACKIT Secrets Manager (a Vault-compatible KV store). Applications switch from the Secret Manager client to a Vault client or to injection by the platform (e.g. External Secrets Operator on SKE); IAM accessors become Secrets Manager users (read-only or read-write for the whole instance) or, narrower and experimental, role bindings on a secret group.","evidence":["https://docs.stackit.cloud/products/security/secrets-manager/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/secretsmanager_instance"],"validated_against":"terraform-provider-stackit@0.116.0; docs security/secrets-manager 2026-09-23","findings":[{"check_id":"secret-iam-access","severity":"warning","message":"The secret has grants for individual principals. Access on STACKIT Secrets Manager is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for the whole secrets engine of its instance, with no scope to one secret or path. Narrower access exists only as role bindings on the instance or on a secret group (a named list of secrets) in the alpha API of the service, and the pinned provider offers them as resources of its experimental IAM feature (stackit_secretsmanager_instance_role_binding_v1 and stackit_secretsmanager_secret_group_role_binding_v1), which its documentation says may change or be removed; the specification does not list the roles a secret group accepts. A grant of one Google principal on one secret therefore cannot be carried one to one: decide per principal whether it gets a user of the whole instance, a role binding on a secret group of the secrets it may read, or a separate Secrets Manager instance.","evidence":["https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/secrets-manager/v1/secrets-manager.json","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/secrets-manager/v1alpha/secrets-manager.json","https://registry.terraform.io/providers/stackitcloud/stackit/0.121.0/docs/resources/secretsmanager_user","https://registry.terraform.io/providers/stackitcloud/stackit/0.121.0/docs/resources/secretsmanager_secret_group_role_binding_v1","https://registry.terraform.io/providers/stackitcloud/stackit/0.121.0/docs/resources/secretsmanager_instance_role_binding_v1"],"blocker_category":"IDENTITY"},{"check_id":"source-provider-unverified","severity":"warning","message":"root: source-provider-unverified:google","root":"source-provider-unverified:google","impact":"PROPAGATED_IMPACT"}],"lifecycle":"internal","production_eligible":false,"semantics":{"contract":"gcp.secret","expected":18,"observed":4,"accounted":4,"unaccounted":0,"critical_unaccounted":[],"critical_open":["secret-value","secret-settings","tcr-secret-id"],"items":[{"id":"secret-manager-secret-deletion-protection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"secret-values","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:secret"},{"id":"customer-managed-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cmek-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"replication","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"rotation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"expiry","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"secret-value","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:secret"},{"id":"secret-settings","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:secret"},{"id":"secret-iam-project","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-deletion-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-deletion-protection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-topics--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secret-manager-secret-iam-binding--condition--expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secret-manager-secret-iam-member--condition--expression","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-secret-manager-secret-version--secret-data-wo","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-version-aliases","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcr-secret-id","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:secret"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT Secrets Manager","confidence":"MEDIUM"}},"property_accounting":{"set":7,"excluded":2,"meaningful":5,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":5,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"google_secret_manager_secret.django_settings","attribute":"replication.user_managed.replicas.location"},{"node":"google_secret_manager_secret.django_settings","attribute":"secret_id"},{"node":"google_secret_manager_secret_iam_binding.django_settings","attribute":"members"},{"node":"google_secret_manager_secret_iam_binding.django_settings","attribute":"role"},{"node":"google_secret_manager_secret_version.django_settings","attribute":"secret_data"}],"class_counts":{"CRITICAL":5},"critical":[{"node":"google_secret_manager_secret.django_settings","attribute":"replication.user_managed.replicas.location","class":"CRITICAL","category":"residency-compliance","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_secret_manager_secret.django_settings): replication, secret_id — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied. (contract gcp.secret/secret-settings:REVIEW)"},{"node":"google_secret_manager_secret.django_settings","attribute":"secret_id","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_secret_manager_secret.django_settings): replication, secret_id — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied. (contract gcp.secret/tcr-secret-id:REVIEW)"},{"node":"google_secret_manager_secret_iam_binding.django_settings","attribute":"members","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_secret_manager_secret_iam_binding.django_settings): members, role = roles/secretmanager.secretAccessor — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied. Proposed, switched off until it is decided: proposals/proposal_django_settings, switch proposal_django_settings_enabled. (contract gcp.secret/secret-settings:REVIEW)"},{"node":"google_secret_manager_secret_iam_binding.django_settings","attribute":"role","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_secret_manager_secret_iam_binding.django_settings): members, role = roles/secretmanager.secretAccessor — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied. Proposed, switched off until it is decided: proposals/proposal_django_settings, switch proposal_django_settings_enabled. (contract gcp.secret/secret-settings:REVIEW)"},{"node":"google_secret_manager_secret_version.django_settings","attribute":"secret_data","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_secret_manager_secret_version.django_settings): secret_data — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied. (contract gcp.secret/secret-value:REVIEW)"}],"automation_eligible":false,"gate_blockers":[{"source_type":"google_secret_manager_secret","attribute":"replication.user_managed.replicas.location","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_secret_manager_secret","attribute":"secret_id","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_secret_manager_secret_iam_binding","attribute":"members","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_secret_manager_secret_iam_binding","attribute":"role","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_secret_manager_secret_version","attribute":"secret_data","closure":"CLOSED:NC+REVIEW"},{"target":"provider:google","closure":"PROVIDER:UNVERIFIED"}]}},{"id":"google_cloud_run_v2_job.migrate","source_type":"google_cloud_run_v2_job","category":"compute","kind":"container_job","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","configuration_completeness":"COMPLETE","depends_on":["google_secret_manager_secret.django_settings","google_service_account.automation","google_sql_database_instance.postgres"],"wave":4,"provenance":{"file":"jobs.tf","line":18,"end_line":57},"result":{"rule_id":"gcp.cloud_run","case_id":"run-job","class":"CONTAINERIZE","confidence":"MEDIUM","target":{"service":"Kubernetes Job/CronJob on SKE","resources":["stackit_ske_cluster"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): ske lists 161 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): ske lists 77 offerings"}]},"reason":"The job already runs a container image; it becomes a Kubernetes Job on SKE (kubernetes/\u003cjob\u003e/manifests.yaml). A Cloud Run job runs only when it is executed, so the Job is written suspended and runs when it is unsuspended; its tasks, parallelism and retries become the completions, parallelism and backoff limit of the Job, and what starts the job today (a scheduler, a workflow, a person) starts the Job or a CronJob instead.","evidence":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/","https://docs.stackit.cloud/products/runtime/cloud-foundry/"],"validated_against":"STACKIT product catalogue 2026-09-23 (no managed serverless container platform); terraform-provider-google 8.4.0 (worker_pool added DA4W-UNCLS3-GCP, 2026-09-29)","findings":[{"check_id":"run-min-zero","severity":"info","message":"The service can scale to zero; on SKE at least one replica runs unless an autoscaler with scale-to-zero (KEDA/Knative) is installed."},{"check_id":"run-unsupported-volume","severity":"warning","message":"A container mounts a Cloud SQL connection, a Cloud Storage bucket (through Cloud Storage FUSE) or an NFS share. The draft writes no volume for these and holds the pods until a person decides: connect to the migrated database or object store over the network instead of the mount, or mount a share or a volume of the cluster yourself.","evidence":["https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service"],"blocker_category":"FEATURE"},{"check_id":"source-provider-unverified","severity":"warning","message":"root: source-provider-unverified:google","root":"source-provider-unverified:google","impact":"PROPAGATED_IMPACT"}],"lifecycle":"internal","production_eligible":false,"semantics":{"contract":"gcp.cloud_run","expected":131,"observed":12,"accounted":12,"unaccounted":0,"critical_unaccounted":[],"critical_open":["cloud-run-v2-job-network-exposure","deployment-artifact","entry-point","k4-cloud-run-volume-mount-cloud-run-v2-job","location-residency","secrets","service-identity","tc-cloud-run-v2-job-name","tc-cloud-run-v2-job-template--template--containers--env--name","tc-cloud-run-v2-job-template--template--volumes--name","terraform-destroy-guard"],"items":[{"id":"session-affinity-and-sticky-cookie","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"delivery-retry-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"request-rate-and-concurrency-cap","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"probe-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-request-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"k4-cloud-run-volume-mount-cloud-run-v2-worker-pool","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"k4-cloud-run-volume-mount-cloud-run-v2-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"k4-cloud-run-volume-mount-cloud-run-v2-job","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-job"},{"id":"k4-cloud-run-volume-mount-cloud-run-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cloud-run-v2-job-network-exposure","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-job"},{"id":"probe-initial-delay-job","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"probe-initial-delay-v2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"probe-initial-delay-v1","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"container-port-h2c","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"container-image","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:run-job"},{"id":"ingress-restriction","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-invocation","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"public-invocation","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-policy-grant","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"job-iam-binding","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"customer-managed-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"multi-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"scale-to-zero","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"terraform-destroy-guard","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-job"},{"id":"iap","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-identity","critical":true,"observed":"unknown","disposition":"LEDGER","by":"ledger:workload identity"},{"id":"environment","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"secrets","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-job"},{"id":"run-service-secret-volume-files","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"run-job-secret-volume-files","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"run-v1-service-secret-volume-files","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cloud-sql-connection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"gpu","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"revision-annotations","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"job-secret-volumes","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-open","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"invoker-iam-setting","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"location-residency","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-job"},{"id":"project-residency","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"wc-cloud-run-v2-job-template-template-node-selector-accelerator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"wc-cloud-run-v2-service-template-node-selector-accelerator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"wc-cloud-run-v2-worker-pool-template-node-selector-accelerator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-binary-authorization--breakglass-justification","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-binary-authorization--policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-binary-authorization--use-default","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-tags","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-binary-authorization--breakglass-justification","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-binary-authorization--policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-binary-authorization--use-default","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-build-config--environment-variables","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-build-config--service-account","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-build-config--worker-pool","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-custom-audiences","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-default-uri-disabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-tags","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-binary-authorization--breakglass-justification","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-binary-authorization--policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-binary-authorization--use-default","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--spec--containers--env-from--secret-ref--local-object-reference--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--spec--containers--sandbox-launcher","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--spec--volumes--csi--read-only","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--spec--volumes--csi--volume-attributes","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--spec--volumes--nfs--path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--spec--volumes--nfs--read-only","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--spec--volumes--nfs--server","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--containers--sandbox-launcher","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--gpu-zonal-redundancy-disabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--volumes--gcs--bucket","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--volumes--gcs--read-only","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--volumes--nfs--path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--volumes--nfs--read-only","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--volumes--nfs--server","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--vpc-access--connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--vpc-access--network-interfaces--tags","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-multi-region-settings--regions","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--containers--sandbox-launcher","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--health-check-disabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--sandboxes--templates--env--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--service-mesh--mesh","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--volumes--gcs--bucket","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--volumes--gcs--read-only","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--volumes--nfs--path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--volumes--nfs--read-only","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--volumes--nfs--server","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--workload-identity-config--identity","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--workload-identity-config--identity-certificate-enabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--workload-identity-config--identity-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--client","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--client-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--containers--sandbox-launcher","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--encryption-key-revocation-action","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--encryption-key-shutdown-duration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--revision","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--volumes--gcs--bucket","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--volumes--gcs--read-only","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--volumes--nfs--path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--volumes--nfs--read-only","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--volumes--nfs--server","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-v2-worker-pool-template--containers--env--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-v2-worker-pool-template--encryption-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-v2-worker-pool-template--service-account","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-v2-worker-pool-template--volumes--cloud-sql-instance--instances","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-v2-worker-pool-template--vpc-access--connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-v2-worker-pool-template--vpc-access--egress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-v2-worker-pool-template--vpc-access--network-interfaces--tags","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-v2-worker-pool-template--vpc-access--network-interfaces--network","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-v2-worker-pool-template--vpc-access--network-interfaces--subnetwork","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--metadata--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--spec--containers--env--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--spec--containers--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-job"},{"id":"tc-cloud-run-v2-job-template--template--containers--env--name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-job"},{"id":"tc-cloud-run-v2-job-template--template--containers--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--volumes--name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-job"},{"id":"tc-cloud-run-v2-service-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--revision","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--volumes--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--volumes--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--volumes--secret--items--path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--volumes--secret--items--path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--volumes--secret--items--path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-kms-crypto-key--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-service-template--spec--containers--ports--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-v2-service-template--containers--ports--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"g8-build-updates","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deployment-artifact","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-job"},{"id":"entry-point","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-job"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REPLATFORM","change_types":["CODE","CONFIG"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"Kubernetes Job/CronJob on SKE","confidence":"MEDIUM"}},"property_accounting":{"set":14,"excluded":1,"meaningful":13,"by_status":{"CONSUMED":1,"CONTRACT":8,"NOT_CARRIED":3,"PLACEMENT":1,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"google_cloud_run_v2_job.migrate","attribute":"deletion_protection"},{"node":"google_cloud_run_v2_job.migrate","attribute":"template.template.service_account"},{"node":"google_cloud_run_v2_job.migrate","attribute":"template.template.volumes.cloud_sql_instance.instances"}],"class_counts":{"CRITICAL":12,"NON_CRITICAL":1},"critical":[{"node":"google_cloud_run_v2_job.migrate","attribute":"deletion_protection","class":"CRITICAL","category":"deletion-protection","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_cloud_run_v2_job.migrate): deletion_protection = false — deletion protection is a Google API guard against deleting the resource; the manifests carry no such guard — protect the workload with the access rules of the namespace. (contract gcp.cloud_run/terraform-destroy-guard:REVIEW)"},{"node":"google_cloud_run_v2_job.migrate","attribute":"location","class":"CRITICAL","category":"residency-compliance","closure":"OPEN:placement-only","by":"google-location"},{"node":"google_cloud_run_v2_job.migrate","attribute":"name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"gcp.cloud_run/tc-cloud-run-v2-job-name:REVIEW"},{"node":"google_cloud_run_v2_job.migrate","attribute":"template.template.containers.command","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"gcp.cloud_run/entry-point:REVIEW"},{"node":"google_cloud_run_v2_job.migrate","attribute":"template.template.containers.env.name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"gcp.cloud_run/tc-cloud-run-v2-job-template--template--containers--env--name:REVIEW"},{"node":"google_cloud_run_v2_job.migrate","attribute":"template.template.containers.env.value_source.secret_key_ref.secret","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:REVIEW","by":"gcp.cloud_run/secrets:REVIEW"},{"node":"google_cloud_run_v2_job.migrate","attribute":"template.template.containers.env.value_source.secret_key_ref.version","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:REVIEW","by":"gcp.cloud_run/secrets:REVIEW"},{"node":"google_cloud_run_v2_job.migrate","attribute":"template.template.containers.image","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"gcp.cloud_run/deployment-artifact:REVIEW"},{"node":"google_cloud_run_v2_job.migrate","attribute":"template.template.containers.volume_mounts.mount_path","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"gcp.cloud_run/k4-cloud-run-volume-mount-cloud-run-v2-job:REVIEW"},{"node":"google_cloud_run_v2_job.migrate","attribute":"template.template.service_account","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_cloud_run_v2_job.migrate): template.template.service_account — the identity of the revision is a Google service account; the pods run as the default Kubernetes ServiceAccount of the namespace and the draft gives them no identity — decide the identity of the application (the service account unit of the source and the identity decisions of the draft, identity.tf), and the roles it holds on the services it calls. (contract gcp.cloud_run/service-identity:LEDGER)"},{"node":"google_cloud_run_v2_job.migrate","attribute":"template.template.volumes.cloud_sql_instance.instances","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_cloud_run_v2_job.migrate): template.template.volumes.cloud_sql_instance.instances — a Cloud Run setting with no counterpart in the draft manifests: Kubernetes has its own rollout, health, scheduling and exec behaviour. (contract gcp.cloud_run/cloud-run-v2-job-network-exposure:REVIEW)"},{"node":"google_cloud_run_v2_job.migrate","attribute":"template.template.volumes.name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"gcp.cloud_run/tc-cloud-run-v2-job-template--template--volumes--name:REVIEW"}],"automation_eligible":false,"gate_blockers":[{"source_type":"google_cloud_run_v2_job","attribute":"deletion_protection","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_cloud_run_v2_job","attribute":"template.template.service_account","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_cloud_run_v2_job","attribute":"template.template.volumes.cloud_sql_instance.instances","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_cloud_run_v2_job","attribute":"name","closure":"CLOSED:REVIEW"},{"source_type":"google_cloud_run_v2_job","attribute":"template.template.containers.command","closure":"CLOSED:REVIEW"},{"source_type":"google_cloud_run_v2_job","attribute":"template.template.containers.env.name","closure":"CLOSED:REVIEW"},{"source_type":"google_cloud_run_v2_job","attribute":"template.template.containers.env.value_source.secret_key_ref.secret","closure":"CLOSED:REVIEW"},{"source_type":"google_cloud_run_v2_job","attribute":"template.template.containers.env.value_source.secret_key_ref.version","closure":"CLOSED:REVIEW"},{"source_type":"google_cloud_run_v2_job","attribute":"template.template.containers.image","closure":"CLOSED:REVIEW"},{"source_type":"google_cloud_run_v2_job","attribute":"template.template.containers.volume_mounts.mount_path","closure":"CLOSED:REVIEW"},{"source_type":"google_cloud_run_v2_job","attribute":"template.template.volumes.name","closure":"CLOSED:REVIEW"},{"source_type":"google_cloud_run_v2_job","closure":"NOT_AUTOMATABLE_CLASS:CONTAINERIZE"},{"source_type":"google_cloud_run_v2_job","attribute":"location","closure":"OPEN:placement-only"},{"target":"provider:google","closure":"PROVIDER:UNVERIFIED"}]}},{"id":"google_cloud_run_v2_service.server","source_type":"google_cloud_run_v2_service","category":"compute","kind":"container_service","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","standing":"UNIT","configuration_completeness":"COMPLETE","depends_on":["google_secret_manager_secret.django_settings","google_service_account.server","google_sql_database_instance.postgres"],"wave":4,"provenance":{"file":"service.tf","line":17,"end_line":96},"result":{"rule_id":"gcp.cloud_run","case_id":"run-service","class":"CONTAINERIZE","confidence":"MEDIUM","target":{"service":"SKE workload (or Cloud Foundry Docker app)","resources":["stackit_ske_cluster"],"maturity":"ga","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): ske lists 161 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): ske lists 77 offerings"}]},"reason":"The service already runs a container image, so it moves as a Deployment on SKE (kubernetes/\u003cservice\u003e/manifests.yaml): its containers, ports, resources, probes, command, arguments, environment names and secret references, volumes of the kinds a pod can mount, and its range of instances (as a HorizontalPodAutoscaler) are written; Cloud Run injects the PORT variable, so the draft sets it. Scale-to-zero, scaling on concurrent requests, per-request billing, revisions and traffic splits go away unless Knative or KEDA is operated on SKE.","evidence":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/","https://docs.stackit.cloud/products/runtime/cloud-foundry/"],"validated_against":"STACKIT product catalogue 2026-09-23 (no managed serverless container platform); terraform-provider-google 8.4.0 (worker_pool added DA4W-UNCLS3-GCP, 2026-09-29)","findings":[{"check_id":"run-min-zero","severity":"info","message":"The service can scale to zero; on SKE at least one replica runs unless an autoscaler with scale-to-zero (KEDA/Knative) is installed."},{"check_id":"run-unsupported-volume","severity":"warning","message":"A container mounts a Cloud SQL connection, a Cloud Storage bucket (through Cloud Storage FUSE) or an NFS share. The draft writes no volume for these and holds the pods until a person decides: connect to the migrated database or object store over the network instead of the mount, or mount a share or a volume of the cluster yourself.","evidence":["https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service"],"blocker_category":"FEATURE"},{"check_id":"run-iam-policy","severity":"warning","message":"A full IAM policy (member/role bindings) is set directly on the service via policy_data; STACKIT has no per-service IAM policy resource, so who may invoke the migrated SKE workload is decided by a person — the draft carries no invocation check.","evidence":["https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloud_run_service_iam.html.markdown"],"blocker_category":"IDENTITY"},{"check_id":"source-provider-unverified","severity":"warning","message":"root: source-provider-unverified:google","root":"source-provider-unverified:google","impact":"PROPAGATED_IMPACT"}],"lifecycle":"internal","production_eligible":false,"semantics":{"contract":"gcp.cloud_run","expected":131,"observed":14,"accounted":14,"unaccounted":0,"critical_unaccounted":[],"critical_open":["cloud-sql-connection","deployment-artifact","environment","iam-invocation","iam-policy-grant","k4-cloud-run-volume-mount-cloud-run-v2-service","location-residency","secrets","service-identity","tc-cloud-run-v2-service-name","tc-cloud-run-v2-service-template--volumes--name","terraform-destroy-guard"],"items":[{"id":"session-affinity-and-sticky-cookie","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"delivery-retry-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"request-rate-and-concurrency-cap","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"probe-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-request-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"k4-cloud-run-volume-mount-cloud-run-v2-worker-pool","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"k4-cloud-run-volume-mount-cloud-run-v2-service","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-service"},{"id":"k4-cloud-run-volume-mount-cloud-run-v2-job","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"k4-cloud-run-volume-mount-cloud-run-service","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cloud-run-v2-job-network-exposure","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"probe-initial-delay-job","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"probe-initial-delay-v2","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"probe-initial-delay-v1","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"container-port-h2c","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"container-image","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:run-service"},{"id":"ingress-restriction","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-invocation","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-service"},{"id":"public-invocation","critical":false,"observed":"no","disposition":"NOT_STATED"},{"id":"iam-policy-grant","critical":true,"observed":"yes","disposition":"REVIEW","by":"check:run-iam-policy"},{"id":"job-iam-binding","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"customer-managed-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"multi-region","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"scale-to-zero","critical":false,"observed":"yes","disposition":"REVIEW","by":"check:run-min-zero"},{"id":"terraform-destroy-guard","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-service"},{"id":"iap","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"service-identity","critical":true,"observed":"unknown","disposition":"LEDGER","by":"ledger:workload identity"},{"id":"environment","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-service"},{"id":"secrets","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-service"},{"id":"run-service-secret-volume-files","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"run-job-secret-volume-files","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"run-v1-service-secret-volume-files","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"vpc-egress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"cloud-sql-connection","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-service"},{"id":"gpu","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"revision-annotations","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"job-secret-volumes","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"ingress-open","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"invoker-iam-setting","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"location-residency","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-service"},{"id":"project-residency","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"wc-cloud-run-v2-job-template-template-node-selector-accelerator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"wc-cloud-run-v2-service-template-node-selector-accelerator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"wc-cloud-run-v2-worker-pool-template-node-selector-accelerator","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-binary-authorization--breakglass-justification","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-binary-authorization--policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-binary-authorization--use-default","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-tags","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-binary-authorization--breakglass-justification","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-binary-authorization--policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-binary-authorization--use-default","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-build-config--environment-variables","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-build-config--service-account","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-build-config--worker-pool","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-custom-audiences","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-default-uri-disabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-tags","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-binary-authorization--breakglass-justification","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-binary-authorization--policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-binary-authorization--use-default","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--spec--containers--env-from--secret-ref--local-object-reference--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--spec--containers--sandbox-launcher","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--spec--volumes--csi--read-only","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--spec--volumes--csi--volume-attributes","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--spec--volumes--nfs--path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--spec--volumes--nfs--read-only","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--spec--volumes--nfs--server","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--containers--sandbox-launcher","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--gpu-zonal-redundancy-disabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--volumes--gcs--bucket","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--volumes--gcs--read-only","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--volumes--nfs--path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--volumes--nfs--read-only","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--volumes--nfs--server","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--vpc-access--connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--vpc-access--network-interfaces--tags","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-multi-region-settings--regions","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--containers--sandbox-launcher","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--health-check-disabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--sandboxes--templates--env--value","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--service-mesh--mesh","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--volumes--gcs--bucket","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--volumes--gcs--read-only","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--volumes--nfs--path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--volumes--nfs--read-only","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--volumes--nfs--server","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--workload-identity-config--identity","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--workload-identity-config--identity-certificate-enabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--workload-identity-config--identity-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--client","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--client-version","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--containers--sandbox-launcher","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--encryption-key-revocation-action","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--encryption-key-shutdown-duration","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--revision","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--volumes--gcs--bucket","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--volumes--gcs--read-only","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--volumes--nfs--path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--volumes--nfs--read-only","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--volumes--nfs--server","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-v2-worker-pool-template--containers--env--value","critical":true,"observed":"no","disposition":"NOT_STATED","withdrawn_by":["environment"]},{"id":"tcp-cloud-run-v2-worker-pool-template--encryption-key","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-v2-worker-pool-template--service-account","critical":true,"observed":"no","disposition":"NOT_STATED","withdrawn_by":["service-identity"]},{"id":"tcp-cloud-run-v2-worker-pool-template--volumes--cloud-sql-instance--instances","critical":true,"observed":"no","disposition":"NOT_STATED","withdrawn_by":["cloud-sql-connection"]},{"id":"tcp-cloud-run-v2-worker-pool-template--vpc-access--connector","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-v2-worker-pool-template--vpc-access--egress","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-v2-worker-pool-template--vpc-access--network-interfaces--tags","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-v2-worker-pool-template--vpc-access--network-interfaces--network","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-v2-worker-pool-template--vpc-access--network-interfaces--subnetwork","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--metadata--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--spec--containers--env--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-service-template--spec--containers--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--containers--env--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--containers--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--volumes--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-service"},{"id":"tc-cloud-run-v2-service-template--revision","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--volumes--name","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-service"},{"id":"tc-cloud-run-v2-worker-pool-name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--volumes--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-job-template--template--volumes--secret--items--path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-service-template--volumes--secret--items--path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloud-run-v2-worker-pool-template--volumes--secret--items--path","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcf-kms-crypto-key--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-service-template--spec--containers--ports--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcp-cloud-run-v2-service-template--containers--ports--name","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"g8-build-updates","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deployment-artifact","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:run-service"},{"id":"entry-point","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REPLATFORM","change_types":["CODE","CONFIG"],"blocker_categories":["FEATURE","IDENTITY","UNKNOWN"],"target_platform":"SKE workload (or Cloud Foundry Docker app)","confidence":"MEDIUM"}},"property_accounting":{"set":17,"excluded":0,"meaningful":17,"by_status":{"CONSUMED":3,"CONTRACT":7,"NOT_CARRIED":6,"PLACEMENT":1,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"google_cloud_run_v2_service.server","attribute":"deletion_protection"},{"node":"google_cloud_run_v2_service.server","attribute":"template.labels"},{"node":"google_cloud_run_v2_service.server","attribute":"template.service_account"},{"node":"google_cloud_run_v2_service.server","attribute":"template.volumes.cloud_sql_instance.instances"},{"node":"google_cloud_run_v2_service.server","attribute":"traffic.percent"},{"node":"google_cloud_run_v2_service.server","attribute":"traffic.type"}],"class_counts":{"CRITICAL":11,"NON_CRITICAL":6},"critical":[{"node":"google_cloud_run_v2_service.server","attribute":"deletion_protection","class":"CRITICAL","category":"deletion-protection","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_cloud_run_v2_service.server): deletion_protection = false — deletion protection is a Google API guard against deleting the resource; the manifests carry no such guard — protect the workload with the access rules of the namespace. (contract gcp.cloud_run/terraform-destroy-guard:REVIEW)"},{"node":"google_cloud_run_v2_service.server","attribute":"location","class":"CRITICAL","category":"residency-compliance","closure":"OPEN:placement-only","by":"google-location"},{"node":"google_cloud_run_v2_service.server","attribute":"name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"gcp.cloud_run/tc-cloud-run-v2-service-name:REVIEW"},{"node":"google_cloud_run_v2_service.server","attribute":"template.containers.env.value","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:REVIEW","by":"gcp.cloud_run/environment:REVIEW"},{"node":"google_cloud_run_v2_service.server","attribute":"template.containers.env.value_source.secret_key_ref.secret","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:REVIEW","by":"gcp.cloud_run/secrets:REVIEW"},{"node":"google_cloud_run_v2_service.server","attribute":"template.containers.env.value_source.secret_key_ref.version","class":"CRITICAL","category":"secret-handling","closure":"CLOSED:REVIEW","by":"gcp.cloud_run/secrets:REVIEW"},{"node":"google_cloud_run_v2_service.server","attribute":"template.containers.image","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"gcp.cloud_run/deployment-artifact:REVIEW"},{"node":"google_cloud_run_v2_service.server","attribute":"template.containers.volume_mounts.mount_path","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"gcp.cloud_run/k4-cloud-run-volume-mount-cloud-run-v2-service:REVIEW"},{"node":"google_cloud_run_v2_service.server","attribute":"template.service_account","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_cloud_run_v2_service.server): template.service_account — the identity of the revision is a Google service account; the pods run as the default Kubernetes ServiceAccount of the namespace and the draft gives them no identity — decide the identity of the application (the service account unit of the source and the identity decisions of the draft, identity.tf), and the roles it holds on the services it calls. (contract gcp.cloud_run/service-identity:LEDGER)"},{"node":"google_cloud_run_v2_service.server","attribute":"template.volumes.cloud_sql_instance.instances","class":"CRITICAL","category":"network-exposure","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_cloud_run_v2_service.server): template.volumes.cloud_sql_instance.instances — a Cloud Run setting with no counterpart in the draft manifests: Kubernetes has its own rollout, health, scheduling and exec behaviour. (contract gcp.cloud_run/cloud-sql-connection:REVIEW)"},{"node":"google_cloud_run_v2_service.server","attribute":"template.volumes.name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"gcp.cloud_run/tc-cloud-run-v2-service-template--volumes--name:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["iam-invocation","iam-policy-grant"],"gate_blockers":[{"source_type":"google_cloud_run_v2_service","attribute":"deletion_protection","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_cloud_run_v2_service","attribute":"template.service_account","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_cloud_run_v2_service","attribute":"template.volumes.cloud_sql_instance.instances","closure":"CLOSED:NC+REVIEW"},{"source_type":"google_cloud_run_v2_service","attribute":"name","closure":"CLOSED:REVIEW"},{"source_type":"google_cloud_run_v2_service","attribute":"template.containers.env.value","closure":"CLOSED:REVIEW"},{"source_type":"google_cloud_run_v2_service","attribute":"template.containers.env.value_source.secret_key_ref.secret","closure":"CLOSED:REVIEW"},{"source_type":"google_cloud_run_v2_service","attribute":"template.containers.env.value_source.secret_key_ref.version","closure":"CLOSED:REVIEW"},{"source_type":"google_cloud_run_v2_service","attribute":"template.containers.image","closure":"CLOSED:REVIEW"},{"source_type":"google_cloud_run_v2_service","attribute":"template.containers.volume_mounts.mount_path","closure":"CLOSED:REVIEW"},{"source_type":"google_cloud_run_v2_service","attribute":"template.volumes.name","closure":"CLOSED:REVIEW"},{"source_type":"google_cloud_run_v2_service","closure":"NOT_AUTOMATABLE_CLASS:CONTAINERIZE"},{"source_type":"google_cloud_run_v2_service","attribute":"location","closure":"OPEN:placement-only"},{"target":"provider:google","closure":"PROVIDER:UNVERIFIED"},{"semantic":"iam-invocation","closure":"open-critical-without-read-set"},{"semantic":"iam-policy-grant","closure":"open-critical-without-read-set"}]}},{"id":"google_cloudbuild_trigger.activategcb","source_type":"google_cloudbuild_trigger","category":"compute","kind":"ci_cd_pipeline_trigger","enabled":true,"instances":1,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.init ? 1 : 0","variables":["var.init"]},"standing":"UNIT","open_dependencies":["google_service_account.init"],"configuration_completeness":"CONDITIONAL","depends_on":["google_pubsub_topic.faux","google_service_account.init"],"wave":0,"provenance":{"file":"postdeployment.tf","line":38,"end_line":68},"result":{"rule_id":"gcp.cloudbuild","case_id":"cicd-redesign","class":"REDESIGN","confidence":"MEDIUM","target":{"service":"a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD","resources":["stackit_git"],"maturity":"beta","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): git_flavors lists 2 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): git_flavors lists 2 offerings"}]},"reason":"A Cloud Build trigger starts a build when a source event happens (a push or a pull request on GitHub, Bitbucket Server, a repository of the 2nd generation, Developer Connect or Cloud Source Repositories), when a Pub/Sub message arrives, when a webhook is called or when a person runs it. The build is a list of container steps (a build block, or a file in the repository) with substitutions, images and artifacts to push, secrets from Secret Manager, a service account, a log destination and optionally a manual approval. STACKIT has no trigger or build resource. The same delivery is a workflow of STACKIT Git Pipelines (workflows written for GitHub Actions; STACKIT-managed or custom runners; secrets from STACKIT Secrets Manager or the repository; a manual-approval action) or the customer's own CI/CD. Nothing is converted: the trigger conditions (branch and tag expressions, file filters, the event kind), the steps (a container step becomes a step or a job with a container), the secrets (created again, never copied), the service account (replaced by the credentials the workflow uses against STACKIT), the log destination and the approval are written again by a person. The pages read describe pipelines that run when changes are pushed; other events (pull requests, schedules, manual runs) are verified against the Forgejo Actions reference.","review":["Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents.","Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied.","Write the trigger conditions again as the on: section of the workflow and verify each event kind against the Forgejo Actions reference.","Decide where images and artifacts go: the package registry of STACKIT Git takes container images from any OCI client, or keep your own registry, and change the image names in the deploy steps."],"evidence":["https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","https://docs.stackit.cloud/products/developer-platform/git/","https://docs.stackit.cloud/products/developer-platform/git/basics/stackit-pipelines/","https://docs.stackit.cloud/products/developer-platform/git/getting-started/pipeline-runners/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/pipelines-custom-runner/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/pipeline-manual-approval/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/pipeline-stackit-compatibility/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/pipeline-github-compatibility/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/package-registry/","https://registry.terraform.io/providers/stackitcloud/stackit/0.121.0/docs/resources/git","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/git/v1beta/git.json","https://docs.stackit.cloud/products/developer-platform/git/basics/stackit-pipelines/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/pipeline-stackit-compatibility/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/package-registry/"],"validated_against":"terraform-provider-google 8.4.0 (cloudbuild_trigger, cloudbuild_worker_pool); terraform-provider-stackit@0.121.0 (schema data/stackit/provider-schema-0.121.0.json: stackit_git is beta and creates the Git instance only; no pipeline, trigger or worker-pool resource); STACKIT Git management API v1beta (services/git/v1beta/git.json: instances, authentications, runner, users); docs.stackit.cloud developer-platform/git pages read 2026-11-05\n","findings":[{"check_id":"cloudbuild-source-event","severity":"info","message":"This trigger starts its builds on a Pub/Sub message. The replacement workflow lists the events that start it in its own on: section; the pages of STACKIT read describe pipelines that run whenever changes are pushed to a repository, so a pull request, a schedule or a manual start is verified by a person against the Forgejo Actions reference.","evidence":["https://docs.stackit.cloud/products/developer-platform/git/basics/stackit-pipelines/"]},{"check_id":"source-provider-unverified","severity":"warning","message":"root: source-provider-unverified:google","root":"source-provider-unverified:google","impact":"PROPAGATED_IMPACT"}],"lifecycle":"internal","production_eligible":false,"coverage":"UNKNOWN_RUNTIME_TOPOLOGY","semantics":{"contract":"gcp.cloudbuild","expected":19,"observed":6,"accounted":6,"unaccounted":0,"critical_unaccounted":[],"critical_open":["project-residency","build-identity","log-destination","deployment-artifact","entry-point","dep-references"],"items":[{"id":"job-execution-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-guard","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"project-residency","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:cicd-redesign"},{"id":"build-identity","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:cicd-redesign"},{"id":"secret-handling","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"worker-pool-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"log-destination","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:cicd-redesign"},{"id":"trigger-enabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"external-pr-trust","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"worker-pool-network","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloudbuild-trigger-build--available-secrets--secret-manager--env","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloudbuild-trigger-filename","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"trigger-event-filter","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"trigger-template-selection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"trigger-ref-selection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"g8-build-source","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deployment-artifact","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:cicd-redesign"},{"id":"entry-point","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:cicd-redesign"},{"id":"dep-references","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:cicd-redesign"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REARCHITECT","change_types":["ARCHITECTURE"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD","confidence":"MEDIUM"}},"property_accounting":{"set":0,"excluded":0,"meaningful":0,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":0,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"critical":[{"node":"google_cloudbuild_trigger.activategcb","attribute":"build.options.logging","class":"CRITICAL","category":"audit-logging","closure":"CLOSED:REVIEW","by":"gcp.cloudbuild/log-destination:REVIEW"},{"node":"google_cloudbuild_trigger.activategcb","attribute":"build.step.name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"gcp.cloudbuild/deployment-artifact:REVIEW"},{"node":"google_cloudbuild_trigger.activategcb","attribute":"build.step.script","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"gcp.cloudbuild/entry-point:REVIEW"},{"node":"google_cloudbuild_trigger.activategcb","attribute":"location","class":"CRITICAL","category":"residency-compliance","closure":"CLOSED:REVIEW","by":"gcp.cloudbuild/project-residency:REVIEW"},{"node":"google_cloudbuild_trigger.activategcb","attribute":"service_account","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"gcp.cloudbuild/build-identity:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["dep-references"],"gate_blockers":[{"target":"type:stackit_git","closure":"BETA_TARGET"},{"source_type":"google_cloudbuild_trigger","attribute":"build.options.logging","closure":"CLOSED:REVIEW"},{"source_type":"google_cloudbuild_trigger","attribute":"build.step.name","closure":"CLOSED:REVIEW"},{"source_type":"google_cloudbuild_trigger","attribute":"build.step.script","closure":"CLOSED:REVIEW"},{"source_type":"google_cloudbuild_trigger","attribute":"location","closure":"CLOSED:REVIEW"},{"source_type":"google_cloudbuild_trigger","attribute":"service_account","closure":"CLOSED:REVIEW"},{"source_type":"google_cloudbuild_trigger","closure":"NOT_AUTOMATABLE_CLASS:REDESIGN"},{"target":"provider:google","closure":"PROVIDER:UNVERIFIED"},{"source_type":"google_cloudbuild_trigger","closure":"TOPOLOGY:unknown"},{"semantic":"dep-references","closure":"open-critical-without-read-set"}],"unit_class":"REDESIGN"}},{"id":"google_cloudbuild_trigger.init","source_type":"google_cloudbuild_trigger","category":"compute","kind":"ci_cd_pipeline_trigger","enabled":true,"instances":1,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.init ? 1 : 0","variables":["var.init"]},"standing":"UNIT","open_dependencies":["google_firebase_hosting_site.client","google_service_account.init"],"configuration_completeness":"CONDITIONAL","depends_on":["google_cloud_run_v2_job.migrate","google_cloud_run_v2_service.server","google_firebase_hosting_site.client","google_pubsub_topic.faux","google_secret_manager_secret.django_admin_password","google_secret_manager_secret.django_settings","google_service_account.automation","google_service_account.client","google_service_account.init","google_sql_database_instance.postgres"],"wave":0,"provenance":{"file":"postdeployment.tf","line":144,"end_line":246},"result":{"rule_id":"gcp.cloudbuild","case_id":"cicd-redesign","class":"REDESIGN","confidence":"LOW","target":{"service":"a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD","resources":["stackit_git"],"maturity":"beta","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): git_flavors lists 2 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): git_flavors lists 2 offerings"}]},"reason":"A Cloud Build trigger starts a build when a source event happens (a push or a pull request on GitHub, Bitbucket Server, a repository of the 2nd generation, Developer Connect or Cloud Source Repositories), when a Pub/Sub message arrives, when a webhook is called or when a person runs it. The build is a list of container steps (a build block, or a file in the repository) with substitutions, images and artifacts to push, secrets from Secret Manager, a service account, a log destination and optionally a manual approval. STACKIT has no trigger or build resource. The same delivery is a workflow of STACKIT Git Pipelines (workflows written for GitHub Actions; STACKIT-managed or custom runners; secrets from STACKIT Secrets Manager or the repository; a manual-approval action) or the customer's own CI/CD. Nothing is converted: the trigger conditions (branch and tag expressions, file filters, the event kind), the steps (a container step becomes a step or a job with a container), the secrets (created again, never copied), the service account (replaced by the credentials the workflow uses against STACKIT), the log destination and the approval are written again by a person. The pages read describe pipelines that run when changes are pushed; other events (pull requests, schedules, manual runs) are verified against the Forgejo Actions reference.","review":["Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents.","Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied.","Write the trigger conditions again as the on: section of the workflow and verify each event kind against the Forgejo Actions reference.","Decide where images and artifacts go: the package registry of STACKIT Git takes container images from any OCI client, or keep your own registry, and change the image names in the deploy steps."],"evidence":["https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","https://docs.stackit.cloud/products/developer-platform/git/","https://docs.stackit.cloud/products/developer-platform/git/basics/stackit-pipelines/","https://docs.stackit.cloud/products/developer-platform/git/getting-started/pipeline-runners/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/pipelines-custom-runner/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/pipeline-manual-approval/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/pipeline-stackit-compatibility/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/pipeline-github-compatibility/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/package-registry/","https://registry.terraform.io/providers/stackitcloud/stackit/0.121.0/docs/resources/git","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/git/v1beta/git.json","https://docs.stackit.cloud/products/developer-platform/git/basics/stackit-pipelines/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/pipeline-stackit-compatibility/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/package-registry/"],"validated_against":"terraform-provider-google 8.4.0 (cloudbuild_trigger, cloudbuild_worker_pool); terraform-provider-stackit@0.121.0 (schema data/stackit/provider-schema-0.121.0.json: stackit_git is beta and creates the Git instance only; no pipeline, trigger or worker-pool resource); STACKIT Git management API v1beta (services/git/v1beta/git.json: instances, authentications, runner, users); docs.stackit.cloud developer-platform/git pages read 2026-11-05\n","findings":[{"check_id":"cloudbuild-source-event","severity":"info","message":"This trigger starts its builds on a Pub/Sub message. The replacement workflow lists the events that start it in its own on: section; the pages of STACKIT read describe pipelines that run whenever changes are pushed to a repository, so a pull request, a schedule or a manual start is verified by a person against the Forgejo Actions reference.","evidence":["https://docs.stackit.cloud/products/developer-platform/git/basics/stackit-pipelines/"]},{"check_id":"source-provider-unverified","severity":"warning","message":"root: source-provider-unverified:google","root":"source-provider-unverified:google","impact":"PROPAGATED_IMPACT"},{"check_id":"linked-dependency-unread","severity":"warning","message":"This unit names google_cloud_run_v2_job.migrate (google_cloud_run_v2_job), which the draft carries. The unit is left for a redesign and the converter writes no block for it, so the reference is not written into the draft. A person re-makes the reference in the redesign of this unit; it is part of that redesign, not a decision of its own."},{"check_id":"linked-dependency-unread","severity":"warning","message":"This unit names google_cloud_run_v2_service.server (google_cloud_run_v2_service), which the draft carries. The unit is left for a redesign and the converter writes no block for it, so the reference is not written into the draft. A person re-makes the reference in the redesign of this unit; it is part of that redesign, not a decision of its own."},{"check_id":"linked-dependency-unread","severity":"warning","message":"This unit names google_firebase_hosting_site.client (google_firebase_hosting_site), whose own decision the target does not carry (it is REDESIGN), and the semantic contract of google_cloudbuild_trigger does not read google_firebase_hosting_site, so what the reference becomes is not assessed."},{"check_id":"linked-dependency-unread","severity":"warning","message":"This unit names google_sql_database_instance.postgres (google_sql_database_instance), which the draft carries. The unit is left for a redesign and the converter writes no block for it, so the reference is not written into the draft. A person re-makes the reference in the redesign of this unit; it is part of that redesign, not a decision of its own."}],"lifecycle":"internal","production_eligible":false,"coverage":"UNKNOWN_RUNTIME_TOPOLOGY","semantics":{"contract":"gcp.cloudbuild","expected":19,"observed":6,"accounted":6,"unaccounted":0,"critical_unaccounted":[],"critical_open":["build-identity","dep-references","deployment-artifact","entry-point","linked-dependency:google_firebase_hosting_site","log-destination","project-residency"],"items":[{"id":"job-execution-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-guard","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"project-residency","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:cicd-redesign"},{"id":"build-identity","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:cicd-redesign"},{"id":"secret-handling","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"worker-pool-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"log-destination","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:cicd-redesign"},{"id":"trigger-enabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"external-pr-trust","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"worker-pool-network","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloudbuild-trigger-build--available-secrets--secret-manager--env","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloudbuild-trigger-filename","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"trigger-event-filter","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"trigger-template-selection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"trigger-ref-selection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"g8-build-source","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deployment-artifact","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:cicd-redesign"},{"id":"entry-point","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:cicd-redesign"},{"id":"dep-references","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:cicd-redesign"},{"id":"linked-dependency:google_firebase_hosting_site","critical":true,"observed":"yes","disposition":"REVIEW","by":"linked-dependency:google_firebase_hosting_site"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REARCHITECT","change_types":["ARCHITECTURE"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD","confidence":"LOW"}},"property_accounting":{"set":0,"excluded":0,"meaningful":0,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":0,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"critical":[{"node":"google_cloudbuild_trigger.init","attribute":"build.options.logging","class":"CRITICAL","category":"audit-logging","closure":"CLOSED:REVIEW","by":"gcp.cloudbuild/log-destination:REVIEW"},{"node":"google_cloudbuild_trigger.init","attribute":"build.step.name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"gcp.cloudbuild/deployment-artifact:REVIEW"},{"node":"google_cloudbuild_trigger.init","attribute":"build.step.script","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"gcp.cloudbuild/entry-point:REVIEW"},{"node":"google_cloudbuild_trigger.init","attribute":"location","class":"CRITICAL","category":"residency-compliance","closure":"CLOSED:REVIEW","by":"gcp.cloudbuild/project-residency:REVIEW"},{"node":"google_cloudbuild_trigger.init","attribute":"service_account","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"gcp.cloudbuild/build-identity:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["dep-references","linked-dependency:google_firebase_hosting_site"],"gate_blockers":[{"target":"type:stackit_git","closure":"BETA_TARGET"},{"source_type":"google_cloudbuild_trigger","attribute":"build.options.logging","closure":"CLOSED:REVIEW"},{"source_type":"google_cloudbuild_trigger","attribute":"build.step.name","closure":"CLOSED:REVIEW"},{"source_type":"google_cloudbuild_trigger","attribute":"build.step.script","closure":"CLOSED:REVIEW"},{"source_type":"google_cloudbuild_trigger","attribute":"location","closure":"CLOSED:REVIEW"},{"source_type":"google_cloudbuild_trigger","attribute":"service_account","closure":"CLOSED:REVIEW"},{"source_type":"google_cloudbuild_trigger","closure":"NOT_AUTOMATABLE_CLASS:REDESIGN"},{"target":"provider:google","closure":"PROVIDER:UNVERIFIED"},{"source_type":"google_cloudbuild_trigger","closure":"TOPOLOGY:unknown"},{"semantic":"dep-references","closure":"open-critical-without-read-set"},{"semantic":"linked-dependency:google_firebase_hosting_site","closure":"open-critical-without-read-set"}],"unit_class":"REDESIGN"}},{"id":"google_cloudbuild_trigger.placeholder","source_type":"google_cloudbuild_trigger","category":"compute","kind":"ci_cd_pipeline_trigger","enabled":true,"instances":1,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.init ? 1 : 0","variables":["var.init"]},"standing":"UNIT","open_dependencies":["google_firebase_hosting_site.client","google_service_account.init"],"configuration_completeness":"CONDITIONAL","depends_on":["google_firebase_hosting_site.client","google_pubsub_topic.faux","google_service_account.init"],"wave":0,"provenance":{"file":"postdeployment.tf","line":87,"end_line":121},"result":{"rule_id":"gcp.cloudbuild","case_id":"cicd-redesign","class":"REDESIGN","confidence":"LOW","target":{"service":"a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD","resources":["stackit_git"],"maturity":"beta","lifecycle":"active","availability":[{"region":"eu01","evidence":"kb/stackit/eu01.json (live catalogue, fetched 2026-10-18): git_flavors lists 2 offerings"},{"region":"eu02","evidence":"kb/stackit/eu02.json (live catalogue, fetched 2026-10-18): git_flavors lists 2 offerings"}]},"reason":"A Cloud Build trigger starts a build when a source event happens (a push or a pull request on GitHub, Bitbucket Server, a repository of the 2nd generation, Developer Connect or Cloud Source Repositories), when a Pub/Sub message arrives, when a webhook is called or when a person runs it. The build is a list of container steps (a build block, or a file in the repository) with substitutions, images and artifacts to push, secrets from Secret Manager, a service account, a log destination and optionally a manual approval. STACKIT has no trigger or build resource. The same delivery is a workflow of STACKIT Git Pipelines (workflows written for GitHub Actions; STACKIT-managed or custom runners; secrets from STACKIT Secrets Manager or the repository; a manual-approval action) or the customer's own CI/CD. Nothing is converted: the trigger conditions (branch and tag expressions, file filters, the event kind), the steps (a container step becomes a step or a job with a container), the secrets (created again, never copied), the service account (replaced by the credentials the workflow uses against STACKIT), the log destination and the approval are written again by a person. The pages read describe pipelines that run when changes are pushed; other events (pull requests, schedules, manual runs) are verified against the Forgejo Actions reference.","review":["Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents.","Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied.","Write the trigger conditions again as the on: section of the workflow and verify each event kind against the Forgejo Actions reference.","Decide where images and artifacts go: the package registry of STACKIT Git takes container images from any OCI client, or keep your own registry, and change the image names in the deploy steps."],"evidence":["https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","https://docs.stackit.cloud/products/developer-platform/git/","https://docs.stackit.cloud/products/developer-platform/git/basics/stackit-pipelines/","https://docs.stackit.cloud/products/developer-platform/git/getting-started/pipeline-runners/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/pipelines-custom-runner/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/pipeline-manual-approval/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/pipeline-stackit-compatibility/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/pipeline-github-compatibility/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/package-registry/","https://registry.terraform.io/providers/stackitcloud/stackit/0.121.0/docs/resources/git","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/git/v1beta/git.json","https://docs.stackit.cloud/products/developer-platform/git/basics/stackit-pipelines/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/pipeline-stackit-compatibility/","https://docs.stackit.cloud/products/developer-platform/git/how-tos/package-registry/"],"validated_against":"terraform-provider-google 8.4.0 (cloudbuild_trigger, cloudbuild_worker_pool); terraform-provider-stackit@0.121.0 (schema data/stackit/provider-schema-0.121.0.json: stackit_git is beta and creates the Git instance only; no pipeline, trigger or worker-pool resource); STACKIT Git management API v1beta (services/git/v1beta/git.json: instances, authentications, runner, users); docs.stackit.cloud developer-platform/git pages read 2026-11-05\n","findings":[{"check_id":"cloudbuild-source-event","severity":"info","message":"This trigger starts its builds on a Pub/Sub message. The replacement workflow lists the events that start it in its own on: section; the pages of STACKIT read describe pipelines that run whenever changes are pushed to a repository, so a pull request, a schedule or a manual start is verified by a person against the Forgejo Actions reference.","evidence":["https://docs.stackit.cloud/products/developer-platform/git/basics/stackit-pipelines/"]},{"check_id":"source-provider-unverified","severity":"warning","message":"root: source-provider-unverified:google","root":"source-provider-unverified:google","impact":"PROPAGATED_IMPACT"},{"check_id":"linked-dependency-unread","severity":"warning","message":"This unit names google_firebase_hosting_site.client (google_firebase_hosting_site), whose own decision the target does not carry (it is REDESIGN), and the semantic contract of google_cloudbuild_trigger does not read google_firebase_hosting_site, so what the reference becomes is not assessed."}],"lifecycle":"internal","production_eligible":false,"coverage":"UNKNOWN_RUNTIME_TOPOLOGY","semantics":{"contract":"gcp.cloudbuild","expected":19,"observed":5,"accounted":5,"unaccounted":0,"critical_unaccounted":[],"critical_open":["build-identity","dep-references","deployment-artifact","linked-dependency:google_firebase_hosting_site","log-destination","project-residency"],"items":[{"id":"job-execution-timeout","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deletion-guard","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"project-residency","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:cicd-redesign"},{"id":"build-identity","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:cicd-redesign"},{"id":"secret-handling","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"worker-pool-target","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"log-destination","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:cicd-redesign"},{"id":"trigger-enabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"external-pr-trust","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"worker-pool-network","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloudbuild-trigger-build--available-secrets--secret-manager--env","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-cloudbuild-trigger-filename","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"trigger-event-filter","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"trigger-template-selection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"trigger-ref-selection","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"g8-build-source","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"deployment-artifact","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:cicd-redesign"},{"id":"entry-point","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"dep-references","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:cicd-redesign"},{"id":"linked-dependency:google_firebase_hosting_site","critical":true,"observed":"yes","disposition":"REVIEW","by":"linked-dependency:google_firebase_hosting_site"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REARCHITECT","change_types":["ARCHITECTURE"],"blocker_categories":["FEATURE","UNKNOWN"],"target_platform":"a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD","confidence":"LOW"}},"property_accounting":{"set":0,"excluded":0,"meaningful":0,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":0,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"critical":[{"node":"google_cloudbuild_trigger.placeholder","attribute":"build.options.logging","class":"CRITICAL","category":"audit-logging","closure":"CLOSED:REVIEW","by":"gcp.cloudbuild/log-destination:REVIEW"},{"node":"google_cloudbuild_trigger.placeholder","attribute":"build.step.name","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"gcp.cloudbuild/deployment-artifact:REVIEW"},{"node":"google_cloudbuild_trigger.placeholder","attribute":"location","class":"CRITICAL","category":"residency-compliance","closure":"CLOSED:REVIEW","by":"gcp.cloudbuild/project-residency:REVIEW"},{"node":"google_cloudbuild_trigger.placeholder","attribute":"service_account","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"gcp.cloudbuild/build-identity:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["dep-references","linked-dependency:google_firebase_hosting_site"],"gate_blockers":[{"target":"type:stackit_git","closure":"BETA_TARGET"},{"source_type":"google_cloudbuild_trigger","attribute":"build.options.logging","closure":"CLOSED:REVIEW"},{"source_type":"google_cloudbuild_trigger","attribute":"build.step.name","closure":"CLOSED:REVIEW"},{"source_type":"google_cloudbuild_trigger","attribute":"location","closure":"CLOSED:REVIEW"},{"source_type":"google_cloudbuild_trigger","attribute":"service_account","closure":"CLOSED:REVIEW"},{"source_type":"google_cloudbuild_trigger","closure":"NOT_AUTOMATABLE_CLASS:REDESIGN"},{"target":"provider:google","closure":"PROVIDER:UNVERIFIED"},{"source_type":"google_cloudbuild_trigger","closure":"TOPOLOGY:unknown"},{"semantic":"dep-references","closure":"open-critical-without-read-set"},{"semantic":"linked-dependency:google_firebase_hosting_site","closure":"open-critical-without-read-set"}],"unit_class":"REDESIGN"}},{"id":"google_firebase_hosting_site.client","source_type":"google_firebase_hosting_site","category":"network","kind":"web_hosting_site","enabled":true,"instances":1,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.random_suffix ? 1 : 0","variables":["var.random_suffix"]},"standing":"UNIT","configuration_completeness":"CONDITIONAL","depends_on":["google_firebase_project.default"],"wave":0,"provenance":{"file":"firebase.tf","line":24,"end_line":34},"result":{"rule_id":"gcp.firebase_hosting_site","case_id":"web-hosting-site","class":"REDESIGN","confidence":"LOW","target":{"service":"STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain","resources":["stackit_objectstorage_bucket","stackit_cdn_distribution","stackit_cdn_custom_domain"],"maturity":"beta","lifecycle":"active"},"reason":"A Firebase Hosting site: the unit of hosting, whose identifier builds the Firebase-provided sub-domains, optionally associated with a Firebase web app. Firebase Hosting is Google's web hosting with a global CDN: a site holds versions (the files with the rewrites, redirects and headers of firebase.json), releases publish a version on a channel, preview channels expire by themselves, and custom domains get a certificate. STACKIT has no web hosting service of this kind (0 hits for firebase in the resource names, descriptions and attributes of the 115 resource types of the pinned STACKIT provider, checked 2026-11-05; the product list at docs.stackit.cloud/products/ read 2026-11-05 names none), but it has the parts for static content: Object Storage buckets, and a CDN whose distribution can use a bucket as its origin and takes redirect rules, TLS settings and a WAF (the stackit_cdn_distribution resource of the pinned provider is a beta resource), with custom domains. Rewrites to Cloud Run services or Cloud Functions, preview channels and the release history of a site have no counterpart there. Static files are published into an Object Storage bucket by a pipeline; a CDN distribution with the bucket as origin serves them on a custom domain, and the redirects of firebase.json become redirect rules of the distribution. Preview channels and release history are rebuilt in the pipeline (one bucket path per preview). Rewrites to dynamic backends need a load balancer or another origin, which a person decides.","review":["Check the rewrites, headers and clean-URL settings of firebase.json: redirects have a counterpart in the CDN, rewrites to a backend do not.","Plan the DNS change for the custom domain and the certificate that the CDN issues for it."],"evidence":["https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/firebase_hosting_site","https://docs.stackit.cloud/products/","https://docs.stackit.cloud/products/storage/object-storage/","https://docs.stackit.cloud/products/network/load-balancing-and-content-delivery/cdn/basics/features-cdn/","https://registry.terraform.io/providers/stackitcloud/stackit/0.121.0/docs/resources/objectstorage_bucket","https://registry.terraform.io/providers/stackitcloud/stackit/0.121.0/docs/resources/cdn_distribution","https://registry.terraform.io/providers/stackitcloud/stackit/0.121.0/docs/resources/cdn_custom_domain"],"validated_against":"terraform-provider-stackit@0.121.0 (provider schema: none of its 115 resource types is a web hosting service; 0 hits for firebase in resource names, descriptions and attributes, checked 2026-11-05); docs.stackit.cloud product list read 2026-11-05 (nearest: Object Storage (S3-compatible) as the origin of a CDN distribution with redirect rules and custom domains); hashicorp/google 8.4.0 schema and docs of the type","findings":[{"check_id":"source-provider-unverified","severity":"warning","message":"root: source-provider-unverified:google","root":"source-provider-unverified:google","impact":"PROPAGATED_IMPACT"},{"check_id":"linked-dependency-unread","severity":"warning","message":"This unit names google_firebase_project.default (google_firebase_project), whose own decision the target does not carry (it is MANUAL_REVIEW), and the semantic contract of google_firebase_hosting_site does not read google_firebase_project, so what the reference becomes is not assessed."}],"lifecycle":"internal","production_eligible":false,"coverage":"UNKNOWN_RUNTIME_TOPOLOGY","semantics":{"contract":"gcp.firebase_hosting_site","expected":5,"observed":3,"accounted":3,"unaccounted":0,"critical_unaccounted":[],"critical_open":["linked-dependency:google_firebase_project","tc-firebase-hosting-site-project","tcr-firebase-hosting-site-site-id"],"items":[{"id":"migration-decision","critical":false,"observed":"yes","disposition":"REVIEW","by":"case:web-hosting-site"},{"id":"tcr-firebase-hosting-site-app-id","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-firebase-hosting-site-deletion-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tc-firebase-hosting-site-project","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:web-hosting-site"},{"id":"tcr-firebase-hosting-site-site-id","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:web-hosting-site"},{"id":"linked-dependency:google_firebase_project","critical":true,"observed":"yes","disposition":"REVIEW","by":"linked-dependency:google_firebase_project"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REARCHITECT","change_types":["ARCHITECTURE"],"blocker_categories":["NETWORK","UNKNOWN"],"target_platform":"STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain","confidence":"LOW"}},"property_accounting":{"set":0,"excluded":0,"meaningful":0,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":0,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"critical":[{"node":"google_firebase_hosting_site.client","attribute":"project","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"gcp.firebase_hosting_site/tc-firebase-hosting-site-project:REVIEW"},{"node":"google_firebase_hosting_site.client","attribute":"site_id","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"gcp.firebase_hosting_site/tcr-firebase-hosting-site-site-id:REVIEW"}],"automation_eligible":false,"open_critical_without_read_set":["linked-dependency:google_firebase_project"],"gate_blockers":[{"target":"type:stackit_cdn_custom_domain","closure":"BETA_TARGET"},{"target":"type:stackit_cdn_distribution","closure":"BETA_TARGET"},{"source_type":"google_firebase_hosting_site","attribute":"project","closure":"CLOSED:REVIEW"},{"source_type":"google_firebase_hosting_site","attribute":"site_id","closure":"CLOSED:REVIEW"},{"source_type":"google_firebase_hosting_site","closure":"NOT_AUTOMATABLE_CLASS:REDESIGN"},{"target":"provider:google","closure":"PROVIDER:UNVERIFIED"},{"source_type":"google_firebase_hosting_site","closure":"TOPOLOGY:unknown"},{"semantic":"linked-dependency:google_firebase_project","closure":"open-critical-without-read-set"}],"unit_class":"REDESIGN"}},{"id":"google_service_account.init","source_type":"google_service_account","category":"identity","kind":"workload_identity","enabled":true,"instances":1,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.init ? 1 : 0","variables":["var.init"]},"standing":"UNIT","configuration_completeness":"CONDITIONAL","wave":0,"provenance":{"file":"iam.tf","line":61,"end_line":66},"result":{"rule_id":"gcp.service_account","case_id":"service-account","class":"RECONFIGURE","confidence":"MEDIUM","target":{"service":"STACKIT service account","resources":["stackit_service_account","stackit_authorization_project_role_assignment","stackit_authorization_folder_role_assignment","stackit_authorization_organization_role_assignment","stackit_authorization_service_account_role_assignment"],"maturity":"experimental","lifecycle":"active"},"reason":"A Google service account becomes a STACKIT service account named after its account ID (shortened to the STACKIT name rules, so its e-mail address changes and every reference to it is updated). What the account may do is what the IAM resources of the estate grant it, and the draft carries that where it can show the mapping: a grant to the account on a project, a folder or an organisation becomes a STACKIT role assignment of the account. The role is written as it is only where the Google role has a STACKIT role with the same permissions or fewer on a project; every other role is an input without a default that names the candidates and how they differ, because a wider role is never a default. A grant that lets another account act as this one becomes an Act-As assignment. Grants that cannot be written are listed in the draft with the reason: a condition (a STACKIT role assignment has none), a policy document, a repeated grant, a role or a member that is not visible statically, and a member that is a person, a group or the identity of a Kubernetes workload. An additive grant (a member) adds one member and removes none, as a role assignment does; a binding or a policy removes every member of its role that it does not list, a role assignment never removes anyone, and the draft marks each such grant. The workloads that ran as the account are not attached to it by this block; workloads that got credentials from the metadata server or GKE Workload Identity need explicit STACKIT credentials or a federated identity. Keys are never carried.","evidence":["https://docs.stackit.cloud/platform/resource-manager/basics/access-control/","https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"],"validated_against":"terraform-provider-stackit@0.116.0 (authorization_*_role_assignment requires experiment iam)","findings":[{"check_id":"sa-account-id-not-visible","severity":"info","message":"The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"]},{"check_id":"source-provider-unverified","severity":"warning","message":"root: source-provider-unverified:google","root":"source-provider-unverified:google","impact":"PROPAGATED_IMPACT"}],"lifecycle":"internal","production_eligible":false,"coverage":"UNKNOWN_RUNTIME_TOPOLOGY","semantics":{"contract":"gcp.service_account","expected":12,"observed":3,"accounted":3,"unaccounted":0,"critical_unaccounted":[],"critical_open":["role-bindings","account-name"],"items":[{"id":"project-residency","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"workload-identity","critical":true,"observed":"yes","disposition":"TRANSFORMED","by":"case:service-account"},{"id":"long-lived-keys","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"role-bindings","critical":true,"observed":"yes","disposition":"REVIEW","by":"case:service-account"},{"id":"disabled","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"account-name","critical":true,"observed":"unknown","disposition":"REVIEW","by":"check:sa-account-id-not-visible"},{"id":"deletion-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--deletion-policy","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--key-algorithm","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--private-key-type","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--public-key-data","critical":true,"observed":"no","disposition":"NOT_STATED"},{"id":"tcfp-service-account-key--public-key-type","critical":true,"observed":"no","disposition":"NOT_STATED"}]},"axes":{"feasibility":"CONDITIONAL","motion":"REHOST","change_types":["CONFIG"],"blocker_categories":["IDENTITY","UNKNOWN"],"target_platform":"STACKIT service account","confidence":"MEDIUM"}},"property_accounting":{"set":2,"excluded":0,"meaningful":2,"by_status":{"CONSUMED":0,"CONTRACT":0,"NOT_CARRIED":2,"PLACEMENT":0,"RELATION":0,"UNACCOUNTED":0},"unaccounted":[],"not_carried":[{"node":"google_service_account.init","attribute":"account_id"},{"node":"google_service_account.init","attribute":"display_name"}],"class_counts":{"CRITICAL":1,"NON_CRITICAL":1},"critical":[{"node":"google_service_account.init","attribute":"account_id","class":"CRITICAL","category":"identity-access","closure":"CLOSED:NC+REVIEW","by":"NOT CARRIED (google_service_account.init): account_id — the account ID is not visible statically, or the account is declared several times: the STACKIT account is named after the source address. (contract gcp.service_account/account-name:REVIEW)"}],"automation_eligible":false,"open_critical_without_read_set":["role-bindings"],"gate_blockers":[{"source_type":"google_service_account","attribute":"account_id","closure":"CLOSED:NC+REVIEW"},{"target":"type:stackit_authorization_folder_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"type:stackit_authorization_organization_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"type:stackit_authorization_project_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"type:stackit_authorization_service_account_role_assignment","closure":"EXPERIMENTAL_TARGET"},{"target":"provider:google","closure":"PROVIDER:UNVERIFIED"},{"source_type":"google_service_account","closure":"TOPOLOGY:unknown"},{"semantic":"role-bindings","closure":"open-critical-without-read-set"}]}}],"graph":{"files":["apis.tf","containers.tf","database.tf","firebase.tf","iam.tf","jobs.tf","main.tf","outputs.tf","postdeployment.tf","secrets.tf","service.tf","storage.tf","variables.tf","versions.tf",".terraform/modules/project_services/modules/project_services/main.tf",".terraform/modules/project_services/modules/project_services/outputs.tf",".terraform/modules/project_services/modules/project_services/variables.tf",".terraform/modules/project_services/modules/project_services/versions.tf"],"nodes":[{"id":"data.google_client_config.current","mode":"data","provider":"google","source_type":"google_client_config","name":"current","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{},"provenance":{"file":"postdeployment.tf","line":28,"end_line":29}},{"id":"data.google_iam_policy.noauth","mode":"data","provider":"google","source_type":"google_iam_policy","name":"noauth","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"binding":[{"members":["allUsers"],"role":"roles/run.invoker"}]},"provenance":{"file":"service.tf","line":100,"end_line":105}},{"id":"data.http.execute_activategcb_trigger","mode":"data","provider":"http","source_type":"http","name":"execute_activategcb_trigger","multiplicity":"count","enabled":true,"instances":1,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.init ? 1 : 0","variables":["var.init"]},"attrs":{"method":"POST","request_headers":{"Authorization":"\u003cunknown\u003e"},"url":"\u003cunknown\u003e"},"unknown":["request_headers","url"],"unknown_causes":{"request_headers":"runtime-data","url":"provider-computed"},"instance_attrs":[{"method":"POST","request_headers":{"Authorization":"\u003cunknown\u003e"},"url":"\u003cunknown\u003e"}],"instance_keys":["0"],"provenance":{"file":"postdeployment.tf","line":72,"end_line":83}},{"id":"data.http.execute_init_trigger","mode":"data","provider":"http","source_type":"http","name":"execute_init_trigger","multiplicity":"count","enabled":true,"instances":1,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.init ? 1 : 0","variables":["var.init"]},"attrs":{"method":"POST","request_headers":{"Authorization":"\u003cunknown\u003e"},"url":"\u003cunknown\u003e"},"unknown":["request_headers","url"],"unknown_causes":{"request_headers":"runtime-data","url":"provider-computed"},"instance_attrs":[{"method":"POST","request_headers":{"Authorization":"\u003cunknown\u003e"},"url":"\u003cunknown\u003e"}],"instance_keys":["0"],"provenance":{"file":"postdeployment.tf","line":250,"end_line":261}},{"id":"data.http.execute_placeholder_trigger","mode":"data","provider":"http","source_type":"http","name":"execute_placeholder_trigger","multiplicity":"count","enabled":true,"instances":1,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.init ? 1 : 0","variables":["var.init"]},"attrs":{"method":"POST","request_headers":{"Authorization":"\u003cunknown\u003e"},"url":"\u003cunknown\u003e"},"unknown":["request_headers","url"],"unknown_causes":{"request_headers":"runtime-data","url":"provider-computed"},"instance_attrs":[{"method":"POST","request_headers":{"Authorization":"\u003cunknown\u003e"},"url":"\u003cunknown\u003e"}],"instance_keys":["0"],"provenance":{"file":"postdeployment.tf","line":126,"end_line":140}},{"id":"google_cloud_run_service_iam_policy.server_noauth","mode":"managed","provider":"google","source_type":"google_cloud_run_service_iam_policy","name":"server_noauth","category":"identity","kind":"role_binding","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"location":"\u003cunknown\u003e","policy_data":"\u003cunknown\u003e","project":"\u003cunknown\u003e","service":"\u003cunknown\u003e"},"unknown":["location","policy_data","project","service"],"unknown_causes":{"location":"provider-computed","policy_data":"runtime-data","project":"provider-computed","service":"provider-computed"},"provenance":{"file":"service.tf","line":107,"end_line":113}},{"id":"google_cloud_run_v2_job.migrate","mode":"managed","provider":"google","source_type":"google_cloud_run_v2_job","name":"migrate","category":"compute","kind":"container_job","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"deletion_protection":false,"labels":{},"location":"us-central1","name":"\u003cunknown\u003e","template":[{"template":[{"containers":[{"command":{"redacted":true,"fingerprint":"41921c9c49245b2505bdc3235b0623b612ff9be61e624ae351e154368cd868ed","byte_length":11,"format":"unknown"},"env":[{"name":"DJANGO_ENV","value_source":[{"secret_key_ref":[{"secret":"\u003cunknown\u003e","version":"latest"}]}]}],"image":"us-docker.pkg.dev/hsa-public/containers/terraform-python-dynamic-webapp/server:v1.13.4","volume_mounts":[{"mount_path":"/cloudsql","name":"cloudsql"}]}],"service_account":"\u003cunknown\u003e","volumes":[{"cloud_sql_instance":[{"instances":["\u003cunknown\u003e"]}],"name":"cloudsql"}]}]}]},"unknown":["name","template.template.containers.env.value_source.secret_key_ref.secret","template.template.service_account","template.template.volumes.cloud_sql_instance.instances"],"unknown_causes":{"name":"provider-computed","template.template.containers.env.value_source.secret_key_ref.secret":"provider-computed","template.template.service_account":"provider-computed","template.template.volumes.cloud_sql_instance.instances":"provider-computed"},"attr_variables":{"labels":["labels"],"location":["region"],"name":["random_suffix"],"template[0].template[0].containers[0].image":["image_version","server_image_host"]},"provenance":{"file":"jobs.tf","line":18,"end_line":57}},{"id":"google_cloud_run_v2_service.server","mode":"managed","provider":"google","source_type":"google_cloud_run_v2_service","name":"server","category":"compute","kind":"container_service","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"deletion_protection":false,"location":"us-central1","name":"\u003cunknown\u003e","template":[{"containers":[{"env":[{"name":"DJANGO_ENV","value_source":[{"secret_key_ref":[{"secret":"\u003cunknown\u003e","version":"latest"}]}]},{"name":"PYTHONPATH","value":{"redacted":true,"fingerprint":"35e1489eedf45bae30c710ec1a85125930d9c9c5d32c2a91b331b4842e625caa","byte_length":0,"format":"unknown"}},{"name":"DJANGO_SETTINGS_MODULE","value":{"redacted":true,"fingerprint":"d80ad8223f01bd545ccfcc3110c991b61c05c6aab187a54f6066528722ab2fa8","byte_length":20,"format":"unknown"}},{"name":"OTEL_METRICS_EXPORTER","value":{"redacted":true,"fingerprint":"4776ed8215d60fe787805c7a90c16ba46df2399cfa7806f36265f10bff5b85c2","byte_length":4,"format":"unknown"}},{"name":"OTEL_TRACES_EXPORTER","value":{"redacted":true,"fingerprint":"b9b80dde4065637671620300980e3a64f59cf689b28e5bf00f8374b67c68c9e1","byte_length":9,"format":"unknown"}},{"name":"OTEL_PYTHON_EXCLUDED_URLS","value":{"redacted":true,"fingerprint":"5bb94495e8dc06764f7bc123e38f68fe578e0380c81dc1182d8b843c4fbcf567","byte_length":7,"format":"unknown"}},{"name":"DEPLOYMENT_SUFFIX","value":"\u003cunknown\u003e"}],"image":"us-docker.pkg.dev/hsa-public/containers/terraform-python-dynamic-webapp/server:v1.13.4","liveness_probe":[{"http_get":[{"path":"/healthy"}]}],"volume_mounts":[{"mount_path":"/cloudsql","name":"cloudsql"}]}],"labels":{},"service_account":"\u003cunknown\u003e","volumes":[{"cloud_sql_instance":[{"instances":["\u003cunknown\u003e"]}],"name":"cloudsql"}]}],"traffic":[{"percent":100,"type":"TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST"}]},"unknown":["name","template.containers.env.value","template.containers.env.value_source.secret_key_ref.secret","template.service_account","template.volumes.cloud_sql_instance.instances"],"unknown_causes":{"name":"provider-computed","template.containers.env.value":"provider-computed","template.containers.env.value_source.secret_key_ref.secret":"provider-computed","template.service_account":"provider-computed","template.volumes.cloud_sql_instance.instances":"provider-computed"},"attr_variables":{"location":["region"],"name":["random_suffix","service_name"],"template[0].containers[0].env[6].value":["random_suffix"],"template[0].containers[0].image":["image_version","server_image_host"],"template[0].labels":["labels"]},"provenance":{"file":"service.tf","line":17,"end_line":96}},{"id":"google_cloudbuild_trigger.activategcb","mode":"managed","provider":"google","source_type":"google_cloudbuild_trigger","name":"activategcb","category":"compute","kind":"ci_cd_pipeline_trigger","multiplicity":"count","enabled":true,"instances":1,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.init ? 1 : 0","variables":["var.init"]},"attrs":{"build":[{"options":[{"logging":"CLOUD_LOGGING_ONLY"}],"step":[{"id":"no-op","name":"ubuntu","script":{"redacted":true,"fingerprint":"1b34fc7c81bd56b9397fbc7a403eb002b398a7378ba5b125f426eb743e7df06c","byte_length":24,"format":"unknown"}}]}],"description":"Get Cloud Build ready for work. This build is expected to fail.","location":"us-central1","name":"\u003cunknown\u003e","pubsub_config":[{"topic":"\u003cunknown\u003e"}],"service_account":"\u003cunknown\u003e"},"unknown":["name","pubsub_config.topic","service_account"],"unknown_causes":{"name":"provider-computed","pubsub_config.topic":"provider-computed","service_account":"provider-computed"},"instance_attrs":[{"build":[{"options":[{"logging":"CLOUD_LOGGING_ONLY"}],"step":[{"id":"no-op","name":"ubuntu","script":{"redacted":true,"fingerprint":"1b34fc7c81bd56b9397fbc7a403eb002b398a7378ba5b125f426eb743e7df06c","byte_length":24,"format":"unknown"}}]}],"description":"Get Cloud Build ready for work. This build is expected to fail.","location":"us-central1","name":"\u003cunknown\u003e","pubsub_config":[{"topic":"\u003cunknown\u003e"}],"service_account":"\u003cunknown\u003e"}],"instance_keys":["0"],"attr_variables":{"location":["region"],"name":["random_suffix"]},"provenance":{"file":"postdeployment.tf","line":38,"end_line":68}},{"id":"google_cloudbuild_trigger.init","mode":"managed","provider":"google","source_type":"google_cloudbuild_trigger","name":"init","category":"compute","kind":"ci_cd_pipeline_trigger","multiplicity":"count","enabled":true,"instances":1,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.init ? 1 : 0","variables":["var.init"]},"attrs":{"build":[{"options":[{"logging":"CLOUD_LOGGING_ONLY"}],"step":[{"id":"create-client-job","name":"gcr.io/google.com/cloudsdktool/cloud-sdk:slim","script":"\u003cunknown\u003e"},{"id":"create-setup-job","name":"gcr.io/google.com/cloudsdktool/cloud-sdk:slim","script":"\u003cunknown\u003e"},{"id":"execute-setup-job","name":"gcr.io/google.com/cloudsdktool/cloud-sdk:slim","script":"\u003cunknown\u003e"},{"id":"execute-client-job","name":"gcr.io/google.com/cloudsdktool/cloud-sdk:slim","script":"\u003cunknown\u003e"},{"id":"purge-and-warmfirebase","name":"ubuntu","script":"\u003cunknown\u003e"}]}],"description":"Perform initialization setup for server and client","location":"us-central1","name":"\u003cunknown\u003e","pubsub_config":[{"topic":"\u003cunknown\u003e"}],"service_account":"\u003cunknown\u003e"},"unknown":["build.step.script","build.step.script","build.step.script","build.step.script","build.step.script","name","pubsub_config.topic","service_account"],"unknown_causes":{"build.step.script":"provider-computed","name":"provider-computed","pubsub_config.topic":"provider-computed","service_account":"provider-computed"},"instance_attrs":[{"build":[{"options":[{"logging":"CLOUD_LOGGING_ONLY"}],"step":[{"id":"create-client-job","name":"gcr.io/google.com/cloudsdktool/cloud-sdk:slim","script":"\u003cunknown\u003e"},{"id":"create-setup-job","name":"gcr.io/google.com/cloudsdktool/cloud-sdk:slim","script":"\u003cunknown\u003e"},{"id":"execute-setup-job","name":"gcr.io/google.com/cloudsdktool/cloud-sdk:slim","script":"\u003cunknown\u003e"},{"id":"execute-client-job","name":"gcr.io/google.com/cloudsdktool/cloud-sdk:slim","script":"\u003cunknown\u003e"},{"id":"purge-and-warmfirebase","name":"ubuntu","script":"\u003cunknown\u003e"}]}],"description":"Perform initialization setup for server and client","location":"us-central1","name":"\u003cunknown\u003e","pubsub_config":[{"topic":"\u003cunknown\u003e"}],"service_account":"\u003cunknown\u003e"}],"instance_keys":["0"],"attr_variables":{"build[0].step[0].script":["client_image_host","image_version","random_suffix","region"],"build[0].step[1].script":["image_version","random_suffix","region","server_image_host"],"build[0].step[2].script":["random_suffix","region"],"build[0].step[3].script":["random_suffix","region"],"build[0].step[4].script":["random_suffix"],"location":["region"],"name":["random_suffix"]},"provenance":{"file":"postdeployment.tf","line":144,"end_line":246}},{"id":"google_cloudbuild_trigger.placeholder","mode":"managed","provider":"google","source_type":"google_cloudbuild_trigger","name":"placeholder","category":"compute","kind":"ci_cd_pipeline_trigger","multiplicity":"count","enabled":true,"instances":1,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.init ? 1 : 0","variables":["var.init"]},"attrs":{"build":[{"options":[{"logging":"CLOUD_LOGGING_ONLY"}],"step":[{"env":{"redacted":true,"fingerprint":"f0c512e6732d2e1cd5ab46d95b549c06d61eb3fad7f7739ca6e15ff49e628501","byte_length":74,"format":"unknown"},"id":"deploy-placeholder","name":"us-docker.pkg.dev/hsa-public/containers/avocano-placeholder:latest"}]}],"description":"Deploy a placeholder Firebase website","location":"us-central1","name":"\u003cunknown\u003e","pubsub_config":[{"topic":"\u003cunknown\u003e"}],"service_account":"\u003cunknown\u003e"},"unknown":["build.step.env","name","pubsub_config.topic","service_account"],"unknown_causes":{"build.step.env":"provider-computed","name":"provider-computed","pubsub_config.topic":"provider-computed","service_account":"provider-computed"},"instance_attrs":[{"build":[{"options":[{"logging":"CLOUD_LOGGING_ONLY"}],"step":[{"env":{"redacted":true,"fingerprint":"f0c512e6732d2e1cd5ab46d95b549c06d61eb3fad7f7739ca6e15ff49e628501","byte_length":74,"format":"unknown"},"id":"deploy-placeholder","name":"us-docker.pkg.dev/hsa-public/containers/avocano-placeholder:latest"}]}],"description":"Deploy a placeholder Firebase website","location":"us-central1","name":"\u003cunknown\u003e","pubsub_config":[{"topic":"\u003cunknown\u003e"}],"service_account":"\u003cunknown\u003e"}],"instance_keys":["0"],"attr_variables":{"build[0].step[0].env":["random_suffix"],"location":["region"],"name":["random_suffix"]},"provenance":{"file":"postdeployment.tf","line":87,"end_line":121}},{"id":"google_firebase_hosting_site.client","mode":"managed","provider":"google","source_type":"google_firebase_hosting_site","name":"client","category":"network","kind":"web_hosting_site","multiplicity":"count","enabled":true,"instances":1,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.random_suffix ? 1 : 0","variables":["var.random_suffix"]},"attrs":{"project":"\u003cunknown\u003e","site_id":"\u003cunknown\u003e"},"unknown":["project","site_id"],"unknown_causes":{"project":"provider-computed","site_id":"provider-computed"},"instance_attrs":[{"project":"\u003cunknown\u003e","site_id":"\u003cunknown\u003e"}],"instance_keys":["0"],"provenance":{"file":"firebase.tf","line":24,"end_line":34}},{"id":"google_firebase_project.default","mode":"managed","provider":"google","source_type":"google_firebase_project","name":"default","category":"platform","kind":"app_platform_project","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"project":"example-project"},"provenance":{"file":"firebase.tf","line":17,"end_line":22}},{"id":"google_project_iam_member.automation_permissions","mode":"managed","provider":"google","source_type":"google_project_iam_member","name":"automation_permissions","category":"identity","kind":"role_binding","multiplicity":"count","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"member":"\u003cunknown\u003e","project":"example-project","role":"\u003cunknown\u003e"},"unknown":["member","role"],"unknown_causes":{"member":"provider-computed","role":"unknown-iteration"},"instance_attrs":[{"member":"\u003cunknown\u003e","project":"example-project","role":"roles/cloudsql.client"}],"instance_keys":["0"],"provenance":{"file":"iam.tf","line":86,"end_line":92}},{"id":"google_project_iam_member.client_permissions","mode":"managed","provider":"google","source_type":"google_project_iam_member","name":"client_permissions","category":"identity","kind":"role_binding","multiplicity":"count","enabled":true,"instances":2,"presence":"KNOWN_PRESENT","attrs":{"member":"\u003cunknown\u003e","project":"example-project","role":"\u003cunknown\u003e"},"unknown":["member","role"],"unknown_causes":{"member":"provider-computed","role":"unknown-iteration"},"instance_attrs":[{"member":"\u003cunknown\u003e","project":"example-project","role":"roles/run.viewer"},{"member":"\u003cunknown\u003e","project":"example-project","role":"roles/firebasehosting.admin"}],"instance_keys":["0","1"],"provenance":{"file":"iam.tf","line":78,"end_line":84}},{"id":"google_project_iam_member.init_permissions","mode":"managed","provider":"google","source_type":"google_project_iam_member","name":"init_permissions","category":"identity","kind":"role_binding","multiplicity":"count","enabled":true,"instances":5,"presence":"KNOWN_PRESENT","attrs":{"member":"\u003cunknown\u003e","project":"example-project","role":"\u003cunknown\u003e"},"unknown":["member","role"],"unknown_causes":{"member":"provider-computed","role":"unknown-iteration"},"instance_attrs":[{"member":"\u003cunknown\u003e","project":"example-project","role":"roles/logging.logWriter"},{"member":"\u003cunknown\u003e","project":"example-project","role":"roles/cloudbuild.builds.builder"},{"member":"\u003cunknown\u003e","project":"example-project","role":"roles/iam.serviceAccountUser"},{"member":"\u003cunknown\u003e","project":"example-project","role":"roles/run.developer"},{"member":"\u003cunknown\u003e","project":"example-project","role":"roles/firebasehosting.admin"}],"instance_keys":["0","1","2","3","4"],"provenance":{"file":"iam.tf","line":94,"end_line":100}},{"id":"google_project_iam_member.server_permissions","mode":"managed","provider":"google","source_type":"google_project_iam_member","name":"server_permissions","category":"identity","kind":"role_binding","multiplicity":"count","enabled":true,"instances":3,"presence":"KNOWN_PRESENT","attrs":{"member":"\u003cunknown\u003e","project":"example-project","role":"\u003cunknown\u003e"},"unknown":["member","role"],"unknown_causes":{"member":"provider-computed","role":"unknown-iteration"},"instance_attrs":[{"member":"\u003cunknown\u003e","project":"example-project","role":"roles/cloudsql.client"},{"member":"\u003cunknown\u003e","project":"example-project","role":"roles/run.viewer"},{"member":"\u003cunknown\u003e","project":"example-project","role":"roles/cloudtrace.agent"}],"instance_keys":["0","1","2"],"provenance":{"file":"iam.tf","line":70,"end_line":76}},{"id":"google_pubsub_topic.faux","mode":"managed","provider":"google","source_type":"google_pubsub_topic","name":"faux","category":"messaging","kind":"topic","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"name":"\u003cunknown\u003e"},"unknown":["name"],"unknown_causes":{"name":"provider-computed"},"attr_variables":{"name":["random_suffix"]},"provenance":{"file":"postdeployment.tf","line":32,"end_line":34}},{"id":"google_secret_manager_secret.django_admin_password","mode":"managed","provider":"google","source_type":"google_secret_manager_secret","name":"django_admin_password","category":"identity","kind":"secret","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"replication":[{"user_managed":[{"replicas":[{"location":"us-central1"}]}]}],"secret_id":"\u003cunknown\u003e"},"unknown":["secret_id"],"unknown_causes":{"secret_id":"provider-computed"},"attr_variables":{"replication[0].user_managed[0].replicas[0].location":["region"],"secret_id":["random_suffix"]},"provenance":{"file":"secrets.tf","line":25,"end_line":37}},{"id":"google_secret_manager_secret.django_settings","mode":"managed","provider":"google","source_type":"google_secret_manager_secret","name":"django_settings","category":"identity","kind":"secret","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"replication":[{"user_managed":[{"replicas":[{"location":"us-central1"}]}]}],"secret_id":"\u003cunknown\u003e"},"unknown":["secret_id"],"unknown_causes":{"secret_id":"provider-computed"},"attr_variables":{"replication[0].user_managed[0].replicas[0].location":["region"],"secret_id":["random_suffix"]},"provenance":{"file":"secrets.tf","line":56,"end_line":68}},{"id":"google_secret_manager_secret_iam_binding.django_admin_password","mode":"managed","provider":"google","source_type":"google_secret_manager_secret_iam_binding","name":"django_admin_password","category":"identity","kind":"secret_access","facet_of":"google_secret_manager_secret.django_admin_password","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"members":["\u003cunknown\u003e"],"role":"roles/secretmanager.secretAccessor","secret_id":"\u003cunknown\u003e"},"unknown":["members","secret_id"],"unknown_causes":{"members":"provider-computed","secret_id":"provider-computed"},"provenance":{"file":"secrets.tf","line":39,"end_line":43}},{"id":"google_secret_manager_secret_iam_binding.django_settings","mode":"managed","provider":"google","source_type":"google_secret_manager_secret_iam_binding","name":"django_settings","category":"identity","kind":"secret_access","facet_of":"google_secret_manager_secret.django_settings","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"members":["\u003cunknown\u003e","\u003cunknown\u003e"],"role":"roles/secretmanager.secretAccessor","secret_id":"\u003cunknown\u003e"},"unknown":["members","secret_id"],"unknown_causes":{"members":"provider-computed","secret_id":"provider-computed"},"provenance":{"file":"secrets.tf","line":80,"end_line":87}},{"id":"google_secret_manager_secret_version.django_admin_password","mode":"managed","provider":"google","source_type":"google_secret_manager_secret_version","name":"django_admin_password","category":"identity","kind":"secret_version","facet_of":"google_secret_manager_secret.django_admin_password","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"secret":"\u003cunknown\u003e","secret_data":"\u003cunknown\u003e"},"unknown":["secret","secret_data"],"unknown_causes":{"secret":"provider-computed","secret_data":"provider-computed"},"provenance":{"file":"secrets.tf","line":45,"end_line":48}},{"id":"google_secret_manager_secret_version.django_settings","mode":"managed","provider":"google","source_type":"google_secret_manager_secret_version","name":"django_settings","category":"identity","kind":"secret_version","facet_of":"google_secret_manager_secret.django_settings","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"secret":"\u003cunknown\u003e","secret_data":"\u003cunknown\u003e"},"unknown":["secret","secret_data"],"unknown_causes":{"secret":"provider-computed","secret_data":"provider-computed"},"provenance":{"file":"secrets.tf","line":71,"end_line":78}},{"id":"google_service_account.automation","mode":"managed","provider":"google","source_type":"google_service_account","name":"automation","category":"identity","kind":"workload_identity","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"account_id":"\u003cunknown\u003e","display_name":"Automation service account"},"unknown":["account_id"],"unknown_causes":{"account_id":"provider-computed"},"attr_variables":{"account_id":["random_suffix"]},"provenance":{"file":"iam.tf","line":54,"end_line":58}},{"id":"google_service_account.client","mode":"managed","provider":"google","source_type":"google_service_account","name":"client","category":"identity","kind":"workload_identity","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"account_id":"\u003cunknown\u003e","display_name":"Client Frontend service account"},"unknown":["account_id"],"unknown_causes":{"account_id":"provider-computed"},"attr_variables":{"account_id":["random_suffix"]},"provenance":{"file":"iam.tf","line":48,"end_line":52}},{"id":"google_service_account.init","mode":"managed","provider":"google","source_type":"google_service_account","name":"init","category":"identity","kind":"workload_identity","multiplicity":"count","enabled":true,"instances":1,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"count","expr":"var.init ? 1 : 0","variables":["var.init"]},"attrs":{"account_id":"\u003cunknown\u003e","display_name":"Jump Start App Init SA"},"unknown":["account_id"],"unknown_causes":{"account_id":"provider-computed"},"instance_attrs":[{"account_id":"\u003cunknown\u003e","display_name":"Jump Start App Init SA"}],"instance_keys":["0"],"attr_variables":{"account_id":["random_suffix"]},"provenance":{"file":"iam.tf","line":61,"end_line":66}},{"id":"google_service_account.server","mode":"managed","provider":"google","source_type":"google_service_account","name":"server","category":"identity","kind":"workload_identity","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"account_id":"\u003cunknown\u003e","display_name":"API Backend service account"},"unknown":["account_id"],"unknown_causes":{"account_id":"provider-computed"},"attr_variables":{"account_id":["random_suffix"]},"provenance":{"file":"iam.tf","line":42,"end_line":46}},{"id":"google_sql_database.database","mode":"managed","provider":"google","source_type":"google_sql_database","name":"database","category":"data","kind":"relational_database_db","facet_of":"google_sql_database_instance.postgres","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"deletion_policy":"ABANDON","instance":"\u003cunknown\u003e","name":"\u003cunknown\u003e"},"unknown":["instance","name"],"unknown_causes":{"instance":"provider-computed","name":"provider-computed"},"attr_variables":{"name":["database_name","random_suffix"]},"provenance":{"file":"database.tf","line":41,"end_line":45}},{"id":"google_sql_database_instance.postgres","mode":"managed","provider":"google","source_type":"google_sql_database_instance","name":"postgres","category":"data","kind":"relational_database","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"database_version":"POSTGRES_14","deletion_protection":false,"name":"\u003cunknown\u003e","project":"example-project","region":"us-central1","settings":[{"tier":"db-custom-2-4096","user_labels":{}}]},"unknown":["name"],"unknown_causes":{"name":"provider-computed"},"attr_variables":{"name":["instance_name","random_suffix"],"region":["region"],"settings[0].user_labels":["labels"]},"provenance":{"file":"database.tf","line":25,"end_line":38}},{"id":"google_sql_user.django","mode":"managed","provider":"google","source_type":"google_sql_user","name":"django","category":"data","kind":"db_user","facet_of":"google_sql_database_instance.postgres","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"deletion_policy":"ABANDON","instance":"\u003cunknown\u003e","name":"\u003cunknown\u003e","password":"\u003cunknown\u003e"},"unknown":["instance","name","password"],"unknown_causes":{"instance":"provider-computed","name":"provider-computed","password":"provider-computed"},"attr_variables":{"name":["database_username","random_suffix"]},"provenance":{"file":"database.tf","line":50,"end_line":55}},{"id":"google_storage_bucket.media","mode":"managed","provider":"google","source_type":"google_storage_bucket","name":"media","category":"storage","kind":"object_bucket","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"force_destroy":true,"labels":{},"location":"us-central1","name":"\u003cunknown\u003e","storage_class":"REGIONAL"},"unknown":["name"],"unknown_causes":{"name":"provider-computed"},"attr_variables":{"labels":["labels"],"location":["region"],"name":["random_suffix"]},"provenance":{"file":"storage.tf","line":17,"end_line":25}},{"id":"google_storage_bucket_iam_member.automation","mode":"managed","provider":"google","source_type":"google_storage_bucket_iam_member","name":"automation","category":"storage","kind":"bucket_policy","facet_of":"google_storage_bucket.media","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"bucket":"\u003cunknown\u003e","member":"\u003cunknown\u003e","role":"roles/storage.admin"},"unknown":["bucket","member"],"unknown_causes":{"bucket":"provider-computed","member":"provider-computed"},"provenance":{"file":"storage.tf","line":33,"end_line":37}},{"id":"google_storage_bucket_iam_member.server","mode":"managed","provider":"google","source_type":"google_storage_bucket_iam_member","name":"server","category":"storage","kind":"bucket_policy","facet_of":"google_storage_bucket.media","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"bucket":"\u003cunknown\u003e","member":"\u003cunknown\u003e","role":"roles/storage.admin"},"unknown":["bucket","member"],"unknown_causes":{"bucket":"provider-computed","member":"provider-computed"},"provenance":{"file":"storage.tf","line":27,"end_line":31}},{"id":"module.project_services.data.google_compute_default_service_account.default","mode":"data","provider":"google","source_type":"google_compute_default_service_account","name":"default","module_path":["project_services"],"multiplicity":"count","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"project":"example-project"},"provenance":{"file":".terraform/modules/project_services/modules/project_services/main.tf","line":53,"end_line":56}},{"id":"module.project_services.google_project_iam_member.project_service_identity_roles","mode":"managed","provider":"google","source_type":"google_project_iam_member","name":"project_service_identity_roles","module_path":["project_services"],"category":"identity","kind":"role_binding","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"member":"\u003cunknown\u003e","project":"example-project","role":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/project_services/modules/project_services/main.tf","line":79,"end_line":85}},{"id":"module.project_services.google_project_service.project_services","mode":"managed","provider":"google","source_type":"google_project_service","name":"project_services","module_path":["project_services"],"category":"organisation","kind":"api_enablement","multiplicity":"for_each","enabled":true,"instances":24,"presence":"CONDITIONAL","presence_cause":{"kind":"root-variable-overridable","where":"for_each","expr":"local.services","variables":["var.enable_apis"]},"attrs":{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"\u003cunknown\u003e"},"unknown":["service"],"unknown_causes":{"service":"unknown-iteration"},"instance_attrs":[{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"artifactregistry.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"bigquery.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"bigquerymigration.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"bigquerystorage.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"cloudbuild.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"cloudresourcemanager.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"cloudtrace.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"compute.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"datastore.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"firebase.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"firebasehosting.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"iam.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"logging.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"monitoring.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"pubsub.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"run.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"secretmanager.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"servicemanagement.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"serviceusage.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"sql-component.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"sqladmin.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"storage-api.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"storage-component.googleapis.com"},{"disable_dependent_services":true,"disable_on_destroy":false,"project":"example-project","service":"storage.googleapis.com"}],"instance_keys":["artifactregistry.googleapis.com","bigquery.googleapis.com","bigquerymigration.googleapis.com","bigquerystorage.googleapis.com","cloudbuild.googleapis.com","cloudresourcemanager.googleapis.com","cloudtrace.googleapis.com","compute.googleapis.com","datastore.googleapis.com","firebase.googleapis.com","firebasehosting.googleapis.com","iam.googleapis.com","logging.googleapis.com","monitoring.googleapis.com","pubsub.googleapis.com","run.googleapis.com","secretmanager.googleapis.com","servicemanagement.googleapis.com","serviceusage.googleapis.com","sql-component.googleapis.com","sqladmin.googleapis.com","storage-api.googleapis.com","storage-component.googleapis.com","storage.googleapis.com"],"provenance":{"file":".terraform/modules/project_services/modules/project_services/main.tf","line":31,"end_line":37}},{"id":"module.project_services.google_project_service_identity.project_service_identities","mode":"managed","provider":"google","source_type":"google_project_service_identity","name":"project_service_identities","module_path":["project_services"],"category":"identity","kind":"service_agent","multiplicity":"for_each","enabled":false,"instances":0,"presence":"KNOWN_ABSENT","attrs":{"project":"example-project","service":"\u003cunknown\u003e"},"provenance":{"file":".terraform/modules/project_services/modules/project_services/main.tf","line":40,"end_line":50}},{"id":"random_id.suffix","mode":"managed","provider":"random","source_type":"random_id","name":"suffix","category":"support","kind":"generated_value","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"byte_length":2},"provenance":{"file":"database.tf","line":21,"end_line":23}},{"id":"random_password.database_user_password","mode":"managed","provider":"random","source_type":"random_password","name":"database_user_password","category":"support","kind":"generated_secret","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"length":30,"special":false},"provenance":{"file":"database.tf","line":57,"end_line":60}},{"id":"random_password.django_admin_password","mode":"managed","provider":"random","source_type":"random_password","name":"django_admin_password","category":"support","kind":"generated_secret","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"length":32,"special":false},"provenance":{"file":"secrets.tf","line":20,"end_line":23}},{"id":"random_password.django_secret_key","mode":"managed","provider":"random","source_type":"random_password","name":"django_secret_key","category":"support","kind":"generated_secret","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"length":50,"special":false},"provenance":{"file":"secrets.tf","line":52,"end_line":55}},{"id":"time_sleep.init_permissions_propagation","mode":"managed","provider":"time","source_type":"time_sleep","name":"init_permissions_propagation","category":"support","kind":"timing","multiplicity":"one","enabled":true,"instances":1,"presence":"KNOWN_PRESENT","attrs":{"create_duration":"60s"},"provenance":{"file":"iam.tf","line":108,"end_line":114}}],"edges":[{"from":"data.http.execute_activategcb_trigger","to":"data.google_client_config.current","type":"DEPENDS_ON","via":"request_headers"},{"from":"data.http.execute_activategcb_trigger","to":"google_cloudbuild_trigger.activategcb","type":"DEPENDS_ON","via":"url"},{"from":"data.http.execute_init_trigger","to":"data.google_client_config.current","type":"DEPENDS_ON","via":"request_headers"},{"from":"data.http.execute_init_trigger","to":"google_cloudbuild_trigger.init","type":"DEPENDS_ON","via":"url"},{"from":"data.http.execute_placeholder_trigger","to":"data.google_client_config.current","type":"DEPENDS_ON","via":"request_headers"},{"from":"data.http.execute_placeholder_trigger","to":"data.http.execute_activategcb_trigger","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"data.http.execute_placeholder_trigger","to":"google_cloudbuild_trigger.placeholder","type":"DEPENDS_ON","via":"url"},{"from":"google_cloud_run_service_iam_policy.server_noauth","to":"data.google_iam_policy.noauth","type":"DEPENDS_ON","via":"policy_data"},{"from":"google_cloud_run_service_iam_policy.server_noauth","to":"google_cloud_run_v2_service.server","type":"DEPENDS_ON","via":"location"},{"from":"google_cloud_run_v2_job.migrate","to":"google_secret_manager_secret.django_settings","type":"DEPENDS_ON","via":"template.template.containers.env.value_source.secret_key_ref.secret"},{"from":"google_cloud_run_v2_job.migrate","to":"google_secret_manager_secret_version.django_settings","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_cloud_run_v2_job.migrate","to":"google_service_account.automation","type":"DEPENDS_ON","via":"template.template.service_account"},{"from":"google_cloud_run_v2_job.migrate","to":"google_sql_database_instance.postgres","type":"DEPENDS_ON","via":"template.template.volumes.cloud_sql_instance.instances"},{"from":"google_cloud_run_v2_job.migrate","to":"random_id.suffix","type":"DEPENDS_ON","via":"name"},{"from":"google_cloud_run_v2_service.server","to":"google_secret_manager_secret.django_settings","type":"DEPENDS_ON","via":"template.containers.env.value_source.secret_key_ref.secret"},{"from":"google_cloud_run_v2_service.server","to":"google_secret_manager_secret_version.django_settings","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_cloud_run_v2_service.server","to":"google_service_account.server","type":"DEPENDS_ON","via":"template.service_account"},{"from":"google_cloud_run_v2_service.server","to":"google_sql_database_instance.postgres","type":"DEPENDS_ON","via":"template.volumes.cloud_sql_instance.instances"},{"from":"google_cloud_run_v2_service.server","to":"random_id.suffix","type":"DEPENDS_ON","via":"name"},{"from":"google_cloudbuild_trigger.activategcb","to":"google_project_iam_member.init_permissions","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_cloudbuild_trigger.activategcb","to":"google_pubsub_topic.faux","type":"DEPENDS_ON","via":"pubsub_config.topic"},{"from":"google_cloudbuild_trigger.activategcb","to":"google_service_account.init","type":"DEPENDS_ON","via":"service_account"},{"from":"google_cloudbuild_trigger.activategcb","to":"random_id.suffix","type":"DEPENDS_ON","via":"name"},{"from":"google_cloudbuild_trigger.init","to":"google_cloud_run_v2_job.migrate","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_cloudbuild_trigger.init","to":"google_cloud_run_v2_service.server","type":"DEPENDS_ON","via":"build.step.script"},{"from":"google_cloudbuild_trigger.init","to":"google_firebase_hosting_site.client","type":"DEPENDS_ON","via":"build.step.script"},{"from":"google_cloudbuild_trigger.init","to":"google_pubsub_topic.faux","type":"DEPENDS_ON","via":"pubsub_config.topic"},{"from":"google_cloudbuild_trigger.init","to":"google_secret_manager_secret.django_admin_password","type":"DEPENDS_ON","via":"build.step.script"},{"from":"google_cloudbuild_trigger.init","to":"google_secret_manager_secret.django_settings","type":"DEPENDS_ON","via":"build.step.script"},{"from":"google_cloudbuild_trigger.init","to":"google_service_account.automation","type":"DEPENDS_ON","via":"build.step.script"},{"from":"google_cloudbuild_trigger.init","to":"google_service_account.client","type":"DEPENDS_ON","via":"build.step.script"},{"from":"google_cloudbuild_trigger.init","to":"google_service_account.init","type":"DEPENDS_ON","via":"service_account"},{"from":"google_cloudbuild_trigger.init","to":"google_sql_database_instance.postgres","type":"DEPENDS_ON","via":"build.step.script"},{"from":"google_cloudbuild_trigger.init","to":"random_id.suffix","type":"DEPENDS_ON","via":"name"},{"from":"google_cloudbuild_trigger.init","to":"time_sleep.init_permissions_propagation","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_cloudbuild_trigger.placeholder","to":"google_firebase_hosting_site.client","type":"DEPENDS_ON","via":"build.step.env"},{"from":"google_cloudbuild_trigger.placeholder","to":"google_pubsub_topic.faux","type":"DEPENDS_ON","via":"pubsub_config.topic"},{"from":"google_cloudbuild_trigger.placeholder","to":"google_service_account.init","type":"DEPENDS_ON","via":"service_account"},{"from":"google_cloudbuild_trigger.placeholder","to":"random_id.suffix","type":"DEPENDS_ON","via":"name"},{"from":"google_cloudbuild_trigger.placeholder","to":"time_sleep.init_permissions_propagation","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_firebase_hosting_site.client","to":"google_firebase_project.default","type":"DEPENDS_ON","via":"project"},{"from":"google_firebase_hosting_site.client","to":"module.project_services.data.google_compute_default_service_account.default","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_firebase_hosting_site.client","to":"module.project_services.google_project_iam_member.project_service_identity_roles","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_firebase_hosting_site.client","to":"module.project_services.google_project_service.project_services","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_firebase_hosting_site.client","to":"module.project_services.google_project_service_identity.project_service_identities","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_firebase_hosting_site.client","to":"random_id.suffix","type":"DEPENDS_ON","via":"site_id"},{"from":"google_firebase_project.default","to":"module.project_services.data.google_compute_default_service_account.default","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_firebase_project.default","to":"module.project_services.google_project_iam_member.project_service_identity_roles","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_firebase_project.default","to":"module.project_services.google_project_service.project_services","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_firebase_project.default","to":"module.project_services.google_project_service_identity.project_service_identities","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_project_iam_member.automation_permissions","to":"google_service_account.automation","type":"DEPENDS_ON","via":"member"},{"from":"google_project_iam_member.client_permissions","to":"google_service_account.client","type":"DEPENDS_ON","via":"member"},{"from":"google_project_iam_member.init_permissions","to":"google_service_account.init","type":"DEPENDS_ON","via":"member"},{"from":"google_project_iam_member.server_permissions","to":"google_service_account.server","type":"DEPENDS_ON","via":"member"},{"from":"google_pubsub_topic.faux","to":"random_id.suffix","type":"DEPENDS_ON","via":"name"},{"from":"google_secret_manager_secret.django_admin_password","to":"module.project_services.data.google_compute_default_service_account.default","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_secret_manager_secret.django_admin_password","to":"module.project_services.google_project_iam_member.project_service_identity_roles","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_secret_manager_secret.django_admin_password","to":"module.project_services.google_project_service.project_services","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_secret_manager_secret.django_admin_password","to":"module.project_services.google_project_service_identity.project_service_identities","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_secret_manager_secret.django_admin_password","to":"random_id.suffix","type":"DEPENDS_ON","via":"secret_id"},{"from":"google_secret_manager_secret.django_settings","to":"module.project_services.data.google_compute_default_service_account.default","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_secret_manager_secret.django_settings","to":"module.project_services.google_project_iam_member.project_service_identity_roles","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_secret_manager_secret.django_settings","to":"module.project_services.google_project_service.project_services","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_secret_manager_secret.django_settings","to":"module.project_services.google_project_service_identity.project_service_identities","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_secret_manager_secret.django_settings","to":"random_id.suffix","type":"DEPENDS_ON","via":"secret_id"},{"from":"google_secret_manager_secret_iam_binding.django_admin_password","to":"google_secret_manager_secret.django_admin_password","type":"DEPENDS_ON","via":"secret_id"},{"from":"google_secret_manager_secret_iam_binding.django_admin_password","to":"google_service_account.automation","type":"DEPENDS_ON","via":"members"},{"from":"google_secret_manager_secret_iam_binding.django_settings","to":"google_secret_manager_secret.django_settings","type":"DEPENDS_ON","via":"secret_id"},{"from":"google_secret_manager_secret_iam_binding.django_settings","to":"google_service_account.automation","type":"DEPENDS_ON","via":"members"},{"from":"google_secret_manager_secret_iam_binding.django_settings","to":"google_service_account.server","type":"DEPENDS_ON","via":"members"},{"from":"google_secret_manager_secret_version.django_admin_password","to":"google_secret_manager_secret.django_admin_password","type":"DEPENDS_ON","via":"secret"},{"from":"google_secret_manager_secret_version.django_admin_password","to":"random_password.django_admin_password","type":"DEPENDS_ON","via":"secret_data"},{"from":"google_secret_manager_secret_version.django_settings","to":"google_secret_manager_secret.django_settings","type":"DEPENDS_ON","via":"secret"},{"from":"google_secret_manager_secret_version.django_settings","to":"google_sql_database.database","type":"DEPENDS_ON","via":"secret_data"},{"from":"google_secret_manager_secret_version.django_settings","to":"google_sql_database_instance.postgres","type":"DEPENDS_ON","via":"secret_data"},{"from":"google_secret_manager_secret_version.django_settings","to":"google_sql_user.django","type":"DEPENDS_ON","via":"secret_data"},{"from":"google_secret_manager_secret_version.django_settings","to":"google_storage_bucket.media","type":"DEPENDS_ON","via":"secret_data"},{"from":"google_secret_manager_secret_version.django_settings","to":"random_password.django_secret_key","type":"DEPENDS_ON","via":"secret_data"},{"from":"google_service_account.automation","to":"module.project_services.data.google_compute_default_service_account.default","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_service_account.automation","to":"module.project_services.google_project_iam_member.project_service_identity_roles","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_service_account.automation","to":"module.project_services.google_project_service.project_services","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_service_account.automation","to":"module.project_services.google_project_service_identity.project_service_identities","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_service_account.automation","to":"random_id.suffix","type":"DEPENDS_ON","via":"account_id"},{"from":"google_service_account.client","to":"module.project_services.data.google_compute_default_service_account.default","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_service_account.client","to":"module.project_services.google_project_iam_member.project_service_identity_roles","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_service_account.client","to":"module.project_services.google_project_service.project_services","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_service_account.client","to":"module.project_services.google_project_service_identity.project_service_identities","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_service_account.client","to":"random_id.suffix","type":"DEPENDS_ON","via":"account_id"},{"from":"google_service_account.init","to":"module.project_services.data.google_compute_default_service_account.default","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_service_account.init","to":"module.project_services.google_project_iam_member.project_service_identity_roles","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_service_account.init","to":"module.project_services.google_project_service.project_services","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_service_account.init","to":"module.project_services.google_project_service_identity.project_service_identities","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_service_account.init","to":"random_id.suffix","type":"DEPENDS_ON","via":"account_id"},{"from":"google_service_account.server","to":"module.project_services.data.google_compute_default_service_account.default","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_service_account.server","to":"module.project_services.google_project_iam_member.project_service_identity_roles","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_service_account.server","to":"module.project_services.google_project_service.project_services","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_service_account.server","to":"module.project_services.google_project_service_identity.project_service_identities","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_service_account.server","to":"random_id.suffix","type":"DEPENDS_ON","via":"account_id"},{"from":"google_sql_database.database","to":"google_sql_database_instance.postgres","type":"DEPENDS_ON","via":"instance"},{"from":"google_sql_database.database","to":"random_id.suffix","type":"DEPENDS_ON","via":"name"},{"from":"google_sql_database_instance.postgres","to":"module.project_services.data.google_compute_default_service_account.default","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_sql_database_instance.postgres","to":"module.project_services.google_project_iam_member.project_service_identity_roles","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_sql_database_instance.postgres","to":"module.project_services.google_project_service.project_services","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_sql_database_instance.postgres","to":"module.project_services.google_project_service_identity.project_service_identities","type":"DEPENDS_ON","via":"depends_on","explicit":true},{"from":"google_sql_database_instance.postgres","to":"random_id.suffix","type":"DEPENDS_ON","via":"name"},{"from":"google_sql_user.django","to":"google_sql_database_instance.postgres","type":"DEPENDS_ON","via":"instance"},{"from":"google_sql_user.django","to":"random_id.suffix","type":"DEPENDS_ON","via":"name"},{"from":"google_sql_user.django","to":"random_password.database_user_password","type":"DEPENDS_ON","via":"password"},{"from":"google_storage_bucket.media","to":"random_id.suffix","type":"DEPENDS_ON","via":"name"},{"from":"google_storage_bucket_iam_member.automation","to":"google_service_account.automation","type":"DEPENDS_ON","via":"member"},{"from":"google_storage_bucket_iam_member.automation","to":"google_storage_bucket.media","type":"DEPENDS_ON","via":"bucket"},{"from":"google_storage_bucket_iam_member.server","to":"google_service_account.server","type":"DEPENDS_ON","via":"member"},{"from":"google_storage_bucket_iam_member.server","to":"google_storage_bucket.media","type":"DEPENDS_ON","via":"bucket"},{"from":"module.project_services.google_project_iam_member.project_service_identity_roles","to":"module.project_services.data.google_compute_default_service_account.default","type":"DEPENDS_ON","via":"for_each","fanout":2},{"from":"module.project_services.google_project_iam_member.project_service_identity_roles","to":"module.project_services.google_project_service_identity.project_service_identities","type":"DEPENDS_ON","via":"for_each","fanout":2},{"from":"time_sleep.init_permissions_propagation","to":"google_project_iam_member.init_permissions","type":"DEPENDS_ON","via":"depends_on","explicit":true}],"diagnostics":[{"severity":"info","message":"unconsumed-lookup: data.google_client_config.current (data source google_client_config) is read by no enabled resource, provider block, output or check block of this scan, so no unit takes anything from it.","node_id":"data.google_client_config.current","provenance":{"file":"postdeployment.tf","line":28,"end_line":29}},{"severity":"info","message":"unconsumed-lookup: data.http.execute_activategcb_trigger (data source http) is read by no enabled resource, provider block, output or check block of this scan, so no unit takes anything from it.","node_id":"data.http.execute_activategcb_trigger","provenance":{"file":"postdeployment.tf","line":72,"end_line":83}},{"severity":"info","message":"unconsumed-lookup: data.http.execute_init_trigger (data source http) is read by no enabled resource, provider block, output or check block of this scan, so no unit takes anything from it.","node_id":"data.http.execute_init_trigger","provenance":{"file":"postdeployment.tf","line":250,"end_line":261}},{"severity":"info","message":"unconsumed-lookup: data.http.execute_placeholder_trigger (data source http) is read by no enabled resource, provider block, output or check block of this scan, so no unit takes anything from it.","node_id":"data.http.execute_placeholder_trigger","provenance":{"file":"postdeployment.tf","line":126,"end_line":140}}],"module_calls":[{"address":"module.project_services","source":"terraform-google-modules/project-factory/google//modules/project_services","source_kind":"other","version_constraint":"18.0.0","version_resolved":"18.0.0","dir":".terraform/modules/project_services/modules/project_services","state":"LOADED","instances":1,"presence":"KNOWN_PRESENT","provenance":{"file":"apis.tf","line":22,"end_line":58}}],"source_providers":[{"name":"google","constraints":["\u003e= 3.43, \u003c 7","\u003e= 6, \u003c 8"],"tested":"8.4.0","status":"UNVERIFIED","note":"no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint \"\u003e= 6, \u003c 8\" excludes it (pinned 8.4.0)","identity":"DECLARED","identity_basis":"REQUIRED_PROVIDERS_SOURCE","identity_evidence":"PINNED_REGISTRY","version_provenance":"CONSTRAINT_ONLY","registry_address":"registry.terraform.io/hashicorp/google","local_names":["google"],"constraint_sources":[{"expr":"\u003e= 6, \u003c 8","provenance":{"file":"versions.tf","line":20,"end_line":23}},{"expr":"\u003e= 3.43, \u003c 7","module_path":"module.project_services","provenance":{"file":".terraform/modules/project_services/modules/project_services/versions.tf","line":20,"end_line":23}}],"declarations":[{"local_name":"google","source":"hashicorp/google","provenance":{"file":"versions.tf","line":20,"end_line":23}},{"module_path":"module.project_services","local_name":"google","source":"hashicorp/google","provenance":{"file":".terraform/modules/project_services/modules/project_services/versions.tf","line":20,"end_line":23}}],"remaps":[{"module_path":"module.project_services","local_name":"google","root_configuration":"google-beta"}]},{"name":"google-beta","constraints":["\u003e= 3.43, \u003c 7","\u003e= 6, \u003c 8"],"tested":"8.4.0","status":"UNVERIFIED","note":"no lock file records the version of registry.terraform.io/hashicorp/google-beta, and the constraint \"\u003e= 6, \u003c 8\" excludes it (pinned 8.4.0)","identity":"DECLARED","identity_basis":"REQUIRED_PROVIDERS_SOURCE","identity_evidence":"PINNED_REGISTRY","version_provenance":"CONSTRAINT_ONLY","registry_address":"registry.terraform.io/hashicorp/google-beta","local_names":["google-beta"],"constraint_sources":[{"expr":"\u003e= 6, \u003c 8","provenance":{"file":"versions.tf","line":24,"end_line":27}},{"expr":"\u003e= 3.43, \u003c 7","module_path":"module.project_services","provenance":{"file":".terraform/modules/project_services/modules/project_services/versions.tf","line":24,"end_line":27}}],"declarations":[{"local_name":"google-beta","source":"hashicorp/google-beta","provenance":{"file":"versions.tf","line":24,"end_line":27}},{"module_path":"module.project_services","local_name":"google-beta","source":"hashicorp/google-beta","provenance":{"file":".terraform/modules/project_services/modules/project_services/versions.tf","line":24,"end_line":27}}]},{"name":"http","status":"UNVERIFIED","note":"The knowledge base holds no pinned source schema of this provider, so its version cannot be checked (UNVERIFIED); the row records that the configuration uses it and changes no decision.","identity":"RESOLVED","identity_basis":"IMPLICIT_TYPE_PREFIX","identity_note":"no source is stated; the provider is taken to be registry.terraform.io/hashicorp/http (Terraform: registry.terraform.io/hashicorp/\u003clocal name\u003e; the terraform_* resources: the built-in provider)","identity_evidence":"UNVERIFIED","version_provenance":"UNPINNED","registry_address":"registry.terraform.io/hashicorp/http","local_names":["http"]},{"name":"random","constraints":["\u003e= 2.2"],"status":"UNVERIFIED","note":"The knowledge base holds no pinned source schema of this provider, so its version cannot be checked (UNVERIFIED); the row records that the configuration uses it and changes no decision.","identity":"DECLARED","identity_basis":"REQUIRED_PROVIDERS_SOURCE","identity_evidence":"UNVERIFIED","version_provenance":"CONSTRAINT_ONLY","registry_address":"registry.terraform.io/hashicorp/random","local_names":["random"],"constraint_sources":[{"expr":"\u003e= 2.2","provenance":{"file":"versions.tf","line":28,"end_line":31}}],"declarations":[{"local_name":"random","source":"hashicorp/random","provenance":{"file":"versions.tf","line":28,"end_line":31}}]},{"name":"time","status":"UNVERIFIED","note":"The knowledge base holds no pinned source schema of this provider, so its version cannot be checked (UNVERIFIED); the row records that the configuration uses it and changes no decision.","identity":"RESOLVED","identity_basis":"IMPLICIT_TYPE_PREFIX","identity_note":"no source is stated; the provider is taken to be registry.terraform.io/hashicorp/time (Terraform: registry.terraform.io/hashicorp/\u003clocal name\u003e; the terraform_* resources: the built-in provider)","identity_evidence":"UNVERIFIED","version_provenance":"UNPINNED","registry_address":"registry.terraform.io/hashicorp/time","local_names":["time"]}],"provider_regions":[{"provider":"google","region":"us-central1","set":true,"region_stated":false},{"provider":"google-beta","region":"us-central1","set":true,"region_stated":false}]},"module_calls":[{"address":"module.project_services","source":"terraform-google-modules/project-factory/google//modules/project_services","version_or_ref":"18.0.0","immutable_ref":false,"fetched_at":"2026-11-07T04:24:16Z"}],"module_fetch":{"network_policy":"AUTO","managed_cache":"used","modules":[{"address":"module.project_services","from":"download","version":"18.0.0","identity":"OTHER_REMOTE","commit":"97a03f2bf4bf1972e12467bc90850e53b6730d8f","freshness":"fetched_this_run","note":"commit 97a03f2bf4bf1972e12467bc90850e53b6730d8f resolved from the source this run"}],"outbound_requests":[{"host":"github.com","purpose":"module download","modules":["module.project_services"],"result":"ok"}]},"support_accounting":[{"node":"google_cloud_run_service_iam_policy.server_noauth","source_type":"google_cloud_run_service_iam_policy","critical":[{"node":"google_cloud_run_service_iam_policy.server_noauth","attribute":"location","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.google_cloud_run_service_iam_policy/sp-location:REVIEW"},{"node":"google_cloud_run_service_iam_policy.server_noauth","attribute":"policy_data","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.google_cloud_run_service_iam_policy/sp-policy-data:REVIEW"},{"node":"google_cloud_run_service_iam_policy.server_noauth","attribute":"project","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.google_cloud_run_service_iam_policy/sp-project:REVIEW"},{"node":"google_cloud_run_service_iam_policy.server_noauth","attribute":"service","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.google_cloud_run_service_iam_policy/sp-service:REVIEW"}]},{"node":"google_project_iam_member.automation_permissions","source_type":"google_project_iam_member","critical":[{"node":"google_project_iam_member.automation_permissions","attribute":"member","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.google_project_iam_member/sp-member:REVIEW"},{"node":"google_project_iam_member.automation_permissions","attribute":"project","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.google_project_iam_member/sp-project:REVIEW"},{"node":"google_project_iam_member.automation_permissions","attribute":"role","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.google_project_iam_member/sp-role:REVIEW"}]},{"node":"google_project_iam_member.client_permissions","source_type":"google_project_iam_member","critical":[{"node":"google_project_iam_member.client_permissions","attribute":"member","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.google_project_iam_member/sp-member:REVIEW"},{"node":"google_project_iam_member.client_permissions","attribute":"project","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.google_project_iam_member/sp-project:REVIEW"},{"node":"google_project_iam_member.client_permissions","attribute":"role","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.google_project_iam_member/sp-role:REVIEW"}]},{"node":"google_project_iam_member.init_permissions","source_type":"google_project_iam_member","critical":[{"node":"google_project_iam_member.init_permissions","attribute":"member","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.google_project_iam_member/sp-member:REVIEW"},{"node":"google_project_iam_member.init_permissions","attribute":"project","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.google_project_iam_member/sp-project:REVIEW"},{"node":"google_project_iam_member.init_permissions","attribute":"role","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.google_project_iam_member/sp-role:REVIEW"}]},{"node":"google_project_iam_member.server_permissions","source_type":"google_project_iam_member","critical":[{"node":"google_project_iam_member.server_permissions","attribute":"member","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.google_project_iam_member/sp-member:REVIEW"},{"node":"google_project_iam_member.server_permissions","attribute":"project","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.google_project_iam_member/sp-project:REVIEW"},{"node":"google_project_iam_member.server_permissions","attribute":"role","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.google_project_iam_member/sp-role:REVIEW"}]},{"node":"module.project_services.google_project_service.project_services","source_type":"google_project_service","critical":[{"node":"module.project_services.google_project_service.project_services","attribute":"disable_dependent_services","class":"CRITICAL","category":"deletion-protection","closure":"CLOSED:REVIEW","by":"support.google_project_service/sp-disable-dependent-services:REVIEW"},{"node":"module.project_services.google_project_service.project_services","attribute":"disable_on_destroy","class":"CRITICAL","category":"deletion-protection","closure":"CLOSED:REVIEW","by":"support.google_project_service/sp-disable-on-destroy:REVIEW"},{"node":"module.project_services.google_project_service.project_services","attribute":"project","class":"CRITICAL","category":"identity-access","closure":"CLOSED:REVIEW","by":"support.google_project_service/sp-project:REVIEW"},{"node":"module.project_services.google_project_service.project_services","attribute":"service","class":"CRITICAL","category":"workload-compatibility","closure":"CLOSED:REVIEW","by":"support.google_project_service/sp-service:REVIEW"}]}],"target_lifecycle":{"units":[{"address":"google_cloud_run_v2_job.migrate","lifecycle":{"state":"GA","state_reason":"the pinned provider schema has no beta, experimental or deprecated notice on the target's resources","sets":[{"capability":"compute.managed-kubernetes","subject_kind":"kubernetes_minor_version","title":"SKE Kubernetes versions","as_of":"2026-11-03","recheck_after":"2027-02-01","expiring_window_days":30,"production_suitability":"SUITABLE","day2":{"forced_update_by":"PROVIDER","forced_update_statement":"\"If the Kubernetes or OS version of a cluster has reached its expiration date, SKE starts a mandatory update to the highest available patch version of the current minor version, or to the highest patch version of the consecutive minor version that is not classified as preview version.\" and \"mandatory version updates run, even if the auto update for the Kubernetes version is deactivated\". Automatic updates otherwise \"only update to higher patch levels\" in the cluster's maintenance window.","notice":"\"As a SKE user you will get informed via release notes and via email in case you are operating a cluster with a deprecated Kubernetes version.\"","customer_action":"\"you can check the exact expiration dates for your current Kubernetes and node pool versions in the cluster.status.expiration field via the SKE API\". The page does not assign any further duty (workload readiness for the update, testing) to the customer or to STACKIT: not stated."},"versions":[{"subject":"1.36","state":"SUPPORTED","disputed":false,"released_at":{"date":"2026-08-27","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2027-06-09","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-11-03"},"production_suitability":"SUITABLE","upgrade_action":"PLAN","migration_timing_risk":"LOW","note":"The expiry day of 1.36 was not published on 2026-10-08 and is on 2026-11-03; the page has no release column, so the release date is still the one of the release note."},{"subject":"1.35","state":"UNKNOWN","disputed":false,"expires_at":{"date":"2027-02-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-11-03"},"production_suitability":"UNKNOWN","upgrade_action":"UNKNOWN","migration_timing_risk":"UNKNOWN","note":"The pages read give no release date for 1.35 (no release-note entry), so the state stays UNKNOWN: a future expiry date does not say that a version is offered. The 1.34 deprecation entry names 1.35 as the upgrade target, and the SKE API catalogue that ships with this build (fetched 2026-10-18) lists 1.35.8 as supported; the draft of the Kubernetes version reads that catalogue for a row like this one, so a release date is not estimated here."},{"subject":"1.34","state":"EXPIRED","disputed":false,"released_at":{"date":"2025-12-16","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-08-28","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-10-14","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"Clusters still on 1.34 are upgraded to 1.35 by the mandatory update (release note of 2026-08-28); the day it runs inside the maintenance window is not stated, so no forced-update date is recorded."},{"subject":"1.33","state":"EXPIRED","disputed":true,"released_at":{"date":"2025-07-29","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-06-09","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-06-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08","dissent":[{"date":"2026-07-08","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"}]},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"The expiry day differs between the lifecycle page (2026-06-10) and the release note (2026-07-08); the state is EXPIRED under either."},{"subject":"1.32","state":"EXPIRED","disputed":false,"deprecated_at":{"date":"2026-02-20","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-04-15","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"No release date for 1.32 appears in the pages read."}],"sources":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/operations/version-updates/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"]}]}},{"address":"google_cloud_run_v2_service.server","lifecycle":{"state":"GA","state_reason":"the pinned provider schema has no beta, experimental or deprecated notice on the target's resources","sets":[{"capability":"compute.managed-kubernetes","subject_kind":"kubernetes_minor_version","title":"SKE Kubernetes versions","as_of":"2026-11-03","recheck_after":"2027-02-01","expiring_window_days":30,"production_suitability":"SUITABLE","day2":{"forced_update_by":"PROVIDER","forced_update_statement":"\"If the Kubernetes or OS version of a cluster has reached its expiration date, SKE starts a mandatory update to the highest available patch version of the current minor version, or to the highest patch version of the consecutive minor version that is not classified as preview version.\" and \"mandatory version updates run, even if the auto update for the Kubernetes version is deactivated\". Automatic updates otherwise \"only update to higher patch levels\" in the cluster's maintenance window.","notice":"\"As a SKE user you will get informed via release notes and via email in case you are operating a cluster with a deprecated Kubernetes version.\"","customer_action":"\"you can check the exact expiration dates for your current Kubernetes and node pool versions in the cluster.status.expiration field via the SKE API\". The page does not assign any further duty (workload readiness for the update, testing) to the customer or to STACKIT: not stated."},"versions":[{"subject":"1.36","state":"SUPPORTED","disputed":false,"released_at":{"date":"2026-08-27","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2027-06-09","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-11-03"},"production_suitability":"SUITABLE","upgrade_action":"PLAN","migration_timing_risk":"LOW","note":"The expiry day of 1.36 was not published on 2026-10-08 and is on 2026-11-03; the page has no release column, so the release date is still the one of the release note."},{"subject":"1.35","state":"UNKNOWN","disputed":false,"expires_at":{"date":"2027-02-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-11-03"},"production_suitability":"UNKNOWN","upgrade_action":"UNKNOWN","migration_timing_risk":"UNKNOWN","note":"The pages read give no release date for 1.35 (no release-note entry), so the state stays UNKNOWN: a future expiry date does not say that a version is offered. The 1.34 deprecation entry names 1.35 as the upgrade target, and the SKE API catalogue that ships with this build (fetched 2026-10-18) lists 1.35.8 as supported; the draft of the Kubernetes version reads that catalogue for a row like this one, so a release date is not estimated here."},{"subject":"1.34","state":"EXPIRED","disputed":false,"released_at":{"date":"2025-12-16","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-08-28","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-10-14","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"Clusters still on 1.34 are upgraded to 1.35 by the mandatory update (release note of 2026-08-28); the day it runs inside the maintenance window is not stated, so no forced-update date is recorded."},{"subject":"1.33","state":"EXPIRED","disputed":true,"released_at":{"date":"2025-07-29","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-06-09","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-06-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08","dissent":[{"date":"2026-07-08","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"}]},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"The expiry day differs between the lifecycle page (2026-06-10) and the release note (2026-07-08); the state is EXPIRED under either."},{"subject":"1.32","state":"EXPIRED","disputed":false,"deprecated_at":{"date":"2026-02-20","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-04-15","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"No release date for 1.32 appears in the pages read."}],"sources":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/operations/version-updates/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"]}]}}]},"kernel":{"schema_version":"kernel-0.1","units":[{"address":"google_firebase_project.default","semantic_fingerprint":"dfe8e90d5aad5c671807c0f7e4984e92d7a2ab15764843bd877e706da72887a1","absent_claims":0,"claims":[{"unit":"google_firebase_project.default","semantic":"migration-decision","fact":{"state":"KNOWN","value":"stated"},"criticality":"NON_CRITICAL","disposition":"REVIEW","evidence_set":"ES-8af9fe2ffde0"},{"unit":"google_firebase_project.default","semantic":"tc-firebase-project-project","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8af9fe2ffde0"}],"invariant_violations":[]},{"address":"google_pubsub_topic.faux","semantic_fingerprint":"915f8c6467855bb93158f4e426743a8cc8210ac0324d51c8056ab8191e760bf1","absent_claims":46,"claims":[{"unit":"google_pubsub_topic.faux","semantic":"messaging-model","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence_set":"ES-2390f2fd30f2"},{"unit":"google_pubsub_topic.faux","semantic":"tc-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-2390f2fd30f2"}],"invariant_violations":[]},{"address":"google_service_account.automation","semantic_fingerprint":"9bdf4c7b88308bd1f98e278e559e9f54ab914c3070e84127d525b89cd3d5f1e5","absent_claims":9,"claims":[{"unit":"google_service_account.automation","semantic":"account-name","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8fc462c03f30"},{"unit":"google_service_account.automation","semantic":"role-bindings","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8fc462c03f30"},{"unit":"google_service_account.automation","semantic":"workload-identity","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence_set":"ES-8fc462c03f30"}],"invariant_violations":[]},{"address":"google_service_account.client","semantic_fingerprint":"9bdf4c7b88308bd1f98e278e559e9f54ab914c3070e84127d525b89cd3d5f1e5","absent_claims":9,"claims":[{"unit":"google_service_account.client","semantic":"account-name","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8fc462c03f30"},{"unit":"google_service_account.client","semantic":"role-bindings","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8fc462c03f30"},{"unit":"google_service_account.client","semantic":"workload-identity","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence_set":"ES-8fc462c03f30"}],"invariant_violations":[]},{"address":"google_service_account.server","semantic_fingerprint":"9bdf4c7b88308bd1f98e278e559e9f54ab914c3070e84127d525b89cd3d5f1e5","absent_claims":9,"claims":[{"unit":"google_service_account.server","semantic":"account-name","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8fc462c03f30"},{"unit":"google_service_account.server","semantic":"role-bindings","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8fc462c03f30"},{"unit":"google_service_account.server","semantic":"workload-identity","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence_set":"ES-8fc462c03f30"}],"invariant_violations":[]},{"address":"google_sql_database_instance.postgres","semantic_fingerprint":"46bd202d60acf783faec71b1e64ad294278929a537e1216e2e8e35e19f8c4155","absent_claims":60,"claims":[{"unit":"google_sql_database_instance.postgres","semantic":"database-users","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-e241bf446232"},{"unit":"google_sql_database_instance.postgres","semantic":"engine","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence_set":"ES-e241bf446232"},{"unit":"google_sql_database_instance.postgres","semantic":"engine-version","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-e241bf446232"},{"unit":"google_sql_database_instance.postgres","semantic":"network-exposure","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"LEDGER","evidence_set":"ES-e241bf446232"},{"unit":"google_sql_database_instance.postgres","semantic":"project-scope","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-e241bf446232"},{"unit":"google_sql_database_instance.postgres","semantic":"region-residency","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-e241bf446232"},{"unit":"google_sql_database_instance.postgres","semantic":"tc-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-e241bf446232"},{"unit":"google_sql_database_instance.postgres","semantic":"tcf-sql-database--name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-e241bf446232"},{"unit":"google_sql_database_instance.postgres","semantic":"tcfp-sql-user--name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-e241bf446232"},{"unit":"google_sql_database_instance.postgres","semantic":"terraform-destroy-guard-off","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"PRESERVED","evidence_set":"ES-e241bf446232"},{"unit":"google_sql_database_instance.postgres","semantic":"user-and-database-settings","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-e241bf446232"}],"invariant_violations":[]},{"address":"google_secret_manager_secret.django_admin_password","semantic_fingerprint":"fbe0f451afa383c996776434cbb5e52081e17626175ab1024d245e7ca2cb7efa","absent_claims":14,"claims":[{"unit":"google_secret_manager_secret.django_admin_password","semantic":"secret-settings","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/secret_manager_secret","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/secretsmanager_instance","valid_from":"2026-09-24"}]},{"unit":"google_secret_manager_secret.django_admin_password","semantic":"secret-value","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/secret_manager_secret","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/secretsmanager_instance","valid_from":"2026-09-24"}]},{"unit":"google_secret_manager_secret.django_admin_password","semantic":"secret-values","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/secret_manager_secret","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/secretsmanager_instance","valid_from":"2026-09-24"}]},{"unit":"google_secret_manager_secret.django_admin_password","semantic":"tcr-secret-id","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/secret_manager_secret","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/secretsmanager_instance","valid_from":"2026-09-24"}]}],"invariant_violations":[]},{"address":"google_storage_bucket.media","semantic_fingerprint":"55ee3d8c6fbeec18264c69b1ffc85fd861834ca81f6c350dc9d249fffcbf27ee","absent_claims":56,"claims":[{"unit":"google_storage_bucket.media","semantic":"bucket-region","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-befd0699cae0"},{"unit":"google_storage_bucket.media","semantic":"force-destroy","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"UNSUPPORTED","evidence_set":"ES-befd0699cae0"},{"unit":"google_storage_bucket.media","semantic":"geo-replication","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-befd0699cae0"},{"unit":"google_storage_bucket.media","semantic":"iam-access","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-befd0699cae0"},{"unit":"google_storage_bucket.media","semantic":"iam-grant","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-befd0699cae0"},{"unit":"google_storage_bucket.media","semantic":"public-access","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-befd0699cae0"},{"unit":"google_storage_bucket.media","semantic":"tc-storage-bucket-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-befd0699cae0"}],"invariant_violations":[]},{"address":"google_secret_manager_secret.django_settings","semantic_fingerprint":"fbe0f451afa383c996776434cbb5e52081e17626175ab1024d245e7ca2cb7efa","absent_claims":14,"claims":[{"unit":"google_secret_manager_secret.django_settings","semantic":"secret-settings","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/secret_manager_secret","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/secretsmanager_instance","valid_from":"2026-09-24"}]},{"unit":"google_secret_manager_secret.django_settings","semantic":"secret-value","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/secret_manager_secret","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/secretsmanager_instance","valid_from":"2026-09-24"}]},{"unit":"google_secret_manager_secret.django_settings","semantic":"secret-values","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/secret_manager_secret","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/secretsmanager_instance","valid_from":"2026-09-24"}]},{"unit":"google_secret_manager_secret.django_settings","semantic":"tcr-secret-id","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/secret_manager_secret","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/secretsmanager_instance","valid_from":"2026-09-24"}]}],"invariant_violations":[]},{"address":"google_cloud_run_v2_job.migrate","semantic_fingerprint":"2ee907c256ec9c332eb2e4653394ccf067c12122b431aacc7ff20cdabda63af8","absent_claims":119,"claims":[{"unit":"google_cloud_run_v2_job.migrate","semantic":"cloud-run-v2-job-network-exposure","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_job.migrate","semantic":"container-image","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_job.migrate","semantic":"deployment-artifact","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_job.migrate","semantic":"entry-point","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_job.migrate","semantic":"k4-cloud-run-volume-mount-cloud-run-v2-job","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_job.migrate","semantic":"location-residency","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_job.migrate","semantic":"secrets","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_job.migrate","semantic":"service-identity","fact":{"state":"UNKNOWN","cause":"unresolved-reference:behavioural-attribute"},"criticality":"CRITICAL","disposition":"LEDGER","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_job.migrate","semantic":"tc-cloud-run-v2-job-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_job.migrate","semantic":"tc-cloud-run-v2-job-template--template--containers--env--name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_job.migrate","semantic":"tc-cloud-run-v2-job-template--template--volumes--name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_job.migrate","semantic":"terraform-destroy-guard","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]}],"invariant_violations":[]},{"address":"google_cloud_run_v2_service.server","semantic_fingerprint":"8cfa05efa1b6219965faed51d9d737c23f474a3e738ac4fc9d0b76beb95d10bd","absent_claims":117,"claims":[{"unit":"google_cloud_run_v2_service.server","semantic":"cloud-sql-connection","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_service.server","semantic":"container-image","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_service.server","semantic":"deployment-artifact","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_service.server","semantic":"environment","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_service.server","semantic":"iam-invocation","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_service.server","semantic":"iam-policy-grant","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_service.server","semantic":"k4-cloud-run-volume-mount-cloud-run-v2-service","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_service.server","semantic":"location-residency","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_service.server","semantic":"scale-to-zero","fact":{"state":"KNOWN","value":"stated"},"criticality":"NON_CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_service.server","semantic":"secrets","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_service.server","semantic":"service-identity","fact":{"state":"UNKNOWN","cause":"unresolved-reference:behavioural-attribute"},"criticality":"CRITICAL","disposition":"LEDGER","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_service.server","semantic":"tc-cloud-run-v2-service-name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_service.server","semantic":"tc-cloud-run-v2-service-template--volumes--name","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]},{"unit":"google_cloud_run_v2_service.server","semantic":"terraform-destroy-guard","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-09-24"}]}],"invariant_violations":[]},{"address":"google_cloudbuild_trigger.activategcb","semantic_fingerprint":"2530a465e2c169edfa0b5aeeb46e57ab4060b201254b2e803896dccb47ff2353","absent_claims":13,"claims":[{"unit":"google_cloudbuild_trigger.activategcb","semantic":"build-identity","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]},{"unit":"google_cloudbuild_trigger.activategcb","semantic":"dep-references","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]},{"unit":"google_cloudbuild_trigger.activategcb","semantic":"deployment-artifact","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]},{"unit":"google_cloudbuild_trigger.activategcb","semantic":"entry-point","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]},{"unit":"google_cloudbuild_trigger.activategcb","semantic":"log-destination","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]},{"unit":"google_cloudbuild_trigger.activategcb","semantic":"project-residency","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]}],"invariant_violations":[]},{"address":"google_cloudbuild_trigger.init","semantic_fingerprint":"009cab99e680d36079da17d4ddf69bb6f576e14c9a85634584f85a60fafdc0c4","absent_claims":13,"claims":[{"unit":"google_cloudbuild_trigger.init","semantic":"build-identity","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]},{"unit":"google_cloudbuild_trigger.init","semantic":"dep-references","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]},{"unit":"google_cloudbuild_trigger.init","semantic":"deployment-artifact","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]},{"unit":"google_cloudbuild_trigger.init","semantic":"entry-point","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]},{"unit":"google_cloudbuild_trigger.init","semantic":"linked-dependency:google_firebase_hosting_site","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]},{"unit":"google_cloudbuild_trigger.init","semantic":"log-destination","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]},{"unit":"google_cloudbuild_trigger.init","semantic":"project-residency","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]}],"invariant_violations":[]},{"address":"google_cloudbuild_trigger.placeholder","semantic_fingerprint":"28832646753ec26215f419487fd014540fa9ec0bc3d117609f8449fa2e703c97","absent_claims":14,"claims":[{"unit":"google_cloudbuild_trigger.placeholder","semantic":"build-identity","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]},{"unit":"google_cloudbuild_trigger.placeholder","semantic":"dep-references","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]},{"unit":"google_cloudbuild_trigger.placeholder","semantic":"deployment-artifact","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]},{"unit":"google_cloudbuild_trigger.placeholder","semantic":"linked-dependency:google_firebase_hosting_site","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]},{"unit":"google_cloudbuild_trigger.placeholder","semantic":"log-destination","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]},{"unit":"google_cloudbuild_trigger.placeholder","semantic":"project-residency","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_trigger.html.markdown","valid_from":"2026-09-29"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://raw.githubusercontent.com/hashicorp/terraform-provider-google/v8.4.0/website/docs/r/cloudbuild_worker_pool.html.markdown","valid_from":"2026-09-29"}]}],"invariant_violations":[]},{"address":"google_firebase_hosting_site.client","semantic_fingerprint":"bdadf367e52a60f452c9da59cef4680b17976f7184d06f80301045e9c1423187","absent_claims":2,"claims":[{"unit":"google_firebase_hosting_site.client","semantic":"linked-dependency:google_firebase_project","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-ff276ef68acc"},{"unit":"google_firebase_hosting_site.client","semantic":"migration-decision","fact":{"state":"KNOWN","value":"stated"},"criticality":"NON_CRITICAL","disposition":"REVIEW","evidence_set":"ES-ff276ef68acc"},{"unit":"google_firebase_hosting_site.client","semantic":"tc-firebase-hosting-site-project","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-ff276ef68acc"},{"unit":"google_firebase_hosting_site.client","semantic":"tcr-firebase-hosting-site-site-id","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-ff276ef68acc"}],"invariant_violations":[]},{"address":"google_service_account.init","semantic_fingerprint":"9bdf4c7b88308bd1f98e278e559e9f54ab914c3070e84127d525b89cd3d5f1e5","absent_claims":9,"claims":[{"unit":"google_service_account.init","semantic":"account-name","fact":{"state":"UNKNOWN","cause":"unspecified"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8fc462c03f30"},{"unit":"google_service_account.init","semantic":"role-bindings","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"REVIEW","evidence_set":"ES-8fc462c03f30"},{"unit":"google_service_account.init","semantic":"workload-identity","fact":{"state":"KNOWN","value":"stated"},"criticality":"CRITICAL","disposition":"TRANSFORMED","evidence_set":"ES-8fc462c03f30"}],"invariant_violations":[]}],"evidence_sets":[{"id":"ES-2390f2fd30f2","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","ref":"the STACKIT provider schema 0.116.0","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/pubsub_topic","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/platform/resource-manager/basics/projects/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/rabbitmq_instance","valid_from":"2026-09-24"}]},{"id":"ES-8af9fe2ffde0","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/firebase_project","valid_from":"2026-11-05"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/","valid_from":"2026-11-05"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/","valid_from":"2026-11-05"}]},{"id":"ES-8fc462c03f30","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","ref":"the STACKIT provider schema 0.116.0","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/google_service_account","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/platform/resource-manager/basics/projects/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account","valid_from":"2026-09-24"}]},{"id":"ES-befd0699cae0","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","ref":"the STACKIT provider schema 0.116.0","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/storage_bucket","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/platform/resource-manager/basics/projects/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/storage/object-storage/basics/object-lock/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/storage/object-storage/how-tos/manage-bucket-policies/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/storage/object-storage/how-tos/manage-bucket-versioning/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/storage/object-storage/reference/supported-operations-on-buckets-and-objects/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/storage/object-storage/reference/supported-permissions-in-bucket-policies/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/objectstorage_bucket","valid_from":"2026-09-24"}]},{"id":"ES-e241bf446232","evidence":[{"kind":"SOURCE_PROVIDER_SCHEMA","ref":"the Google provider schema 8.4.0","valid_from":"2026-09-24"},{"kind":"TARGET_PROVIDER_SCHEMA","ref":"the STACKIT provider schema 0.116.0","valid_from":"2026-09-24"},{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/sql_database_instance","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/platform/resource-manager/basics/projects/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/databases/postgresql-flex/","valid_from":"2026-09-24"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/postgresflex_instance","valid_from":"2026-09-24"}]},{"id":"ES-ff276ef68acc","evidence":[{"kind":"SOURCE_OFFICIAL_DOC","ref":"https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/firebase_hosting_site","valid_from":"2026-11-05"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/","valid_from":"2026-11-05"},{"kind":"TARGET_OFFICIAL_DOC","ref":"https://docs.stackit.cloud/products/storage/object-storage/","valid_from":"2026-11-05"}]}]}}