{ "schema_version": "0.6.0", "run_id": "6f8f72b2-1c34-4cfc-8483-344c41245364", "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "statement": "PROPOSAL: a record groups the open decisions of the plans of the draft by the part of the draft they concern and the kind of the decision, or the units that leave one critical semantic of one contract open, or the manual actions of the plans by kind, or the open statements of the plans about units they write no resource for by the reason of the statement. It is a view: nothing here changes the draft, target-plan.json, a gate, or any class, confidence or eligibility, and every critical semantic stays open in the assessment. A review of a plan-decision record acts on the execution plan only, by its effect: an answer whose option is what the draft already carries out (ACK_CURRENT_ARTIFACT) frees the steps that wait for the decision; an option that changes the draft (REGENERATE_REQUIRED) or a redesign keeps them held until the draft carries the option (the line of the option in decisions-template.yaml says whether an answer of the inputs file writes it or no answer of this build does), a manual alternative frees only the manual step that carries it out, and a refused opt-in to an API resolves to the draft's own path (the steps of the API path are not taken). The draft itself is unchanged by a review in the decisions file. The one exception is an option that declines a default of the draft (choose-the-size, choose-the-snapshot-count, choose-the-zone-per-server, keep-the-source-rules-and-redesign-a-firewall, machine-type-with-a-local-disk, persistent-volume-for-the-data): the run that reads that answer writes its draft without the default, and the value the default stood for is yours to set.", "state": "BUILT", "basis": "Records group four lists: the open decisions of the TargetPlans of the draft this run wrote, by the family of the producer (security group, routing, identity, logs, server) and the kind of the decision (plan decisions); the open critical semantics of the units, by the contract family and the semantic (critical semantics); the manual actions of the plans, by the family of the producer and the kind of the action (manual actions); and the open statements of the plans about units they write no resource for (a redesign, a review, a block, a failed model, or a step beside a unit whose draft a converter writes), by the family of the producer and the reason (plan statements). Plan decisions and manual actions cover only drafted units whose draft passed StackToIT's own checks, and only the families whose draft this run wrote from a plan: a family with no plan has none to list. A plan statement covers a unit the plan writes nothing for, whether or not a draft check ran over it; a statement that leaves nothing to a person (a unit the plan does not draft and no manual action of it names) is counted (closed_statements) and is no record. A record shows the review of an overlay beside the open state the engine reached; a review closes no critical semantic and changes no draft, target plan, gate, class, confidence or eligibility. An accepted plan decision frees the steps of the execution plan that wait for it only when the answer's effect acknowledges the current draft; an option that changes the draft keeps them held until the draft carries that option (the line of the option in decisions-template.yaml says whether an answer of the inputs file writes it or no answer of this build does). The one exception is an option that declines a default of the draft (choose-the-size, choose-the-snapshot-count, choose-the-zone-per-server, keep-the-source-rules-and-redesign-a-firewall, machine-type-with-a-local-disk, persistent-volume-for-the-data): the run that reads that answer writes its draft without the default, and the value the default stood for is yours to set. Records of the family \"convert\" are decisions of the converter's own generators, outside every plan: a CONSTRAINT_CONFLICT (a variable whose consumers' STACKIT bounds exclude one another keeps the source default) and an AMBIGUOUS_* selection (the source does not prove which instance, interface, key pair, gateway, peer, subnet, proxy, URL map or health check it means, so the draft holds a required variable without a default); the unit that owns one is not automation-eligible. They are listed for a drafted unit whose plan checks did not fail.", "plan_read": true, "decisions": [ { "id": "DEC-GEN-CONVERT-API-OPT-IN", "kind": "API_OPT_IN", "family": "convert", "source": "PLAN_DECISION", "group": "GRP-PLAN-DECISION-convert", "block": "API_OPT_IN", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "google_pubsub_topic.faux", "artifact": "assessment.json", "pointer": "/units/1" }, { "kind": "unit", "id": "google_secret_manager_secret.django_admin_password", "artifact": "assessment.json", "pointer": "/units/6" }, { "kind": "unit", "id": "google_secret_manager_secret.django_settings", "artifact": "assessment.json", "pointer": "/units/8" } ], "affected_applications": [], "members": [ { "kind": "plan_decision", "id": "convert:api:pubsub:v1beta:beta:API_OPT_IN", "artifact": "workspace.json", "pointer": "/units/7/deployment_prerequisites/open_decisions/0" }, { "kind": "plan_decision", "id": "convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN", "artifact": "workspace.json", "pointer": "/units/8/deployment_prerequisites/open_decisions/0" } ], "aliases": [ { "id": "convert:api:pubsub:v1beta:beta:API_OPT_IN", "source": "PLAN_DECISION", "subject": "google_pubsub_topic.faux", "display_id": "DEC-GEN-CONVERT-API-OPT-IN/google_pubsub_topic.faux" }, { "id": "convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN", "source": "PLAN_DECISION", "subject": "google_secret_manager_secret.django_admin_password", "display_id": "DEC-GEN-CONVERT-API-OPT-IN/google_secret_manager_secret.django_admin_password" } ], "options": [ { "id": "allow-calls-of-the-api", "title": "Allow the calls of the API for this migration", "effect": "The calls of the API the plan states are made as the plan writes them (the request documents of the execution package), and the steps of their path are taken; the migration then depends on an API that may change or vanish.", "execution_effect": "ACK_CURRENT_ARTIFACT", "evidence": [ { "url": "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/functions/v1alpha/functions.json#L767-L771", "class": "SOURCE_CODE_VERIFIED", "checked_at": "2026-10-23", "quote": "\"info\": {\"description\": \"This API provides endpoints for managing STACKIT Functions.\", \"title\": \"STACKIT Functions Core API\", \"version\": \"1alpha\"}" } ] } ], "recommended_option": null, "blocking_effect": "TARGET_DESIGN_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_pubsub_topic.faux", "artifact": "workspace.json", "pointer": "/units/7/trace" }, { "kind": "evidence", "id": "google_secret_manager_secret.django_admin_password", "artifact": "workspace.json", "pointer": "/units/8/trace" }, { "kind": "evidence", "id": "google_secret_manager_secret.django_settings", "artifact": "workspace.json", "pointer": "/units/9/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:ad0b4646256d69e513051c7a948486002928b0d8da0e8c103efc9f267ec3d9fe", "artifact_sha256": "sha256:4dcc4d547c199508ac6d33000affd676431fd849c5ce9b11aefb886b2717ff5f", "kb_dependencies": [ { "kind": "decision_kind", "id": "convert/API_OPT_IN", "sha256": "sha256:54132b6ed57d6a74b87e703c82360235486f76a5141b49f018b81d3be2629bfb" }, { "kind": "review_cause", "id": "convert/API_OPT_IN", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:03735a47b22c84235c95ed16b33e929eb21e905431c7a1c2103a67e6c13f9395" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 2 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "unblocks": { "holds": 5, "alone": 5, "shared": 0, "steps": [ "API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password", "API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings", "MAN/path/secrets-migration/read-back", "MAN/path/secrets-migration/retire-user", "MAN/pubsub.topic/name/google_pubsub_topic.faux" ], "best_option": "allow-calls-of-the-api", "options": [ { "option": "allow-calls-of-the-api", "effects": [ "ACK_CURRENT_ARTIFACT" ], "alone": 5, "shared": 0 }, { "option": "", "effects": [ "ACK_CURRENT_ARTIFACT" ], "alone": 5, "shared": 0 } ], "automated": { "holds": 2, "alone": 2, "shared": 0 } }, "why": "The plan calls a STACKIT API that is not generally available (alpha, beta, or a release status its documentation does not state), which may change or be withdrawn, so it makes those calls only after you allow them (2 APIs): until you answer, the calls and the steps of their path wait. Allowing carries them out; refusing keeps the draft's own path where the API's path is an alternative beside it, and leaves the question open where the API is the only carrier of what its call sets. No block of the draft waits for it, and no unit's eligibility rests on it.", "required_evidence": [ "the Secrets Manager Vault-compatible API is of a maturity that is not established (its documentation states no release status and its product documentation does not establish it as generally available): the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for google_secret_manager_secret.django_admin_password, google_secret_manager_secret.django_settings wait for this decision; the draft's own blocks do not", "the pubsub API v1beta is beta: the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for google_pubsub_topic.faux wait for this decision; the draft's own blocks do not", "the platform's consent to depend on an API that may change or vanish (alpha, beta, or a maturity the documentation does not establish)" ], "resolution": { "decision_id": "DEC-GEN-CONVERT-API-OPT-IN", "source_family": "convert", "source_semantic": "API_OPT_IN", "affected_units": [ "google_pubsub_topic.faux", "google_secret_manager_secret.django_admin_password", "google_secret_manager_secret.django_settings" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "TARGET_DESIGN_OPEN", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The plan leaves this decision open on google_pubsub_topic.faux, google_secret_manager_secret.django_admin_password and google_secret_manager_secret.django_settings.", "generated_target_behavior": "The draft holds MAN/pubsub.topic/name/google_pubsub_topic.faux, API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password and API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings until this decision is answered by an answer that frees it.", "residual_difference": "the target design is open until the decision is answered", "execution_effect": "3 steps of the plan wait for it until it is answered: MAN/pubsub.topic/name/google_pubsub_topic.faux, API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password and API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings.", "next_action": "Allow STACKIT's pre-release APIs, which may change or be withdrawn: Pub/Sub v1beta (beta) and Secrets Manager v1 (release status not stated). 3 steps of the plan name this decision and wait for this answer (the steps that come after them are counted in what an answer frees); allowing the calls lets the plan carry them out and makes the migration depend on those APIs. If you say no (record a rejection), the calls are not made: the steps of Pub/Sub and Secrets Manager stay open. Record the answer in the decisions file given with --decisions (decisions-template.yaml); answer each API on its own through the members of the record.", "why_open": [ "The plan calls a STACKIT API that is not generally available (alpha, beta, or a release status its documentation does not state), which may change or be withdrawn, so it makes those calls only after you allow them (2 APIs): until you answer, the calls and the steps of their path wait. Allowing carries them out; refusing keeps the draft's own path where the API's path is an alternative beside it, and leaves the question open where the API is the only carrier of what its call sets. No block of the draft waits for it, and no unit's eligibility rests on it." ], "closes_when": [ "Every API the record lists is answered in the decisions file: allowed, or refused." ], "required_inputs": [ "the Secrets Manager Vault-compatible API is of a maturity that is not established (its documentation states no release status and its product documentation does not establish it as generally available): the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for google_secret_manager_secret.django_admin_password, google_secret_manager_secret.django_settings wait for this decision; the draft's own blocks do not", "the pubsub API v1beta is beta: the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for google_pubsub_topic.faux wait for this decision; the draft's own blocks do not", "the platform's consent to depend on an API that may change or vanish (alpha, beta, or a maturity the documentation does not establish)" ], "resolution_paths": [ { "id": "allow-calls-of-the-api", "title": "Allow the calls of the API for this migration", "prerequisites": [], "effects": [ "The calls of the API the plan states are made as the plan writes them (the request documents of the execution package), and the steps of their path are taken; the migration then depends on an API that may change or vanish." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/functions/v1alpha/functions.json#L767-L771" ], "regeneration_required": false } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [ "https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/functions/v1alpha/functions.json#L767-L771" ], "related_execution_steps": [ { "id": "MAN/pubsub.topic/name/google_pubsub_topic.faux", "mode": "MANUAL", "phase": "PLATFORM", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true }, { "id": "API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password", "mode": "STACKIT_API", "phase": "SECURITY", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true }, { "id": "API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings", "mode": "STACKIT_API", "phase": "SECURITY", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true } ] } }, { "id": "DEC-GEN-CONVERT-DATA-MOVEMENT", "kind": "DATA_MOVEMENT", "family": "convert", "source": "PLAN_DECISION", "group": "GRP-PLAN-DECISION-convert", "block": "DATA_MOVEMENT", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Data Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "google_sql_database_instance.postgres", "artifact": "assessment.json", "pointer": "/units/5" } ], "affected_applications": [], "members": [ { "kind": "plan_decision", "id": "convert:google_sql_database_instance.postgres:data:DATA_MOVEMENT", "artifact": "workspace.json", "pointer": "/units/14/deployment_prerequisites/open_decisions/2" } ], "options": [ { "id": "export-and-import-with-the-engine-clients", "title": "Export the data from the source and import it with the clients of the target engine", "effect": "A person exports the data from the source and imports it into the STACKIT instance with the clients of its engine during a window the business accepts, then checks that the copy is complete; the clients reach the instance at the host and port its credential states. The source and the target engine may differ (DynamoDB to MongoDB Flex), so the export is converted where they do. The plan holds the steps of this option as typed steps: for a PostgreSQL database, for a MySQL, MariaDB or Aurora MySQL database moving to MariaDB and for an RDS for SQL Server database moving to SQLServer Flex (the native backup, its copy to a STACKIT S3 bucket and the import_database call) the preflight, the rehearsal, the write freeze, the dump or backup and the restore or import inside it, the reconcile and the cleanup; for an ElastiCache, MemoryDB or ElastiCache serverless cache moving to a Key Value Store the preflight, the rehearsal, the write freeze, the copy by a client, the reconcile and the cleanup; for an Amazon Aurora DSQL cluster moving to PostgreSQL Flex the preflight, the rehearsal, the write freeze, the copy of the tables by a client (the schema from the catalogs of the cluster, or from pg_dump --schema-only where the preflight shows that it works, and the rows through the PostgreSQL protocol: no AWS page read documents a dump of a cluster), the reconcile and the cleanup; for an OpenSearch store the write freeze, the copy and the reconcile. The decision offers this option only for a store whose STACKIT service documents a way in with such clients: PostgreSQL Flex (for an Aurora DSQL cluster, which has no change stream, this option and the tool of the customer's own are the only ones; the replication of the engine is not offered), MariaDB (the mysql client loads a dump into an empty instance), SQLServer Flex (a .bak file imported with import_database), Key Value Store (the tutorial migrates a Redis instance by the MIGRATE command; for an ElastiCache source, where AWS lists migrate among the commands unavailable for caches running Redis OSS, the copy is a client that iterates the keys with SCAN and copies each with DUMP, PTTL and RESTORE; for a MemoryDB source, where AWS lists migrate, sync, psync, bgsave, save and config among the unavailable commands and the cluster mode is always on, the same client copy runs against every shard primary found with CLUSTER NODES or CLUSTER SLOTS, with TLS where the source has it and an ACL user that reaches every key; whether DUMP, RESTORE and PTTL run on a standard MemoryDB cluster is not stated by AWS, and for a member of a multi-Region cluster, whose page lists PTTL as unsupported, the step says the TTLs are not carried) and OpenSearch (the reindex operation). For a store without a documented way in (MongoDB Flex, a memcached cache) it is not offered and the decision offers the tool of the customer's own alone.", "execution_effect": "MANUAL_ALTERNATIVE", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-23", "quote": "Read-Only: host (String), hosts (List of String), ..., port (Number), uri (String, Sensitive)" }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_user.md#L59-L63", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-23", "quote": "Read-Only: host (String), ..., port (Number), uri (String, Sensitive)" }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_credential.md#L51-L57", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-23", "quote": "Read-Only: host (String), hosts (List of String), ..., port (Number), ..., uri (String, Sensitive)" }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_credential.md#L51-L57", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-23", "quote": "Read-Only: host (String), hosts (List of String), load_balanced_host (String), ..., port (Number), uri (String, Sensitive) Connection URI." }, { "url": "https://docs.stackit.cloud/products/databases/mariadb/how-tos/backup-and-restore/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "Connect to the database and import the backup." }, { "url": "https://docs.stackit.cloud/products/databases/sqlserver-flex/how-tos/import-database-backup-from-stackit-s3-into-sqlserver-flex/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "You have uploaded the database to be imported as .bak file(s) to the STACKIT S3 bucket" }, { "url": "https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "The main strategy to migrate the whole dataset from the source to the target is based on the MIGRATE command." }, { "url": "https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/SupportedCommands.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "For caches running Redis OSS, the following commands are unavailable:" }, { "url": "https://docs.aws.amazon.com/memorydb/latest/devguide/restrictedcommands.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "To deliver a managed service experience, MemoryDB restricts access to certain commands that require advanced privileges. The following commands are unavailable:" }, { "url": "https://docs.stackit.cloud/products/databases/opensearch/how-tos/migrate-elasticsearch-data-to-an-opensearch2-service-instance/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "to use the `reindex` Data Operation" } ] }, { "id": "replicate-with-the-engine-replication", "title": "Replicate the data with the replication of the source engine until the cutover", "effect": "A person sets up the replication of the source engine so that the STACKIT instance follows the source while the application keeps writing to the source (for PostgreSQL, logical replication: the schema is copied first with pg_dump --schema-only, a publication on the source and a subscription on the target copy the existing rows and then the changes, and the sequences are copied inside the write freeze because they are not replicated). The source needs a change and a reboot to turn replication on, and the target must be able to reach the source. Inside the write freeze the person waits until the target has caught up, compares both sides and switches the clients, then removes the replication. For a PostgreSQL database the plan holds the steps of this option (the initial copy, the watch of the lag, the freeze, the final copy, the reconcile and the cleanup); for an S3 bucket this option is not available, because S3 Replication copies between Amazon S3 buckets and no STACKIT bucket is documented as a destination (the plan holds the two copy tools instead); for any other engine this option is not offered, because no STACKIT service other than PostgreSQL Flex documents the replication of a source engine into it (MariaDB, Key Value Store, OpenSearch and MongoDB Flex document none, and the SQLServer Flex page on transactional replication describes an on-premises publisher and does not name Amazon RDS as one), so the decision of such a store offers the export and the import with the engine clients where its service documents them, and the tool of the customer's own.", "execution_effect": "MANUAL_ALTERNATIVE", "evidence": [ { "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "You can use replication to enable automatic, asynchronous copying of objects across Amazon S3 buckets." }, { "url": "https://www.postgresql.org/docs/current/logical-replication-restrictions.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "The database schema and DDL commands are not replicated. The initial schema can be copied by hand using pg_dump --schema-only." }, { "url": "https://www.postgresql.org/docs/current/logical-replication-restrictions.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "Sequence data is not replicated." }, { "url": "https://www.postgresql.org/docs/current/sql-createsubscription.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "To be able to create a subscription, you must have the privileges of the pg_create_subscription role, as well as CREATE privileges on the current database." }, { "url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "Set the rds.logical_replication static parameter to 1." }, { "url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-29", "quote": "Reboot the DB instance for the static rds.logical_replication parameter to take effect." } ] }, { "id": "copy-the-objects-with-rclone", "title": "Copy the objects of the bucket with rclone, from the source bucket to the STACKIT bucket", "effect": "For an S3 bucket: a person runs rclone on a move host that reaches both endpoints, with two S3 remotes (the source with the AWS credentials of the shell, the target as a provider Other remote at the STACKIT S3 endpoint with a credential of a credentials group, both read from the environment at run time), copies every current object while the writers keep writing, repeats the copy until a pass is short, stops the writers, runs the last pass, settles what the source deleted after the first copy, and compares both sides (the count and the bytes, the key lists and, where a hash is shared, the content) before the applications are switched. The copy carries the current object of every key and nothing of the bucket's configuration: no older version, no delete marker, no retention, no ACL, no policy; those are settled where the draft names them. The plan holds the steps of this option (the initial copy, the passes, the freeze, the last pass, the reconcile and the cleanup) with command templates and no credential value. No copy was run against a STACKIT bucket by StackToIT.", "execution_effect": "MANUAL_ALTERNATIVE", "evidence": [ { "url": "https://docs.stackit.cloud/products/storage/object-storage/tutorials/migrate-data-using-rclone/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "rclone copy source:/BUCKET_NAME destination:/BUCKET_NAME --s3-upload-cutoff 0 --progress --log-file /tmp/rclone.log" }, { "url": "https://rclone.org/commands/rclone_copy/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "Copy files from source to dest, skipping identical files. ... Doesn't delete files from the destination." }, { "url": "https://rclone.org/commands/rclone_check/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "compares sizes and hashes (MD5 or SHA1) and logs a report of files that don't match." }, { "url": "https://docs.stackit.cloud/products/storage/object-storage/reference/supported-operations-on-buckets-and-objects/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "Create Multipart Upload: Initiates a multipart upload and returns an upload ID." } ] }, { "id": "copy-the-objects-with-the-aws-cli", "title": "Copy the objects of the bucket with the AWS CLI, through a staging directory", "effect": "For an S3 bucket: a person runs the AWS CLI on a move host with free disk for the data. One command sends its requests to one endpoint, so the objects are downloaded from the AWS bucket into a directory with aws s3 sync and uploaded from it to the STACKIT bucket with aws s3 sync and --endpoint-url set to the STACKIT S3 endpoint, with the credential of a credentials group read from the environment at run time. The data crosses the host twice, one pass after the other; aws s3 sync decides by size and last-modified time and never compares the content, so the comparison before the switch downloads the target and compares the files. The copy carries the current object of every key and nothing of the bucket's configuration, as with rclone. The plan holds the steps of this option with command templates and no credential value. No copy was run against a STACKIT bucket by StackToIT.", "execution_effect": "MANUAL_ALTERNATIVE", "evidence": [ { "url": "https://docs.aws.amazon.com/cli/latest/reference/s3/sync.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "An S3 object will require copying if the sizes of the two S3 objects differ, the last modified time of the source is newer than the last modified time of the destination, or the S3 object does not exist under the specified bucket and prefix destination." }, { "url": "https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-options.html", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "--endpoint-url \u003cstring\u003e Specifies the URL to send the request to." }, { "url": "https://docs.stackit.cloud/products/storage/object-storage/how-tos/manage-encryption/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-30", "quote": "aws s3 cp ./my-file.txt s3://my-bucket/ --sse AES256 --endpoint-url https://object.storage.eu01.onstackit.cloud" } ] }, { "id": "migrate-with-a-tool-of-my-own", "title": "Move the data with a migration tool or a replication of the owner's own", "effect": "A person moves the data with a tool or a replication they run (for example a change-data-capture replication that keeps the copy in step until the cutover), writes its steps, the checks before the move, the cutover window and the way back, and carries them out. The STACKIT instance is reached at the host and port its credential states. The plan holds that work as typed steps: the write freeze of the source, the copy as one step whose commands the person writes, and the reconcile that compares both sides; the source stays the way back until the reconcile records GO, which a person checks, since the plan cannot know that the tool leaves the source unchanged. A memcached cache holds a confirmation instead of a copy. A bucket repeated by count or for_each has neither a reconcile nor any other option: its instances and the buckets they move to are not named, so the plan holds the one manual step, which the person writes for each instance after naming them.", "execution_effect": "MANUAL_ALTERNATIVE", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-10-23", "quote": "Read-Only: host (String), hosts (List of String), ..., port (Number), uri (String, Sensitive)" } ] } ], "recommended_option": null, "blocking_effect": "TARGET_DESIGN_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_sql_database_instance.postgres", "artifact": "workspace.json", "pointer": "/units/14/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:84bb3ebfd40276eeeabadf6428f1d880feb76324d64e689f3269ad76bb2b327d", "artifact_sha256": "sha256:a4f94232ca78f136bc3cea3ddd554e90886d26cf333ee677b940028baa86d050", "kb_dependencies": [ { "kind": "decision_kind", "id": "convert/DATA_MOVEMENT", "sha256": "sha256:e3cf2a65c088a6ea536170a5fc6970aab632c442714ea237f8ad0d6b0545fae1" }, { "kind": "review_cause", "id": "convert/DATA_MOVEMENT", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:610870c4321b580122859ef332af5301a6bd3a8973057240bd04c7d631e03a41" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "unblocks": { "holds": 13, "alone": 6, "shared": 0, "steps": [ "MAN/data/google_sql_database_instance.postgres/initial-copy/logical-replication", "MAN/data/google_sql_database_instance.postgres/delta-sync/logical-replication", "MAN/data/google_sql_database_instance.postgres/write-freeze/logical-replication", "MAN/data/google_sql_database_instance.postgres/final-sync/logical-replication", "MAN/data/google_sql_database_instance.postgres/reconcile/logical-replication", "MAN/data/google_sql_database_instance.postgres/cleanup/logical-replication" ], "best_option": "replicate-with-the-engine-replication", "options": [ { "option": "export-and-import-with-the-engine-clients", "effects": [ "MANUAL_ALTERNATIVE" ], "alone": 4, "shared": 0 }, { "option": "replicate-with-the-engine-replication", "effects": [ "MANUAL_ALTERNATIVE" ], "alone": 6, "shared": 0 }, { "option": "copy-the-objects-with-rclone", "effects": [ "MANUAL_ALTERNATIVE" ], "alone": 0, "shared": 0 }, { "option": "copy-the-objects-with-the-aws-cli", "effects": [ "MANUAL_ALTERNATIVE" ], "alone": 0, "shared": 0 }, { "option": "migrate-with-a-tool-of-my-own", "effects": [ "MANUAL_ALTERNATIVE" ], "alone": 3, "shared": 0 } ], "automated": { "holds": 0, "alone": 0, "shared": 0 } }, "why": "The method that moves the data of a store (a database, a cache, a search domain, or the objects of a bucket) to its STACKIT service is a person's choice (1 converter decision): the steps of each method are in the plan where the planner covers the store (a PostgreSQL database and an S3 bucket, each with the runbook of the move), and the plan holds one manual step the person writes where it does not; the steps of the move wait for the choice. The choice decides how the data is moved, not whether it is: every method is work a person does by hand, so the unit that owns one keeps a manual data-migration step, and answering it does not take that step away.", "required_evidence": [ "the plan defines both methods of the engine (a dump restored inside the write freeze, and a logical replication that follows the changes until the freeze) and keeps them open: which one applies depends on the size of the data, the write rate and the downtime the business accepts, and the source states none of them; the steps of the methods wait for the answer", "the size of the data, the downtime the business tolerates and the consistency the application needs, to choose the method and the cutover window" ], "resolution": { "decision_id": "DEC-GEN-CONVERT-DATA-MOVEMENT", "source_family": "convert", "source_semantic": "DATA_MOVEMENT", "affected_units": [ "google_sql_database_instance.postgres" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "NOT_STATED", "owner_role": "Data Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "TARGET_DESIGN_OPEN", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The plan leaves this decision open on google_sql_database_instance.postgres.", "generated_target_behavior": "The draft holds MAN/data/google_sql_database_instance.postgres/initial-copy/logical-replication, MAN/data/google_sql_database_instance.postgres/delta-sync/logical-replication, MAN/data/google_sql_database_instance.postgres/write-freeze/dump-restore, MAN/data/google_sql_database_instance.postgres/final-sync/dump-restore, MAN/data/google_sql_database_instance.postgres/reconcile/dump-restore, MAN/data/google_sql_database_instance.postgres/write-freeze/logical-replication, MAN/data/google_sql_database_instance.postgres/final-sync/logical-replication, MAN/data/google_sql_database_instance.postgres/reconcile/logical-replication, MAN/data/google_sql_database_instance.postgres/write-freeze/own-tool, MAN/data/google_sql_database_instance.postgres/final-sync/own-tool and 3 more until this decision is answered by an answer that frees it.", "residual_difference": "the target design is open until the decision is answered", "execution_effect": "13 steps of the plan wait for it until it is answered: MAN/data/google_sql_database_instance.postgres/initial-copy/logical-replication, MAN/data/google_sql_database_instance.postgres/delta-sync/logical-replication, MAN/data/google_sql_database_instance.postgres/write-freeze/dump-restore, MAN/data/google_sql_database_instance.postgres/final-sync/dump-restore, MAN/data/google_sql_database_instance.postgres/reconcile/dump-restore, MAN/data/google_sql_database_instance.postgres/write-freeze/logical-replication, MAN/data/google_sql_database_instance.postgres/final-sync/logical-replication, MAN/data/google_sql_database_instance.postgres/reconcile/logical-replication, MAN/data/google_sql_database_instance.postgres/write-freeze/own-tool, MAN/data/google_sql_database_instance.postgres/final-sync/own-tool and 3 more.", "next_action": "Choose how the data is moved for google_sql_database_instance.postgres: choose one of the 5 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "The method that moves the data of a store (a database, a cache, a search domain, or the objects of a bucket) to its STACKIT service is a person's choice (1 converter decision): the steps of each method are in the plan where the planner covers the store (a PostgreSQL database and an S3 bucket, each with the runbook of the move), and the plan holds one manual step the person writes where it does not; the steps of the move wait for the choice. The choice decides how the data is moved, not whether it is: every method is work a person does by hand, so the unit that owns one keeps a manual data-migration step, and answering it does not take that step away." ], "closes_when": [ "an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option" ], "required_inputs": [ "the plan defines both methods of the engine (a dump restored inside the write freeze, and a logical replication that follows the changes until the freeze) and keeps them open: which one applies depends on the size of the data, the write rate and the downtime the business accepts, and the source states none of them; the steps of the methods wait for the answer", "the size of the data, the downtime the business tolerates and the consistency the application needs, to choose the method and the cutover window" ], "resolution_paths": [ { "id": "export-and-import-with-the-engine-clients", "title": "Export the data from the source and import it with the clients of the target engine", "prerequisites": [], "effects": [ "A person exports the data from the source and imports it into the STACKIT instance with the clients of its engine during a window the business accepts, then checks that the copy is complete; the clients reach the instance at the host and port its credential states. The source and the target engine may differ (DynamoDB to MongoDB Flex), so the export is converted where they do. The plan holds the steps of this option as typed steps: for a PostgreSQL database, for a MySQL, MariaDB or Aurora MySQL database moving to MariaDB and for an RDS for SQL Server database moving to SQLServer Flex (the native backup, its copy to a STACKIT S3 bucket and the import_database call) the preflight, the rehearsal, the write freeze, the dump or backup and the restore or import inside it, the reconcile and the cleanup; for an ElastiCache, MemoryDB or ElastiCache serverless cache moving to a Key Value Store the preflight, the rehearsal, the write freeze, the copy by a client, the reconcile and the cleanup; for an Amazon Aurora DSQL cluster moving to PostgreSQL Flex the preflight, the rehearsal, the write freeze, the copy of the tables by a client (the schema from the catalogs of the cluster, or from pg_dump --schema-only where the preflight shows that it works, and the rows through the PostgreSQL protocol: no AWS page read documents a dump of a cluster), the reconcile and the cleanup; for an OpenSearch store the write freeze, the copy and the reconcile. The decision offers this option only for a store whose STACKIT service documents a way in with such clients: PostgreSQL Flex (for an Aurora DSQL cluster, which has no change stream, this option and the tool of the customer's own are the only ones; the replication of the engine is not offered), MariaDB (the mysql client loads a dump into an empty instance), SQLServer Flex (a .bak file imported with import_database), Key Value Store (the tutorial migrates a Redis instance by the MIGRATE command; for an ElastiCache source, where AWS lists migrate among the commands unavailable for caches running Redis OSS, the copy is a client that iterates the keys with SCAN and copies each with DUMP, PTTL and RESTORE; for a MemoryDB source, where AWS lists migrate, sync, psync, bgsave, save and config among the unavailable commands and the cluster mode is always on, the same client copy runs against every shard primary found with CLUSTER NODES or CLUSTER SLOTS, with TLS where the source has it and an ACL user that reaches every key; whether DUMP, RESTORE and PTTL run on a standard MemoryDB cluster is not stated by AWS, and for a member of a multi-Region cluster, whose page lists PTTL as unsupported, the step says the TTLs are not carried) and OpenSearch (the reindex operation). For a store without a documented way in (MongoDB Flex, a memcached cache) it is not offered and the decision offers the tool of the customer's own alone." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_user.md#L59-L63", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_credential.md#L51-L57", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_credential.md#L51-L57", "https://docs.stackit.cloud/products/databases/mariadb/how-tos/backup-and-restore/", "https://docs.stackit.cloud/products/databases/sqlserver-flex/how-tos/import-database-backup-from-stackit-s3-into-sqlserver-flex/", "https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/", "https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/SupportedCommands.html", "https://docs.aws.amazon.com/memorydb/latest/devguide/restrictedcommands.html", "https://docs.stackit.cloud/products/databases/opensearch/how-tos/migrate-elasticsearch-data-to-an-opensearch2-service-instance/" ], "regeneration_required": false }, { "id": "replicate-with-the-engine-replication", "title": "Replicate the data with the replication of the source engine until the cutover", "prerequisites": [], "effects": [ "A person sets up the replication of the source engine so that the STACKIT instance follows the source while the application keeps writing to the source (for PostgreSQL, logical replication: the schema is copied first with pg_dump --schema-only, a publication on the source and a subscription on the target copy the existing rows and then the changes, and the sequences are copied inside the write freeze because they are not replicated). The source needs a change and a reboot to turn replication on, and the target must be able to reach the source. Inside the write freeze the person waits until the target has caught up, compares both sides and switches the clients, then removes the replication. For a PostgreSQL database the plan holds the steps of this option (the initial copy, the watch of the lag, the freeze, the final copy, the reconcile and the cleanup); for an S3 bucket this option is not available, because S3 Replication copies between Amazon S3 buckets and no STACKIT bucket is documented as a destination (the plan holds the two copy tools instead); for any other engine this option is not offered, because no STACKIT service other than PostgreSQL Flex documents the replication of a source engine into it (MariaDB, Key Value Store, OpenSearch and MongoDB Flex document none, and the SQLServer Flex page on transactional replication describes an on-premises publisher and does not name Amazon RDS as one), so the decision of such a store offers the export and the import with the engine clients where its service documents them, and the tool of the customer's own." ], "risk": [], "evidence": [ "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html", "https://www.postgresql.org/docs/current/logical-replication-restrictions.html", "https://www.postgresql.org/docs/current/logical-replication-restrictions.html", "https://www.postgresql.org/docs/current/sql-createsubscription.html", "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html", "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html" ], "regeneration_required": false }, { "id": "copy-the-objects-with-rclone", "title": "Copy the objects of the bucket with rclone, from the source bucket to the STACKIT bucket", "prerequisites": [], "effects": [ "For an S3 bucket: a person runs rclone on a move host that reaches both endpoints, with two S3 remotes (the source with the AWS credentials of the shell, the target as a provider Other remote at the STACKIT S3 endpoint with a credential of a credentials group, both read from the environment at run time), copies every current object while the writers keep writing, repeats the copy until a pass is short, stops the writers, runs the last pass, settles what the source deleted after the first copy, and compares both sides (the count and the bytes, the key lists and, where a hash is shared, the content) before the applications are switched. The copy carries the current object of every key and nothing of the bucket's configuration: no older version, no delete marker, no retention, no ACL, no policy; those are settled where the draft names them. The plan holds the steps of this option (the initial copy, the passes, the freeze, the last pass, the reconcile and the cleanup) with command templates and no credential value. No copy was run against a STACKIT bucket by StackToIT." ], "risk": [], "evidence": [ "https://docs.stackit.cloud/products/storage/object-storage/tutorials/migrate-data-using-rclone/", "https://rclone.org/commands/rclone_copy/", "https://rclone.org/commands/rclone_check/", "https://docs.stackit.cloud/products/storage/object-storage/reference/supported-operations-on-buckets-and-objects/" ], "regeneration_required": false }, { "id": "copy-the-objects-with-the-aws-cli", "title": "Copy the objects of the bucket with the AWS CLI, through a staging directory", "prerequisites": [], "effects": [ "For an S3 bucket: a person runs the AWS CLI on a move host with free disk for the data. One command sends its requests to one endpoint, so the objects are downloaded from the AWS bucket into a directory with aws s3 sync and uploaded from it to the STACKIT bucket with aws s3 sync and --endpoint-url set to the STACKIT S3 endpoint, with the credential of a credentials group read from the environment at run time. The data crosses the host twice, one pass after the other; aws s3 sync decides by size and last-modified time and never compares the content, so the comparison before the switch downloads the target and compares the files. The copy carries the current object of every key and nothing of the bucket's configuration, as with rclone. The plan holds the steps of this option with command templates and no credential value. No copy was run against a STACKIT bucket by StackToIT." ], "risk": [], "evidence": [ "https://docs.aws.amazon.com/cli/latest/reference/s3/sync.html", "https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-options.html", "https://docs.stackit.cloud/products/storage/object-storage/how-tos/manage-encryption/" ], "regeneration_required": false }, { "id": "migrate-with-a-tool-of-my-own", "title": "Move the data with a migration tool or a replication of the owner's own", "prerequisites": [], "effects": [ "A person moves the data with a tool or a replication they run (for example a change-data-capture replication that keeps the copy in step until the cutover), writes its steps, the checks before the move, the cutover window and the way back, and carries them out. The STACKIT instance is reached at the host and port its credential states. The plan holds that work as typed steps: the write freeze of the source, the copy as one step whose commands the person writes, and the reconcile that compares both sides; the source stays the way back until the reconcile records GO, which a person checks, since the plan cannot know that the tool leaves the source unchanged. A memcached cache holds a confirmation instead of a copy. A bucket repeated by count or for_each has neither a reconcile nor any other option: its instances and the buckets they move to are not named, so the plan holds the one manual step, which the person writes for each instance after naming them." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57" ], "regeneration_required": false } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_user.md#L59-L63", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_credential.md#L51-L57", "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_credential.md#L51-L57", "https://docs.stackit.cloud/products/databases/mariadb/how-tos/backup-and-restore/", "https://docs.stackit.cloud/products/databases/sqlserver-flex/how-tos/import-database-backup-from-stackit-s3-into-sqlserver-flex/", "https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/", "https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/SupportedCommands.html", "https://docs.aws.amazon.com/memorydb/latest/devguide/restrictedcommands.html", "https://docs.stackit.cloud/products/databases/opensearch/how-tos/migrate-elasticsearch-data-to-an-opensearch2-service-instance/", "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html", "https://www.postgresql.org/docs/current/logical-replication-restrictions.html", "https://www.postgresql.org/docs/current/sql-createsubscription.html", "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html", "https://docs.stackit.cloud/products/storage/object-storage/tutorials/migrate-data-using-rclone/", "https://rclone.org/commands/rclone_copy/", "https://rclone.org/commands/rclone_check/", "https://docs.stackit.cloud/products/storage/object-storage/reference/supported-operations-on-buckets-and-objects/", "https://docs.aws.amazon.com/cli/latest/reference/s3/sync.html", "https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-options.html", "https://docs.stackit.cloud/products/storage/object-storage/how-tos/manage-encryption/" ], "related_execution_steps": [ { "id": "MAN/data/google_sql_database_instance.postgres/initial-copy/logical-replication", "mode": "MANUAL", "phase": "DATA", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true }, { "id": "MAN/data/google_sql_database_instance.postgres/delta-sync/logical-replication", "mode": "MANUAL", "phase": "DATA", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true }, { "id": "MAN/data/google_sql_database_instance.postgres/write-freeze/dump-restore", "mode": "MANUAL", "phase": "CUTOVER", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true }, { "id": "MAN/data/google_sql_database_instance.postgres/final-sync/dump-restore", "mode": "MANUAL", "phase": "CUTOVER", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true }, { "id": "MAN/data/google_sql_database_instance.postgres/reconcile/dump-restore", "mode": "MANUAL", "phase": "CUTOVER", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true }, { "id": "MAN/data/google_sql_database_instance.postgres/write-freeze/logical-replication", "mode": "MANUAL", "phase": "CUTOVER", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true }, { "id": "MAN/data/google_sql_database_instance.postgres/final-sync/logical-replication", "mode": "MANUAL", "phase": "CUTOVER", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true }, { "id": "MAN/data/google_sql_database_instance.postgres/reconcile/logical-replication", "mode": "MANUAL", "phase": "CUTOVER", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true }, { "id": "MAN/data/google_sql_database_instance.postgres/write-freeze/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true }, { "id": "MAN/data/google_sql_database_instance.postgres/final-sync/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true }, { "id": "MAN/data/google_sql_database_instance.postgres/reconcile/own-tool", "mode": "MANUAL", "phase": "CUTOVER", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true }, { "id": "MAN/data/google_sql_database_instance.postgres/cleanup/dump-restore", "mode": "MANUAL", "phase": "DECOMMISSION", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true }, { "id": "MAN/data/google_sql_database_instance.postgres/cleanup/logical-replication", "mode": "MANUAL", "phase": "DECOMMISSION", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true } ] } }, { "id": "DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE", "kind": "PROPOSED_ALTERNATIVE", "family": "convert", "source": "PLAN_DECISION", "group": "GRP-PLAN-DECISION-convert", "block": "PROPOSED_ALTERNATIVE", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "google_cloudbuild_trigger.activategcb", "artifact": "assessment.json", "pointer": "/units/11" }, { "kind": "unit", "id": "google_cloudbuild_trigger.init", "artifact": "assessment.json", "pointer": "/units/12" }, { "kind": "unit", "id": "google_cloudbuild_trigger.placeholder", "artifact": "assessment.json", "pointer": "/units/13" }, { "kind": "unit", "id": "google_firebase_hosting_site.client", "artifact": "assessment.json", "pointer": "/units/14" }, { "kind": "unit", "id": "google_secret_manager_secret.django_admin_password", "artifact": "assessment.json", "pointer": "/units/6" }, { "kind": "unit", "id": "google_secret_manager_secret.django_settings", "artifact": "assessment.json", "pointer": "/units/8" }, { "kind": "unit", "id": "google_storage_bucket.media", "artifact": "assessment.json", "pointer": "/units/7" } ], "affected_applications": [], "members": [ { "kind": "plan_decision", "id": "convert:google_cloudbuild_trigger.activategcb:proposal:PROPOSED_ALTERNATIVE", "artifact": "workspace.json", "pointer": "/units/2/deployment_prerequisites/open_decisions/1" }, { "kind": "plan_decision", "id": "convert:google_cloudbuild_trigger.init:proposal:PROPOSED_ALTERNATIVE", "artifact": "workspace.json", "pointer": "/units/3/deployment_prerequisites/open_decisions/1" }, { "kind": "plan_decision", "id": "convert:google_cloudbuild_trigger.placeholder:proposal:PROPOSED_ALTERNATIVE", "artifact": "workspace.json", "pointer": "/units/4/deployment_prerequisites/open_decisions/1" }, { "kind": "plan_decision", "id": "convert:google_firebase_hosting_site.client:proposal:PROPOSED_ALTERNATIVE", "artifact": "workspace.json", "pointer": "/units/5/deployment_prerequisites/open_decisions/0" }, { "kind": "plan_decision", "id": "convert:google_secret_manager_secret_iam_binding.django_admin_password:proposal:PROPOSED_ALTERNATIVE", "artifact": "workspace.json", "pointer": "/units/8/deployment_prerequisites/open_decisions/1" }, { "kind": "plan_decision", "id": "convert:google_secret_manager_secret_iam_binding.django_settings:proposal:PROPOSED_ALTERNATIVE", "artifact": "workspace.json", "pointer": "/units/9/deployment_prerequisites/open_decisions/1" }, { "kind": "plan_decision", "id": "convert:google_storage_bucket_iam_member.automation:proposal:PROPOSED_ALTERNATIVE", "artifact": "workspace.json", "pointer": "/units/15/deployment_prerequisites/open_decisions/1" }, { "kind": "plan_decision", "id": "convert:google_storage_bucket_iam_member.server:proposal:PROPOSED_ALTERNATIVE", "artifact": "workspace.json", "pointer": "/units/15/deployment_prerequisites/open_decisions/2" } ], "aliases": [ { "id": "convert:google_cloudbuild_trigger.activategcb:proposal:PROPOSED_ALTERNATIVE", "source": "PLAN_DECISION", "subject": "google_cloudbuild_trigger.activategcb", "display_id": "DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_cloudbuild_trigger.activategcb" }, { "id": "convert:google_cloudbuild_trigger.init:proposal:PROPOSED_ALTERNATIVE", "source": "PLAN_DECISION", "subject": "google_cloudbuild_trigger.init", "display_id": "DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_cloudbuild_trigger.init" }, { "id": "convert:google_cloudbuild_trigger.placeholder:proposal:PROPOSED_ALTERNATIVE", "source": "PLAN_DECISION", "subject": "google_cloudbuild_trigger.placeholder", "display_id": "DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_cloudbuild_trigger.placeholder" }, { "id": "convert:google_firebase_hosting_site.client:proposal:PROPOSED_ALTERNATIVE", "source": "PLAN_DECISION", "subject": "google_firebase_hosting_site.client", "display_id": "DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_firebase_hosting_site.client" }, { "id": "convert:google_secret_manager_secret_iam_binding.django_admin_password:proposal:PROPOSED_ALTERNATIVE", "source": "PLAN_DECISION", "subject": "google_secret_manager_secret_iam_binding.django_admin_password", "display_id": "DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_secret_manager_secret_iam_binding.django_admin_password" }, { "id": "convert:google_secret_manager_secret_iam_binding.django_settings:proposal:PROPOSED_ALTERNATIVE", "source": "PLAN_DECISION", "subject": "google_secret_manager_secret_iam_binding.django_settings", "display_id": "DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_secret_manager_secret_iam_binding.django_settings" }, { "id": "convert:google_storage_bucket_iam_member.automation:proposal:PROPOSED_ALTERNATIVE", "source": "PLAN_DECISION", "subject": "google_storage_bucket_iam_member.automation", "display_id": "DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_storage_bucket_iam_member.automation" }, { "id": "convert:google_storage_bucket_iam_member.server:proposal:PROPOSED_ALTERNATIVE", "source": "PLAN_DECISION", "subject": "google_storage_bucket_iam_member.server", "display_id": "DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_storage_bucket_iam_member.server" } ], "options": [ { "id": "use-the-proposed-module", "title": "Use the proposed module, with the stated difference", "effect": "A person reads the module, sets its values and sets its switch to true: the module is then part of the plan of the draft, with the stated difference from the source. While the switch is false, the module creates nothing.", "execution_effect": "ACK_CURRENT_ARTIFACT", "evidence": [ { "url": "https://opentofu.org/docs/language/meta-arguments/count/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "If a resource or module block includes a count argument whose value is a whole number, OpenTofu will create that many instances." } ] }, { "id": "design-it-another-way", "title": "Design it another way and leave the module off", "effect": "A person designs the capability another way, by hand, and the switch of the module stays false: the module creates nothing and the unit's manual step stays the person's work.", "execution_effect": "MANUAL_ALTERNATIVE", "evidence": [ { "url": "https://opentofu.org/docs/language/meta-arguments/count/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "If a resource or module block includes a count argument whose value is a whole number, OpenTofu will create that many instances." } ] } ], "recommended_option": null, "blocking_effect": "TARGET_DESIGN_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_secret_manager_secret.django_admin_password", "artifact": "workspace.json", "pointer": "/units/8/trace" }, { "kind": "evidence", "id": "google_secret_manager_secret.django_settings", "artifact": "workspace.json", "pointer": "/units/9/trace" }, { "kind": "evidence", "id": "google_storage_bucket.media", "artifact": "workspace.json", "pointer": "/units/15/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:af35ed50b2c8832725ee5a41a11f947f09e19ee3a5aad77e3417356fd0bd96e9", "artifact_sha256": "sha256:1faf18cdde50f305c706a8770f6ab7e3fdc8ea913deff4b820878f73ad61058a", "kb_dependencies": [ { "kind": "decision_kind", "id": "convert/PROPOSED_ALTERNATIVE", "sha256": "sha256:2d3df9fdf41aa732315c8e86695f5501a64a3368c3a0889161d6f034b0ff2dba" }, { "kind": "review_cause", "id": "convert/PROPOSED_ALTERNATIVE", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" } ], "kb_dependencies_sha256": "sha256:4e2f49836dda938009c1e17d3985cef438eb78acb823da060a7d4677f36dd7f9" }, "causes": [ { "cause": "TARGET_LIMIT", "members": 8 } ], "blocker_class": "ROOT_BLOCKER", "unblocks": { "holds": 4, "alone": 4, "shared": 0, "steps": [ "MAN/unit/google_firebase_hosting_site.client", "MAN/unit/google_cloudbuild_trigger.activategcb", "MAN/unit/google_cloudbuild_trigger.init", "MAN/unit/google_cloudbuild_trigger.placeholder" ], "best_option": "use-the-proposed-module", "options": [ { "option": "use-the-proposed-module", "effects": [ "ACK_CURRENT_ARTIFACT" ], "alone": 4, "shared": 0 }, { "option": "design-it-another-way", "effects": [ "MANUAL_ALTERNATIVE" ], "alone": 4, "shared": 0 } ], "automated": { "holds": 0, "alone": 0, "shared": 0 } }, "why": "The target has no equal of a source capability, and the draft holds a STACKIT alternative in a module that is switched off (8 converter decisions): nothing of the module applies until a person accepts the stated difference, gives it its values and sets its switch, or designs the capability another way.", "required_evidence": [ "the target has no equal of this Cloud Build trigger: starts a build on a source event, a Pub/Sub message, a webhook or by hand, with its steps, substitutions, artifacts, secrets and optional approval: Nothing is converted. The same delivery is a workflow of STACKIT Git Pipelines (written for GitHub Actions; STACKIT-managed or custom runners; secrets from Secrets Manager or the repository; a manual-approval action) or the customer's own CI/CD. Trigger conditions, steps, secrets (created again, never copied), the service account (replaced by the credentials the workflow uses against STACKIT), the log destination and the approval are written again by a person. To decide: Which pipelines are still needed, where they run (STACKIT Git Pipelines or the customer's own CI/CD), how each trigger, step, secret and approval is written again, and who owns the workflow files.", "the target has no equal of this one member's role on the Cloud Storage bucket: A STACKIT credentials group is not a grant on the Cloud Storage bucket. It is the principal that a bucket policy names, a set of S3 keys with no Google identity behind it, and by itself it gives no access to the bucket and takes none away. The statement that grants it something is a statement of the bucket policy, in the policy language of STACKIT (a credentials group or * as the principal, S3 actions, five condition keys), which no Terraform resource sets. The Google role is not mapped to S3 actions by any table, the condition of the grant has no counterpart unless it can be written with those five condition keys, and a Google group, a domain, a federated identity and allUsers or allAuthenticatedUsers are named again as credentials groups or as *. To decide: Which credentials group stands for each member of the grant, which S3 actions of the bucket policy give the same people the access they need and no more than the Google role gave, what becomes of the condition, of public members (allUsers, allAuthenticatedUsers), of Google groups, domains and federated identities, and whether the grant ends with the Cloud Storage bucket when it has no replacement. Which bucket the grant is on, because the scan does not hold it. The draft of google_storage_bucket.media stands as it is: this answer decides the module and nothing of that draft.", "the target has no equal of this static web hosting site: Static files are published into an Object Storage bucket by a pipeline, and a CDN distribution (a beta resource) with the bucket as origin serves them on a custom domain; the redirects of the site become redirect rules of the distribution. Custom response headers, rewrites to Cloud Run services or Cloud Functions, preview channels and the release history have no counterpart and are restated in the pipeline or in the application. To decide: Which bucket is the origin, which domain the distribution serves, and how rewrites and previews are replaced. The CDN resources are beta.", "the target has no equal of this the members of one role on the Secret Manager secret: A STACKIT role assignment is not a grant on the Secret Manager secret. It gives one user, group or service account one STACKIT role on a whole project, folder or organisation. The role is a set of STACKIT permissions, not the Google role, and no table maps one to the other. It has no condition and no public member, so what the grant gave to a Google group, a domain, a federated identity or everyone is named again, and the access reaches more than the Secret Manager secret. A binding on a secret group applies to every secret in the group, so it is wider than a grant on one secret unless the secret has a group of its own, and its roles are Secrets Manager roles. The binding was authoritative for its role: STACKIT role assignments are additive, so a person who holds the role through another assignment keeps it, and removing such people is a step of a person. To decide: Which STACKIT role, on which project, folder or organisation, gives the same people the access they need on the Secret Manager secret, knowing it covers everything in that scope; which STACKIT users, groups or service accounts take the place of Google groups, domains, federated identities and a public member; and whether the grant ends with the Secret Manager secret when it has no replacement. For secrets: which secret group holds the secret, who else shares that group, and which Secrets Manager role and subject take the grant. Whether people who hold the role through another assignment keep it. The draft of google_secret_manager_secret.django_admin_password stands as it is: this answer decides the module and nothing of that draft.", "the target has no equal of this the members of one role on the Secret Manager secret: A STACKIT role assignment is not a grant on the Secret Manager secret. It gives one user, group or service account one STACKIT role on a whole project, folder or organisation. The role is a set of STACKIT permissions, not the Google role, and no table maps one to the other. It has no condition and no public member, so what the grant gave to a Google group, a domain, a federated identity or everyone is named again, and the access reaches more than the Secret Manager secret. A binding on a secret group applies to every secret in the group, so it is wider than a grant on one secret unless the secret has a group of its own, and its roles are Secrets Manager roles. The binding was authoritative for its role: STACKIT role assignments are additive, so a person who holds the role through another assignment keeps it, and removing such people is a step of a person. To decide: Which STACKIT role, on which project, folder or organisation, gives the same people the access they need on the Secret Manager secret, knowing it covers everything in that scope; which STACKIT users, groups or service accounts take the place of Google groups, domains, federated identities and a public member; and whether the grant ends with the Secret Manager secret when it has no replacement. For secrets: which secret group holds the secret, who else shares that group, and which Secrets Manager role and subject take the grant. Whether people who hold the role through another assignment keep it. The draft of google_secret_manager_secret.django_settings stands as it is: this answer decides the module and nothing of that draft.", "that the stated difference from the source is acceptable for what depends on it", "the values the module asks for, which the draft does not invent" ], "resolution": { "decision_id": "DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE", "source_family": "convert", "source_semantic": "PROPOSED_ALTERNATIVE", "affected_units": [ "google_cloudbuild_trigger.activategcb", "google_cloudbuild_trigger.init", "google_cloudbuild_trigger.placeholder", "google_firebase_hosting_site.client", "google_secret_manager_secret.django_admin_password", "google_secret_manager_secret.django_settings", "google_storage_bucket.media" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "TARGET_DESIGN_OPEN", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The plan leaves this decision open on google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder, google_firebase_hosting_site.client and 3 more.", "generated_target_behavior": "The draft holds MAN/unit/google_cloudbuild_trigger.activategcb, MAN/unit/google_cloudbuild_trigger.init, MAN/unit/google_cloudbuild_trigger.placeholder and MAN/unit/google_firebase_hosting_site.client until this decision is answered by an answer that frees it.", "residual_difference": "the target design is open until the decision is answered", "execution_effect": "4 steps of the plan wait for it until it is answered: MAN/unit/google_cloudbuild_trigger.activategcb, MAN/unit/google_cloudbuild_trigger.init, MAN/unit/google_cloudbuild_trigger.placeholder and MAN/unit/google_firebase_hosting_site.client.", "next_action": "Decide whether a proposed STACKIT alternative replaces a source capability for google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder, google_firebase_hosting_site.client and 3 more: choose one of the 2 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "The target has no equal of a source capability, and the draft holds a STACKIT alternative in a module that is switched off (8 converter decisions): nothing of the module applies until a person accepts the stated difference, gives it its values and sets its switch, or designs the capability another way." ], "closes_when": [ "an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option" ], "required_inputs": [ "the target has no equal of this Cloud Build trigger: starts a build on a source event, a Pub/Sub message, a webhook or by hand, with its steps, substitutions, artifacts, secrets and optional approval: Nothing is converted. The same delivery is a workflow of STACKIT Git Pipelines (written for GitHub Actions; STACKIT-managed or custom runners; secrets from Secrets Manager or the repository; a manual-approval action) or the customer's own CI/CD. Trigger conditions, steps, secrets (created again, never copied), the service account (replaced by the credentials the workflow uses against STACKIT), the log destination and the approval are written again by a person. To decide: Which pipelines are still needed, where they run (STACKIT Git Pipelines or the customer's own CI/CD), how each trigger, step, secret and approval is written again, and who owns the workflow files.", "the target has no equal of this one member's role on the Cloud Storage bucket: A STACKIT credentials group is not a grant on the Cloud Storage bucket. It is the principal that a bucket policy names, a set of S3 keys with no Google identity behind it, and by itself it gives no access to the bucket and takes none away. The statement that grants it something is a statement of the bucket policy, in the policy language of STACKIT (a credentials group or * as the principal, S3 actions, five condition keys), which no Terraform resource sets. The Google role is not mapped to S3 actions by any table, the condition of the grant has no counterpart unless it can be written with those five condition keys, and a Google group, a domain, a federated identity and allUsers or allAuthenticatedUsers are named again as credentials groups or as *. To decide: Which credentials group stands for each member of the grant, which S3 actions of the bucket policy give the same people the access they need and no more than the Google role gave, what becomes of the condition, of public members (allUsers, allAuthenticatedUsers), of Google groups, domains and federated identities, and whether the grant ends with the Cloud Storage bucket when it has no replacement. Which bucket the grant is on, because the scan does not hold it. The draft of google_storage_bucket.media stands as it is: this answer decides the module and nothing of that draft.", "the target has no equal of this static web hosting site: Static files are published into an Object Storage bucket by a pipeline, and a CDN distribution (a beta resource) with the bucket as origin serves them on a custom domain; the redirects of the site become redirect rules of the distribution. Custom response headers, rewrites to Cloud Run services or Cloud Functions, preview channels and the release history have no counterpart and are restated in the pipeline or in the application. To decide: Which bucket is the origin, which domain the distribution serves, and how rewrites and previews are replaced. The CDN resources are beta.", "the target has no equal of this the members of one role on the Secret Manager secret: A STACKIT role assignment is not a grant on the Secret Manager secret. It gives one user, group or service account one STACKIT role on a whole project, folder or organisation. The role is a set of STACKIT permissions, not the Google role, and no table maps one to the other. It has no condition and no public member, so what the grant gave to a Google group, a domain, a federated identity or everyone is named again, and the access reaches more than the Secret Manager secret. A binding on a secret group applies to every secret in the group, so it is wider than a grant on one secret unless the secret has a group of its own, and its roles are Secrets Manager roles. The binding was authoritative for its role: STACKIT role assignments are additive, so a person who holds the role through another assignment keeps it, and removing such people is a step of a person. To decide: Which STACKIT role, on which project, folder or organisation, gives the same people the access they need on the Secret Manager secret, knowing it covers everything in that scope; which STACKIT users, groups or service accounts take the place of Google groups, domains, federated identities and a public member; and whether the grant ends with the Secret Manager secret when it has no replacement. For secrets: which secret group holds the secret, who else shares that group, and which Secrets Manager role and subject take the grant. Whether people who hold the role through another assignment keep it. The draft of google_secret_manager_secret.django_admin_password stands as it is: this answer decides the module and nothing of that draft.", "the target has no equal of this the members of one role on the Secret Manager secret: A STACKIT role assignment is not a grant on the Secret Manager secret. It gives one user, group or service account one STACKIT role on a whole project, folder or organisation. The role is a set of STACKIT permissions, not the Google role, and no table maps one to the other. It has no condition and no public member, so what the grant gave to a Google group, a domain, a federated identity or everyone is named again, and the access reaches more than the Secret Manager secret. A binding on a secret group applies to every secret in the group, so it is wider than a grant on one secret unless the secret has a group of its own, and its roles are Secrets Manager roles. The binding was authoritative for its role: STACKIT role assignments are additive, so a person who holds the role through another assignment keeps it, and removing such people is a step of a person. To decide: Which STACKIT role, on which project, folder or organisation, gives the same people the access they need on the Secret Manager secret, knowing it covers everything in that scope; which STACKIT users, groups or service accounts take the place of Google groups, domains, federated identities and a public member; and whether the grant ends with the Secret Manager secret when it has no replacement. For secrets: which secret group holds the secret, who else shares that group, and which Secrets Manager role and subject take the grant. Whether people who hold the role through another assignment keep it. The draft of google_secret_manager_secret.django_settings stands as it is: this answer decides the module and nothing of that draft.", "that the stated difference from the source is acceptable for what depends on it", "the values the module asks for, which the draft does not invent" ], "resolution_paths": [ { "id": "use-the-proposed-module", "title": "Use the proposed module, with the stated difference", "prerequisites": [], "effects": [ "A person reads the module, sets its values and sets its switch to true: the module is then part of the plan of the draft, with the stated difference from the source. While the switch is false, the module creates nothing." ], "risk": [], "evidence": [ "https://opentofu.org/docs/language/meta-arguments/count/" ], "regeneration_required": false }, { "id": "design-it-another-way", "title": "Design it another way and leave the module off", "prerequisites": [], "effects": [ "A person designs the capability another way, by hand, and the switch of the module stays false: the module creates nothing and the unit's manual step stays the person's work." ], "risk": [], "evidence": [ "https://opentofu.org/docs/language/meta-arguments/count/" ], "regeneration_required": false } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [ "https://opentofu.org/docs/language/meta-arguments/count/" ], "related_execution_steps": [ { "id": "MAN/unit/google_cloudbuild_trigger.activategcb", "mode": "MANUAL", "phase": "WORKLOAD", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true }, { "id": "MAN/unit/google_cloudbuild_trigger.init", "mode": "MANUAL", "phase": "WORKLOAD", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true }, { "id": "MAN/unit/google_cloudbuild_trigger.placeholder", "mode": "MANUAL", "phase": "WORKLOAD", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true }, { "id": "MAN/unit/google_firebase_hosting_site.client", "mode": "MANUAL", "phase": "DATA", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true } ] } }, { "id": "DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING", "kind": "SOURCE_PROJECT_MAPPING", "family": "convert", "source": "PLAN_DECISION", "group": "GRP-PLAN-DECISION-convert", "block": "SOURCE_PROJECT_MAPPING", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "google_cloudbuild_trigger.activategcb", "artifact": "assessment.json", "pointer": "/units/11" }, { "kind": "unit", "id": "google_cloudbuild_trigger.init", "artifact": "assessment.json", "pointer": "/units/12" }, { "kind": "unit", "id": "google_cloudbuild_trigger.placeholder", "artifact": "assessment.json", "pointer": "/units/13" }, { "kind": "unit", "id": "google_sql_database_instance.postgres", "artifact": "assessment.json", "pointer": "/units/5" } ], "affected_applications": [], "members": [ { "kind": "plan_decision", "id": "convert:estate:source_project:SOURCE_PROJECT_MAPPING", "artifact": "workspace.json", "pointer": "/units/2/deployment_prerequisites/open_decisions/0" }, { "kind": "semantic", "id": "google_cloudbuild_trigger.activategcb|project-residency", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/5" }, { "kind": "semantic", "id": "google_cloudbuild_trigger.init|project-residency", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/11" }, { "kind": "semantic", "id": "google_cloudbuild_trigger.placeholder|project-residency", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/17" }, { "kind": "semantic", "id": "google_sql_database_instance.postgres|project-scope", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/38" } ], "sources": [ "PLAN_DECISION", "CRITICAL_SEMANTIC" ], "blocking_effects": [ "TARGET_DESIGN_OPEN", "CRITICAL_SEMANTIC_OPEN" ], "aliases": [ { "id": "convert:estate:source_project:SOURCE_PROJECT_MAPPING", "source": "PLAN_DECISION", "subject": "google_cloudbuild_trigger.activategcb", "display_id": "DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING" }, { "id": "google_cloudbuild_trigger.activategcb|project-residency", "source": "CRITICAL_SEMANTIC", "subject": "google_cloudbuild_trigger.activategcb", "display_id": "DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING" }, { "id": "google_cloudbuild_trigger.init|project-residency", "source": "CRITICAL_SEMANTIC", "subject": "google_cloudbuild_trigger.init", "display_id": "DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING" }, { "id": "google_cloudbuild_trigger.placeholder|project-residency", "source": "CRITICAL_SEMANTIC", "subject": "google_cloudbuild_trigger.placeholder", "display_id": "DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING" }, { "id": "google_sql_database_instance.postgres|project-scope", "source": "CRITICAL_SEMANTIC", "subject": "google_sql_database_instance.postgres", "display_id": "DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING" } ], "conditional_members": 3, "options": [ { "id": "units-go-to-the-project-variable", "title": "The units of the source project go to the project the variable project_id names", "effect": "A person states that the units of this source project go to the STACKIT project var.project_id names. The source project is carried nowhere: the answer records the person's mapping, changes nothing in the draft, which keeps its own project resolver, and closes the settings of that project.", "execution_effect": "ACK_CURRENT_ARTIFACT", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-06", "quote": "`project_id` (String) STACKIT project ID to which the network is associated." } ] }, { "id": "units-go-to-the-project-of-their-network", "title": "The units of the source project go to the project of their network", "effect": "A person states that the units of this source project go to the STACKIT project of the network they stand in. The network design maps a source network to a target project, and no map from a source project to a target project exists: the answer records the person's mapping, changes nothing in the draft, which keeps its own project resolver, and closes the settings of that project.", "execution_effect": "ACK_CURRENT_ARTIFACT", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-06", "quote": "`project_id` (String) STACKIT project ID to which the network is associated." } ] } ], "recommended_option": null, "blocking_effect": "TARGET_DESIGN_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_sql_database_instance.postgres", "artifact": "workspace.json", "pointer": "/units/14/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:bfe72ff4b84be59f91d62c726bb588d393af2d2beebf6f921538125bffe5ffd9", "artifact_sha256": "sha256:5f13672461ff52c8812ef8689225bfb97acab9d2c4a3a7e6671a24c17ea663c2", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.cloudbuild/project-residency", "sha256": "sha256:91c26b9fe18766a0adccf221c0c6741b5dbd490695d36fd9680442518fc14bdf" }, { "kind": "contract_semantic", "id": "gcp.sql_instance/project-scope", "sha256": "sha256:2aabcb438375e141302bd64de3b602cd75a98c5ad29d40f833c9a36fc245bf68" }, { "kind": "decision_kind", "id": "convert/SOURCE_PROJECT_MAPPING", "sha256": "sha256:137deabf8aa362cbb932fc910f46f044e1acdb83d83ce46f324fb7d00a9d6637" }, { "kind": "review_cause", "id": "convert/SOURCE_PROJECT_MAPPING", "sha256": "sha256:9c9574ed4eb8ebe16e049fac4577e70a1d76cc2515eb76898827e107ffdae816" } ], "kb_dependencies_sha256": "sha256:499099d550b6e4222fa317976fd0988578b8321f689feaf564abc70903c02d1d" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 3 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "unblocks": { "holds": 1, "alone": 1, "shared": 0, "steps": [ "MAN/estate/SOURCE_PROJECT_MAPPING" ], "best_option": "units-go-to-the-project-variable", "options": [ { "option": "units-go-to-the-project-variable", "effects": [ "ACK_CURRENT_ARTIFACT" ], "alone": 1, "shared": 0 }, { "option": "units-go-to-the-project-of-their-network", "effects": [ "ACK_CURRENT_ARTIFACT" ], "alone": 1, "shared": 0 }, { "option": "", "effects": [ "ACK_CURRENT_ARTIFACT" ], "alone": 1, "shared": 0 } ], "automated": { "holds": 0, "alone": 0, "shared": 0 } }, "why": "Where the units of each source project go is one statement a person makes for the estate: the source project is carried nowhere, the draft keeps its own project resolver, and the answer changes nothing in the draft. There is no default. It holds 4 open critical settings of the estate: an answer in the inputs file closes those of its place, and a review of this record records the confirmation and closes none of them.", "required_evidence": [ "The source places its units in the project example-project, and in a project the scan cannot read for some units, and the source project is carried nowhere. A person maps the source projects by answering target.project.source_project for each: var.project_id, or the project of the unit's network (network-project). The answer records that mapping and changes nothing in the draft, which keeps its own project resolver.", "which source projects stay one STACKIT project and which do not, and who owns each" ], "resolution": { "decision_id": "DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING", "source_family": "convert", "source_semantic": "SOURCE_PROJECT_MAPPING", "affected_units": [ "google_cloudbuild_trigger.activategcb", "google_cloudbuild_trigger.init", "google_cloudbuild_trigger.placeholder", "google_sql_database_instance.postgres" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states the setting on google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder and google_sql_database_instance.postgres. The plan leaves this decision open on google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder and google_sql_database_instance.postgres.", "generated_target_behavior": "The draft does not carry the setting on google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder and google_sql_database_instance.postgres. The draft holds MAN/estate/SOURCE_PROJECT_MAPPING until this decision is answered by an answer that frees it.", "residual_difference": "the target design is open until the decision is answered", "execution_effect": "1 step of the plan waits for it until it is answered: MAN/estate/SOURCE_PROJECT_MAPPING. Held by something else first: MAN/unit/google_cloudbuild_trigger.activategcb, MAN/unit/google_cloudbuild_trigger.init and MAN/unit/google_cloudbuild_trigger.placeholder.", "next_action": "State where the units of each source project of the estate go for google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder and google_sql_database_instance.postgres: choose one of the 2 options, in the inputs file given with --inputs (the stubs are in inputs-template.yaml), once for each source project: that closes the settings of the project and does not change the draft.", "why_open": [ "The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Project and Cloud Build location are data-residency/project-boundary facts with no STACKIT CI/CD resource to remap them onto -- REVIEW.", "The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The project of the instance (google 8.4.0 `project`: \"The ID of the project in which the resource belongs. If it is not provided, the provider project is used\"). A STACKIT project is the scope for ownership, resource consumption and access control (docs.stackit.cloud/platform/resource-manager/basics/projects/): whether the database's source project becomes the project of the rest of the estate is a design decision no rule evidences — a person confirms it — REVIEW (critical)." ], "closes_when": [ "A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting.", "A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "the module terraform/proposals/proposal_activategcb is switched on with its values and checked, or the design that replaces it is set up and checked; the decision records which", "the module terraform/proposals/proposal_init is switched on with its values and checked, or the design that replaces it is set up and checked; the decision records which", "the module terraform/proposals/proposal_placeholder is switched on with its values and checked, or the design that replaces it is set up and checked; the decision records which" ], "required_inputs": [ "The source places its units in the project example-project, and in a project the scan cannot read for some units, and the source project is carried nowhere. A person maps the source projects by answering target.project.source_project for each: var.project_id, or the project of the unit's network (network-project). The answer records that mapping and changes nothing in the draft, which keeps its own project resolver.", "which source projects stay one STACKIT project and which do not, and who owns each", "what the customer decides: Which pipelines are still needed, where they run (STACKIT Git Pipelines or the customer's own CI/CD), how each trigger, step, secret and approval is written again, and who owns the workflow files. the review the assessment asks for: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents; Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied; Write the trigger conditions again as the on: section of the workflow and verify each event kind against the Forgejo Actions reference; Decide where images and artifacts go: the package registry of STACKIT Git takes container images from any OCI client, or keep your own registry, and change the image names in the deploy steps.; whether google_cloudbuild_trigger.activategcb exists in production, and with how many instances: the value production gives var.init", "what the customer decides: Which pipelines are still needed, where they run (STACKIT Git Pipelines or the customer's own CI/CD), how each trigger, step, secret and approval is written again, and who owns the workflow files. the review the assessment asks for: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents; Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied; Write the trigger conditions again as the on: section of the workflow and verify each event kind against the Forgejo Actions reference; Decide where images and artifacts go: the package registry of STACKIT Git takes container images from any OCI client, or keep your own registry, and change the image names in the deploy steps.; whether google_cloudbuild_trigger.init exists in production, and with how many instances: the value production gives var.init", "what the customer decides: Which pipelines are still needed, where they run (STACKIT Git Pipelines or the customer's own CI/CD), how each trigger, step, secret and approval is written again, and who owns the workflow files. the review the assessment asks for: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents; Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied; Write the trigger conditions again as the on: section of the workflow and verify each event kind against the Forgejo Actions reference; Decide where images and artifacts go: the package registry of STACKIT Git takes container images from any OCI client, or keep your own registry, and change the image names in the deploy steps.; whether google_cloudbuild_trigger.placeholder exists in production, and with how many instances: the value production gives var.init" ], "resolution_paths": [ { "id": "units-go-to-the-project-variable", "title": "The units of the source project go to the project the variable project_id names", "prerequisites": [], "effects": [ "A person states that the units of this source project go to the STACKIT project var.project_id names. The source project is carried nowhere: the answer records the person's mapping, changes nothing in the draft, which keeps its own project resolver, and closes the settings of that project." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network.md" ], "regeneration_required": false }, { "id": "units-go-to-the-project-of-their-network", "title": "The units of the source project go to the project of their network", "prerequisites": [], "effects": [ "A person states that the units of this source project go to the STACKIT project of the network they stand in. The network design maps a source network to a target project, and no map from a source project to a target project exists: the answer records the person's mapping, changes nothing in the draft, which keeps its own project resolver, and closes the settings of that project." ], "risk": [], "evidence": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network.md" ], "regeneration_required": false } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [ "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network.md" ], "related_execution_steps": [ { "id": "MAN/estate/SOURCE_PROJECT_MAPPING", "mode": "MANUAL", "phase": "DATA", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true }, { "id": "MAN/unit/google_cloudbuild_trigger.activategcb", "mode": "MANUAL", "phase": "WORKLOAD", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": false }, { "id": "MAN/unit/google_cloudbuild_trigger.init", "mode": "MANUAL", "phase": "WORKLOAD", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": false }, { "id": "MAN/unit/google_cloudbuild_trigger.placeholder", "mode": "MANUAL", "phase": "WORKLOAD", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-GEN-CONVERT-SOURCE-REGION-MAPPING", "kind": "SOURCE_REGION_MAPPING", "family": "convert", "source": "PLAN_DECISION", "group": "GRP-PLAN-DECISION-convert", "block": "SOURCE_REGION_MAPPING", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "google_cloud_run_v2_job.migrate", "artifact": "assessment.json", "pointer": "/units/9" }, { "kind": "unit", "id": "google_cloud_run_v2_service.server", "artifact": "assessment.json", "pointer": "/units/10" }, { "kind": "unit", "id": "google_sql_database_instance.postgres", "artifact": "assessment.json", "pointer": "/units/5" }, { "kind": "unit", "id": "google_storage_bucket.media", "artifact": "assessment.json", "pointer": "/units/7" } ], "affected_applications": [], "members": [ { "kind": "plan_decision", "id": "convert:estate:source_location:SOURCE_REGION_MAPPING", "artifact": "workspace.json", "pointer": "/units/0/deployment_prerequisites/open_decisions/0" }, { "kind": "semantic", "id": "google_cloud_run_v2_job.migrate|location-residency", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/4" }, { "kind": "semantic", "id": "google_cloud_run_v2_service.server|location-residency", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/17" }, { "kind": "semantic", "id": "google_sql_database_instance.postgres|region-residency", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/39" }, { "kind": "semantic", "id": "google_storage_bucket.media|bucket-region", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/43" } ], "sources": [ "PLAN_DECISION", "CRITICAL_SEMANTIC" ], "blocking_effects": [ "TARGET_DESIGN_OPEN", "CRITICAL_SEMANTIC_OPEN" ], "aliases": [ { "id": "convert:estate:source_location:SOURCE_REGION_MAPPING", "source": "PLAN_DECISION", "subject": "google_cloud_run_v2_job.migrate", "display_id": "DEC-GEN-CONVERT-SOURCE-REGION-MAPPING" }, { "id": "google_cloud_run_v2_job.migrate|location-residency", "source": "CRITICAL_SEMANTIC", "subject": "google_cloud_run_v2_job.migrate", "display_id": "DEC-GEN-CONVERT-SOURCE-REGION-MAPPING" }, { "id": "google_cloud_run_v2_service.server|location-residency", "source": "CRITICAL_SEMANTIC", "subject": "google_cloud_run_v2_service.server", "display_id": "DEC-GEN-CONVERT-SOURCE-REGION-MAPPING" }, { "id": "google_sql_database_instance.postgres|region-residency", "source": "CRITICAL_SEMANTIC", "subject": "google_sql_database_instance.postgres", "display_id": "DEC-GEN-CONVERT-SOURCE-REGION-MAPPING" }, { "id": "google_storage_bucket.media|bucket-region", "source": "CRITICAL_SEMANTIC", "subject": "google_storage_bucket.media", "display_id": "DEC-GEN-CONVERT-SOURCE-REGION-MAPPING" } ], "options": [ { "id": "map-source-locations-to-the-draft-region", "title": "Map every source location of the estate to the one STACKIT region the draft builds in", "effect": "The draft builds every unit in the one region of the estate, and that is what it does with no answer. STACKIT hosts its regions in Germany and Austria, each physically separate from the others, so the region is not shown to hold the residency a source location gave: the option states where the draft builds and claims no equal residency. A review of this option records the confirmation and closes no setting; an answer of target.region.source_location for each location closes the settings of that location.", "execution_effect": "ACK_CURRENT_ARTIFACT", "evidence": [ { "url": "https://docs.stackit.cloud/platform/regions/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "STACKIT hosts all regions exclusively in Germany (eu01) and Austria (eu02)." }, { "url": "https://docs.stackit.cloud/platform/regions/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "Each region remains physically separate from others." } ], "default": true }, { "id": "choose-the-region-of-each-location", "title": "Choose the STACKIT region of each source location", "effect": "An answer of target.region.source_location names the region of one source location, and the units whose location the scan cannot read are one more subject of the same topic. An answer that names the region the draft builds in closes the settings of that location. The draft builds in one region, so an answer that names another region is recorded, and read by the network design, and closes nothing until the estate is built there (target.region). Whether a region holds the residency of a source location stays the person's statement.", "execution_effect": "REGENERATE_REQUIRED", "evidence": [ { "url": "https://docs.stackit.cloud/platform/regions/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "STACKIT hosts all regions exclusively in Germany (eu01) and Austria (eu02)." }, { "url": "https://docs.stackit.cloud/platform/regions/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "While STACKIT maintains parity across all locations, we may release specialized services or newer features in specific regions first." } ] } ], "recommended_option": null, "defaults": [ { "member": "convert:estate:source_location:SOURCE_REGION_MAPPING", "option": "map-source-locations-to-the-draft-region", "words": "the draft builds every unit in the STACKIT region eu01, which is what it does with no answer. That is a region the catalogue of this build lists and no claim that it holds the residency of the source: only an answer of target.region.source_location closes the settings this decision holds.", "answered_by": "DEFAULT" } ], "blocking_effect": "TARGET_DESIGN_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_sql_database_instance.postgres", "artifact": "workspace.json", "pointer": "/units/14/trace" }, { "kind": "evidence", "id": "google_storage_bucket.media", "artifact": "workspace.json", "pointer": "/units/15/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:1be5810bd6bed11fb1fc02fe831c232fd9d2b9eaa1ed6c2f21eb8923722e1372", "artifact_sha256": "sha256:1b7845371e8d741cb3eef090a161d6679f6d28d298bea24c1f5186e5204d1f24", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.cloud_run/location-residency", "sha256": "sha256:93fb55f32101d1272a0974d33789c4fd9fba84a8fb0e568d0691b0afbe8e568a" }, { "kind": "contract_semantic", "id": "gcp.sql_instance/region-residency", "sha256": "sha256:df7174d240f00cd255c6892f7dab2fb6ab7b5d13387b8fd7ec72cae485cc2ce1" }, { "kind": "contract_semantic", "id": "gcp.storage_bucket/bucket-region", "sha256": "sha256:59bf7ffc54f90de31dba9a3e91fa86f206ac901a277e9d13fe83697890be439c" }, { "kind": "decision_kind", "id": "convert/SOURCE_REGION_MAPPING", "sha256": "sha256:592d3c9043b86e29dcc6e8b31dcec0f954b2d9c8db461f990893d126ae379ccf" }, { "kind": "review_cause", "id": "convert/SOURCE_REGION_MAPPING", "sha256": "sha256:fb3924b78b2b793d51a4edfba69fadc3e4f28d576808d9aad0f362b264b84410" } ], "kb_dependencies_sha256": "sha256:9f089fa98bc5213252824480f45d48fce25196a42c1a14b903267ac4cf2bf279" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 3 }, { "cause": "NOT_CLASSIFIED", "members": 2 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "unblocks": { "holds": 1, "alone": 1, "shared": 0, "steps": [ "MAN/estate/SOURCE_REGION_MAPPING" ], "best_option": "map-source-locations-to-the-draft-region", "options": [ { "option": "map-source-locations-to-the-draft-region", "effects": [ "ACK_CURRENT_ARTIFACT" ], "alone": 1, "shared": 0 }, { "option": "choose-the-region-of-each-location", "effects": [ "REGENERATE_REQUIRED" ], "alone": 0, "shared": 0 } ], "automated": { "holds": 0, "alone": 0, "shared": 0 } }, "why": "Each source location the estate uses maps to one STACKIT region, once for the estate: the draft builds in one region and states it as a default to confirm, no mapping between the source's regions and STACKIT's is evidenced, and a default closes nothing. A location answered with another region places its buckets, databases and caches there; what needs a network stays in the region of the draft. It holds 4 open critical settings of the estate: an answer in the inputs file closes those of its place, and a review of this record records the confirmation and closes none of them.", "required_evidence": [ "The source places its units in a location the scan cannot read (the value comes from an input a plan can change, or the source does not state it). No mapping between Google and STACKIT regions is evidenced, so the region the draft builds in is not shown to hold the residency of a source location: a person states it once for the estate, by answering target.region.source_location for each location.", "the residency requirement behind each source location (a law, a contract, a policy) and the STACKIT region that meets it" ], "resolution": { "decision_id": "DEC-GEN-CONVERT-SOURCE-REGION-MAPPING", "source_family": "convert", "source_semantic": "SOURCE_REGION_MAPPING", "affected_units": [ "google_cloud_run_v2_job.migrate", "google_cloud_run_v2_service.server", "google_sql_database_instance.postgres", "google_storage_bucket.media" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states the setting on google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server, google_sql_database_instance.postgres and google_storage_bucket.media. The plan leaves this decision open on google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server, google_sql_database_instance.postgres and google_storage_bucket.media.", "generated_target_behavior": "The draft does not carry the setting on google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server, google_sql_database_instance.postgres and google_storage_bucket.media. The draft holds MAN/estate/SOURCE_REGION_MAPPING until this decision is answered by an answer that frees it.", "residual_difference": "the target design stands on a default that nobody answered: StackToIT chose it, and a person confirms it or changes it in the decisions file", "execution_effect": "1 step of the plan waits for it until it is answered: MAN/estate/SOURCE_REGION_MAPPING.", "next_action": "Map each source location of the estate to a STACKIT region for google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server, google_sql_database_instance.postgres and google_storage_bucket.media: choose one of the 2 options, in the inputs file given with --inputs (the stubs are in inputs-template.yaml), once for each source location: that closes the settings of the location.", "why_open": [ "The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The region the service, job or worker pool runs in (google 8.4.0 `location`). A person confirms the region — REVIEW (critical, the value is not verified against the target).", "The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The region of the instance (google 8.4.0 `region`; unset means the provider's region). A person confirms the region — REVIEW (critical, the value is not verified against the target).", "The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A single-region location (us-central1, europe-west3, ...), or one not visible statically: the draft sets no region on stackit_objectstorage_bucket (`region`: \"if not defined, the provider region is used\", pinned provider), so the bucket lands in the STACKIT region the user sets, not in the source's — a person confirms the residency — REVIEW." ], "closes_when": [ "A person confirms the STACKIT region of the SKE cluster the workload runs on holds the residency the source region gave, since no mapping between Google and STACKIT regions is evidenced.", "A person confirms the STACKIT region of the instance (and of a read replica, decided with its primary) holds the residency the source region gave.", "A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [ "The source places its units in a location the scan cannot read (the value comes from an input a plan can change, or the source does not state it). No mapping between Google and STACKIT regions is evidenced, so the region the draft builds in is not shown to hold the residency of a source location: a person states it once for the estate, by answering target.region.source_location for each location.", "the residency requirement behind each source location (a law, a contract, a policy) and the STACKIT region that meets it" ], "resolution_paths": [ { "id": "map-source-locations-to-the-draft-region", "title": "Map every source location of the estate to the one STACKIT region the draft builds in", "prerequisites": [], "effects": [ "The draft builds every unit in the one region of the estate, and that is what it does with no answer. STACKIT hosts its regions in Germany and Austria, each physically separate from the others, so the region is not shown to hold the residency a source location gave: the option states where the draft builds and claims no equal residency. A review of this option records the confirmation and closes no setting; an answer of target.region.source_location for each location closes the settings of that location." ], "risk": [], "evidence": [ "https://docs.stackit.cloud/platform/regions/", "https://docs.stackit.cloud/platform/regions/" ], "regeneration_required": false }, { "id": "choose-the-region-of-each-location", "title": "Choose the STACKIT region of each source location", "prerequisites": [], "effects": [ "An answer of target.region.source_location names the region of one source location, and the units whose location the scan cannot read are one more subject of the same topic. An answer that names the region the draft builds in closes the settings of that location. The draft builds in one region, so an answer that names another region is recorded, and read by the network design, and closes nothing until the estate is built there (target.region). Whether a region holds the residency of a source location stays the person's statement." ], "risk": [], "evidence": [ "https://docs.stackit.cloud/platform/regions/", "https://docs.stackit.cloud/platform/regions/" ], "regeneration_required": true } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [ "https://docs.stackit.cloud/platform/regions/" ], "related_execution_steps": [ { "id": "MAN/estate/SOURCE_REGION_MAPPING", "mode": "MANUAL", "phase": "DATA", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": true } ] } }, { "id": "DEC-IAM-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE", "kind": "unit-review", "family": "gcp.cloud_run", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.cloud_run", "block": "google_cloud_run_v2_job.migrate", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_cloud_run_v2_job.migrate", "artifact": "assessment.json", "pointer": "/units/9" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_cloud_run_v2_job.migrate|service-identity", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/6" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:6d8e764691c2b3f560403316def3586a0b4f7662f6b183ca8a876e22b4f6ad93", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.cloud_run/service-identity", "sha256": "sha256:f29fbcf3e3a4bd57c6cb8c361445e4336575ac937e93704f05a1b464be3bf2e3" }, { "kind": "review_cause", "id": "gcp.cloud_run/service-identity", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:de5130d930b3443183d5b28e0b451069a044b7f2102cdc526edd3df9e6e63492" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of google_cloud_run_v2_job.migrate: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-IAM-GCP-CLOUD-RUN-SERVICE-IDENTITY", "kind": "service-identity", "family": "gcp.cloud_run", "title": "Review the service identity setting", "block": "template", "category": "identity-access", "why": "The knowledge base cannot decide \"service-identity\" of the gcp.cloud_run contract for 1 unit (LEDGER): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_job.migrate|service-identity" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "This setting follows the decision on the unit; it is not decided on its own." } ], "resolution": { "decision_id": "DEC-IAM-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE", "source_family": "gcp.cloud_run", "source_semantic": "unit-review", "affected_units": [ "google_cloud_run_v2_job.migrate" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "LEDGER", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on google_cloud_run_v2_job.migrate that the knowledge base cannot decide: Review the service identity setting.", "generated_target_behavior": "Review the service identity setting: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/service-identity).", "residual_difference": "Review the service identity setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_cloud_run_v2_job.migrate/service-identity now.", "next_action": "Review the service identity setting: This setting follows the decision on the unit; it is not decided on its own.", "why_open": [ "Review the service identity setting: Whether the draft carries this setting is decided by its semantic ledger entry \"workload identity\", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). The Google service account the workload runs as. target.workload.identity asks the customer which model the pods use." ], "closes_when": [ "Review the service identity setting: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/google_cloud_run_v2_job.migrate/service-identity", "mode": "MANUAL", "phase": "PLATFORM", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-NET-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE", "kind": "unit-review", "family": "gcp.cloud_run", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.cloud_run", "block": "google_cloud_run_v2_job.migrate", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_cloud_run_v2_job.migrate", "artifact": "assessment.json", "pointer": "/units/9" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_cloud_run_v2_job.migrate|cloud-run-v2-job-network-exposure", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/0" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:5f61f359aed7bddb0e87466e258be5e63147063c19a9cd13dbb420ae4128c575", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.cloud_run/cloud-run-v2-job-network-exposure", "sha256": "sha256:16ee09359693115aa665ab58ec9f9b7d197ddbdb1d4b10024c19d73f405b66e9" }, { "kind": "review_cause", "id": "gcp.cloud_run/cloud-run-v2-job-network-exposure", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:7619947cac69513468f065e085ea96fa41d749d90aa2164661afc29a1d27bf20" }, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of google_cloud_run_v2_job.migrate: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-NET-GCP-CLOUD-RUN-CLOUD-RUN-V2-JOB-NETWORK-EXPOSURE", "kind": "cloud-run-v2-job-network-exposure", "family": "gcp.cloud_run", "title": "Review the cloud run v2 job network exposure setting", "block": "template", "category": "network-exposure", "why": "The knowledge base cannot decide \"cloud-run-v2-job-network-exposure\" of the gcp.cloud_run contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_job.migrate|cloud-run-v2-job-network-exposure" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "derived-carry-on-the-target-ae560c1053b1", "title": "Carry the setting on Kubernetes Job/CronJob on SKE", "effect": "You design how Kubernetes Job/CronJob on SKE carries this setting and build it outside the draft. The draft does not change and no step is freed by it.", "evidence": [], "derived_from": "RULE_CASE" }, { "id": "derived-accept-the-difference-ae560c1053b1", "title": "Accept the difference", "effect": "The target does not carry this setting as the source states it, and you record that as accepted. The draft does not change and no step is freed by it.", "evidence": [], "derived_from": "RULE_CASE" } ], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the cloud run v2 job network exposure setting for google_cloud_run_v2_job.migrate: Decide how Kubernetes Job/CronJob on SKE carries this setting, or accept the difference. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-NET-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE", "source_family": "gcp.cloud_run", "source_semantic": "unit-review", "affected_units": [ "google_cloud_run_v2_job.migrate" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on google_cloud_run_v2_job.migrate that the knowledge base cannot decide: Review the cloud run v2 job network exposure setting.", "generated_target_behavior": "Review the cloud run v2 job network exposure setting: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/cloud-run-v2-job-network-exposure).", "residual_difference": "Review the cloud run v2 job network exposure setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_cloud_run_v2_job.migrate/cloud-run-v2-job-network-exposure now.", "next_action": "Review the cloud run v2 job network exposure setting: Review the cloud run v2 job network exposure setting for google_cloud_run_v2_job.migrate: Decide how Kubernetes Job/CronJob on SKE carries this setting, or accept the difference. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the cloud run v2 job network exposure setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. template.template.vpc_access.egress, template.template.vpc_access.network_interfaces.network, template.template.vpc_access.network_interfaces.subnetwork, template.template.volumes.cloud_sql_instance.instances (network exposure) — what the resource is reachable from and what it can reach. The draft names these settings NOT CARRIED: which database the job mounts and which network its egress goes through are re-created on the target (a database connection, the network of the workload) by a person. A person decides: REVIEW." ], "closes_when": [ "Review the cloud run v2 job network exposure setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [ { "id": "cloud-run-v2-job-network-exposure/derived-carry-on-the-target-ae560c1053b1", "title": "Review the cloud run v2 job network exposure setting: Carry the setting on Kubernetes Job/CronJob on SKE", "prerequisites": [], "effects": [ "You design how Kubernetes Job/CronJob on SKE carries this setting and build it outside the draft. The draft does not change and no step is freed by it." ], "risk": [], "evidence": [], "regeneration_required": false }, { "id": "cloud-run-v2-job-network-exposure/derived-accept-the-difference-ae560c1053b1", "title": "Review the cloud run v2 job network exposure setting: Accept the difference", "prerequisites": [], "effects": [ "The target does not carry this setting as the source states it, and you record that as accepted. The draft does not change and no step is freed by it." ], "risk": [], "evidence": [], "regeneration_required": false } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/google_cloud_run_v2_job.migrate/cloud-run-v2-job-network-exposure", "mode": "MANUAL", "phase": "PLATFORM", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-OPS-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE", "kind": "unit-review", "family": "gcp.cloud_run", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.cloud_run", "block": "google_cloud_run_v2_job.migrate", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_cloud_run_v2_job.migrate", "artifact": "assessment.json", "pointer": "/units/9" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_cloud_run_v2_job.migrate|deployment-artifact", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/1" }, { "kind": "semantic", "id": "google_cloud_run_v2_job.migrate|entry-point", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/2" }, { "kind": "semantic", "id": "google_cloud_run_v2_job.migrate|k4-cloud-run-volume-mount-cloud-run-v2-job", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/3" }, { "kind": "semantic", "id": "google_cloud_run_v2_job.migrate|tc-cloud-run-v2-job-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/7" }, { "kind": "semantic", "id": "google_cloud_run_v2_job.migrate|tc-cloud-run-v2-job-template--template--containers--env--name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/8" }, { "kind": "semantic", "id": "google_cloud_run_v2_job.migrate|tc-cloud-run-v2-job-template--template--volumes--name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/9" }, { "kind": "semantic", "id": "google_cloud_run_v2_job.migrate|terraform-destroy-guard", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/10" } ], "confirm_only_members": 1, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:685b77a28b897320d29a0b28c3f0b7ecff0c3c23f08ebf48e4fb10892434a8c7", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.cloud_run/deployment-artifact", "sha256": "sha256:a73ef89a1956c3e1a47374a66696c0b582b85bbe90c07678b09fc54da4afe794" }, { "kind": "contract_semantic", "id": "gcp.cloud_run/entry-point", "sha256": "sha256:4d1b12cc71c42174d6e22074f67885858594acb1b00482824945c19f7a80be6c" }, { "kind": "contract_semantic", "id": "gcp.cloud_run/k4-cloud-run-volume-mount-cloud-run-v2-job", "sha256": "sha256:fef1dddd3109bf0c4a6ad64da01aa93e2747c4de0791b00cab65073820c99c6e" }, { "kind": "contract_semantic", "id": "gcp.cloud_run/tc-cloud-run-v2-job-name", "sha256": "sha256:97c4f977dce5843ac25d60527ac5648886e003888683fbc55992c4fe83d8b373" }, { "kind": "contract_semantic", "id": "gcp.cloud_run/tc-cloud-run-v2-job-template--template--containers--env--name", "sha256": "sha256:dca2df312dcfbd1f56fd5ac4185613c60bbba15b4e943bbd662a3e26444d14a3" }, { "kind": "contract_semantic", "id": "gcp.cloud_run/tc-cloud-run-v2-job-template--template--volumes--name", "sha256": "sha256:22418615c6101cd2723530d727de0aebf942f73488c180b80ca4fe062887da4d" }, { "kind": "contract_semantic", "id": "gcp.cloud_run/terraform-destroy-guard", "sha256": "sha256:1a2afea9fd8ae0dc0ff4a6ab4ffe12108d8dccf46c4392ad03152776a73db5e7" }, { "kind": "decision_kind", "id": "gcp.cloud_run/deployment-artifact", "sha256": "sha256:5833ef582fe556aa6c9d0b12e3482d785cff8548625dfe16f52f32ec2e9d85c9" }, { "kind": "review_cause", "id": "gcp.cloud_run/deployment-artifact", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "gcp.cloud_run/entry-point", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "gcp.cloud_run/k4-cloud-run-volume-mount-cloud-run-v2-job", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "gcp.cloud_run/tc-cloud-run-v2-job-name", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "gcp.cloud_run/tc-cloud-run-v2-job-template--template--containers--env--name", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "gcp.cloud_run/tc-cloud-run-v2-job-template--template--volumes--name", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "gcp.cloud_run/terraform-destroy-guard", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:23f816d8acde4a1b38467d66e94c81af79e843f510e81614686937b327b047f7" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "IMPLEMENTATION_GAP", "members": 3 }, { "cause": "NOT_CLASSIFIED", "members": 3 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 7 critical settings of google_cloud_run_v2_job.migrate: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is carried by the draft already: a person only confirms it. The review step of the execution plan for these settings is MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect.", "required_evidence": [ "where the image is built or pulled from" ], "items": [ { "id": "DEC-OPS-GCP-CLOUD-RUN-DEPLOYMENT-ARTIFACT", "kind": "deployment-artifact", "family": "gcp.cloud_run", "title": "Choose the container image or artifact", "block": "build_config", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"deployment-artifact\" of the gcp.cloud_run contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_job.migrate|deployment-artifact" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "workload-on-ske", "title": "Run the container as a workload on SKE", "effect": "A service or a function that already runs as a container image moves as a Deployment on a SKE cluster, which is a managed Kubernetes service. Scale to zero and the billing per request go away unless an autoscaler that scales to zero is operated on the cluster.", "evidence": [ { "url": "https://docs.stackit.cloud/products/runtime/kubernetes-engine/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "STACKIT Kubernetes Engine (SKE) is a robust, scalable, and managed Kubernetes service." } ] }, { "id": "app-on-cloud-foundry", "title": "Push the application to STACKIT Cloud Foundry", "effect": "STACKIT Cloud Foundry is a managed platform for applications that a developer deploys and scales; the application is pushed from its image or its code. Scale to zero and the billing per request go away.", "evidence": [ { "url": "https://docs.stackit.cloud/products/runtime/cloud-foundry/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "STACKIT Cloud Foundry is a fully managed platform as a service (PaaS) that enables developers to build, deploy, and scale applications effortlessly." } ] } ], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Choose the container image or artifact for google_cloud_run_v2_job.migrate: A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-GCP-CLOUD-RUN-ENTRY-POINT", "kind": "entry-point", "family": "gcp.cloud_run", "title": "Confirm the entry point of the function", "block": "build_config", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"entry-point\" of the gcp.cloud_run contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_job.migrate|entry-point" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "derived-carry-on-the-target-ae560c1053b1", "title": "Carry the setting on Kubernetes Job/CronJob on SKE", "effect": "You design how Kubernetes Job/CronJob on SKE carries this setting and build it outside the draft. The draft does not change and no step is freed by it.", "evidence": [], "derived_from": "RULE_CASE" }, { "id": "derived-accept-the-difference-ae560c1053b1", "title": "Accept the difference", "effect": "The target does not carry this setting as the source states it, and you record that as accepted. The draft does not change and no step is freed by it.", "evidence": [], "derived_from": "RULE_CASE" } ], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the entry point of the function for google_cloud_run_v2_job.migrate: Decide how Kubernetes Job/CronJob on SKE carries this setting, or accept the difference. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-GCP-CLOUD-RUN-K4-CLOUD-RUN-VOLUME-MOUNT-CLOUD-RUN-V2-JOB", "kind": "k4-cloud-run-volume-mount-cloud-run-v2-job", "family": "gcp.cloud_run", "title": "Review the k4 cloud run volume mount cloud run v2 job setting", "block": "template", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"k4-cloud-run-volume-mount-cloud-run-v2-job\" of the gcp.cloud_run contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_job.migrate|k4-cloud-run-volume-mount-cloud-run-v2-job" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the k4 cloud run volume mount cloud run v2 job setting for google_cloud_run_v2_job.migrate: A person provides the data in the target workload at the path the application expects, with an owner and mode it can use, and checks that it finds its files. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-GCP-CLOUD-RUN-TC-CLOUD-RUN-V2-JOB-NAME", "kind": "tc-cloud-run-v2-job-name", "family": "gcp.cloud_run", "title": "Confirm the name of the cloud run v2 job", "block": "name", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tc-cloud-run-v2-job-name\" of the gcp.cloud_run contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_job.migrate|tc-cloud-run-v2-job-name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the name of the cloud run v2 job for google_cloud_run_v2_job.migrate: The name of the service, job or worker pool becomes the name of the Deployment or Job, which must be a valid lower-case Kubernetes name. Everything that starts or calls the workload by its old name changes with it: a scheduler, a workflow or a pipeline that runs the job by name, a caller that uses the service address, a dashboard or an alert that filters by name. List those callers and update each one. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-GCP-CLOUD-RUN-TC-CLOUD-RUN-V2-JOB-TEMPLATE-TEMPLATE-CON-FAAB59CD", "kind": "tc-cloud-run-v2-job-template--template--containers--env--name", "family": "gcp.cloud_run", "title": "Confirm the name of the env entry of the containers of the template of the template of the cloud run v2 job", "block": "tc-cloud-run-v2-job-template--template--containers--env--name", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tc-cloud-run-v2-job-template--template--containers--env--name\" of the gcp.cloud_run contract for 1 unit (REVIEW): the draft already carries it, so a person only confirms it. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The row of each member in assurance/critical-semantics.json (carried_by) names the step and the file that carry it.", "members": [ "google_cloud_run_v2_job.migrate|tc-cloud-run-v2-job-template--template--containers--env--name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "confirm_only_members": 1, "customer_action_status": "CONFIRM_CARRIED", "next_action": "Confirm in the draft that the draft carries the name of the env entry of the containers of the template of the template of the cloud run v2 job for google_cloud_run_v2_job.migrate as the source relies on it; nothing needs deciding." }, { "id": "DEC-OPS-GCP-CLOUD-RUN-TC-CLOUD-RUN-V2-JOB-TEMPLATE-TEMPLATE-VOLUMES-NAME", "kind": "tc-cloud-run-v2-job-template--template--volumes--name", "family": "gcp.cloud_run", "title": "Confirm the name of the volumes entry of the template of the template of the cloud run v2 job", "block": "tc-cloud-run-v2-job-template--template--volumes--name", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tc-cloud-run-v2-job-template--template--volumes--name\" of the gcp.cloud_run contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_job.migrate|tc-cloud-run-v2-job-template--template--volumes--name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the name of the volumes entry of the template of the template of the cloud run v2 job for google_cloud_run_v2_job.migrate: This name only wires the manifest together: the name of a container, of a volume that a mount refers to, of a variable the application reads, or of a revision. Check the manifest holds each environment variable under exactly the name the application reads, and that every mount refers to a volume that exists in the manifest. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-DATA-GCP-CLOUD-RUN-TERRAFORM-DESTROY-GUARD", "kind": "terraform-destroy-guard", "family": "gcp.cloud_run", "title": "Review the terraform destroy guard setting", "block": "deletion_protection", "category": "deletion-protection", "why": "The knowledge base cannot decide \"terraform-destroy-guard\" of the gcp.cloud_run contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_job.migrate|terraform-destroy-guard" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the terraform destroy guard setting for google_cloud_run_v2_job.migrate: A person decides whether the replacement keeps the guard with lifecycle { prevent_destroy = true } in the Terraform code. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-OPS-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE", "source_family": "gcp.cloud_run", "source_semantic": "unit-review", "affected_units": [ "google_cloud_run_v2_job.migrate" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "serverless-integration", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [ { "unit": "google_cloud_run_v2_job.migrate", "step": "MAN/draft/kubernetes/migrate/manifests-yaml", "mode": "MANUAL", "evidence": "the 1 environment keys of the source (DJANGO_ENV) are the env entries of `terraform/kubernetes/migrate/manifests.yaml`: the keys are carried, and the values stay the person's" } ], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Choose the container image or artifact; the 7 settings of the record state their own.", "source_observation": "The source states 7 critical settings on google_cloud_run_v2_job.migrate that the knowledge base cannot decide: Choose the container image or artifact; Confirm the entry point of the function; Review the k4 cloud run volume mount cloud run v2 job setting; Confirm the name of the cloud run v2 job; Confirm the name of the env entry of the containers of the template of the template of the cloud run v2 job; Confirm the name of the volumes entry of the template of the template of the cloud run v2 job; Review the terraform destroy guard setting.", "generated_target_behavior": "Choose the container image or artifact: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect). The draft does not carry the image reference; the setting is left to a person. Confirm the entry point of the function: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect). Review the k4 cloud run volume mount cloud run v2 job setting: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect). Confirm the name of the cloud run v2 job: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect). Confirm the name of the env entry of the containers of the template of the template of the cloud run v2 job: The draft carries it on google_cloud_run_v2_job.migrate: step MAN/draft/kubernetes/migrate/manifests-yaml (the 1 environment keys of the source (DJANGO_ENV) are the env entries of `terraform/kubernetes/migrate/manifests.yaml`: the keys are carried, and the values stay the person's). Confirm the name of the volumes entry of the template of the template of the cloud run v2 job: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect). Review the terraform destroy guard setting: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect).", "residual_difference": "Choose the container image or artifact: That the same build runs on the target platform. Confirm the entry point of the function: the target behaviour of this setting is not established Review the k4 cloud run volume mount cloud run v2 job setting: the target behaviour of this setting is not established Confirm the name of the cloud run v2 job: the target behaviour of this setting is not established Confirm the name of the env entry of the containers of the template of the template of the cloud run v2 job: a person confirms that the carried value is what the source relies on Confirm the name of the volumes entry of the template of the template of the cloud run v2 job: the target behaviour of this setting is not established Review the terraform destroy guard setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect now.", "next_action": "Choose the container image or artifact: Choose the container image or artifact for google_cloud_run_v2_job.migrate: A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Choose the container image or artifact: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_service.template.spec.containers.image; google_cloud_run_v2_service.template.containers.image, build_config.base_image, build_config.image_uri and 5 more; google_cloud_run_v2_job.template.template.containers.image; google_cloud_run_v2_worker_pool.template.containers.image, artifact or image reference (workload compatibility: a setting that binds the code to its runtime stays CRITICAL).", "Confirm the entry point of the function: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_service.template.spec.containers.command, template.spec.containers.args, template.spec.containers.working_dir; google_cloud_run_v2_service.template.containers.command, template.containers.args, template.containers.working_dir and 4 more.", "Review the k4 cloud run volume mount cloud run v2 job setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Where a volume appears in the container, which part of it is mounted there and the gcsfuse flags of a bucket mount (volume_mounts, mount_path and sub_path; volumes, gcs, mount_options). The application opens the bucket or share as a local directory, and the STACKIT draft mounts no volume into a container.", "Confirm the name of the cloud run v2 job: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_v2_job.name: The job's own name, used for identification.", "Confirm the name of the env entry of the containers of the template of the template of the cloud run v2 job: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_v2_job.template.template.containers.env.name: The name of an environment variable; an identifier, not the value it carries.", "Confirm the name of the volumes entry of the template of the template of the cloud run v2 job: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_v2_job.template.template.volumes.name: The volume's own name, used only to cross-reference it from volume_mounts.name; an internal wiring identifier with no security meaning of its own.", "Review the terraform destroy guard setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. deletion_protection of a Cloud Run service, job or worker pool (on unless the source switches it off, which an explicit false states) only stops Terraform from destroying the resource; it is not an API protection." ], "closes_when": [ "Choose the container image or artifact: A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there.", "Confirm the entry point of the function: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Review the k4 cloud run volume mount cloud run v2 job setting: A person provides the data in the target workload at the path the application expects, with an owner and mode it can use, and checks that it finds its files.", "Confirm the name of the cloud run v2 job: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Confirm the name of the env entry of the containers of the template of the template of the cloud run v2 job: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Confirm the name of the volumes entry of the template of the template of the cloud run v2 job: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.", "Review the terraform destroy guard setting: A person decides whether the replacement keeps the guard with lifecycle { prevent_destroy = true } in the Terraform code." ], "required_inputs": [ "where the image is built or pulled from" ], "resolution_paths": [ { "id": "deployment-artifact/workload-on-ske", "title": "Choose the container image or artifact: Run the container as a workload on SKE", "prerequisites": [ "the container image and its settings", "a SKE cluster" ], "effects": [ "A service or a function that already runs as a container image moves as a Deployment on a SKE cluster, which is a managed Kubernetes service. Scale to zero and the billing per request go away unless an autoscaler that scales to zero is operated on the cluster.", "regeneration: not stated — treated as required" ], "risk": [ "Capacity runs, and is billed, whether or not requests arrive." ], "evidence": [ "provider-docs mirror stackit/docs.stackit.cloud/products/runtime/kubernetes-engine.html: \"STACKIT Kubernetes Engine (SKE) is a robust, scalable, and managed Kubernetes service.\"" ], "regeneration_required": true }, { "id": "deployment-artifact/app-on-cloud-foundry", "title": "Choose the container image or artifact: Push the application to STACKIT Cloud Foundry", "prerequisites": [ "the application in a form Cloud Foundry runs", "a Cloud Foundry organization" ], "effects": [ "STACKIT Cloud Foundry is a managed platform for applications that a developer deploys and scales; the application is pushed from its image or its code. Scale to zero and the billing per request go away.", "regeneration: not stated — treated as required" ], "risk": [ "The platform differs from the source platform in how it scales and how it is billed." ], "evidence": [ "provider-docs mirror stackit/docs.stackit.cloud/products/runtime/cloud-foundry.html: \"STACKIT Cloud Foundry is a fully managed platform as a service (PaaS) that enables developers to build, deploy, and scale applications effortlessly.\"" ], "regeneration_required": true }, { "id": "entry-point/derived-carry-on-the-target-ae560c1053b1", "title": "Confirm the entry point of the function: Carry the setting on Kubernetes Job/CronJob on SKE", "prerequisites": [], "effects": [ "You design how Kubernetes Job/CronJob on SKE carries this setting and build it outside the draft. The draft does not change and no step is freed by it." ], "risk": [], "evidence": [], "regeneration_required": false }, { "id": "entry-point/derived-accept-the-difference-ae560c1053b1", "title": "Confirm the entry point of the function: Accept the difference", "prerequisites": [], "effects": [ "The target does not carry this setting as the source states it, and you record that as accepted. The draft does not change and no step is freed by it." ], "risk": [], "evidence": [], "regeneration_required": false } ], "required_verification": [ "Choose the container image or artifact: the image is pulled or built for the target platform and runs there" ], "next_run_changes": [ "A rerun does not build or pull the image; an answer in the decisions file records the choice and writes nothing." ], "remains_manual": [ "Choose the container image or artifact: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note gcp.cloud_run/deployment-artifact: \"A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect", "mode": "MANUAL", "phase": "PLATFORM", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false }, { "id": "MAN/draft/kubernetes/migrate/manifests-yaml", "mode": "MANUAL", "phase": "WORKLOAD", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-SEC-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE", "kind": "unit-review", "family": "gcp.cloud_run", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.cloud_run", "block": "google_cloud_run_v2_job.migrate", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_cloud_run_v2_job.migrate", "artifact": "assessment.json", "pointer": "/units/9" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_cloud_run_v2_job.migrate|secrets", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/5" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:eb72d924ef3dca3df509ae9675b4cd2374b14119b591b9ae674c3cc242c6ba62", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.cloud_run/secrets", "sha256": "sha256:31bb2e9d7aba3989dc4933ae7ff2de28eec7542a67d93d7face959b6756b038a" }, { "kind": "review_cause", "id": "gcp.cloud_run/secrets", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:05323ded731a64941b628473bd15b5e2f03fe0f884b06d9feceb4f924f902e4c" }, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of google_cloud_run_v2_job.migrate: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-SEC-GCP-CLOUD-RUN-SECRETS", "kind": "secrets", "family": "gcp.cloud_run", "title": "Create the Kubernetes Secrets for the Secret Manager references", "block": "template", "category": "secret-handling", "why": "The knowledge base cannot decide \"secrets\" of the gcp.cloud_run contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_job.migrate|secrets" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Create the Kubernetes Secrets for the Secret Manager references for google_cloud_run_v2_job.migrate: A person creates the Kubernetes Secrets the manifest lists, filled from STACKIT Secrets Manager (for example with an External Secrets Operator). Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-SEC-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE", "source_family": "gcp.cloud_run", "source_semantic": "unit-review", "affected_units": [ "google_cloud_run_v2_job.migrate" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on google_cloud_run_v2_job.migrate that the knowledge base cannot decide: Create the Kubernetes Secrets for the Secret Manager references.", "generated_target_behavior": "Create the Kubernetes Secrets for the Secret Manager references: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/secrets).", "residual_difference": "Create the Kubernetes Secrets for the Secret Manager references: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_cloud_run_v2_job.migrate/secrets now.", "next_action": "Create the Kubernetes Secrets for the Secret Manager references: Create the Kubernetes Secrets for the Secret Manager references for google_cloud_run_v2_job.migrate: A person creates the Kubernetes Secrets the manifest lists, filled from STACKIT Secrets Manager (for example with an External Secrets Operator). Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Create the Kubernetes Secrets for the Secret Manager references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A Secret Manager reference in the environment becomes a secretKeyRef of the Deployment or Job and a secret volume a Kubernetes secret volume, and the head of the manifest lists the Secrets to create. The draft writes no Secret, because no value of a secret reaches an output." ], "closes_when": [ "Create the Kubernetes Secrets for the Secret Manager references: A person creates the Kubernetes Secrets the manifest lists, filled from STACKIT Secrets Manager (for example with an External Secrets Operator)." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/google_cloud_run_v2_job.migrate/secrets", "mode": "MANUAL", "phase": "PLATFORM", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-GEN-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "kind": "unit-review", "family": "gcp.cloud_run", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.cloud_run", "block": "google_cloud_run_v2_service.server", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "NOT_STATED", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_cloud_run_v2_service.server", "artifact": "assessment.json", "pointer": "/units/10" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_cloud_run_v2_service.server|iam-policy-grant", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/15" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:15f679b726862e403a8aaf12cc8a1b31c16dcc0b586ea26fffb4621d0bd2fcc2", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.cloud_run/iam-policy-grant", "sha256": "sha256:7122d09f31d6213f3426c7c0d9f1bcd6847df9e773d67189766a3542a5b523d8" }, { "kind": "review_cause", "id": "gcp.cloud_run/iam-policy-grant", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:a283a1e6a981f35147d6eb1ac11a22014607c92e729f0c07719a27e656f74bb8" }, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of google_cloud_run_v2_service.server: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect.", "required_evidence": [], "items": [ { "id": "DEC-GEN-GCP-CLOUD-RUN-IAM-POLICY-GRANT", "kind": "iam-policy-grant", "family": "gcp.cloud_run", "title": "Review the IAM policy grant setting", "block": "iam-policy-grant", "why": "The knowledge base cannot decide \"iam-policy-grant\" of the gcp.cloud_run contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_service.server|iam-policy-grant" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the IAM policy grant setting for google_cloud_run_v2_service.server: A person decides what this finding asks, and records the evidence or the decision. The finding says: A full IAM policy (member/role bindings) is set directly on the service via policy_data; STACKIT has no per-service IAM policy resource, so who may invoke the migrated SKE workload is decided by a person — the draft carries no invocation check. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-GEN-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "source_family": "gcp.cloud_run", "source_semantic": "unit-review", "affected_units": [ "google_cloud_run_v2_service.server" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "NOT_STATED", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on google_cloud_run_v2_service.server that the knowledge base cannot decide: Review the IAM policy grant setting.", "generated_target_behavior": "Review the IAM policy grant setting: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect).", "residual_difference": "Review the IAM policy grant setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect now.", "next_action": "Review the IAM policy grant setting: Review the IAM policy grant setting for google_cloud_run_v2_service.server: A person decides what this finding asks, and records the evidence or the decision. The finding says: A full IAM policy (member/role bindings) is set directly on the service via policy_data; STACKIT has no per-service IAM policy resource, so who may invoke the migrated SKE workload is decided by a person — the draft carries no invocation check. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the IAM policy grant setting: A check of the knowledge base (run iam policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). A full IAM policy (member/role bindings) is set directly on the service via policy_data (google 8.4.0); STACKIT has no per-service IAM policy resource, so who may invoke the migrated SKE workload is decided by a person — REVIEW." ], "closes_when": [ "Review the IAM policy grant setting: A person decides what this finding asks, and records the evidence or the decision. The finding says: A full IAM policy (member/role bindings) is set directly on the service via policy_data; STACKIT has no per-service IAM policy resource, so who may invoke the migrated SKE workload is decided by a person — the draft carries no invocation check." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect", "mode": "MANUAL", "phase": "PLATFORM", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-IAM-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "kind": "unit-review", "family": "gcp.cloud_run", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.cloud_run", "block": "google_cloud_run_v2_service.server", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_cloud_run_v2_service.server", "artifact": "assessment.json", "pointer": "/units/10" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_cloud_run_v2_service.server|iam-invocation", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/14" }, { "kind": "semantic", "id": "google_cloud_run_v2_service.server|service-identity", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/19" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:49a9627d2f1d15f305b977c86b73db0162a769ecd453b5b1fca71650bba2a2e8", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.cloud_run/iam-invocation", "sha256": "sha256:ae8f98b706b115b6df3b19f140bac3fb1abf5a3f43d89594b816aa0a440a637f" }, { "kind": "contract_semantic", "id": "gcp.cloud_run/service-identity", "sha256": "sha256:f29fbcf3e3a4bd57c6cb8c361445e4336575ac937e93704f05a1b464be3bf2e3" }, { "kind": "review_cause", "id": "gcp.cloud_run/iam-invocation", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "gcp.cloud_run/service-identity", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:769e45c36ad1371d92358ae5dfa9a3e7cdc8cd60355fbc338219885964f449c1" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 2 critical settings of google_cloud_run_v2_service.server: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/google_cloud_run_v2_service.server/open-settings-identity-architect.", "required_evidence": [], "items": [ { "id": "DEC-IAM-GCP-CLOUD-RUN-IAM-INVOCATION", "kind": "iam-invocation", "family": "gcp.cloud_run", "title": "Decide who may invoke the service", "block": "invoker_iam_disabled", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-invocation\" of the gcp.cloud_run contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_service.server|iam-invocation" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Decide who may invoke the service for google_cloud_run_v2_service.server: A person decides how callers of the workload are authenticated (in the application, behind an authenticating proxy, or by no exposure at all) and how the SKE exposure is set, since the draft carries no invocation check. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-IAM-GCP-CLOUD-RUN-SERVICE-IDENTITY", "kind": "service-identity", "family": "gcp.cloud_run", "title": "Review the service identity setting", "block": "template", "category": "identity-access", "why": "The knowledge base cannot decide \"service-identity\" of the gcp.cloud_run contract for 1 unit (LEDGER): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_service.server|service-identity" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "This setting follows the decision on the unit; it is not decided on its own." } ], "resolution": { "decision_id": "DEC-IAM-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "source_family": "gcp.cloud_run", "source_semantic": "unit-review", "affected_units": [ "google_cloud_run_v2_service.server" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW, LEDGER", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Decide who may invoke the service; the 2 settings of the record state their own.", "source_observation": "The source states 2 critical settings on google_cloud_run_v2_service.server that the knowledge base cannot decide: Decide who may invoke the service; Review the service identity setting.", "generated_target_behavior": "Decide who may invoke the service: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-identity-architect). Review the service identity setting: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-identity-architect).", "residual_difference": "Decide who may invoke the service: the target behaviour of this setting is not established Review the service identity setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_cloud_run_v2_service.server/open-settings-identity-architect now.", "next_action": "Decide who may invoke the service: Decide who may invoke the service for google_cloud_run_v2_service.server: A person decides how callers of the workload are authenticated (in the application, behind an authenticating proxy, or by no exposure at all) and how the SKE exposure is set, since the draft carries no invocation check. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Decide who may invoke the service: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Cloud Run lets only callers with the invoker role through unless the service is made public. The draft carries no invocation check; the SKE exposure and the authentication of callers (application, authenticating proxy, or no exposure at all) are decided by a person.", "Review the service identity setting: Whether the draft carries this setting is decided by its semantic ledger entry \"workload identity\", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). The Google service account the workload runs as. target.workload.identity asks the customer which model the pods use." ], "closes_when": [ "Decide who may invoke the service: A person decides how callers of the workload are authenticated (in the application, behind an authenticating proxy, or by no exposure at all) and how the SKE exposure is set, since the draft carries no invocation check.", "Review the service identity setting: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/google_cloud_run_v2_service.server/open-settings-identity-architect", "mode": "MANUAL", "phase": "PLATFORM", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-NET-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "kind": "unit-review", "family": "gcp.cloud_run", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.cloud_run", "block": "google_cloud_run_v2_service.server", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_cloud_run_v2_service.server", "artifact": "assessment.json", "pointer": "/units/10" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_cloud_run_v2_service.server|cloud-sql-connection", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/11" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:7ffdff9c041378f4eae6d4342c8775fd97bc2eb295a39ce01f24caa6e06208ea", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.cloud_run/cloud-sql-connection", "sha256": "sha256:551a8d174a251fda625795ada0e35435c81bf7d26d8160157a8407d6a99b6c98" }, { "kind": "review_cause", "id": "gcp.cloud_run/cloud-sql-connection", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:7cbc235f3121e16aeb96bb232707c733562215e218571c70a5a63316998d150b" }, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of google_cloud_run_v2_service.server: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-NET-GCP-CLOUD-RUN-CLOUD-SQL-CONNECTION", "kind": "cloud-sql-connection", "family": "gcp.cloud_run", "title": "Decide how the service connects to the database", "block": "template", "category": "network-exposure", "why": "The knowledge base cannot decide \"cloud-sql-connection\" of the gcp.cloud_run contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_service.server|cloud-sql-connection" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Decide how the service connects to the database for google_cloud_run_v2_service.server: A person points the workload at the endpoint of the migrated database instance (a Flex or MariaDB instance) over TLS, because the Cloud SQL connector socket has no counterpart. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-NET-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "source_family": "gcp.cloud_run", "source_semantic": "unit-review", "affected_units": [ "google_cloud_run_v2_service.server" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on google_cloud_run_v2_service.server that the knowledge base cannot decide: Decide how the service connects to the database.", "generated_target_behavior": "Decide how the service connects to the database: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/cloud-sql-connection).", "residual_difference": "Decide how the service connects to the database: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_cloud_run_v2_service.server/cloud-sql-connection now.", "next_action": "Decide how the service connects to the database: Decide how the service connects to the database for google_cloud_run_v2_service.server: A person points the workload at the endpoint of the migrated database instance (a Flex or MariaDB instance) over TLS, because the Cloud SQL connector socket has no counterpart. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Decide how the service connects to the database: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The Cloud SQL connection volume (a connector socket) has no counterpart: the workload connects to the migrated Flex instance endpoint over TLS." ], "closes_when": [ "Decide how the service connects to the database: A person points the workload at the endpoint of the migrated database instance (a Flex or MariaDB instance) over TLS, because the Cloud SQL connector socket has no counterpart." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/google_cloud_run_v2_service.server/cloud-sql-connection", "mode": "MANUAL", "phase": "PLATFORM", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-OPS-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "kind": "unit-review", "family": "gcp.cloud_run", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.cloud_run", "block": "google_cloud_run_v2_service.server", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_cloud_run_v2_service.server", "artifact": "assessment.json", "pointer": "/units/10" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_cloud_run_v2_service.server|deployment-artifact", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/12" }, { "kind": "semantic", "id": "google_cloud_run_v2_service.server|k4-cloud-run-volume-mount-cloud-run-v2-service", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/16" }, { "kind": "semantic", "id": "google_cloud_run_v2_service.server|tc-cloud-run-v2-service-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/20" }, { "kind": "semantic", "id": "google_cloud_run_v2_service.server|tc-cloud-run-v2-service-template--volumes--name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/21" }, { "kind": "semantic", "id": "google_cloud_run_v2_service.server|terraform-destroy-guard", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/22" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:49a225e8454b013cae4c0796f19f24dec5d3c80788ef6189addeeb19bbb5467c", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.cloud_run/deployment-artifact", "sha256": "sha256:a73ef89a1956c3e1a47374a66696c0b582b85bbe90c07678b09fc54da4afe794" }, { "kind": "contract_semantic", "id": "gcp.cloud_run/k4-cloud-run-volume-mount-cloud-run-v2-service", "sha256": "sha256:6ce9a028b016341851b38e3f2294337563a546b72669ec675d412cca92a77f08" }, { "kind": "contract_semantic", "id": "gcp.cloud_run/tc-cloud-run-v2-service-name", "sha256": "sha256:da10feeea52cd0f2658c3b0dbff25f2a61d85439912009f1572f4fe8c5e814c6" }, { "kind": "contract_semantic", "id": "gcp.cloud_run/tc-cloud-run-v2-service-template--volumes--name", "sha256": "sha256:0f221a70c27514a04a91802965b5401d70ee8c9e94ce222527fb111dad70004e" }, { "kind": "contract_semantic", "id": "gcp.cloud_run/terraform-destroy-guard", "sha256": "sha256:1a2afea9fd8ae0dc0ff4a6ab4ffe12108d8dccf46c4392ad03152776a73db5e7" }, { "kind": "decision_kind", "id": "gcp.cloud_run/deployment-artifact", "sha256": "sha256:5833ef582fe556aa6c9d0b12e3482d785cff8548625dfe16f52f32ec2e9d85c9" }, { "kind": "review_cause", "id": "gcp.cloud_run/deployment-artifact", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" }, { "kind": "review_cause", "id": "gcp.cloud_run/k4-cloud-run-volume-mount-cloud-run-v2-service", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "gcp.cloud_run/tc-cloud-run-v2-service-name", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "gcp.cloud_run/tc-cloud-run-v2-service-template--volumes--name", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "gcp.cloud_run/terraform-destroy-guard", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:08117121d8baf3feb598399602f00521c4c81fe308e9a86a19db79824e6c6be8" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "IMPLEMENTATION_GAP", "members": 2 }, { "cause": "NOT_CLASSIFIED", "members": 2 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 5 critical settings of google_cloud_run_v2_service.server: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect.", "required_evidence": [ "where the image is built or pulled from" ], "items": [ { "id": "DEC-OPS-GCP-CLOUD-RUN-DEPLOYMENT-ARTIFACT", "kind": "deployment-artifact", "family": "gcp.cloud_run", "title": "Choose the container image or artifact", "block": "build_config", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"deployment-artifact\" of the gcp.cloud_run contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_service.server|deployment-artifact" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "workload-on-ske", "title": "Run the container as a workload on SKE", "effect": "A service or a function that already runs as a container image moves as a Deployment on a SKE cluster, which is a managed Kubernetes service. Scale to zero and the billing per request go away unless an autoscaler that scales to zero is operated on the cluster.", "evidence": [ { "url": "https://docs.stackit.cloud/products/runtime/kubernetes-engine/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "STACKIT Kubernetes Engine (SKE) is a robust, scalable, and managed Kubernetes service." } ] }, { "id": "app-on-cloud-foundry", "title": "Push the application to STACKIT Cloud Foundry", "effect": "STACKIT Cloud Foundry is a managed platform for applications that a developer deploys and scales; the application is pushed from its image or its code. Scale to zero and the billing per request go away.", "evidence": [ { "url": "https://docs.stackit.cloud/products/runtime/cloud-foundry/", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "STACKIT Cloud Foundry is a fully managed platform as a service (PaaS) that enables developers to build, deploy, and scale applications effortlessly." } ] } ], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Choose the container image or artifact for google_cloud_run_v2_service.server: A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-GCP-CLOUD-RUN-K4-CLOUD-RUN-VOLUME-MOUNT-CLOUD-RUN-V2-SERVICE", "kind": "k4-cloud-run-volume-mount-cloud-run-v2-service", "family": "gcp.cloud_run", "title": "Decide how the volume mounts are carried", "block": "template", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"k4-cloud-run-volume-mount-cloud-run-v2-service\" of the gcp.cloud_run contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_service.server|k4-cloud-run-volume-mount-cloud-run-v2-service" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Decide how the volume mounts are carried for google_cloud_run_v2_service.server: A person provides the data in the target workload at the path the application expects, with an owner and mode it can use, and checks that it finds its files. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-GCP-CLOUD-RUN-TC-CLOUD-RUN-V2-SERVICE-NAME", "kind": "tc-cloud-run-v2-service-name", "family": "gcp.cloud_run", "title": "Confirm the name of the Cloud Run service", "block": "name", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tc-cloud-run-v2-service-name\" of the gcp.cloud_run contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_service.server|tc-cloud-run-v2-service-name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the name of the Cloud Run service for google_cloud_run_v2_service.server: A person confirms the workload name on the cluster against what addresses or refers to the Cloud Run service name, or accepts the new name. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-GCP-CLOUD-RUN-TC-CLOUD-RUN-V2-SERVICE-TEMPLATE-VOLUMES-NAME", "kind": "tc-cloud-run-v2-service-template--volumes--name", "family": "gcp.cloud_run", "title": "Confirm the name of the volumes entry of the template of the Cloud Run service", "block": "tc-cloud-run-v2-service-template--volumes--name", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tc-cloud-run-v2-service-template--volumes--name\" of the gcp.cloud_run contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_service.server|tc-cloud-run-v2-service-template--volumes--name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the name of the volumes entry of the template of the Cloud Run service for google_cloud_run_v2_service.server: A person keeps each volume name matched with the volume mount that refers to it when the volumes are rebuilt as workload volumes on the cluster. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-DATA-GCP-CLOUD-RUN-TERRAFORM-DESTROY-GUARD", "kind": "terraform-destroy-guard", "family": "gcp.cloud_run", "title": "Review the terraform destroy guard setting", "block": "deletion_protection", "category": "deletion-protection", "why": "The knowledge base cannot decide \"terraform-destroy-guard\" of the gcp.cloud_run contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_service.server|terraform-destroy-guard" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the terraform destroy guard setting for google_cloud_run_v2_service.server: A person decides whether the replacement keeps the guard with lifecycle { prevent_destroy = true } in the Terraform code. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-OPS-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "source_family": "gcp.cloud_run", "source_semantic": "unit-review", "affected_units": [ "google_cloud_run_v2_service.server" ], "affected_application": [], "action_type": "DESIGN_CHOICE", "work_package": "serverless-integration", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Choose the container image or artifact; the 5 settings of the record state their own.", "source_observation": "The source states 5 critical settings on google_cloud_run_v2_service.server that the knowledge base cannot decide: Choose the container image or artifact; Decide how the volume mounts are carried; Confirm the name of the Cloud Run service; Confirm the name of the volumes entry of the template of the Cloud Run service; Review the terraform destroy guard setting.", "generated_target_behavior": "Choose the container image or artifact: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect). The draft does not carry the image reference; the setting is left to a person. Decide how the volume mounts are carried: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect). Confirm the name of the Cloud Run service: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect). Confirm the name of the volumes entry of the template of the Cloud Run service: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect). Review the terraform destroy guard setting: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect).", "residual_difference": "Choose the container image or artifact: That the same build runs on the target platform. Decide how the volume mounts are carried: the target behaviour of this setting is not established Confirm the name of the Cloud Run service: the target behaviour of this setting is not established Confirm the name of the volumes entry of the template of the Cloud Run service: the target behaviour of this setting is not established Review the terraform destroy guard setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect now.", "next_action": "Choose the container image or artifact: Choose the container image or artifact for google_cloud_run_v2_service.server: A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Choose the container image or artifact: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_service.template.spec.containers.image; google_cloud_run_v2_service.template.containers.image, build_config.base_image, build_config.image_uri and 5 more; google_cloud_run_v2_job.template.template.containers.image; google_cloud_run_v2_worker_pool.template.containers.image, artifact or image reference (workload compatibility: a setting that binds the code to its runtime stays CRITICAL).", "Decide how the volume mounts are carried: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Where a volume appears in the container, which part of it is mounted there and the gcsfuse flags of a bucket mount (volume_mounts, mount_path and sub_path; volumes, gcs, mount_options). The application opens the bucket or share as a local directory, and the STACKIT draft mounts no volume into a container.", "Confirm the name of the Cloud Run service: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_v2_service.name: The Service's own name; an identifier used for addressing/reference, not an access-control or safety property in itself.", "Confirm the name of the volumes entry of the template of the Cloud Run service: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_v2_service.template.volumes.name: The volume's own name, used only to cross-reference it from a volume_mounts.name entry; internal wiring identifier.", "Review the terraform destroy guard setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. deletion_protection of a Cloud Run service, job or worker pool (on unless the source switches it off, which an explicit false states) only stops Terraform from destroying the resource; it is not an API protection." ], "closes_when": [ "Choose the container image or artifact: A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there.", "Decide how the volume mounts are carried: A person provides the data in the target workload at the path the application expects, with an owner and mode it can use, and checks that it finds its files.", "Confirm the name of the Cloud Run service: A person confirms the workload name on the cluster against what addresses or refers to the Cloud Run service name, or accepts the new name.", "Confirm the name of the volumes entry of the template of the Cloud Run service: A person keeps each volume name matched with the volume mount that refers to it when the volumes are rebuilt as workload volumes on the cluster.", "Review the terraform destroy guard setting: A person decides whether the replacement keeps the guard with lifecycle { prevent_destroy = true } in the Terraform code." ], "required_inputs": [ "where the image is built or pulled from" ], "resolution_paths": [ { "id": "deployment-artifact/workload-on-ske", "title": "Choose the container image or artifact: Run the container as a workload on SKE", "prerequisites": [ "the container image and its settings", "a SKE cluster" ], "effects": [ "A service or a function that already runs as a container image moves as a Deployment on a SKE cluster, which is a managed Kubernetes service. Scale to zero and the billing per request go away unless an autoscaler that scales to zero is operated on the cluster.", "regeneration: not stated — treated as required" ], "risk": [ "Capacity runs, and is billed, whether or not requests arrive." ], "evidence": [ "provider-docs mirror stackit/docs.stackit.cloud/products/runtime/kubernetes-engine.html: \"STACKIT Kubernetes Engine (SKE) is a robust, scalable, and managed Kubernetes service.\"" ], "regeneration_required": true }, { "id": "deployment-artifact/app-on-cloud-foundry", "title": "Choose the container image or artifact: Push the application to STACKIT Cloud Foundry", "prerequisites": [ "the application in a form Cloud Foundry runs", "a Cloud Foundry organization" ], "effects": [ "STACKIT Cloud Foundry is a managed platform for applications that a developer deploys and scales; the application is pushed from its image or its code. Scale to zero and the billing per request go away.", "regeneration: not stated — treated as required" ], "risk": [ "The platform differs from the source platform in how it scales and how it is billed." ], "evidence": [ "provider-docs mirror stackit/docs.stackit.cloud/products/runtime/cloud-foundry.html: \"STACKIT Cloud Foundry is a fully managed platform as a service (PaaS) that enables developers to build, deploy, and scale applications effortlessly.\"" ], "regeneration_required": true } ], "required_verification": [ "Choose the container image or artifact: the image is pulled or built for the target platform and runs there" ], "next_run_changes": [ "A rerun does not build or pull the image; an answer in the decisions file records the choice and writes nothing." ], "remains_manual": [ "Choose the container image or artifact: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note gcp.cloud_run/deployment-artifact: \"A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect", "mode": "MANUAL", "phase": "PLATFORM", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-SEC-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "kind": "unit-review", "family": "gcp.cloud_run", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.cloud_run", "block": "google_cloud_run_v2_service.server", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_cloud_run_v2_service.server", "artifact": "assessment.json", "pointer": "/units/10" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_cloud_run_v2_service.server|environment", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/13" }, { "kind": "semantic", "id": "google_cloud_run_v2_service.server|secrets", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/18" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:a62c4ae04e476e59d71bcc934c792968379d2bec15964708b153e580e7b3c411", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.cloud_run/environment", "sha256": "sha256:c7401058b29b95921d746e353362586d856b8026afbb59e8bca9c9150fa625a1" }, { "kind": "contract_semantic", "id": "gcp.cloud_run/secrets", "sha256": "sha256:31bb2e9d7aba3989dc4933ae7ff2de28eec7542a67d93d7face959b6756b038a" }, { "kind": "review_cause", "id": "gcp.cloud_run/environment", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "gcp.cloud_run/secrets", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:9ba3a1bd3e61762c99157e16ecf5d4927ed883e672aa19e0399f56143c69420a" }, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 2 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 2 critical settings of google_cloud_run_v2_service.server: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/google_cloud_run_v2_service.server/open-settings-security-architect.", "required_evidence": [], "items": [ { "id": "DEC-SEC-GCP-CLOUD-RUN-ENVIRONMENT", "kind": "environment", "family": "gcp.cloud_run", "title": "Confirm the environment settings", "block": "template", "category": "secret-handling", "why": "The knowledge base cannot decide \"environment\" of the gcp.cloud_run contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_service.server|environment" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the environment settings for google_cloud_run_v2_service.server: A person fills in the values the manifest lists as not copied, in the ConfigMap on the cluster. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-GCP-CLOUD-RUN-SECRETS", "kind": "secrets", "family": "gcp.cloud_run", "title": "Create the Kubernetes Secrets for the Secret Manager references", "block": "template", "category": "secret-handling", "why": "The knowledge base cannot decide \"secrets\" of the gcp.cloud_run contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_cloud_run_v2_service.server|secrets" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Create the Kubernetes Secrets for the Secret Manager references for google_cloud_run_v2_service.server: A person creates the Kubernetes Secrets the manifest lists, filled from STACKIT Secrets Manager (for example with an External Secrets Operator). Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-SEC-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "source_family": "gcp.cloud_run", "source_semantic": "unit-review", "affected_units": [ "google_cloud_run_v2_service.server" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm the environment settings; the 2 settings of the record state their own.", "source_observation": "The source states 2 critical settings on google_cloud_run_v2_service.server that the knowledge base cannot decide: Confirm the environment settings; Create the Kubernetes Secrets for the Secret Manager references.", "generated_target_behavior": "Confirm the environment settings: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-security-architect). Create the Kubernetes Secrets for the Secret Manager references: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-security-architect).", "residual_difference": "Confirm the environment settings: the target behaviour of this setting is not established Create the Kubernetes Secrets for the Secret Manager references: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_cloud_run_v2_service.server/open-settings-security-architect now.", "next_action": "Confirm the environment settings: Confirm the environment settings for google_cloud_run_v2_service.server: A person fills in the values the manifest lists as not copied, in the ConfigMap on the cluster. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Confirm the environment settings: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The draft writes the environment keys into the ConfigMap and the env of the Deployment or Job. A value is copied only when it is a quantity under a name that says so or a boolean, because any other value can hold a secret, so the rest of the values are a person's.", "Create the Kubernetes Secrets for the Secret Manager references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A Secret Manager reference in the environment becomes a secretKeyRef of the Deployment or Job and a secret volume a Kubernetes secret volume, and the head of the manifest lists the Secrets to create. The draft writes no Secret, because no value of a secret reaches an output." ], "closes_when": [ "Confirm the environment settings: A person fills in the values the manifest lists as not copied, in the ConfigMap on the cluster.", "Create the Kubernetes Secrets for the Secret Manager references: A person creates the Kubernetes Secrets the manifest lists, filled from STACKIT Secrets Manager (for example with an External Secrets Operator)." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/google_cloud_run_v2_service.server/open-settings-security-architect", "mode": "MANUAL", "phase": "PLATFORM", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-ACTIVATEGCB", "kind": "unit-review", "family": "gcp.cloudbuild", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.cloudbuild", "block": "google_cloudbuild_trigger.activategcb", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_cloudbuild_trigger.activategcb", "artifact": "assessment.json", "pointer": "/units/11" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_cloudbuild_trigger.activategcb|build-identity", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/0" } ], "conditional_members": 1, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:9386141c388d58e556657d741dad4f3973d0a7917c12094e76ed87729a78a697", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.cloudbuild/build-identity", "sha256": "sha256:514a373e2d25251ab6357f079fc4d2eaaf5b82c5ef41aa402d6957befbeda23f" }, { "kind": "review_cause", "id": "gcp.cloudbuild/build-identity", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:986fe167bf9a329368f8430b5da2276a3dcf5c4bd1b79fc22533a56446154eac" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "OPTIONAL_CONDITIONAL", "shape": "RSH-6f19d10581d9", "subject": "google_cloudbuild_trigger.activategcb", "resolution": { "decision_id": "DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-ACTIVATEGCB", "source_family": "gcp.cloudbuild", "source_semantic": "unit-review", "affected_units": [ "google_cloudbuild_trigger.activategcb" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-ACTIVATEGCB", "kind": "unit-review", "family": "gcp.cloudbuild", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.cloudbuild", "block": "google_cloudbuild_trigger.activategcb", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_cloudbuild_trigger.activategcb", "artifact": "assessment.json", "pointer": "/units/11" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_cloudbuild_trigger.activategcb|dep-references", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/1" }, { "kind": "semantic", "id": "google_cloudbuild_trigger.activategcb|deployment-artifact", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/2" }, { "kind": "semantic", "id": "google_cloudbuild_trigger.activategcb|entry-point", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/3" }, { "kind": "semantic", "id": "google_cloudbuild_trigger.activategcb|log-destination", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/4" } ], "conditional_members": 4, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:e0143295cfa5a05eb32a3e9cb7e67db7ffdee678b9d8576c04505e0b9c53e0d6", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.cloudbuild/dep-references", "sha256": "sha256:41e6d55948623d83f717a003346df68c8a7e69550e67dab6961d4fa241cd1b00" }, { "kind": "contract_semantic", "id": "gcp.cloudbuild/deployment-artifact", "sha256": "sha256:c8d77f6cd455043cb626d9d62984597490d744f6ea38a9b13bd1764686227c0d" }, { "kind": "contract_semantic", "id": "gcp.cloudbuild/entry-point", "sha256": "sha256:6e86059d4b5ce66cfd67495167f4184c5aaed1aa5d7a5c82ea29df2dbcedd360" }, { "kind": "contract_semantic", "id": "gcp.cloudbuild/log-destination", "sha256": "sha256:9c32867aca9e4723ed7e09b2ac8748bb684b5bed33f18f4f609f17891bfcb698" }, { "kind": "review_cause", "id": "gcp.cloudbuild/dep-references", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "gcp.cloudbuild/deployment-artifact", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "gcp.cloudbuild/entry-point", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "gcp.cloudbuild/log-destination", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:4eb8ef0b5ba6b230afae8df04c4c76d948a60d07ff869cc7c621ad2b16b82e9e" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 4 } ], "blocker_class": "OPTIONAL_CONDITIONAL", "why": "The knowledge base cannot decide 4 critical settings of google_cloudbuild_trigger.activategcb: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 4 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.", "required_evidence": [], "items": [ { "id": "DEC-OPS-GCP-CLOUDBUILD-DEP-REFERENCES", "kind": "dep-references", "family": "gcp.cloudbuild", "title": "Confirm its dependency on the references", "block": "dep-references", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"dep-references\" of the gcp.cloudbuild contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "google_cloudbuild_trigger.activategcb|dep-references" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "This setting follows the decision on the unit: A person confirms how the replacement carries the relation, or accepts the difference." }, { "id": "DEC-OPS-GCP-CLOUDBUILD-DEPLOYMENT-ARTIFACT", "kind": "deployment-artifact", "family": "gcp.cloudbuild", "title": "Choose the container image or artifact", "block": "build", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"deployment-artifact\" of the gcp.cloudbuild contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "google_cloudbuild_trigger.activategcb|deployment-artifact" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied." }, { "id": "DEC-OPS-GCP-CLOUDBUILD-ENTRY-POINT", "kind": "entry-point", "family": "gcp.cloudbuild", "title": "Confirm the entry point of the function", "block": "build", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"entry-point\" of the gcp.cloudbuild contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "google_cloudbuild_trigger.activategcb|entry-point" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Follows the same decision on the unit as Choose the container image or artifact." }, { "id": "DEC-OPS-GCP-CLOUDBUILD-LOG-DESTINATION", "kind": "log-destination", "family": "gcp.cloudbuild", "title": "Review the log destination setting", "block": "build", "category": "audit-logging", "why": "The knowledge base cannot decide \"log-destination\" of the gcp.cloudbuild contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "google_cloudbuild_trigger.activategcb|log-destination" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Follows the same decision on the unit as Choose the container image or artifact." } ], "resolution": { "decision_id": "DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-ACTIVATEGCB", "source_family": "gcp.cloudbuild", "source_semantic": "unit-review", "affected_units": [ "google_cloudbuild_trigger.activategcb" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm its dependency on the references; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on google_cloudbuild_trigger.activategcb that the knowledge base cannot decide: Confirm its dependency on the references; Choose the container image or artifact; Confirm the entry point of the function; Review the log destination setting.", "generated_target_behavior": "Confirm its dependency on the references: The draft does not carry the setting on google_cloudbuild_trigger.activategcb; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.activategcb). Choose the container image or artifact: The draft does not carry the setting on google_cloudbuild_trigger.activategcb; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.activategcb). Confirm the entry point of the function: The draft does not carry the setting on google_cloudbuild_trigger.activategcb; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.activategcb). Review the log destination setting: The draft does not carry the setting on google_cloudbuild_trigger.activategcb; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.activategcb).", "residual_difference": "Confirm its dependency on the references: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Choose the container image or artifact: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Confirm the entry point of the function: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Review the log destination setting: the draft writes nothing for the unit: what the setting becomes depends on what replaces it", "execution_effect": "No step waits for it. Held by something else first: MAN/unit/google_cloudbuild_trigger.activategcb.", "next_action": "Confirm its dependency on the references: This setting follows the decision on the unit: A person confirms how the replacement carries the relation, or accepts the difference.", "why_open": [ "Confirm its dependency on the references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger and google_cloudbuild_worker_pool names other units or resources (google_cloudbuild_bitbucket_server_config, google_cloudbuild_worker_pool, google_cloudbuildv2_repository, google_compute_global_address, google_compute_network, google_developer_connect_git_repository_link, google_pubsub_topic, google_secret_manager_secret, google_secret_manager_secret_version, google_service_account, google_sourcerepo_repository, google_storage_bucket). A person confirms how the replacement carries the relation between this unit and the units it names, or accepts the difference.", "Choose the container image or artifact: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger.build.step.name, artifact or image reference (workload compatibility: a setting that binds the code to its runtime stays CRITICAL).", "Confirm the entry point of the function: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger.build.step.entrypoint, build.step.script, build.step.args, entry point (workload compatibility: a setting that binds the code to its runtime stays CRITICAL).", "Review the log destination setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states where/whether build logs are captured or exposed back to GitHub; STACKIT Git Pipelines' own logging model is different -- REVIEW." ], "closes_when": [ "Confirm its dependency on the references: A person confirms how the replacement carries the relation, or accepts the difference.", "Choose the container image or artifact: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting.", "Confirm the entry point of the function: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting.", "Review the log destination setting: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/unit/google_cloudbuild_trigger.activategcb", "mode": "MANUAL", "phase": "WORKLOAD", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-INIT", "kind": "unit-review", "family": "gcp.cloudbuild", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.cloudbuild", "block": "google_cloudbuild_trigger.init", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_cloudbuild_trigger.init", "artifact": "assessment.json", "pointer": "/units/12" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_cloudbuild_trigger.init|build-identity", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/6" } ], "conditional_members": 1, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:983aef1e0dd9bd041a79bd51beb04d5a8ac24a45e1c9a2a46cefc90d25ee7eb3", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.cloudbuild/build-identity", "sha256": "sha256:514a373e2d25251ab6357f079fc4d2eaaf5b82c5ef41aa402d6957befbeda23f" }, { "kind": "review_cause", "id": "gcp.cloudbuild/build-identity", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:986fe167bf9a329368f8430b5da2276a3dcf5c4bd1b79fc22533a56446154eac" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "OPTIONAL_CONDITIONAL", "shape": "RSH-6f19d10581d9", "subject": "google_cloudbuild_trigger.init", "resolution": { "decision_id": "DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-INIT", "source_family": "gcp.cloudbuild", "source_semantic": "unit-review", "affected_units": [ "google_cloudbuild_trigger.init" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-INIT", "kind": "unit-review", "family": "gcp.cloudbuild", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.cloudbuild", "block": "google_cloudbuild_trigger.init", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_cloudbuild_trigger.init", "artifact": "assessment.json", "pointer": "/units/12" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_cloudbuild_trigger.init|dep-references", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/7" }, { "kind": "semantic", "id": "google_cloudbuild_trigger.init|deployment-artifact", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/8" }, { "kind": "semantic", "id": "google_cloudbuild_trigger.init|entry-point", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/9" }, { "kind": "semantic", "id": "google_cloudbuild_trigger.init|log-destination", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/10" } ], "conditional_members": 4, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:dde8057fbf100190ede422135467b4944298a15361db3dab48d0eac6ec929497", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.cloudbuild/dep-references", "sha256": "sha256:41e6d55948623d83f717a003346df68c8a7e69550e67dab6961d4fa241cd1b00" }, { "kind": "contract_semantic", "id": "gcp.cloudbuild/deployment-artifact", "sha256": "sha256:c8d77f6cd455043cb626d9d62984597490d744f6ea38a9b13bd1764686227c0d" }, { "kind": "contract_semantic", "id": "gcp.cloudbuild/entry-point", "sha256": "sha256:6e86059d4b5ce66cfd67495167f4184c5aaed1aa5d7a5c82ea29df2dbcedd360" }, { "kind": "contract_semantic", "id": "gcp.cloudbuild/log-destination", "sha256": "sha256:9c32867aca9e4723ed7e09b2ac8748bb684b5bed33f18f4f609f17891bfcb698" }, { "kind": "review_cause", "id": "gcp.cloudbuild/dep-references", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "gcp.cloudbuild/deployment-artifact", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "gcp.cloudbuild/entry-point", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "gcp.cloudbuild/log-destination", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:4eb8ef0b5ba6b230afae8df04c4c76d948a60d07ff869cc7c621ad2b16b82e9e" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 4 } ], "blocker_class": "OPTIONAL_CONDITIONAL", "why": "The knowledge base cannot decide 4 critical settings of google_cloudbuild_trigger.init: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 4 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.", "required_evidence": [], "items": [ { "id": "DEC-OPS-GCP-CLOUDBUILD-DEP-REFERENCES", "kind": "dep-references", "family": "gcp.cloudbuild", "title": "Confirm its dependency on the references", "block": "dep-references", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"dep-references\" of the gcp.cloudbuild contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "google_cloudbuild_trigger.init|dep-references" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "This setting follows the decision on the unit: A person confirms how the replacement carries the relation, or accepts the difference." }, { "id": "DEC-OPS-GCP-CLOUDBUILD-DEPLOYMENT-ARTIFACT", "kind": "deployment-artifact", "family": "gcp.cloudbuild", "title": "Choose the container image or artifact", "block": "build", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"deployment-artifact\" of the gcp.cloudbuild contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "google_cloudbuild_trigger.init|deployment-artifact" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied." }, { "id": "DEC-OPS-GCP-CLOUDBUILD-ENTRY-POINT", "kind": "entry-point", "family": "gcp.cloudbuild", "title": "Confirm the entry point of the function", "block": "build", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"entry-point\" of the gcp.cloudbuild contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "google_cloudbuild_trigger.init|entry-point" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Follows the same decision on the unit as Choose the container image or artifact." }, { "id": "DEC-OPS-GCP-CLOUDBUILD-LOG-DESTINATION", "kind": "log-destination", "family": "gcp.cloudbuild", "title": "Review the log destination setting", "block": "build", "category": "audit-logging", "why": "The knowledge base cannot decide \"log-destination\" of the gcp.cloudbuild contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "google_cloudbuild_trigger.init|log-destination" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Follows the same decision on the unit as Choose the container image or artifact." } ], "resolution": { "decision_id": "DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-INIT", "source_family": "gcp.cloudbuild", "source_semantic": "unit-review", "affected_units": [ "google_cloudbuild_trigger.init" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm its dependency on the references; the 4 settings of the record state their own.", "source_observation": "The source states 4 critical settings on google_cloudbuild_trigger.init that the knowledge base cannot decide: Confirm its dependency on the references; Choose the container image or artifact; Confirm the entry point of the function; Review the log destination setting.", "generated_target_behavior": "Confirm its dependency on the references: The draft does not carry the setting on google_cloudbuild_trigger.init; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.init). Choose the container image or artifact: The draft does not carry the setting on google_cloudbuild_trigger.init; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.init). Confirm the entry point of the function: The draft does not carry the setting on google_cloudbuild_trigger.init; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.init). Review the log destination setting: The draft does not carry the setting on google_cloudbuild_trigger.init; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.init).", "residual_difference": "Confirm its dependency on the references: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Choose the container image or artifact: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Confirm the entry point of the function: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Review the log destination setting: the draft writes nothing for the unit: what the setting becomes depends on what replaces it", "execution_effect": "No step waits for it. Held by something else first: MAN/unit/google_cloudbuild_trigger.init.", "next_action": "Confirm its dependency on the references: This setting follows the decision on the unit: A person confirms how the replacement carries the relation, or accepts the difference.", "why_open": [ "Confirm its dependency on the references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger and google_cloudbuild_worker_pool names other units or resources (google_cloudbuild_bitbucket_server_config, google_cloudbuild_worker_pool, google_cloudbuildv2_repository, google_compute_global_address, google_compute_network, google_developer_connect_git_repository_link, google_pubsub_topic, google_secret_manager_secret, google_secret_manager_secret_version, google_service_account, google_sourcerepo_repository, google_storage_bucket). A person confirms how the replacement carries the relation between this unit and the units it names, or accepts the difference.", "Choose the container image or artifact: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger.build.step.name, artifact or image reference (workload compatibility: a setting that binds the code to its runtime stays CRITICAL).", "Confirm the entry point of the function: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger.build.step.entrypoint, build.step.script, build.step.args, entry point (workload compatibility: a setting that binds the code to its runtime stays CRITICAL). The unit names google_firebase_hosting_site.client (google_firebase_hosting_site) through this setting (the target does not carry it: it is REDESIGN), so what the reference becomes is part of this setting.", "Review the log destination setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states where/whether build logs are captured or exposed back to GitHub; STACKIT Git Pipelines' own logging model is different -- REVIEW." ], "closes_when": [ "Confirm its dependency on the references: A person confirms how the replacement carries the relation, or accepts the difference.", "Choose the container image or artifact: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting.", "Confirm the entry point of the function: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting.", "Review the log destination setting: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/unit/google_cloudbuild_trigger.init", "mode": "MANUAL", "phase": "WORKLOAD", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-GEN-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER", "kind": "unit-review", "family": "gcp.cloudbuild", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.cloudbuild", "block": "google_cloudbuild_trigger.placeholder", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "NOT_STATED", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_cloudbuild_trigger.placeholder", "artifact": "assessment.json", "pointer": "/units/13" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_cloudbuild_trigger.placeholder|linked-dependency:google_firebase_hosting_site", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/15" } ], "conditional_members": 1, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:c674d845100b6fe50690bf19a8f6cb6e1c75ac37f81d12554d22665ec6b82793", "kb_dependencies": [ { "kind": "contract", "id": "gcp.cloudbuild", "sha256": "sha256:02ae4176b17bac19cd76c8b38f3e04919b7f714f38526e64214c0c3fa1b86dbe" }, { "kind": "review_cause", "id": "gcp.cloudbuild/linked-dependency:google_firebase_hosting_site", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:2263f44dd94d80de252fce492c6264ad809d936ed18332bf0c4dab3747e0a1d8" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "PROPAGATED_IMPACT", "root_ids": [ "google_firebase_hosting_site.client" ], "propagated_members": 1, "why": "The knowledge base cannot decide 1 critical setting of google_cloudbuild_trigger.placeholder: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.", "required_evidence": [], "items": [ { "id": "DEC-GEN-GCP-CLOUDBUILD-LINKED-DEPENDENCY-GOOGLE-FIREBASE-HOSTING-SITE", "kind": "linked-dependency:google_firebase_hosting_site", "family": "gcp.cloudbuild", "title": "Decide which firebase hosting site this resource depends on", "block": "linked-dependency:google_firebase_hosting_site", "why": "The knowledge base cannot decide \"linked-dependency:google_firebase_hosting_site\" of the gcp.cloudbuild contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "google_cloudbuild_trigger.placeholder|linked-dependency:google_firebase_hosting_site" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied." } ], "resolution": { "decision_id": "DEC-GEN-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER", "source_family": "gcp.cloudbuild", "source_semantic": "unit-review", "affected_units": [ "google_cloudbuild_trigger.placeholder" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "NOT_STATED", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on google_cloudbuild_trigger.placeholder that the knowledge base cannot decide: Decide which firebase hosting site this resource depends on.", "generated_target_behavior": "Decide which firebase hosting site this resource depends on: The draft does not carry the setting on google_cloudbuild_trigger.placeholder; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.placeholder).", "residual_difference": "Decide which firebase hosting site this resource depends on: the draft writes nothing for the unit: what the setting becomes depends on what replaces it", "execution_effect": "No step waits for it. Held by something else first: MAN/unit/google_cloudbuild_trigger.placeholder.", "next_action": "Decide which firebase hosting site this resource depends on: This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied.", "why_open": [ "Decide which firebase hosting site this resource depends on: This unit names a resource of the type google_firebase_hosting_site (by an attribute that configures it) and the target does not carry that resource as a mapped unit (it is redesigned, blocked, left for review or has no draft block of its own), and no semantic of this unit's contract reads that type: what the reference becomes on the target is not assessed." ], "closes_when": [ "Decide which firebase hosting site this resource depends on: The contract of this unit gains a semantic that reads google_firebase_hosting_site (and lists it as carried), or a person decides what the reference to the resource becomes." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/unit/google_cloudbuild_trigger.placeholder", "mode": "MANUAL", "phase": "WORKLOAD", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER", "kind": "unit-review", "family": "gcp.cloudbuild", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.cloudbuild", "block": "google_cloudbuild_trigger.placeholder", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_cloudbuild_trigger.placeholder", "artifact": "assessment.json", "pointer": "/units/13" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_cloudbuild_trigger.placeholder|build-identity", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/12" } ], "conditional_members": 1, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:5dd6517fac6668ddfc41409b0b481e67806d0e95fb9a8fcb6d7ed6132d67439b", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.cloudbuild/build-identity", "sha256": "sha256:514a373e2d25251ab6357f079fc4d2eaaf5b82c5ef41aa402d6957befbeda23f" }, { "kind": "review_cause", "id": "gcp.cloudbuild/build-identity", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:986fe167bf9a329368f8430b5da2276a3dcf5c4bd1b79fc22533a56446154eac" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "OPTIONAL_CONDITIONAL", "shape": "RSH-6f19d10581d9", "subject": "google_cloudbuild_trigger.placeholder", "resolution": { "decision_id": "DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER", "source_family": "gcp.cloudbuild", "source_semantic": "unit-review", "affected_units": [ "google_cloudbuild_trigger.placeholder" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER", "kind": "unit-review", "family": "gcp.cloudbuild", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.cloudbuild", "block": "google_cloudbuild_trigger.placeholder", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_cloudbuild_trigger.placeholder", "artifact": "assessment.json", "pointer": "/units/13" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_cloudbuild_trigger.placeholder|dep-references", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/13" }, { "kind": "semantic", "id": "google_cloudbuild_trigger.placeholder|deployment-artifact", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/14" }, { "kind": "semantic", "id": "google_cloudbuild_trigger.placeholder|log-destination", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/16" } ], "conditional_members": 3, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:7e70eed61a6fa17edd718e38dd29074b9b3e25e7abd5fc99b629828000c689a8", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.cloudbuild/dep-references", "sha256": "sha256:41e6d55948623d83f717a003346df68c8a7e69550e67dab6961d4fa241cd1b00" }, { "kind": "contract_semantic", "id": "gcp.cloudbuild/deployment-artifact", "sha256": "sha256:c8d77f6cd455043cb626d9d62984597490d744f6ea38a9b13bd1764686227c0d" }, { "kind": "contract_semantic", "id": "gcp.cloudbuild/log-destination", "sha256": "sha256:9c32867aca9e4723ed7e09b2ac8748bb684b5bed33f18f4f609f17891bfcb698" }, { "kind": "review_cause", "id": "gcp.cloudbuild/dep-references", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "gcp.cloudbuild/deployment-artifact", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "gcp.cloudbuild/log-destination", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:08f216fcd85c9d6305f60978415fc1d136a6daf9270b7b52bd96a0bf9a3fb4af" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 3 } ], "blocker_class": "OPTIONAL_CONDITIONAL", "why": "The knowledge base cannot decide 3 critical settings of google_cloudbuild_trigger.placeholder: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 3 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.", "required_evidence": [], "items": [ { "id": "DEC-OPS-GCP-CLOUDBUILD-DEP-REFERENCES", "kind": "dep-references", "family": "gcp.cloudbuild", "title": "Confirm its dependency on the references", "block": "dep-references", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"dep-references\" of the gcp.cloudbuild contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "google_cloudbuild_trigger.placeholder|dep-references" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "This setting follows the decision on the unit: A person confirms how the replacement carries the relation, or accepts the difference." }, { "id": "DEC-OPS-GCP-CLOUDBUILD-DEPLOYMENT-ARTIFACT", "kind": "deployment-artifact", "family": "gcp.cloudbuild", "title": "Choose the container image or artifact", "block": "build", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"deployment-artifact\" of the gcp.cloudbuild contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "google_cloudbuild_trigger.placeholder|deployment-artifact" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied." }, { "id": "DEC-OPS-GCP-CLOUDBUILD-LOG-DESTINATION", "kind": "log-destination", "family": "gcp.cloudbuild", "title": "Review the log destination setting", "block": "build", "category": "audit-logging", "why": "The knowledge base cannot decide \"log-destination\" of the gcp.cloudbuild contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "google_cloudbuild_trigger.placeholder|log-destination" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "Follows the same decision on the unit as Choose the container image or artifact." } ], "resolution": { "decision_id": "DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER", "source_family": "gcp.cloudbuild", "source_semantic": "unit-review", "affected_units": [ "google_cloudbuild_trigger.placeholder" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm its dependency on the references; the 3 settings of the record state their own.", "source_observation": "The source states 3 critical settings on google_cloudbuild_trigger.placeholder that the knowledge base cannot decide: Confirm its dependency on the references; Choose the container image or artifact; Review the log destination setting.", "generated_target_behavior": "Confirm its dependency on the references: The draft does not carry the setting on google_cloudbuild_trigger.placeholder; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.placeholder). Choose the container image or artifact: The draft does not carry the setting on google_cloudbuild_trigger.placeholder; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.placeholder). Review the log destination setting: The draft does not carry the setting on google_cloudbuild_trigger.placeholder; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.placeholder).", "residual_difference": "Confirm its dependency on the references: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Choose the container image or artifact: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Review the log destination setting: the draft writes nothing for the unit: what the setting becomes depends on what replaces it", "execution_effect": "No step waits for it. Held by something else first: MAN/unit/google_cloudbuild_trigger.placeholder.", "next_action": "Confirm its dependency on the references: This setting follows the decision on the unit: A person confirms how the replacement carries the relation, or accepts the difference.", "why_open": [ "Confirm its dependency on the references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger and google_cloudbuild_worker_pool names other units or resources (google_cloudbuild_bitbucket_server_config, google_cloudbuild_worker_pool, google_cloudbuildv2_repository, google_compute_global_address, google_compute_network, google_developer_connect_git_repository_link, google_pubsub_topic, google_secret_manager_secret, google_secret_manager_secret_version, google_service_account, google_sourcerepo_repository, google_storage_bucket). A person confirms how the replacement carries the relation between this unit and the units it names, or accepts the difference.", "Choose the container image or artifact: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger.build.step.name, artifact or image reference (workload compatibility: a setting that binds the code to its runtime stays CRITICAL).", "Review the log destination setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states where/whether build logs are captured or exposed back to GitHub; STACKIT Git Pipelines' own logging model is different -- REVIEW." ], "closes_when": [ "Confirm its dependency on the references: A person confirms how the replacement carries the relation, or accepts the difference.", "Choose the container image or artifact: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting.", "Review the log destination setting: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/unit/google_cloudbuild_trigger.placeholder", "mode": "MANUAL", "phase": "WORKLOAD", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-IAM-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT", "kind": "unit-review", "family": "gcp.firebase_hosting_site", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.firebase_hosting_site", "block": "google_firebase_hosting_site.client", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_firebase_hosting_site.client", "artifact": "assessment.json", "pointer": "/units/14" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_firebase_hosting_site.client|tc-firebase-hosting-site-project", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/18" } ], "conditional_members": 1, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:b4097e90369c69fe115b52f7ba297fa1a8a151b2f4e4cb927a2477eb7449550e", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.firebase_hosting_site/tc-firebase-hosting-site-project", "sha256": "sha256:a68d8c7b51bfcc41318669f555fb68143ade9f351fc6c421d4fddcff4c3197ee" }, { "kind": "review_cause", "id": "gcp.firebase_hosting_site/tc-firebase-hosting-site-project", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:f55dba7d6b49141ce72d8f9e08bc07f99cb4ee36e013de7545c9e78dec5243be" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "ROOT_BLOCKER", "why": "The knowledge base cannot decide 1 critical setting of google_firebase_hosting_site.client: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.", "required_evidence": [], "items": [ { "id": "DEC-IAM-GCP-FIREBASE-HOSTING-SITE-TC-FIREBASE-HOSTING-SITE-PROJECT", "kind": "tc-firebase-hosting-site-project", "family": "gcp.firebase_hosting_site", "title": "Confirm the project of the firebase hosting site", "block": "project", "category": "identity-access", "why": "The knowledge base cannot decide \"tc-firebase-hosting-site-project\" of the gcp.firebase_hosting_site contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "google_firebase_hosting_site.client|tc-firebase-hosting-site-project" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "This setting follows the decision on the unit: A person decides which STACKIT project, and with it which access rules, holds the replacement." } ], "resolution": { "decision_id": "DEC-IAM-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT", "source_family": "gcp.firebase_hosting_site", "source_semantic": "unit-review", "affected_units": [ "google_firebase_hosting_site.client" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on google_firebase_hosting_site.client that the knowledge base cannot decide: Confirm the project of the firebase hosting site.", "generated_target_behavior": "Confirm the project of the firebase hosting site: The draft does not carry the setting on google_firebase_hosting_site.client; a manual step stands for it (MAN/unit/google_firebase_hosting_site.client).", "residual_difference": "Confirm the project of the firebase hosting site: the draft writes nothing for the unit: what the setting becomes depends on what replaces it", "execution_effect": "No step waits for it. Held by something else first: MAN/unit/google_firebase_hosting_site.client.", "next_action": "Confirm the project of the firebase hosting site: This setting follows the decision on the unit: A person decides which STACKIT project, and with it which access rules, holds the replacement.", "why_open": [ "Confirm the project of the firebase hosting site: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_firebase_hosting_site.project (identity access): The Google Cloud project the resource is created in. IAM policy, organisation policy and audit configuration are inherited from the project, so it decides who can act on the resource and what it is isolated from. The unit names google_firebase_project.default (google_firebase_project) through this setting (the target does not carry it: it is MANUAL_REVIEW), so what the reference becomes is part of this setting." ], "closes_when": [ "Confirm the project of the firebase hosting site: A person decides which STACKIT project, and with it which access rules, holds the replacement." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/unit/google_firebase_hosting_site.client", "mode": "MANUAL", "phase": "DATA", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-OPS-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT", "kind": "unit-review", "family": "gcp.firebase_hosting_site", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.firebase_hosting_site", "block": "google_firebase_hosting_site.client", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_firebase_hosting_site.client", "artifact": "assessment.json", "pointer": "/units/14" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_firebase_hosting_site.client|tcr-firebase-hosting-site-site-id", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/19" } ], "conditional_members": 1, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:f1335c383712c8d9a2d9e320a1daa4839dab4858facb100fc6012ff529d7cacc", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.firebase_hosting_site/tcr-firebase-hosting-site-site-id", "sha256": "sha256:ecfaf07f14390ad02bc45e3f9ec2a5a42294287e6d7a2a4dcbba617072ce5648" }, { "kind": "review_cause", "id": "gcp.firebase_hosting_site/tcr-firebase-hosting-site-site-id", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:a631a25906c03485dfab5b0a0a312fc9b2555f35bf1744f986183dd81745237c" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "ROOT_BLOCKER", "why": "The knowledge base cannot decide 1 critical setting of google_firebase_hosting_site.client: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.", "required_evidence": [], "items": [ { "id": "DEC-OPS-GCP-FIREBASE-HOSTING-SITE-TCR-FIREBASE-HOSTING-SITE-SITE-ID", "kind": "tcr-firebase-hosting-site-site-id", "family": "gcp.firebase_hosting_site", "title": "Confirm the site ID of the firebase hosting site", "block": "site_id", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tcr-firebase-hosting-site-site-id\" of the gcp.firebase_hosting_site contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "google_firebase_hosting_site.client|tcr-firebase-hosting-site-site-id" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "This setting follows the decision on the unit: A person sets this up on the bucket, the CDN distribution and the domain that replace Firebase Hosting, or decides to drop it, and records the decision." } ], "resolution": { "decision_id": "DEC-OPS-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT", "source_family": "gcp.firebase_hosting_site", "source_semantic": "unit-review", "affected_units": [ "google_firebase_hosting_site.client" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on google_firebase_hosting_site.client that the knowledge base cannot decide: Confirm the site ID of the firebase hosting site.", "generated_target_behavior": "Confirm the site ID of the firebase hosting site: The draft does not carry the setting on google_firebase_hosting_site.client; a manual step stands for it (MAN/unit/google_firebase_hosting_site.client).", "residual_difference": "Confirm the site ID of the firebase hosting site: the draft writes nothing for the unit: what the setting becomes depends on what replaces it", "execution_effect": "No step waits for it. Held by something else first: MAN/unit/google_firebase_hosting_site.client.", "next_action": "Confirm the site ID of the firebase hosting site: This setting follows the decision on the unit: A person sets this up on the bucket, the CDN distribution and the domain that replace Firebase Hosting, or decides to drop it, and records the decision.", "why_open": [ "Confirm the site ID of the firebase hosting site: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_firebase_hosting_site.site_id (workload compatibility): A globally unique identifier for the Hosting site; other settings, bindings and clients refer to the object by this id. Firebase Hosting has no STACKIT counterpart, so the site is rebuilt on Object Storage with a CDN." ], "closes_when": [ "Confirm the site ID of the firebase hosting site: A person sets this up on the bucket, the CDN distribution and the domain that replace Firebase Hosting, or decides to drop it, and records the decision." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/unit/google_firebase_hosting_site.client", "mode": "MANUAL", "phase": "DATA", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-IAM-GOOGLE-FIREBASE-PROJECT-DEFAULT", "kind": "unit-review", "family": "gcp.firebase_project", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.firebase_project", "block": "google_firebase_project.default", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_firebase_project.default", "artifact": "assessment.json", "pointer": "/units/0" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_firebase_project.default|tc-firebase-project-project", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/23" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:667031dd2b2502bc1c1caca38c963530b561e9cde073a8b3faae85c068978e91", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.firebase_project/tc-firebase-project-project", "sha256": "sha256:b5000cbe8038e268c13aba58ee82a20952a97ae75b041b325e8aa27f05a27700" }, { "kind": "review_cause", "id": "gcp.firebase_project/tc-firebase-project-project", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:85daa99d61e711d84e649385b5c149432e234a88bdc0a8c525deb5ca3a0ef7e7" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of google_firebase_project.default: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-IAM-GCP-FIREBASE-PROJECT-TC-FIREBASE-PROJECT-PROJECT", "kind": "tc-firebase-project-project", "family": "gcp.firebase_project", "title": "Confirm the project of the firebase project", "block": "project", "category": "identity-access", "why": "The knowledge base cannot decide \"tc-firebase-project-project\" of the gcp.firebase_project contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_firebase_project.default|tc-firebase-project-project" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "BLOCKED", "next_action": "The plan refuses REF/unit/google_firebase_project.default for google_firebase_project.default: Nothing on STACKIT holds the registration of an app or the enabling of Firebase on a project. It stays with Google for as long as any Firebase service (push messaging, for example) is used, and a person decides, app by app, which backend replaces the Firebase services the app calls. Adding Firebase to a project cannot be undone (a redesign could go: List the Firebase services each app uses (authentication, database, storage, messaging, remote config); each needs its own replacement; The signing keys and store listings stay with Google Play and the Apple App Store; only the backend the app talks to moves). Decide the redesign before anything rests on this record." } ], "resolution": { "decision_id": "DEC-IAM-GOOGLE-FIREBASE-PROJECT-DEFAULT", "source_family": "gcp.firebase_project", "source_semantic": "unit-review", "affected_units": [ "google_firebase_project.default" ], "affected_application": [], "action_type": "BLOCKED_OR_UNSUPPORTED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "BLOCKED", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "the execution plan refuses REF/unit/google_firebase_project.default, which carries the record", "source_observation": "The source states 1 critical setting on google_firebase_project.default that the knowledge base cannot decide: Confirm the project of the firebase project.", "generated_target_behavior": "Confirm the project of the firebase project: The draft does not carry the setting on google_firebase_project.default. The plan refuses REF/unit/google_firebase_project.default.", "residual_difference": "Confirm the project of the firebase project: the draft writes nothing for the unit: what the setting becomes depends on what replaces it", "execution_effect": "No step waits for it. Held by something else first: REF/unit/google_firebase_project.default.", "next_action": "Confirm the project of the firebase project: The plan refuses REF/unit/google_firebase_project.default for google_firebase_project.default: Nothing on STACKIT holds the registration of an app or the enabling of Firebase on a project. It stays with Google for as long as any Firebase service (push messaging, for example) is used, and a person decides, app by app, which backend replaces the Firebase services the app calls. Adding Firebase to a project cannot be undone (a redesign could go: List the Firebase services each app uses (authentication, database, storage, messaging, remote config); each needs its own replacement; The signing keys and store listings stay with Google Play and the Apple App Store; only the backend the app talks to moves). Decide the redesign before anything rests on this record.", "why_open": [ "Confirm the project of the firebase project: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_firebase_project.project (identity access): The Google Cloud project the resource is created in. IAM policy, organisation policy and audit configuration are inherited from the project, so it decides who can act on the resource and what it is isolated from. Firebase has no STACKIT counterpart, so the registration of the app is not moved and the backend the app talks to is chosen by a person." ], "closes_when": [ "Confirm the project of the firebase project: A person decides which STACKIT project, and with it which access rules, holds the replacement." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "REF/unit/google_firebase_project.default", "mode": "REFUSE", "phase": "PLATFORM", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-OPS-GOOGLE-PUBSUB-TOPIC-FAUX", "kind": "unit-review", "family": "gcp.pubsub_topic", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.pubsub_topic", "block": "google_pubsub_topic.faux", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_pubsub_topic.faux", "artifact": "assessment.json", "pointer": "/units/1" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_pubsub_topic.faux|tc-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/24" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_pubsub_topic.faux", "artifact": "workspace.json", "pointer": "/units/7/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:a7d8918bd3887e9683ef3e8136ed581b298c98a4bd2f2c70d955d19659e55ff8", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.pubsub_topic/tc-name", "sha256": "sha256:6a0588c95bb790f1592aa4bb0536fd6c44efbafcae5dfb37821f9ebe3a20e6d3" }, { "kind": "review_cause", "id": "gcp.pubsub_topic/tc-name", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:9141875ce7743ffec157132a09b478d7c4c66adccff8d3fc37212a6edbf027de" }, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of google_pubsub_topic.faux: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-OPS-GCP-PUBSUB-TOPIC-TC-NAME", "kind": "tc-name", "family": "gcp.pubsub_topic", "title": "Confirm the name of the resource on the target", "block": "name", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tc-name\" of the gcp.pubsub_topic contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_pubsub_topic.faux|tc-name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the name of the resource on the target for google_pubsub_topic.faux: A person confirms the topic name the replacement messaging service carries against the publishers and subscribers that use it, or accepts the new name. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-OPS-GOOGLE-PUBSUB-TOPIC-FAUX", "source_family": "gcp.pubsub_topic", "source_semantic": "unit-review", "affected_units": [ "google_pubsub_topic.faux" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on google_pubsub_topic.faux that the knowledge base cannot decide: Confirm the name of the resource on the target.", "generated_target_behavior": "Confirm the name of the resource on the target: The draft does not carry the setting on google_pubsub_topic.faux; a manual step stands for it (MAN/semantic/google_pubsub_topic.faux/tc-name).", "residual_difference": "Confirm the name of the resource on the target: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_pubsub_topic.faux/tc-name now.", "next_action": "Confirm the name of the resource on the target: Confirm the name of the resource on the target for google_pubsub_topic.faux: A person confirms the topic name the replacement messaging service carries against the publishers and subscribers that use it, or accepts the new name. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Confirm the name of the resource on the target: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_pubsub_topic.name: The topic's own resource name, which publishers and subscribers address it by; access to it is controlled by IAM, not by the name string itself, and a changed name breaks every client that uses the old one." ], "closes_when": [ "Confirm the name of the resource on the target: A person confirms the topic name the replacement messaging service carries against the publishers and subscribers that use it, or accepts the new name." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/google_pubsub_topic.faux/tc-name", "mode": "MANUAL", "phase": "PLATFORM", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD", "kind": "unit-review", "family": "gcp.secret", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.secret", "block": "google_secret_manager_secret.django_admin_password", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_secret_manager_secret.django_admin_password", "artifact": "assessment.json", "pointer": "/units/6" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_secret_manager_secret.django_admin_password|secret-settings", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/25" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_secret_manager_secret.django_admin_password", "artifact": "workspace.json", "pointer": "/units/8/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:3e09fec2b3fabb25d58fdb484b8b5ab923f9e3ab186d861af6d5dcf041d7659b", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.secret/secret-settings", "sha256": "sha256:7ed38e43fb1d3fd4b6370c3c202adf35bcbd17b09546a50eabdf450218568c78" }, { "kind": "review_cause", "id": "gcp.secret/secret-settings", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:0ccd16d2e735b9486466e3d6dbe99987df23297d09511b6cab689cdb4854aa41" }, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-e375932468f2", "subject": "google_secret_manager_secret.django_admin_password", "resolution": { "decision_id": "DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD", "source_family": "gcp.secret", "source_semantic": "unit-review", "affected_units": [ "google_secret_manager_secret.django_admin_password" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD", "kind": "unit-review", "family": "gcp.secret", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.secret", "block": "google_secret_manager_secret.django_admin_password", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_secret_manager_secret.django_admin_password", "artifact": "assessment.json", "pointer": "/units/6" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_secret_manager_secret.django_admin_password|secret-value", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/26" }, { "kind": "semantic", "id": "google_secret_manager_secret.django_admin_password|tcr-secret-id", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/27" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_secret_manager_secret.django_admin_password", "artifact": "workspace.json", "pointer": "/units/8/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:eb29f1eaa95c211eb17973b5c3e485f452884068952077daaa1918823c3c8cf2", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.secret/secret-value", "sha256": "sha256:b2d7bf45d2c9c972e9db4677933ca99b310271372a9b428dedf546ab2e55018a" }, { "kind": "contract_semantic", "id": "gcp.secret/tcr-secret-id", "sha256": "sha256:51bd6756c6542839bdbd99d8e470ea921b9cd1cfc6c0a9c62a3232d5ae7256df" }, { "kind": "review_cause", "id": "gcp.secret/secret-value", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "gcp.secret/tcr-secret-id", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:3e006b8a81c0ca3b70d5261345ffc7f78b9801324130cf812092e2bf2d4267d2" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-57f6574c79c3", "subject": "google_secret_manager_secret.django_admin_password", "resolution": { "decision_id": "DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD", "source_family": "gcp.secret", "source_semantic": "unit-review", "affected_units": [ "google_secret_manager_secret.django_admin_password" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-SETTINGS", "kind": "unit-review", "family": "gcp.secret", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.secret", "block": "google_secret_manager_secret.django_settings", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_secret_manager_secret.django_settings", "artifact": "assessment.json", "pointer": "/units/8" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_secret_manager_secret.django_settings|secret-settings", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/28" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_secret_manager_secret.django_settings", "artifact": "workspace.json", "pointer": "/units/9/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:6d6b7e816d8d4ad7005954dceeadfb922b3abfaa5ba54c8f6ea046dc1ee92c0a", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.secret/secret-settings", "sha256": "sha256:7ed38e43fb1d3fd4b6370c3c202adf35bcbd17b09546a50eabdf450218568c78" }, { "kind": "review_cause", "id": "gcp.secret/secret-settings", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:0ccd16d2e735b9486466e3d6dbe99987df23297d09511b6cab689cdb4854aa41" }, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-e375932468f2", "subject": "google_secret_manager_secret.django_settings", "resolution": { "decision_id": "DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-SETTINGS", "source_family": "gcp.secret", "source_semantic": "unit-review", "affected_units": [ "google_secret_manager_secret.django_settings" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-SETTINGS", "kind": "unit-review", "family": "gcp.secret", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.secret", "block": "google_secret_manager_secret.django_settings", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_secret_manager_secret.django_settings", "artifact": "assessment.json", "pointer": "/units/8" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_secret_manager_secret.django_settings|secret-value", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/29" }, { "kind": "semantic", "id": "google_secret_manager_secret.django_settings|tcr-secret-id", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/30" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_secret_manager_secret.django_settings", "artifact": "workspace.json", "pointer": "/units/9/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:716b1b457e427774c0a7f4b650e4c1b35931c304d406b6d687462a336a072224", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.secret/secret-value", "sha256": "sha256:b2d7bf45d2c9c972e9db4677933ca99b310271372a9b428dedf546ab2e55018a" }, { "kind": "contract_semantic", "id": "gcp.secret/tcr-secret-id", "sha256": "sha256:51bd6756c6542839bdbd99d8e470ea921b9cd1cfc6c0a9c62a3232d5ae7256df" }, { "kind": "review_cause", "id": "gcp.secret/secret-value", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "gcp.secret/tcr-secret-id", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:3e006b8a81c0ca3b70d5261345ffc7f78b9801324130cf812092e2bf2d4267d2" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-57f6574c79c3", "subject": "google_secret_manager_secret.django_settings", "resolution": { "decision_id": "DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-SETTINGS", "source_family": "gcp.secret", "source_semantic": "unit-review", "affected_units": [ "google_secret_manager_secret.django_settings" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic" } }, { "id": "DEC-IAM-GOOGLE-SERVICE-ACCOUNT-AUTOMATION", "kind": "unit-review", "family": "gcp.service_account", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.service_account", "block": "google_service_account.automation", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_service_account.automation", "artifact": "assessment.json", "pointer": "/units/2" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_service_account.automation|account-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/31" }, { "kind": "semantic", "id": "google_service_account.automation|role-bindings", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/32" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:274ca0dfef1c6eb06c78eb115a723bfb517013ac6392e727915c50ba200a2ff8", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.service_account/account-name", "sha256": "sha256:569232e9e09039119b8dfad018fa960c15f935f9d96bcc643456a66798eb1e47" }, { "kind": "contract_semantic", "id": "gcp.service_account/role-bindings", "sha256": "sha256:bcbcb80532bd32b0de8ddfb9d26e579b82348f3355659819f5ce5d0790a5c96b" }, { "kind": "decision_kind", "id": "gcp.service_account/role-bindings", "sha256": "sha256:c78772004fe4de56c903ccaa85d645de2e148216c9c2d7a376ffa306bdc4d9d6" }, { "kind": "review_cause", "id": "gcp.service_account/account-name", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "gcp.service_account/role-bindings", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:a2f32f0b19e4dd60b79173e9fabcf5021c17aa2d1102ae21c5a9f31db479c9b6" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-be38e574aa6e", "subject": "google_service_account.automation", "resolution": { "decision_id": "DEC-IAM-GOOGLE-SERVICE-ACCOUNT-AUTOMATION", "source_family": "gcp.service_account", "source_semantic": "unit-review", "affected_units": [ "google_service_account.automation" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-IAM-GOOGLE-SERVICE-ACCOUNT-CLIENT", "kind": "unit-review", "family": "gcp.service_account", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.service_account", "block": "google_service_account.client", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_service_account.client", "artifact": "assessment.json", "pointer": "/units/3" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_service_account.client|account-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/33" }, { "kind": "semantic", "id": "google_service_account.client|role-bindings", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/34" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_service_account.client", "artifact": "workspace.json", "pointer": "/units/11/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:88ae4b1b16dcb159b368f4323b539cbf6d141a882787af854f5db4709ec45ac9", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.service_account/account-name", "sha256": "sha256:569232e9e09039119b8dfad018fa960c15f935f9d96bcc643456a66798eb1e47" }, { "kind": "contract_semantic", "id": "gcp.service_account/role-bindings", "sha256": "sha256:bcbcb80532bd32b0de8ddfb9d26e579b82348f3355659819f5ce5d0790a5c96b" }, { "kind": "decision_kind", "id": "gcp.service_account/role-bindings", "sha256": "sha256:c78772004fe4de56c903ccaa85d645de2e148216c9c2d7a376ffa306bdc4d9d6" }, { "kind": "review_cause", "id": "gcp.service_account/account-name", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "gcp.service_account/role-bindings", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:a2f32f0b19e4dd60b79173e9fabcf5021c17aa2d1102ae21c5a9f31db479c9b6" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 2 critical settings of google_service_account.client: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/google_service_account.client/open-settings.", "required_evidence": [ "the members that act as or manage the service account" ], "items": [ { "id": "DEC-IAM-GCP-SERVICE-ACCOUNT-ACCOUNT-NAME", "kind": "account-name", "family": "gcp.service_account", "title": "Review the account name setting", "block": "account_id", "category": "identity-access", "why": "The knowledge base cannot decide \"account-name\" of the gcp.service_account contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_service_account.client|account-name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "This setting follows the decision on the unit: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact." }, { "id": "DEC-GEN-GCP-SERVICE-ACCOUNT-ROLE-BINDINGS", "kind": "role-bindings", "family": "gcp.service_account", "title": "Map the IAM roles of the service account to STACKIT roles", "block": "role-bindings", "why": "The knowledge base cannot decide \"role-bindings\" of the gcp.service_account contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_service_account.client|role-bindings" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "bind-a-role-on-the-service-account", "title": "Bind a role of the STACKIT service account to the member", "effect": "A role assignment on a STACKIT service account gives a role the authorization API lists for that account to a user, a service account or a client; given to a service account, it grants the Act-As permission, which lets that account impersonate the target account. A person re-maps each Google role on the account (using it, creating its keys, managing it) to a role of the STACKIT service account and binds it to the member. The assignment carries no condition and has no setting that removes the other holders of a role, so if the Google resource was authoritative (a binding for its role, a policy for the whole account) the replacing effect is not carried: a person lists who else holds a role on the account and removes what the source did not list. The resource is part of an experimental feature that is likely to change or be removed. The documents read do not state how a person, as opposed to a service account, acts as the account.", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_service_account_role_assignment.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "`resource_id` (String) Service-account Resource to assign the role to." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_service_account_role_assignment.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "`subject` (String) Identifier of user, service account or client." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_service_account_role_assignment.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "Use this resource to grant 'Act-As' permissions. This allows a service-account (the `subject`) to impersonate the target Service Account." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_folder_role_assignment.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "This resource is part of the experimental feature iam and is likely going to undergo significant changes or be removed in the future. Use it at your own discretion." } ] } ], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Outside the draft, for google_service_account.client: The grants that name the account become STACKIT role assignments where the role and members are readable and the grant has no condition, and the draft lists the others. A Google role is written as a STACKIT role only where the STACKIT role holds the same permissions or fewer; for every other role a person confirms the choice. A grant that lets another account act as this one, or that is authoritative, must be reviewed: list who else holds access on the target and remove what the source did not list." } ], "resolution": { "decision_id": "DEC-IAM-GOOGLE-SERVICE-ACCOUNT-CLIENT", "source_family": "gcp.service_account", "source_semantic": "unit-review", "affected_units": [ "google_service_account.client" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the account name setting; the 2 settings of the record state their own.", "source_observation": "The source states 2 critical settings on google_service_account.client that the knowledge base cannot decide: Review the account name setting; Map the IAM roles of the service account to STACKIT roles.", "generated_target_behavior": "Review the account name setting: The draft does not carry the setting on google_service_account.client; a manual step stands for it (MAN/semantic/google_service_account.client/open-settings). Map the IAM roles of the service account to STACKIT roles: The draft does not carry the setting on google_service_account.client; a manual step stands for it (MAN/semantic/google_service_account.client/open-settings). The draft writes the service account, and a STACKIT role assignment of the account for each grant on a project, a folder or an organisation whose role and members are visible statically and that has no condition; a grant that lets another account act as it is written as an Act-As assignment. A grant with a condition, a policy document, a repeated grant and a grant whose role or members are not visible statically are listed in the draft and not written.", "residual_difference": "Review the account name setting: the target behaviour of this setting is not established Map the IAM roles of the service account to STACKIT roles: Which STACKIT role gives a member the access the Google role gave on the service account, and that no member gets more.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_service_account.client/open-settings now.", "next_action": "Review the account name setting: This setting follows the decision on the unit: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.", "why_open": [ "Review the account name setting: A check of the knowledge base (sa account id not visible) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The account ID becomes the stackit_service_account name (shortened to the STACKIT name rules; pinned provider) — TRANSFORMED; the e-mail address changes. An ID not visible statically (or a repeated account) is named NOT CARRIED — REVIEW (check sa-account-id-not-visible).", "Map the IAM roles of the service account to STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The grants of the estate that name the account: a grant on a project, a folder or an organisation is written as a STACKIT role assignment of the account when its role and members are visible statically and it has no condition, and a grant that lets another account act as it is written as an Act-As assignment. A Google role is written as a STACKIT role only where the mapping shows the STACKIT role holds the same permissions or fewer on a project; every other role is an input that names the candidates, and a person confirms each. A binding or a policy is authoritative (it removes the members of its role that it does not list) and a role assignment only adds, which the draft says on each: members that hold the role outside the configuration keep it on STACKIT until a person removes them." ], "closes_when": [ "Review the account name setting: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.", "Map the IAM roles of the service account to STACKIT roles: The knowledge base's note on this setting states no closing condition; it is done when a person has chosen a way out above, recorded the choice, and the target is checked as the verification says.", "Map the IAM roles of the service account to STACKIT roles: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [ "the members that act as or manage the service account" ], "resolution_paths": [ { "id": "role-bindings/bind-a-role-on-the-service-account", "title": "Map the IAM roles of the service account to STACKIT roles: Bind a role of the STACKIT service account to the member", "prerequisites": [ "the Google roles granted on the service account and what each one allowed", "the roles the authorization API lists for the STACKIT service account" ], "effects": [ "A role assignment on a STACKIT service account gives a role the authorization API lists for that account to a user, a service account or a client; given to a service account, it grants the Act-As permission, which lets that account impersonate the target account. A person re-maps each Google role on the account (using it, creating its keys, managing it) to a role of the STACKIT service account and binds it to the member. The assignment carries no condition and has no setting that removes the other holders of a role, so if the Google resource was authoritative (a binding for its role, a policy for the whole account) the replacing effect is not carried: a person lists who else holds a role on the account and removes what the source did not list. The resource is part of an experimental feature that is likely to change or be removed. The documents read do not state how a person, as opposed to a service account, acts as the account." ], "risk": [ "A role chosen too wide lets a member act as the account more than the source allowed." ], "evidence": [ "provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_service_account_role_assignment.md: \"`resource_id` (String) Service-account Resource to assign the role to.\"", "provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_service_account_role_assignment.md: \"`subject` (String) Identifier of user, service account or client.\"", "provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_service_account_role_assignment.md: \"Use this resource to grant 'Act-As' permissions. This allows a service-account (the `subject`) to impersonate the target Service Account.\"", "provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_folder_role_assignment.md: \"This resource is part of the experimental feature iam and is likely going to undergo significant changes or be removed in the future. Use it at your own discretion.\"" ], "regeneration_required": false } ], "required_verification": [ "Map the IAM roles of the service account to STACKIT roles: each member can do what the source role allowed on the service account and nothing more, tried on the target" ], "next_run_changes": [ "A rerun writes no further role assignment on its own; an answer in the decisions file records the choice and writes nothing." ], "remains_manual": [ "Map the IAM roles of the service account to STACKIT roles: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note gcp.service_account/role-bindings: \"Role assignments need the experimental IAM feature of the pinned STACKIT provider.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/google_service_account.client/open-settings", "mode": "MANUAL", "phase": "SECURITY", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-IAM-GOOGLE-SERVICE-ACCOUNT-INIT", "kind": "unit-review", "family": "gcp.service_account", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.service_account", "block": "google_service_account.init", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_service_account.init", "artifact": "assessment.json", "pointer": "/units/15" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_service_account.init|account-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/20" }, { "kind": "semantic", "id": "google_service_account.init|role-bindings", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/conditional_open/21" } ], "conditional_members": 2, "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_service_account.init", "artifact": "workspace.json", "pointer": "/units/12/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:fbe36a66702026998a663181d81729b5b25573a82351a71f48bca28a9039d33d", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.service_account/account-name", "sha256": "sha256:569232e9e09039119b8dfad018fa960c15f935f9d96bcc643456a66798eb1e47" }, { "kind": "contract_semantic", "id": "gcp.service_account/role-bindings", "sha256": "sha256:bcbcb80532bd32b0de8ddfb9d26e579b82348f3355659819f5ce5d0790a5c96b" }, { "kind": "decision_kind", "id": "gcp.service_account/role-bindings", "sha256": "sha256:c78772004fe4de56c903ccaa85d645de2e148216c9c2d7a376ffa306bdc4d9d6" }, { "kind": "review_cause", "id": "gcp.service_account/account-name", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "gcp.service_account/role-bindings", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:a2f32f0b19e4dd60b79173e9fabcf5021c17aa2d1102ae21c5a9f31db479c9b6" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "OPTIONAL_CONDITIONAL", "why": "The knowledge base cannot decide 2 critical settings of google_service_account.init: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 2 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them. The review step of the execution plan for these settings is MAN/semantic/google_service_account.init/open-settings.", "required_evidence": [ "the members that act as or manage the service account" ], "items": [ { "id": "DEC-IAM-GCP-SERVICE-ACCOUNT-ACCOUNT-NAME", "kind": "account-name", "family": "gcp.service_account", "title": "Review the account name setting", "block": "account_id", "category": "identity-access", "why": "The knowledge base cannot decide \"account-name\" of the gcp.service_account contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "google_service_account.init|account-name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "This setting follows the decision on the unit: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact." }, { "id": "DEC-GEN-GCP-SERVICE-ACCOUNT-ROLE-BINDINGS", "kind": "role-bindings", "family": "gcp.service_account", "title": "Map the IAM roles of the service account to STACKIT roles", "block": "role-bindings", "why": "The knowledge base cannot decide \"role-bindings\" of the gcp.service_account contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "google_service_account.init|role-bindings" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "bind-a-role-on-the-service-account", "title": "Bind a role of the STACKIT service account to the member", "effect": "A role assignment on a STACKIT service account gives a role the authorization API lists for that account to a user, a service account or a client; given to a service account, it grants the Act-As permission, which lets that account impersonate the target account. A person re-maps each Google role on the account (using it, creating its keys, managing it) to a role of the STACKIT service account and binds it to the member. The assignment carries no condition and has no setting that removes the other holders of a role, so if the Google resource was authoritative (a binding for its role, a policy for the whole account) the replacing effect is not carried: a person lists who else holds a role on the account and removes what the source did not list. The resource is part of an experimental feature that is likely to change or be removed. The documents read do not state how a person, as opposed to a service account, acts as the account.", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_service_account_role_assignment.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "`resource_id` (String) Service-account Resource to assign the role to." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_service_account_role_assignment.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "`subject` (String) Identifier of user, service account or client." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_service_account_role_assignment.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "Use this resource to grant 'Act-As' permissions. This allows a service-account (the `subject`) to impersonate the target Service Account." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_folder_role_assignment.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "This resource is part of the experimental feature iam and is likely going to undergo significant changes or be removed in the future. Use it at your own discretion." } ] } ], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Outside the draft, for google_service_account.init: The grants that name the account become STACKIT role assignments where the role and members are readable and the grant has no condition, and the draft lists the others. A Google role is written as a STACKIT role only where the STACKIT role holds the same permissions or fewer; for every other role a person confirms the choice. A grant that lets another account act as this one, or that is authoritative, must be reviewed: list who else holds access on the target and remove what the source did not list." } ], "resolution": { "decision_id": "DEC-IAM-GOOGLE-SERVICE-ACCOUNT-INIT", "source_family": "gcp.service_account", "source_semantic": "unit-review", "affected_units": [ "google_service_account.init" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the account name setting; the 2 settings of the record state their own.", "source_observation": "The source states 2 critical settings on google_service_account.init that the knowledge base cannot decide: Review the account name setting; Map the IAM roles of the service account to STACKIT roles.", "generated_target_behavior": "Review the account name setting: The draft does not carry the setting on google_service_account.init; a manual step stands for it (MAN/semantic/google_service_account.init/open-settings). Map the IAM roles of the service account to STACKIT roles: The draft does not carry the setting on google_service_account.init; a manual step stands for it (MAN/semantic/google_service_account.init/open-settings). The draft writes the service account, and a STACKIT role assignment of the account for each grant on a project, a folder or an organisation whose role and members are visible statically and that has no condition; a grant that lets another account act as it is written as an Act-As assignment. A grant with a condition, a policy document, a repeated grant and a grant whose role or members are not visible statically are listed in the draft and not written.", "residual_difference": "Review the account name setting: the target behaviour of this setting is not established Map the IAM roles of the service account to STACKIT roles: Which STACKIT role gives a member the access the Google role gave on the service account, and that no member gets more.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_service_account.init/open-settings now.", "next_action": "Review the account name setting: This setting follows the decision on the unit: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.", "why_open": [ "Review the account name setting: A check of the knowledge base (sa account id not visible) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The account ID becomes the stackit_service_account name (shortened to the STACKIT name rules; pinned provider) — TRANSFORMED; the e-mail address changes. An ID not visible statically (or a repeated account) is named NOT CARRIED — REVIEW (check sa-account-id-not-visible).", "Map the IAM roles of the service account to STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The grants of the estate that name the account: a grant on a project, a folder or an organisation is written as a STACKIT role assignment of the account when its role and members are visible statically and it has no condition, and a grant that lets another account act as it is written as an Act-As assignment. A Google role is written as a STACKIT role only where the mapping shows the STACKIT role holds the same permissions or fewer on a project; every other role is an input that names the candidates, and a person confirms each. A binding or a policy is authoritative (it removes the members of its role that it does not list) and a role assignment only adds, which the draft says on each: members that hold the role outside the configuration keep it on STACKIT until a person removes them." ], "closes_when": [ "Review the account name setting: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.", "Map the IAM roles of the service account to STACKIT roles: The knowledge base's note on this setting states no closing condition; it is done when a person has chosen a way out above, recorded the choice, and the target is checked as the verification says.", "Map the IAM roles of the service account to STACKIT roles: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [ "the members that act as or manage the service account" ], "resolution_paths": [ { "id": "role-bindings/bind-a-role-on-the-service-account", "title": "Map the IAM roles of the service account to STACKIT roles: Bind a role of the STACKIT service account to the member", "prerequisites": [ "the Google roles granted on the service account and what each one allowed", "the roles the authorization API lists for the STACKIT service account" ], "effects": [ "A role assignment on a STACKIT service account gives a role the authorization API lists for that account to a user, a service account or a client; given to a service account, it grants the Act-As permission, which lets that account impersonate the target account. A person re-maps each Google role on the account (using it, creating its keys, managing it) to a role of the STACKIT service account and binds it to the member. The assignment carries no condition and has no setting that removes the other holders of a role, so if the Google resource was authoritative (a binding for its role, a policy for the whole account) the replacing effect is not carried: a person lists who else holds a role on the account and removes what the source did not list. The resource is part of an experimental feature that is likely to change or be removed. The documents read do not state how a person, as opposed to a service account, acts as the account." ], "risk": [ "A role chosen too wide lets a member act as the account more than the source allowed." ], "evidence": [ "provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_service_account_role_assignment.md: \"`resource_id` (String) Service-account Resource to assign the role to.\"", "provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_service_account_role_assignment.md: \"`subject` (String) Identifier of user, service account or client.\"", "provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_service_account_role_assignment.md: \"Use this resource to grant 'Act-As' permissions. This allows a service-account (the `subject`) to impersonate the target Service Account.\"", "provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_folder_role_assignment.md: \"This resource is part of the experimental feature iam and is likely going to undergo significant changes or be removed in the future. Use it at your own discretion.\"" ], "regeneration_required": false } ], "required_verification": [ "Map the IAM roles of the service account to STACKIT roles: each member can do what the source role allowed on the service account and nothing more, tried on the target" ], "next_run_changes": [ "A rerun writes no further role assignment on its own; an answer in the decisions file records the choice and writes nothing." ], "remains_manual": [ "Map the IAM roles of the service account to STACKIT roles: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note gcp.service_account/role-bindings: \"Role assignments need the experimental IAM feature of the pinned STACKIT provider.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/google_service_account.init/open-settings", "mode": "MANUAL", "phase": "SECURITY", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-IAM-GOOGLE-SERVICE-ACCOUNT-SERVER", "kind": "unit-review", "family": "gcp.service_account", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.service_account", "block": "google_service_account.server", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_service_account.server", "artifact": "assessment.json", "pointer": "/units/4" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_service_account.server|account-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/35" }, { "kind": "semantic", "id": "google_service_account.server|role-bindings", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/36" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:7036953ced621ef3845bebb3c9ebfeb20a65a2b923fb82cebde5066f39687853", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.service_account/account-name", "sha256": "sha256:569232e9e09039119b8dfad018fa960c15f935f9d96bcc643456a66798eb1e47" }, { "kind": "contract_semantic", "id": "gcp.service_account/role-bindings", "sha256": "sha256:bcbcb80532bd32b0de8ddfb9d26e579b82348f3355659819f5ce5d0790a5c96b" }, { "kind": "decision_kind", "id": "gcp.service_account/role-bindings", "sha256": "sha256:c78772004fe4de56c903ccaa85d645de2e148216c9c2d7a376ffa306bdc4d9d6" }, { "kind": "review_cause", "id": "gcp.service_account/account-name", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" }, { "kind": "review_cause", "id": "gcp.service_account/role-bindings", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:a2f32f0b19e4dd60b79173e9fabcf5021c17aa2d1102ae21c5a9f31db479c9b6" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 }, { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "shape": "RSH-be38e574aa6e", "subject": "google_service_account.server", "resolution": { "decision_id": "DEC-IAM-GOOGLE-SERVICE-ACCOUNT-SERVER", "source_family": "gcp.service_account", "source_semantic": "unit-review", "affected_units": [ "google_service_account.server" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "STATED" } }, { "id": "DEC-IAM-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES", "kind": "unit-review", "family": "gcp.sql_instance", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.sql_instance", "block": "google_sql_database_instance.postgres", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_sql_database_instance.postgres", "artifact": "assessment.json", "pointer": "/units/5" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_sql_database_instance.postgres|database-users", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/37" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_sql_database_instance.postgres", "artifact": "workspace.json", "pointer": "/units/14/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:0a35e53fc17ee2be1fc2c0e5230f1a06bc8fc2064d3432154f560454ac3d7bf1", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.sql_instance/database-users", "sha256": "sha256:a88ac7c2a91d32dc994bf2d90411cb69669191a27398438a95eea94b6203344e" }, { "kind": "review_cause", "id": "gcp.sql_instance/database-users", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:786401fe2bf3a93712af592b39f26370dffdc000473a1ca2590b6505bbb4e338" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of google_sql_database_instance.postgres: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-IAM-GCP-SQL-INSTANCE-DATABASE-USERS", "kind": "database-users", "family": "gcp.sql_instance", "title": "Review the database users setting", "block": "database-users", "category": "identity-access", "why": "The knowledge base cannot decide \"database-users\" of the gcp.sql_instance contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_sql_database_instance.postgres|database-users" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "This setting follows the decision on the unit: A literal value or a resolved reference in the source lets the check decide, or a person verifies the value." } ], "resolution": { "decision_id": "DEC-IAM-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES", "source_family": "gcp.sql_instance", "source_semantic": "unit-review", "affected_units": [ "google_sql_database_instance.postgres" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on google_sql_database_instance.postgres that the knowledge base cannot decide: Review the database users setting.", "generated_target_behavior": "Review the database users setting: The draft does not carry the setting on google_sql_database_instance.postgres; a manual step stands for it (MAN/semantic/google_sql_database_instance.postgres/database-users).", "residual_difference": "Review the database users setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_sql_database_instance.postgres/database-users now.", "next_action": "Review the database users setting: This setting follows the decision on the unit: A literal value or a resolved reference in the source lets the check decide, or a person verifies the value.", "why_open": [ "Review the database users setting: A check of the knowledge base (sql user not generated) needs a value the scan cannot read statically, so it could not decide. A built-in user of a PostgreSQL instance becomes a stackit_postgresflex_user with the same username (pinned provider) — TRANSFORMED. IAM users (and a name or type not visible statically) are not generated — REVIEW (check sql-user-not-generated); users of the other engines are named NOT CARRIED — REVIEW." ], "closes_when": [ "Review the database users setting: A literal value or a resolved reference in the source lets the check decide, or a person verifies the value." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/google_sql_database_instance.postgres/database-users", "mode": "MANUAL", "phase": "DATA", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-NET-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES", "kind": "unit-review", "family": "gcp.sql_instance", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.sql_instance", "block": "google_sql_database_instance.postgres", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_sql_database_instance.postgres", "artifact": "assessment.json", "pointer": "/units/5" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_sql_database_instance.postgres|user-and-database-settings", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/42" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_sql_database_instance.postgres", "artifact": "workspace.json", "pointer": "/units/14/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:ccd4c92d365d49d5bb933ef5ad8b7cc3397c53a84b5773808f2bac8cf9beb0a5", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.sql_instance/user-and-database-settings", "sha256": "sha256:a0ed90d71acd15a1bc799251165b0eb25a7ef4d9a709979668cf243478084ebb" }, { "kind": "review_cause", "id": "gcp.sql_instance/user-and-database-settings", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:05ec37deefc9709dd4094cc43443e5ea4161bb0fb883d0c31b14f7eab9c97734" }, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of google_sql_database_instance.postgres: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-NET-GCP-SQL-INSTANCE-USER-AND-DATABASE-SETTINGS", "kind": "user-and-database-settings", "family": "gcp.sql_instance", "title": "Review the user and database settings setting", "block": "user-and-database-settings", "category": "network-exposure", "why": "The knowledge base cannot decide \"user-and-database-settings\" of the gcp.sql_instance contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_sql_database_instance.postgres|user-and-database-settings" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "derived-carry-on-the-target-25abe723033e", "title": "Carry the setting on STACKIT PostgreSQL Flex", "effect": "You design how STACKIT PostgreSQL Flex carries this setting and build it outside the draft. The draft does not change and no step is freed by it.", "evidence": [], "derived_from": "RULE_CASE" }, { "id": "derived-accept-the-difference-25abe723033e", "title": "Accept the difference", "effect": "The target does not carry this setting as the source states it, and you record that as accepted. The draft does not change and no step is freed by it.", "evidence": [], "derived_from": "RULE_CASE" } ], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the user and database settings setting for google_sql_database_instance.postgres: Decide how STACKIT PostgreSQL Flex carries this setting, or accept the difference. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-NET-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES", "source_family": "gcp.sql_instance", "source_semantic": "unit-review", "affected_units": [ "google_sql_database_instance.postgres" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Network Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on google_sql_database_instance.postgres that the knowledge base cannot decide: Review the user and database settings setting.", "generated_target_behavior": "Review the user and database settings setting: The draft does not carry the setting on google_sql_database_instance.postgres; a manual step stands for it (MAN/semantic/google_sql_database_instance.postgres/user-and-database-settings).", "residual_difference": "Review the user and database settings setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_sql_database_instance.postgres/user-and-database-settings now.", "next_action": "Review the user and database settings setting: Review the user and database settings setting for google_sql_database_instance.postgres: Decide how STACKIT PostgreSQL Flex carries this setting, or accept the difference. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the user and database settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The source password is not copied (STACKIT generates it: stackit_postgresflex_user.password is computed), a host restriction and ABANDON deletion policies have no counterpart (pinned provider) — the draft names them NOT CARRIED — REVIEW." ], "closes_when": [ "Review the user and database settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [ { "id": "user-and-database-settings/derived-carry-on-the-target-25abe723033e", "title": "Review the user and database settings setting: Carry the setting on STACKIT PostgreSQL Flex", "prerequisites": [], "effects": [ "You design how STACKIT PostgreSQL Flex carries this setting and build it outside the draft. The draft does not change and no step is freed by it." ], "risk": [], "evidence": [], "regeneration_required": false }, { "id": "user-and-database-settings/derived-accept-the-difference-25abe723033e", "title": "Review the user and database settings setting: Accept the difference", "prerequisites": [], "effects": [ "The target does not carry this setting as the source states it, and you record that as accepted. The draft does not change and no step is freed by it." ], "risk": [], "evidence": [], "regeneration_required": false } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/google_sql_database_instance.postgres/user-and-database-settings", "mode": "MANUAL", "phase": "DATA", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-OPS-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES", "kind": "unit-review", "family": "gcp.sql_instance", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.sql_instance", "block": "google_sql_database_instance.postgres", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_sql_database_instance.postgres", "artifact": "assessment.json", "pointer": "/units/5" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_sql_database_instance.postgres|tc-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/40" }, { "kind": "semantic", "id": "google_sql_database_instance.postgres|tcf-sql-database--name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/41" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_sql_database_instance.postgres", "artifact": "workspace.json", "pointer": "/units/14/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:b13cd08f1d5978440b0dece1471faff3802205881397bcf65829f41bc7f89a47", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.sql_instance/tc-name", "sha256": "sha256:cd1d6d793a7d7e91c3b80bf2a3728437ca42ba6ac2425eea0402097d9d511472" }, { "kind": "contract_semantic", "id": "gcp.sql_instance/tcf-sql-database--name", "sha256": "sha256:c2ca2b0810e1604a5190553b344492e8f255dcf5d05d7e6b8cc92487ba55d161" }, { "kind": "review_cause", "id": "gcp.sql_instance/tc-name", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" }, { "kind": "review_cause", "id": "gcp.sql_instance/tcf-sql-database--name", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:78bf9d5ee89c911cfef7286217a3cc65b58d8c90bd4528ac2ff20b4162d37bc7" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 2 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 2 critical settings of google_sql_database_instance.postgres: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/google_sql_database_instance.postgres/open-settings-platform-architect.", "required_evidence": [], "items": [ { "id": "DEC-OPS-GCP-SQL-INSTANCE-TC-NAME", "kind": "tc-name", "family": "gcp.sql_instance", "title": "Confirm the name of the resource on the target", "block": "name", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tc-name\" of the gcp.sql_instance contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_sql_database_instance.postgres|tc-name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the name of the resource on the target for google_sql_database_instance.postgres: A person confirms the instance name the STACKIT database carries against what refers to the source instance name, or accepts the new name. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-OPS-GCP-SQL-INSTANCE-TCF-SQL-DATABASE-NAME", "kind": "tcf-sql-database--name", "family": "gcp.sql_instance", "title": "Confirm the name of the SQL database", "block": "tcf-sql-database--name", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tcf-sql-database--name\" of the gcp.sql_instance contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_sql_database_instance.postgres|tcf-sql-database--name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the name of the SQL database for google_sql_database_instance.postgres: Create the database under the same name on the target, because the application connects to it by that name. PostgreSQL Flex and SQL Server Flex have a database resource; on MariaDB create the database with SQL once the instance exists. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-OPS-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES", "source_family": "gcp.sql_instance", "source_semantic": "unit-review", "affected_units": [ "google_sql_database_instance.postgres" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm the name of the resource on the target; the 2 settings of the record state their own.", "source_observation": "The source states 2 critical settings on google_sql_database_instance.postgres that the knowledge base cannot decide: Confirm the name of the resource on the target; Confirm the name of the SQL database.", "generated_target_behavior": "Confirm the name of the resource on the target: The draft does not carry the setting on google_sql_database_instance.postgres; a manual step stands for it (MAN/semantic/google_sql_database_instance.postgres/open-settings-platform-architect). Confirm the name of the SQL database: The draft does not carry the setting on google_sql_database_instance.postgres; a manual step stands for it (MAN/semantic/google_sql_database_instance.postgres/open-settings-platform-architect).", "residual_difference": "Confirm the name of the resource on the target: the target behaviour of this setting is not established Confirm the name of the SQL database: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_sql_database_instance.postgres/open-settings-platform-architect now.", "next_action": "Confirm the name of the resource on the target: Confirm the name of the resource on the target for google_sql_database_instance.postgres: A person confirms the instance name the STACKIT database carries against what refers to the source instance name, or accepts the new name. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Confirm the name of the resource on the target: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_sql_database_instance.name: The instance's name/label; does not itself grant access, encrypt data, or control backups/availability/residency.", "Confirm the name of the SQL database: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_sql_database.name (a facet of the unit): The literal database name; determines the connection target's label but does not itself grant or restrict access, encrypt data, or affect backups/availability/residency." ], "closes_when": [ "Confirm the name of the resource on the target: A person confirms the instance name the STACKIT database carries against what refers to the source instance name, or accepts the new name.", "Confirm the name of the SQL database: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/google_sql_database_instance.postgres/open-settings-platform-architect", "mode": "MANUAL", "phase": "DATA", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-DATA-GOOGLE-STORAGE-BUCKET-MEDIA", "kind": "unit-review", "family": "gcp.storage_bucket", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.storage_bucket", "block": "google_storage_bucket.media", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Storage Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_storage_bucket.media", "artifact": "assessment.json", "pointer": "/units/7" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_storage_bucket.media|force-destroy", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/44" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_storage_bucket.media", "artifact": "workspace.json", "pointer": "/units/15/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:cee2afe3415694523ba90f77fa2e9a367eed61a79003c85f938f4e026e843f95", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.storage_bucket/force-destroy", "sha256": "sha256:7f863dad4a18608159e5289d293fa41804ac402b367d90408a96090c534ffa2e" }, { "kind": "review_cause", "id": "gcp.storage_bucket/force-destroy", "sha256": "sha256:0b9c9fcd9b327c017f0b536af6f41c3a1b9895a07365cac36bb5d391429ae66b" } ], "kb_dependencies_sha256": "sha256:ff6ca5d3176c5f7bc2f6bb8c2946b4c21f8220ca742aa0d2a5362aa5669dd82b" }, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of google_storage_bucket.media: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-DATA-GCP-STORAGE-BUCKET-FORCE-DESTROY", "kind": "force-destroy", "family": "gcp.storage_bucket", "title": "Confirm whether the bucket may be deleted with its contents", "block": "force_destroy", "category": "deletion-protection", "why": "The knowledge base cannot decide \"force-destroy\" of the gcp.storage_bucket contract for 1 unit (UNSUPPORTED): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_storage_bucket.media|force-destroy" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "derived-accept-the-loss-5d7d37005886", "title": "Accept the loss", "effect": "Nothing on the target carries this setting, and you record that as accepted. The draft does not change and no step is freed by it.", "evidence": [], "derived_from": "RULE_CASE" }, { "id": "derived-rebuild-by-hand-5d7d37005886", "title": "Rebuild it by hand", "effect": "Find which applications use the Google client libraries or signed URLs — those need a code change. The draft does not change and no step is freed by it.", "evidence": [], "derived_from": "RULE_CASE" } ], "recommended_option": null, "causes": [ { "cause": "TARGET_LIMIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm whether the bucket may be deleted with its contents for google_storage_bucket.media: force_destroy lets Terraform delete the bucket together with its objects. STACKIT has no such override: stackit_objectstorage_bucket (the pinned STACKIT provider) \"cannot be destroyed if the bucket contains objects\" — empty the bucket (or migrate its objects) before destroying it. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-DATA-GOOGLE-STORAGE-BUCKET-MEDIA", "source_family": "gcp.storage_bucket", "source_semantic": "unit-review", "affected_units": [ "google_storage_bucket.media" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Storage Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "UNSUPPORTED", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "the execution plan refuses REF/semantic/google_storage_bucket.media/force-destroy because the target has no counterpart for the setting: a person accepts the difference or redesigns, and the step stays refused", "source_observation": "The source states 1 critical setting on google_storage_bucket.media that the knowledge base cannot decide: Confirm whether the bucket may be deleted with its contents.", "generated_target_behavior": "Confirm whether the bucket may be deleted with its contents: The draft does not carry the setting on google_storage_bucket.media. The plan refuses REF/semantic/google_storage_bucket.media/force-destroy.", "residual_difference": "Confirm whether the bucket may be deleted with its contents: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. Held by something else first: REF/semantic/google_storage_bucket.media/force-destroy.", "next_action": "Confirm whether the bucket may be deleted with its contents: Confirm whether the bucket may be deleted with its contents for google_storage_bucket.media: force_destroy lets Terraform delete the bucket together with its objects. STACKIT has no such override: stackit_objectstorage_bucket (the pinned STACKIT provider) \"cannot be destroyed if the bucket contains objects\" — empty the bucket (or migrate its objects) before destroying it. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Confirm whether the bucket may be deleted with its contents: A check of the knowledge base (gcs force destroy) found a setting the target has no counterpart for (a finding of this unit describes it). stackit_objectstorage_bucket (pinned provider) \"cannot be destroyed if the bucket contains objects\" (schema description): force_destroy = false — a destroy that stops at a non-empty bucket — is what STACKIT does, PRESERVED; true has no counterpart, UNSUPPORTED (check gcs-force-destroy)." ], "closes_when": [ "Confirm whether the bucket may be deleted with its contents: A person accepts the difference or the design changes: nothing in the source can make the target carry it." ], "required_inputs": [], "resolution_paths": [ { "id": "force-destroy/derived-accept-the-loss-5d7d37005886", "title": "Confirm whether the bucket may be deleted with its contents: Accept the loss", "prerequisites": [], "effects": [ "Nothing on the target carries this setting, and you record that as accepted. The draft does not change and no step is freed by it." ], "risk": [], "evidence": [], "regeneration_required": false }, { "id": "force-destroy/derived-rebuild-by-hand-5d7d37005886", "title": "Confirm whether the bucket may be deleted with its contents: Rebuild it by hand", "prerequisites": [], "effects": [ "Find which applications use the Google client libraries or signed URLs — those need a code change. The draft does not change and no step is freed by it." ], "risk": [], "evidence": [], "regeneration_required": false } ], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "REF/semantic/google_storage_bucket.media/force-destroy", "mode": "REFUSE", "phase": "DATA", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-GEN-GOOGLE-STORAGE-BUCKET-MEDIA", "kind": "unit-review", "family": "gcp.storage_bucket", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.storage_bucket", "block": "google_storage_bucket.media", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "NOT_STATED", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_storage_bucket.media", "artifact": "assessment.json", "pointer": "/units/7" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_storage_bucket.media|iam-access", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/46" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_storage_bucket.media", "artifact": "workspace.json", "pointer": "/units/15/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:4c80dda543fb5e78f94213c2419ad6da54bf1b98a1df79c0ac2a8e5fe8555ac4", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.storage_bucket/iam-access", "sha256": "sha256:11d61d119b517b0f2a0b819f2851071fb3c9824cb1ddc0041fd18ed6b8ee60a9" }, { "kind": "review_cause", "id": "gcp.storage_bucket/iam-access", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" } ], "kb_dependencies_sha256": "sha256:b7eeaba8b9c0d94e36ddc3359a7d737791e673d022999d650c4d0d686a4ff250" }, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of google_storage_bucket.media: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-GEN-GCP-STORAGE-BUCKET-IAM-ACCESS", "kind": "iam-access", "family": "gcp.storage_bucket", "title": "Review the IAM access setting", "block": "iam-access", "why": "The knowledge base cannot decide \"iam-access\" of the gcp.storage_bucket contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_storage_bucket.media|iam-access" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the IAM access setting for google_storage_bucket.media: A person creates the bucket policies and Object Storage credentials that give the same access on STACKIT. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-GEN-GOOGLE-STORAGE-BUCKET-MEDIA", "source_family": "gcp.storage_bucket", "source_semantic": "unit-review", "affected_units": [ "google_storage_bucket.media" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "NOT_STATED", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on google_storage_bucket.media that the knowledge base cannot decide: Review the IAM access setting.", "generated_target_behavior": "Review the IAM access setting: The draft does not carry the setting on google_storage_bucket.media; a manual step stands for it (MAN/semantic/google_storage_bucket.media/iam-access).", "residual_difference": "Review the IAM access setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_storage_bucket.media/iam-access now.", "next_action": "Review the IAM access setting: Review the IAM access setting for google_storage_bucket.media: A person creates the bucket policies and Object Storage credentials that give the same access on STACKIT. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the IAM access setting: A check of the knowledge base (gcs iam) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states who may access the bucket, granted with IAM bindings or ACL entries." ], "closes_when": [ "Review the IAM access setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person creates the bucket policies and Object Storage credentials that give the same access on STACKIT." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/google_storage_bucket.media/iam-access", "mode": "MANUAL", "phase": "DATA", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-IAM-GOOGLE-STORAGE-BUCKET-MEDIA", "kind": "unit-review", "family": "gcp.storage_bucket", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.storage_bucket", "block": "google_storage_bucket.media", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_storage_bucket.media", "artifact": "assessment.json", "pointer": "/units/7" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_storage_bucket.media|iam-grant", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/47" }, { "kind": "semantic", "id": "google_storage_bucket.media|public-access", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/48" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_storage_bucket.media", "artifact": "workspace.json", "pointer": "/units/15/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:82968eacb6f72cd72fd95b5501daf787d5707e72dd3c66366c44080dc700a319", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.storage_bucket/iam-grant", "sha256": "sha256:d0f4338f5c6f0db109b8e0c73a37279d87ee6e6edcd2eb728bd9dcc94d164c71" }, { "kind": "contract_semantic", "id": "gcp.storage_bucket/public-access", "sha256": "sha256:b6d76a0db263d926f3f3fccf611bd93775d0ac80bbd4a62aee608e6faf630845" }, { "kind": "review_cause", "id": "gcp.storage_bucket/iam-grant", "sha256": "sha256:fdb4f34a04e778b8896f6bf23959429f3ce8f171f5aac2dffb2fbadf0af12acd" }, { "kind": "review_cause", "id": "gcp.storage_bucket/public-access", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:501308cb054c71c8e9dff6e445f4fa5dc02da316cf0e5a6cfaf3261af9ec4576" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 }, { "cause": "NOT_CLASSIFIED", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 2 critical settings of google_storage_bucket.media: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/google_storage_bucket.media/open-settings-identity-architect.", "required_evidence": [], "items": [ { "id": "DEC-IAM-GCP-STORAGE-BUCKET-IAM-GRANT", "kind": "iam-grant", "family": "gcp.storage_bucket", "title": "Review the IAM grant setting", "block": "iam-grant", "category": "identity-access", "why": "The knowledge base cannot decide \"iam-grant\" of the gcp.storage_bucket contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_storage_bucket.media|iam-grant" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Review the IAM grant setting for google_storage_bucket.media: A person decides what this finding asks, and records the evidence or the decision. The finding says: Bucket access is granted with IAM bindings or ACL entries; on STACKIT it becomes bucket policies and Object Storage credentials. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-IAM-GCP-STORAGE-BUCKET-PUBLIC-ACCESS", "kind": "public-access", "family": "gcp.storage_bucket", "title": "Review the public access setting", "block": "public-access", "category": "identity-access", "why": "The knowledge base cannot decide \"public-access\" of the gcp.storage_bucket contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_storage_bucket.media|public-access" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "This setting follows the decision on the unit: A literal value or a resolved reference in the source lets the check decide, or a person verifies the value." } ], "resolution": { "decision_id": "DEC-IAM-GOOGLE-STORAGE-BUCKET-MEDIA", "source_family": "gcp.storage_bucket", "source_semantic": "unit-review", "affected_units": [ "google_storage_bucket.media" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the IAM grant setting; the 2 settings of the record state their own.", "source_observation": "The source states 2 critical settings on google_storage_bucket.media that the knowledge base cannot decide: Review the IAM grant setting; Review the public access setting.", "generated_target_behavior": "Review the IAM grant setting: The draft does not carry the setting on google_storage_bucket.media; a manual step stands for it (MAN/semantic/google_storage_bucket.media/open-settings-identity-architect). Review the public access setting: The draft does not carry the setting on google_storage_bucket.media; a manual step stands for it (MAN/semantic/google_storage_bucket.media/open-settings-identity-architect).", "residual_difference": "Review the IAM grant setting: the target behaviour of this setting is not established Review the public access setting: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_storage_bucket.media/open-settings-identity-architect now.", "next_action": "Review the IAM grant setting: Review the IAM grant setting for google_storage_bucket.media: A person decides what this finding asks, and records the evidence or the decision. The finding says: Bucket access is granted with IAM bindings or ACL entries; on STACKIT it becomes bucket policies and Object Storage credentials. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Review the IAM grant setting: A check of the knowledge base (gcs iam) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The value-level reader of who gets which role (`iam-access` above is the facet as a whole): role, member(s) and condition. A GCP principal (user:, group:, serviceAccount:, allUsers) and a predefined role have no STACKIT counterpart in a bucket policy, whose statements name principals and S3 actions (supported-permissions-in-bucket-policies docs; the draft writes no policy) — a person translates each grant — REVIEW for every value, allUsers included (that one is also public-access, TRANSFORMED).", "Review the public access setting: A check of the knowledge base (gcs public) needs a value the scan cannot read statically, so it could not decide. The counterpart is a bucket policy with Principal \"*\" and s3:GetObject (documented sample), but stackit_objectstorage_bucket has no policy attribute and the provider no bucket-policy resource, so the draft writes none: REVIEW, as for the IP rules." ], "closes_when": [ "Review the IAM grant setting: A person decides what this finding asks, and records the evidence or the decision. The finding says: Bucket access is granted with IAM bindings or ACL entries; on STACKIT it becomes bucket policies and Object Storage credentials.", "Review the public access setting: A literal value or a resolved reference in the source lets the check decide, or a person verifies the value." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/google_storage_bucket.media/open-settings-identity-architect", "mode": "MANUAL", "phase": "DATA", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-OPS-GOOGLE-STORAGE-BUCKET-MEDIA", "kind": "unit-review", "family": "gcp.storage_bucket", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.storage_bucket", "block": "google_storage_bucket.media", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_storage_bucket.media", "artifact": "assessment.json", "pointer": "/units/7" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_storage_bucket.media|tc-storage-bucket-name", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/49" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_storage_bucket.media", "artifact": "workspace.json", "pointer": "/units/15/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:ce1bb38d4159e6f1cc5ae1511fe2069c51d893d88b71471ec81e111114565ccd", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.storage_bucket/tc-storage-bucket-name", "sha256": "sha256:d566f1b0a2d4a3bda97f71a210a1662c7426225b32cbbd547513555c243f5f53" }, { "kind": "review_cause", "id": "gcp.storage_bucket/tc-storage-bucket-name", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:2e055e5ac4d1a1ac28d8e2cf788d5ee9377a16e102dec0ccf86614ea88b70e93" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of google_storage_bucket.media: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-OPS-GCP-STORAGE-BUCKET-TC-STORAGE-BUCKET-NAME", "kind": "tc-storage-bucket-name", "family": "gcp.storage_bucket", "title": "Confirm the name of the Cloud Storage bucket", "block": "name", "category": "workload-compatibility", "why": "The knowledge base cannot decide \"tc-storage-bucket-name\" of the gcp.storage_bucket contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_storage_bucket.media|tc-storage-bucket-name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the name of the Cloud Storage bucket for google_storage_bucket.media: A person confirms the Object Storage bucket name against the applications and tools that use the source bucket name, or accepts the new name. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-OPS-GOOGLE-STORAGE-BUCKET-MEDIA", "source_family": "gcp.storage_bucket", "source_semantic": "unit-review", "affected_units": [ "google_storage_bucket.media" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Platform Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on google_storage_bucket.media that the knowledge base cannot decide: Confirm the name of the Cloud Storage bucket.", "generated_target_behavior": "Confirm the name of the Cloud Storage bucket: The draft does not carry the setting on google_storage_bucket.media; a manual step stands for it (MAN/semantic/google_storage_bucket.media/tc-storage-bucket-name).", "residual_difference": "Confirm the name of the Cloud Storage bucket: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_storage_bucket.media/tc-storage-bucket-name now.", "next_action": "Confirm the name of the Cloud Storage bucket: Confirm the name of the Cloud Storage bucket for google_storage_bucket.media: A person confirms the Object Storage bucket name against the applications and tools that use the source bucket name, or accepts the new name. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Confirm the name of the Cloud Storage bucket: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The name of the Cloud Storage bucket, in lowercase and at most 63 characters per the provider documentation, by which applications address it." ], "closes_when": [ "Confirm the name of the Cloud Storage bucket: A person confirms the Object Storage bucket name against the applications and tools that use the source bucket name, or accepts the new name." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/google_storage_bucket.media/tc-storage-bucket-name", "mode": "MANUAL", "phase": "DATA", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-SEC-GOOGLE-STORAGE-BUCKET-MEDIA", "kind": "unit-review", "family": "gcp.storage_bucket", "source": "CRITICAL_SEMANTIC", "group": "GRP-CRITICAL-SEMANTIC-gcp.storage_bucket", "block": "google_storage_bucket.media", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "affected_units": [ { "kind": "unit", "id": "google_storage_bucket.media", "artifact": "assessment.json", "pointer": "/units/7" } ], "affected_applications": [], "members": [ { "kind": "semantic", "id": "google_storage_bucket.media|geo-replication", "artifact": "assurance/critical-semantics.json", "pointer": "/critical_semantic_resolution/open/45" } ], "options": [], "recommended_option": null, "blocking_effect": "CRITICAL_SEMANTIC_OPEN", "evidence_refs": [ { "kind": "evidence", "id": "google_storage_bucket.media", "artifact": "workspace.json", "pointer": "/units/15/trace" } ], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:218dbf4d063d925c3ec13dcee5b71559568345f3441e250c6353827928621501", "kb_dependencies": [ { "kind": "contract_semantic", "id": "gcp.storage_bucket/geo-replication", "sha256": "sha256:6915538b86392cd954ee4a16fb009f3f3f2f0c88068a9c0dda7e5d91d8996da0" }, { "kind": "review_cause", "id": "gcp.storage_bucket/geo-replication", "sha256": "sha256:3c72d00bce7f1023ebc081862cf4fc04881091121ca8f44a037a091e53fb0aa4" } ], "kb_dependencies_sha256": "sha256:23b6a8ae451f9999dffe60eb24069fa7f6a0d1e9462633f32326666d793fe4f4" }, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The knowledge base cannot decide 1 critical setting of google_storage_bucket.media: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-CMP-GCP-STORAGE-BUCKET-GEO-REPLICATION", "kind": "geo-replication", "family": "gcp.storage_bucket", "title": "Decide the geo-replication", "block": "custom_placement_config", "category": "residency-compliance", "why": "The knowledge base cannot decide \"geo-replication\" of the gcp.storage_bucket contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "google_storage_bucket.media|geo-replication" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Decide the geo-replication for google_storage_bucket.media: The value is set where the module is called (a literal), the variable is given its value in a variable file of the scan (--var-file), or a person confirms the value production uses. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "decision_id": "DEC-SEC-GOOGLE-STORAGE-BUCKET-MEDIA", "source_family": "gcp.storage_bucket", "source_semantic": "unit-review", "affected_units": [ "google_storage_bucket.media" ], "affected_application": [], "action_type": "NOT_STATED", "work_package": "NOT_STATED", "owner_role": "Security Architect", "required_by_phase": "NOT_STATED", "raw_semantic_status": "REVIEW", "review_status": "OPEN", "customer_action_status": "OPEN_INPUT", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on google_storage_bucket.media that the knowledge base cannot decide: Decide the geo-replication.", "generated_target_behavior": "Decide the geo-replication: The draft does not carry the setting on google_storage_bucket.media; a manual step stands for it (MAN/semantic/google_storage_bucket.media/geo-replication).", "residual_difference": "Decide the geo-replication: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/google_storage_bucket.media/geo-replication now.", "next_action": "Decide the geo-replication: Decide the geo-replication for google_storage_bucket.media: The value is set where the module is called (a literal), the variable is given its value in a variable file of the scan (--var-file), or a person confirms the value production uses. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Decide the geo-replication: The value is read from a variable's default; that is not a fact of the source. A custom_placement_config not visible statically (a dynamic block over an unknown for_each, a whole value from a variable) may be absent: the facts state no replication, the ledger writes no line and a person decides (REVIEW by the case; 2026-09-25 unknown-value audit — it used to be claimed as replicated)." ], "closes_when": [ "Decide the geo-replication: The value is set where the module is called (a literal), the variable is given its value in a variable file of the scan (--var-file), or a person confirms the value production uses." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/google_storage_bucket.media/geo-replication", "mode": "MANUAL", "phase": "DATA", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW", "kind": "MANUAL_REVIEW", "family": "stackitsa", "source": "PLAN_STATEMENT", "group": "GRP-PLAN-STATEMENT-stackitsa", "block": "MANUAL_REVIEW", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "google_cloud_run_v2_job.migrate", "artifact": "assessment.json", "pointer": "/units/9" }, { "kind": "unit", "id": "google_cloud_run_v2_service.server", "artifact": "assessment.json", "pointer": "/units/10" } ], "affected_applications": [], "members": [ { "kind": "plan_statement", "id": "stackitsa:statement:google_cloud_run_v2_job.migrate", "artifact": "workspace.json", "pointer": "/units/0/plan_statements/0" }, { "kind": "plan_statement", "id": "stackitsa:statement:google_cloud_run_v2_service.server", "artifact": "workspace.json", "pointer": "/units/1/plan_statements/0" } ], "options": [], "recommended_option": null, "blocking_effect": "PLAN_STATEMENT_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:0d87407edba569bfdd79c86e92e517831a240259de9e18c935cbb2e383da0a46", "kb_dependencies": [ { "kind": "review_cause", "id": "stackitsa/MANUAL_REVIEW", "sha256": "sha256:0e6bd24a80d10577af6d6a940eb6670b5ecb91ded7e3f5f98460ad1ab58a5ed6" } ], "kb_dependencies_sha256": "sha256:83a8f6eef89167b4a870555fd2ffcf930e8e1486e7893eb941efdfcf7f52cb49" }, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 2 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The stackitsa plan of the draft writes no resource for 2 units and states why (the plan states the cause for each unit: google_cloud_run_v2_job.migrate: google_cloud_run_v2_job.migrate is a container task: its 1 identity binding(s) are facts only, and no service account is attached for it (no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account); google_cloud_run_v2_service.server: google_cloud_run_v2_service.server is a container service: its 1 identity binding(s) are facts only, and no service account is attached for it (no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account)): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.", "required_evidence": [], "resolution": { "decision_id": "DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW", "source_family": "stackitsa", "source_semantic": "MANUAL_REVIEW", "affected_units": [ "google_cloud_run_v2_job.migrate", "google_cloud_run_v2_service.server" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "PLAN_STATEMENT_OPEN", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "the plan writes no resource for the unit and names the work a person does instead", "source_observation": "The plan writes no resource for google_cloud_run_v2_job.migrate: google_cloud_run_v2_job.migrate is a container task: its 1 identity binding(s) are facts only, and no service account is attached for it (no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account). The plan writes no resource for google_cloud_run_v2_service.server: google_cloud_run_v2_service.server is a container service: its 1 identity binding(s) are facts only, and no service account is attached for it (no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account).", "generated_target_behavior": "The draft writes no resource for google_cloud_run_v2_job.migrate and google_cloud_run_v2_service.server.", "residual_difference": "the work outside the draft is neither done nor verified by StackToIT", "execution_effect": "No step waits for it. The plan can start MAN/identity/facts:google_cloud_run_v2_job.migrate:google_cloud_run_v2_job.migrate.template.0.template.0.service_account-8dc3e1 and MAN/identity/facts:google_cloud_run_v2_service.server:google_cloud_run_v2_service.server.template.0.service_account-5ccce9 now.", "next_action": "Outside the draft, for google_cloud_run_v2_job.migrate and google_cloud_run_v2_service.server: Decide how google_cloud_run_v2_job.migrate gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it (and 1 more manual steps); the plan lists it as manual work.", "why_open": [ "The stackitsa plan of the draft writes no resource for 2 units and states why (the plan states the cause for each unit: google_cloud_run_v2_job.migrate: google_cloud_run_v2_job.migrate is a container task: its 1 identity binding(s) are facts only, and no service account is attached for it (no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account); google_cloud_run_v2_service.server: google_cloud_run_v2_service.server is a container service: its 1 identity binding(s) are facts only, and no service account is attached for it (no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account)): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan." ], "closes_when": [ "the identity fact of google_cloud_run_v2_job.migrate (template[0].template[0].service_account of google_cloud_run_v2_job.migrate names google_service_account.automation) is decided on STACKIT and recorded, or recorded as not needed", "the identity fact of google_cloud_run_v2_service.server (template[0].service_account of google_cloud_run_v2_service.server names google_service_account.server) is decided on STACKIT and recorded, or recorded as not needed" ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/identity/facts:google_cloud_run_v2_job.migrate:google_cloud_run_v2_job.migrate.template.0.template.0.service_account-8dc3e1", "mode": "MANUAL", "phase": "PREPARE", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false }, { "id": "MAN/identity/facts:google_cloud_run_v2_service.server:google_cloud_run_v2_service.server.template.0.service_account-5ccce9", "mode": "MANUAL", "phase": "PREPARE", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "DEC-IAM-STACKITSA-STATEMENT-NOT-DRAFTED", "kind": "NOT_DRAFTED", "family": "stackitsa", "source": "PLAN_STATEMENT", "group": "GRP-PLAN-STATEMENT-stackitsa", "block": "NOT_DRAFTED", "scope": { "kind": "estate", "id": "estate", "artifact": "workspace.json", "pointer": "/estate" }, "status": "OPEN", "review_state": "UNREVIEWED", "design_state": "OPEN", "validation_state": "NOT_VALIDATED", "owner_role": "Identity Architect", "required_by_phase": "BEFORE_PILOT", "affected_units": [ { "kind": "unit", "id": "google_service_account.automation", "artifact": "assessment.json", "pointer": "/units/2" }, { "kind": "unit", "id": "google_service_account.server", "artifact": "assessment.json", "pointer": "/units/4" } ], "affected_applications": [], "members": [ { "kind": "plan_statement", "id": "stackitsa:statement:google_service_account.automation", "artifact": "workspace.json", "pointer": "/units/10/plan_statements/0" }, { "kind": "plan_statement", "id": "stackitsa:statement:google_service_account.server", "artifact": "workspace.json", "pointer": "/units/13/plan_statements/0" } ], "options": [], "recommended_option": null, "blocking_effect": "PLAN_STATEMENT_OPEN", "evidence_refs": [], "review_binding": { "source_digest": "sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000", "kb_version": "0.394.0", "kb_sha256": "480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0", "members_sha256": "sha256:e85552354c4f233c6960ca13d2ae813bf9758092a5a48d836f0839a1cb81ab87", "kb_dependencies": [ { "kind": "review_cause", "id": "stackitsa/NOT_DRAFTED", "sha256": "sha256:2399a480e3f67ee3f5ce7f6c23ae56bd664df91cf2127943cbff59e78f989e5e" } ], "kb_dependencies_sha256": "sha256:fe3be1b899466063f75cf0424168230d97d3a1492d8dd1b68db6325ffa70ccdf" }, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 2 } ], "blocker_class": "GENUINELY_UNACCOUNTED", "why": "The stackitsa plan of the draft writes no resource for 2 units and states why (no resource is written for the unit and the plan names a step beside it): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.", "required_evidence": [], "resolution": { "decision_id": "DEC-IAM-STACKITSA-STATEMENT-NOT-DRAFTED", "source_family": "stackitsa", "source_semantic": "NOT_DRAFTED", "affected_units": [ "google_service_account.automation", "google_service_account.server" ], "affected_application": [], "action_type": "MANUAL_IMPLEMENTATION", "work_package": "NOT_STATED", "owner_role": "Identity Architect", "required_by_phase": "BEFORE_PILOT", "raw_semantic_status": "PLAN_STATEMENT_OPEN", "review_status": "OPEN", "customer_action_status": "MANUAL_IMPLEMENTATION", "applied_input_refs": [], "carried_by": [], "accepted_by": [], "recommended_path_if_proven": null, "guidance_status": "NOT_STATED", "guidance_note": "resolution guidance: not stated for this semantic", "state_reason": "the plan writes no resource for the unit and names the work a person does instead", "source_observation": "The plan writes no resource for google_service_account.automation: google_service_account.automation is an identity of the source whose service account is written by the draft's converter of google_service_account, not by this plan: the plan states what uses it and attaches it to nothing. The plan writes no resource for google_service_account.server: google_service_account.server is an identity of the source whose service account is written by the draft's converter of google_service_account, not by this plan: the plan states what uses it and attaches it to nothing.", "generated_target_behavior": "The draft writes no resource for google_service_account.automation and google_service_account.server.", "residual_difference": "the work outside the draft is neither done nor verified by StackToIT", "execution_effect": "No step waits for it. The plan can start MAN/identity/held:principal:google_service_account.automation and MAN/identity/held:principal:google_service_account.server now.", "next_action": "Outside the draft, for google_service_account.automation and google_service_account.server: Decide who may use the STACKIT service account written for google_service_account.automation, what it may do and which workloads run as it: the draft attaches it to nothing (and 1 more manual steps); the plan lists it as manual work.", "why_open": [ "The stackitsa plan of the draft writes no resource for 2 units and states why (no resource is written for the unit and the plan names a step beside it): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan." ], "closes_when": [ "the people and the workloads that may use the service account written for google_service_account.automation are named, and the roles it holds are stated", "the people and the workloads that may use the service account written for google_service_account.server are named, and the roles it holds are stated" ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/identity/held:principal:google_service_account.automation", "mode": "MANUAL", "phase": "PREPARE", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false }, { "id": "MAN/identity/held:principal:google_service_account.server", "mode": "MANUAL", "phase": "PREPARE", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } } ], "groups": [ { "id": "GRP-PLAN-DECISION-convert", "source": "PLAN_DECISION", "family": "convert", "title": "Plan decisions · convert", "record_ids": [ "DEC-GEN-CONVERT-API-OPT-IN", "DEC-GEN-CONVERT-DATA-MOVEMENT", "DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE", "DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING", "DEC-GEN-CONVERT-SOURCE-REGION-MAPPING" ], "records": 5, "status": "OPEN", "open_items": 21, "accepted_items": 0, "units": 11, "by_status": [ { "key": "OPEN", "count": 5 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Data Architect", "Platform Architect" ], "earliest_phase": "BEFORE_PILOT", "conditional": 3 }, { "id": "GRP-CRITICAL-SEMANTIC-gcp.cloud_run", "source": "CRITICAL_SEMANTIC", "family": "gcp.cloud_run", "title": "Critical semantics · gcp.cloud_run", "record_ids": [ "DEC-IAM-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE", "DEC-NET-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE", "DEC-OPS-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE", "DEC-SEC-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE", "DEC-GEN-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "DEC-IAM-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "DEC-NET-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "DEC-OPS-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "DEC-SEC-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER" ], "records": 9, "status": "OPEN", "open_items": 21, "accepted_items": 0, "units": 2, "by_status": [ { "key": "OPEN", "count": 9 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Identity Architect", "NOT_STATED", "Network Architect", "Platform Architect", "Security Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-gcp.cloudbuild", "source": "CRITICAL_SEMANTIC", "family": "gcp.cloudbuild", "title": "Critical semantics · gcp.cloudbuild", "record_ids": [ "DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-ACTIVATEGCB", "DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-ACTIVATEGCB", "DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-INIT", "DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-INIT", "DEC-GEN-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER", "DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER", "DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER" ], "records": 7, "status": "OPEN", "open_items": 15, "accepted_items": 0, "units": 3, "by_status": [ { "key": "OPEN", "count": 7 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Identity Architect", "NOT_STATED", "Platform Architect" ], "earliest_phase": "NOT_STATED", "conditional": 15 }, { "id": "GRP-CRITICAL-SEMANTIC-gcp.firebase_hosting_site", "source": "CRITICAL_SEMANTIC", "family": "gcp.firebase_hosting_site", "title": "Critical semantics · gcp.firebase_hosting_site", "record_ids": [ "DEC-IAM-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT", "DEC-OPS-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT" ], "records": 2, "status": "OPEN", "open_items": 2, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 2 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Identity Architect", "Platform Architect" ], "earliest_phase": "NOT_STATED", "conditional": 2 }, { "id": "GRP-CRITICAL-SEMANTIC-gcp.firebase_project", "source": "CRITICAL_SEMANTIC", "family": "gcp.firebase_project", "title": "Critical semantics · gcp.firebase_project", "record_ids": [ "DEC-IAM-GOOGLE-FIREBASE-PROJECT-DEFAULT" ], "records": 1, "status": "OPEN", "open_items": 1, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 1 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Identity Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-gcp.pubsub_topic", "source": "CRITICAL_SEMANTIC", "family": "gcp.pubsub_topic", "title": "Critical semantics · gcp.pubsub_topic", "record_ids": [ "DEC-OPS-GOOGLE-PUBSUB-TOPIC-FAUX" ], "records": 1, "status": "OPEN", "open_items": 1, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 1 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Platform Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-gcp.secret", "source": "CRITICAL_SEMANTIC", "family": "gcp.secret", "title": "Critical semantics · gcp.secret", "record_ids": [ "DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD", "DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD", "DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-SETTINGS", "DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-SETTINGS" ], "records": 4, "status": "OPEN", "open_items": 6, "accepted_items": 0, "units": 2, "by_status": [ { "key": "OPEN", "count": 4 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Identity Architect", "Security Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-gcp.service_account", "source": "CRITICAL_SEMANTIC", "family": "gcp.service_account", "title": "Critical semantics · gcp.service_account", "record_ids": [ "DEC-IAM-GOOGLE-SERVICE-ACCOUNT-AUTOMATION", "DEC-IAM-GOOGLE-SERVICE-ACCOUNT-CLIENT", "DEC-IAM-GOOGLE-SERVICE-ACCOUNT-INIT", "DEC-IAM-GOOGLE-SERVICE-ACCOUNT-SERVER" ], "records": 4, "status": "OPEN", "open_items": 8, "accepted_items": 0, "units": 4, "by_status": [ { "key": "OPEN", "count": 4 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Identity Architect" ], "earliest_phase": "NOT_STATED", "conditional": 2 }, { "id": "GRP-CRITICAL-SEMANTIC-gcp.sql_instance", "source": "CRITICAL_SEMANTIC", "family": "gcp.sql_instance", "title": "Critical semantics · gcp.sql_instance", "record_ids": [ "DEC-IAM-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES", "DEC-NET-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES", "DEC-OPS-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES" ], "records": 3, "status": "OPEN", "open_items": 4, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 3 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Identity Architect", "Network Architect", "Platform Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-CRITICAL-SEMANTIC-gcp.storage_bucket", "source": "CRITICAL_SEMANTIC", "family": "gcp.storage_bucket", "title": "Critical semantics · gcp.storage_bucket", "record_ids": [ "DEC-DATA-GOOGLE-STORAGE-BUCKET-MEDIA", "DEC-GEN-GOOGLE-STORAGE-BUCKET-MEDIA", "DEC-IAM-GOOGLE-STORAGE-BUCKET-MEDIA", "DEC-OPS-GOOGLE-STORAGE-BUCKET-MEDIA", "DEC-SEC-GOOGLE-STORAGE-BUCKET-MEDIA" ], "records": 5, "status": "OPEN", "open_items": 6, "accepted_items": 0, "units": 1, "by_status": [ { "key": "OPEN", "count": 5 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Identity Architect", "NOT_STATED", "Platform Architect", "Security Architect", "Storage Architect" ], "earliest_phase": "NOT_STATED", "conditional": 0 }, { "id": "GRP-PLAN-STATEMENT-stackitsa", "source": "PLAN_STATEMENT", "family": "stackitsa", "title": "Plan statements · stackitsa", "record_ids": [ "DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW", "DEC-IAM-STACKITSA-STATEMENT-NOT-DRAFTED" ], "records": 2, "status": "OPEN", "open_items": 4, "accepted_items": 0, "units": 4, "by_status": [ { "key": "OPEN", "count": 2 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "categories": [], "owner_roles": [ "Identity Architect" ], "earliest_phase": "BEFORE_PILOT", "conditional": 0 } ], "id_grammar": "DEC-\u003cAREA\u003e-\u003cKEY\u003e; AREA one of NET, IAM, DATA, SEC, OPS, CMP, GEN; KEY 5 to 64 characters A-Z, 0-9, - (first A-Z or 0-9); built here as DEC-\u003cAREA\u003e-\u003cFAMILY\u003e-\u003cKIND\u003e", "counts": { "records": 43, "plan_records": 5, "plan_decisions": 13, "plan_decision_states": { "pending": 13, "accepted_awaiting_verification": 0, "rejected": 0, "stale": 0 }, "semantic_records": 36, "open_critical_semantics": 72, "conditional_semantics": 22, "action_records": 0, "manual_actions": 0, "statement_records": 2, "plan_statements": 4, "closed_statements": 0, "units": 16, "by_status": [ { "key": "OPEN", "count": 43 }, { "key": "PARTIAL", "count": 0 }, { "key": "ACCEPTED", "count": 0 }, { "key": "STALE", "count": 0 }, { "key": "REJECTED", "count": 0 } ], "by_source": [ { "source": "PLAN_DECISION", "records": 5, "open_items": 13, "accepted_items": 0, "units": 11, "conditional": 0, "open_records": 5, "open_units": 11, "open_default_records": 1 }, { "source": "CRITICAL_SEMANTIC", "records": 36, "open_items": 72, "accepted_items": 0, "units": 16, "conditional": 22, "open_records": 36, "open_units": 16, "open_confirm_only_items": 1 }, { "source": "MANUAL_ACTION", "records": 0, "open_items": 0, "accepted_items": 0, "units": 0, "conditional": 0 }, { "source": "PLAN_STATEMENT", "records": 2, "open_items": 4, "accepted_items": 0, "units": 4, "conditional": 0, "open_records": 2, "open_units": 4 } ], "by_cause": [ { "key": "CUSTOMER_INPUT", "count": 3 }, { "key": "TARGET_LIMIT", "count": 2 }, { "key": "EVIDENCE_GAP", "count": 0 }, { "key": "IMPLEMENTATION_GAP", "count": 4 }, { "key": "APPLY_TIME", "count": 0 }, { "key": "DEPENDS_ON_UNIT", "count": 12 }, { "key": "NOT_CLASSIFIED", "count": 10 }, { "key": "MIXED", "count": 12 } ], "root_causes": 1, "dependent_units": 1, "by_blocker_class": [ { "class": "ROOT_BLOCKER", "records": 3, "items": 3 }, { "class": "GENUINELY_UNACCOUNTED", "records": 32, "items": 63 }, { "class": "OPTIONAL_CONDITIONAL", "records": 7, "items": 22 }, { "class": "PROPAGATED_IMPACT", "records": 1, "items": 1 } ] }, "review_input": { "state": "NOT_PROVIDED", "entries": 0 }, "unmatched_reviews": [], "state_definitions": { "review_state": "ARCHITECT_REVIEWED: a review of the decisions file, bound to this run (source digest, knowledge base and members all hold), covers every member of the record and accepts or rejects it; the outcome is the status and the review of the record. UNREVIEWED: none was given, it covers only some members, or its binding no longer holds. A review never closes a plan decision, a critical semantic or a manual action.", "design_state": "OPEN: this run's plan or draft still carries the item. DESIGN_RESOLVED: stated only for an entry of the decisions file that this run's register does not hold, written for another source digest and the same knowledge base, in a run that read the plans of a generated draft without a degraded reading: the item is gone from the plan or draft of the later source. It is inferred from the absent id, so an id misspelled in the file reads the same way; a review never sets it.", "validation_state": "TECHNICAL_VALIDATION_PASSED: this run ran tofu validate on the draft, it passed, and the record belongs to a family of the draft (security group, routing, identity or logs) that the validation covered. NOT_VALIDATED: tofu validate was not asked for, did not run, or the record is a critical semantic of the source, which a schema check of the draft does not cover. FAILED: tofu validate rejected the draft that holds the family. It is a static check against the pinned provider schema, not target behaviour and not approval." }, "root_causes": [ { "id": "google_firebase_hosting_site.client", "unit": "google_firebase_hosting_site.client", "source_type": "google_firebase_hosting_site", "why": "it is REDESIGN", "conditional": true, "records": [ "DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE", "DEC-IAM-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT", "DEC-OPS-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT" ], "dependent_units": [ "google_cloudbuild_trigger.placeholder" ], "dependent_records": [ "DEC-GEN-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER" ], "dependent_items": 1, "next_step": "Decide whether a proposed STACKIT alternative replaces a source capability for google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder, google_firebase_hosting_site.client and 3 more: choose one of the 2 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "next_record": "DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE" } ], "record_shapes": [ { "id": "RSH-57f6574c79c3", "why": "The knowledge base cannot decide 2 critical settings of {subject}: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings-security-architect.", "required_evidence": [], "items": [ { "id": "DEC-SEC-GCP-SECRET-SECRET-VALUE", "kind": "secret-value", "family": "gcp.secret", "title": "Provide the values of the secrets", "block": "secret-value", "category": "secret-handling", "why": "The knowledge base cannot decide \"secret-value\" of the gcp.secret contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|secret-value" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Provide the values of the secrets for {subject}: A person decides where the value comes from, supplies the document and the step has run. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." }, { "id": "DEC-SEC-GCP-SECRET-TCR-SECRET-ID", "kind": "tcr-secret-id", "family": "gcp.secret", "title": "Confirm the name of the secret", "block": "secret_id", "category": "secret-handling", "why": "The knowledge base cannot decide \"tcr-secret-id\" of the gcp.secret contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|tcr-secret-id" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "IMPLEMENTATION_GAP", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Confirm the name of the secret for {subject}: A person confirms the secret name in STACKIT Secrets Manager against what refers to the source secret ID, or accepts the new name. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Provide the values of the secrets; the 2 settings of the record state their own.", "source_observation": "The source states 2 critical settings on {subject} that the knowledge base cannot decide: Provide the values of the secrets; Confirm the name of the secret.", "generated_target_behavior": "Provide the values of the secrets: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-security-architect). Confirm the name of the secret: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-security-architect).", "residual_difference": "Provide the values of the secrets: the target behaviour of this setting is not established Confirm the name of the secret: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/{subject}/open-settings-security-architect now.", "next_action": "Provide the values of the secrets: Provide the values of the secrets for {subject}: A person decides where the value comes from, supplies the document and the step has run. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Provide the values of the secrets: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_secret_manager_secret_version.secret_data: the value of the secret. StackToIT never reads it and never writes it into the draft; the API step of the secret writes the document the customer supplies.", "Confirm the name of the secret: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_secret_manager_secret.secret_id: The secret's own resource identifier; access to the secret's value is controlled by IAM bindings and replication/encryption settings, not by the id string itself." ], "closes_when": [ "Provide the values of the secrets: A person decides where the value comes from, supplies the document and the step has run.", "Confirm the name of the secret: A person confirms the secret name in STACKIT Secrets Manager against what refers to the source secret ID, or accepts the new name." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/{subject}/open-settings-security-architect", "mode": "MANUAL", "phase": "SECURITY", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "RSH-6f19d10581d9", "why": "The knowledge base cannot decide 1 critical setting of {subject}: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.", "required_evidence": [], "items": [ { "id": "DEC-IAM-GCP-CLOUDBUILD-BUILD-IDENTITY", "kind": "build-identity", "family": "gcp.cloudbuild", "title": "Review the build identity setting", "block": "pubsub_config", "category": "identity-access", "why": "The knowledge base cannot decide \"build-identity\" of the gcp.cloudbuild contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.", "members": [ "{subject}|build-identity" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "conditional_members": 1, "customer_action_status": "OPEN_INPUT", "next_action": "This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied." } ], "resolution": { "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on {subject} that the knowledge base cannot decide: Review the build identity setting.", "generated_target_behavior": "Review the build identity setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/unit/{subject}).", "residual_difference": "Review the build identity setting: the draft writes nothing for the unit: what the setting becomes depends on what replaces it", "execution_effect": "No step waits for it. Held by something else first: MAN/unit/{subject}.", "next_action": "Review the build identity setting: This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied.", "why_open": [ "Review the build identity setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The service account the build (or the Pub/Sub push notification) runs as; STACKIT Git Pipelines has its own, differently-shaped identity model -- REVIEW." ], "closes_when": [ "Review the build identity setting: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/unit/{subject}", "mode": "MANUAL", "phase": "WORKLOAD", "free_of_decisions": false, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "RSH-be38e574aa6e", "why": "The knowledge base cannot decide 2 critical settings of {subject}: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings.", "required_evidence": [ "the members that act as or manage the service account" ], "items": [ { "id": "DEC-IAM-GCP-SERVICE-ACCOUNT-ACCOUNT-NAME", "kind": "account-name", "family": "gcp.service_account", "title": "Review the account name setting", "block": "account_id", "category": "identity-access", "why": "The knowledge base cannot decide \"account-name\" of the gcp.service_account contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|account-name" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "DEPENDS_ON_UNIT", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "This setting follows the decision on the unit: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact." }, { "id": "DEC-GEN-GCP-SERVICE-ACCOUNT-ROLE-BINDINGS", "kind": "role-bindings", "family": "gcp.service_account", "title": "Map the IAM roles of the service account to STACKIT roles", "block": "role-bindings", "why": "The knowledge base cannot decide \"role-bindings\" of the gcp.service_account contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|role-bindings" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [ { "id": "bind-a-role-on-the-service-account", "title": "Bind a role of the STACKIT service account to the member", "effect": "A role assignment on a STACKIT service account gives a role the authorization API lists for that account to a user, a service account or a client; given to a service account, it grants the Act-As permission, which lets that account impersonate the target account. A person re-maps each Google role on the account (using it, creating its keys, managing it) to a role of the STACKIT service account and binds it to the member. The assignment carries no condition and has no setting that removes the other holders of a role, so if the Google resource was authoritative (a binding for its role, a policy for the whole account) the replacing effect is not carried: a person lists who else holds a role on the account and removes what the source did not list. The resource is part of an experimental feature that is likely to change or be removed. The documents read do not state how a person, as opposed to a service account, acts as the account.", "evidence": [ { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_service_account_role_assignment.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "`resource_id` (String) Service-account Resource to assign the role to." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_service_account_role_assignment.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "`subject` (String) Identifier of user, service account or client." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_service_account_role_assignment.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "Use this resource to grant 'Act-As' permissions. This allows a service-account (the `subject`) to impersonate the target Service Account." }, { "url": "https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/authorization_folder_role_assignment.md", "class": "OFFICIAL_DOCUMENTED", "checked_at": "2026-11-05", "quote": "This resource is part of the experimental feature iam and is likely going to undergo significant changes or be removed in the future. Use it at your own discretion." } ] } ], "recommended_option": null, "causes": [ { "cause": "CUSTOMER_INPUT", "members": 1 } ], "customer_action_status": "MANUAL_IMPLEMENTATION", "next_action": "Outside the draft, for {subject}: The grants that name the account become STACKIT role assignments where the role and members are readable and the grant has no condition, and the draft lists the others. A Google role is written as a STACKIT role only where the STACKIT role holds the same permissions or fewer; for every other role a person confirms the choice. A grant that lets another account act as this one, or that is authoritative, must be reviewed: list who else holds access on the target and remove what the source did not list." } ], "resolution": { "state_reason": "a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the account name setting; the 2 settings of the record state their own.", "source_observation": "The source states 2 critical settings on {subject} that the knowledge base cannot decide: Review the account name setting; Map the IAM roles of the service account to STACKIT roles.", "generated_target_behavior": "Review the account name setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). Map the IAM roles of the service account to STACKIT roles: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). The draft writes the service account, and a STACKIT role assignment of the account for each grant on a project, a folder or an organisation whose role and members are visible statically and that has no condition; a grant that lets another account act as it is written as an Act-As assignment. A grant with a condition, a policy document, a repeated grant and a grant whose role or members are not visible statically are listed in the draft and not written.", "residual_difference": "Review the account name setting: the target behaviour of this setting is not established Map the IAM roles of the service account to STACKIT roles: Which STACKIT role gives a member the access the Google role gave on the service account, and that no member gets more.", "execution_effect": "No step waits for it. The plan can start MAN/semantic/{subject}/open-settings now.", "next_action": "Review the account name setting: This setting follows the decision on the unit: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.", "why_open": [ "Review the account name setting: A check of the knowledge base (sa account id not visible) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The account ID becomes the stackit_service_account name (shortened to the STACKIT name rules; pinned provider) — TRANSFORMED; the e-mail address changes. An ID not visible statically (or a repeated account) is named NOT CARRIED — REVIEW (check sa-account-id-not-visible).", "Map the IAM roles of the service account to STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The grants of the estate that name the account: a grant on a project, a folder or an organisation is written as a STACKIT role assignment of the account when its role and members are visible statically and it has no condition, and a grant that lets another account act as it is written as an Act-As assignment. A Google role is written as a STACKIT role only where the mapping shows the STACKIT role holds the same permissions or fewer on a project; every other role is an input that names the candidates, and a person confirms each. A binding or a policy is authoritative (it removes the members of its role that it does not list) and a role assignment only adds, which the draft says on each: members that hold the role outside the configuration keep it on STACKIT until a person removes them." ], "closes_when": [ "Review the account name setting: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.", "Map the IAM roles of the service account to STACKIT roles: The knowledge base's note on this setting states no closing condition; it is done when a person has chosen a way out above, recorded the choice, and the target is checked as the verification says.", "Map the IAM roles of the service account to STACKIT roles: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting." ], "required_inputs": [ "the members that act as or manage the service account" ], "resolution_paths": [ { "id": "role-bindings/bind-a-role-on-the-service-account", "title": "Map the IAM roles of the service account to STACKIT roles: Bind a role of the STACKIT service account to the member", "prerequisites": [ "the Google roles granted on the service account and what each one allowed", "the roles the authorization API lists for the STACKIT service account" ], "effects": [ "A role assignment on a STACKIT service account gives a role the authorization API lists for that account to a user, a service account or a client; given to a service account, it grants the Act-As permission, which lets that account impersonate the target account. A person re-maps each Google role on the account (using it, creating its keys, managing it) to a role of the STACKIT service account and binds it to the member. The assignment carries no condition and has no setting that removes the other holders of a role, so if the Google resource was authoritative (a binding for its role, a policy for the whole account) the replacing effect is not carried: a person lists who else holds a role on the account and removes what the source did not list. The resource is part of an experimental feature that is likely to change or be removed. The documents read do not state how a person, as opposed to a service account, acts as the account." ], "risk": [ "A role chosen too wide lets a member act as the account more than the source allowed." ], "evidence": [ "provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_service_account_role_assignment.md: \"`resource_id` (String) Service-account Resource to assign the role to.\"", "provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_service_account_role_assignment.md: \"`subject` (String) Identifier of user, service account or client.\"", "provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_service_account_role_assignment.md: \"Use this resource to grant 'Act-As' permissions. This allows a service-account (the `subject`) to impersonate the target Service Account.\"", "provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_folder_role_assignment.md: \"This resource is part of the experimental feature iam and is likely going to undergo significant changes or be removed in the future. Use it at your own discretion.\"" ], "regeneration_required": false } ], "required_verification": [ "Map the IAM roles of the service account to STACKIT roles: each member can do what the source role allowed on the service account and nothing more, tried on the target" ], "next_run_changes": [ "A rerun writes no further role assignment on its own; an answer in the decisions file records the choice and writes nothing." ], "remains_manual": [ "Map the IAM roles of the service account to STACKIT roles: Manual work remains: a person closes the semantic, the draft does not." ], "evidence_refs": [ "contract note gcp.service_account/role-bindings: \"Role assignments need the experimental IAM feature of the pinned STACKIT provider.\"" ], "related_execution_steps": [ { "id": "MAN/semantic/{subject}/open-settings", "mode": "MANUAL", "phase": "SECURITY", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } }, { "id": "RSH-e375932468f2", "why": "The knowledge base cannot decide 1 critical setting of {subject}: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "required_evidence": [], "items": [ { "id": "DEC-IAM-GCP-SECRET-SECRET-SETTINGS", "kind": "secret-settings", "family": "gcp.secret", "title": "Decide how the secrets are carried", "block": "replication", "category": "identity-access", "why": "The knowledge base cannot decide \"secret-settings\" of the gcp.secret contract for 1 unit (REVIEW): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.", "members": [ "{subject}|secret-settings" ], "status": "OPEN", "review_state": "UNREVIEWED", "options": [], "recommended_option": null, "causes": [ { "cause": "NOT_CLASSIFIED", "members": 1 } ], "customer_action_status": "OPEN_INPUT", "next_action": "Decide how the secrets are carried for {subject}: A person recreates the secret in the Secrets Manager instance, since its data is not written into the draft, and decides for each IAM member whether it gets a user of the whole instance, a role binding on a secret group, or a separate instance. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml)." } ], "resolution": { "state_reason": "a person's decision or input is still open", "source_observation": "The source states 1 critical setting on {subject} that the knowledge base cannot decide: Decide how the secrets are carried.", "generated_target_behavior": "Decide how the secrets are carried: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/secret-settings).", "residual_difference": "Decide how the secrets are carried: the target behaviour of this setting is not established", "execution_effect": "No step waits for it. The plan can start MAN/semantic/{subject}/secret-settings now.", "next_action": "Decide how the secrets are carried: Decide how the secrets are carried for {subject}: A person recreates the secret in the Secrets Manager instance, since its data is not written into the draft, and decides for each IAM member whether it gets a user of the whole instance, a role binding on a secret group, or a separate instance. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).", "why_open": [ "Decide how the secrets are carried: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The settings of the secret beside its value (secret-value): STACKIT replicates it itself (no replica locations or per-replica keys), tags and version states have no counterpart, and IAM members and policy map to Secrets Manager users (read-only or read-write for a whole instance) or to experimental role bindings on a secret group — REVIEW." ], "closes_when": [ "Decide how the secrets are carried: A person recreates the secret in the Secrets Manager instance, since its data is not written into the draft, and decides for each IAM member whether it gets a user of the whole instance, a role binding on a secret group, or a separate instance." ], "required_inputs": [], "resolution_paths": [], "required_verification": [], "next_run_changes": [], "remains_manual": [], "evidence_refs": [], "related_execution_steps": [ { "id": "MAN/semantic/{subject}/secret-settings", "mode": "MANUAL", "phase": "SECURITY", "free_of_decisions": true, "runs_as_written": false, "waits_for_this": false } ] } } ], "template": [ { "id": "DEC-GEN-CONVERT-API-OPT-IN", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:ad0b4646256d69e513051c7a948486002928b0d8da0e8c103efc9f267ec3d9fe", "artifact_sha256": "sha256:4dcc4d547c199508ac6d33000affd676431fd849c5ce9b11aefb886b2717ff5f", "kb_dependencies_sha256": "sha256:03735a47b22c84235c95ed16b33e929eb21e905431c7a1c2103a67e6c13f9395", "members": [ "convert:api:pubsub:v1beta:beta:API_OPT_IN", "convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN" ] }, { "id": "DEC-GEN-CONVERT-DATA-MOVEMENT", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:84bb3ebfd40276eeeabadf6428f1d880feb76324d64e689f3269ad76bb2b327d", "artifact_sha256": "sha256:a4f94232ca78f136bc3cea3ddd554e90886d26cf333ee677b940028baa86d050", "kb_dependencies_sha256": "sha256:610870c4321b580122859ef332af5301a6bd3a8973057240bd04c7d631e03a41", "members": [ "convert:google_sql_database_instance.postgres:data:DATA_MOVEMENT" ] }, { "id": "DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:af35ed50b2c8832725ee5a41a11f947f09e19ee3a5aad77e3417356fd0bd96e9", "artifact_sha256": "sha256:1faf18cdde50f305c706a8770f6ab7e3fdc8ea913deff4b820878f73ad61058a", "kb_dependencies_sha256": "sha256:4e2f49836dda938009c1e17d3985cef438eb78acb823da060a7d4677f36dd7f9", "members": [ "convert:google_cloudbuild_trigger.activategcb:proposal:PROPOSED_ALTERNATIVE", "convert:google_cloudbuild_trigger.init:proposal:PROPOSED_ALTERNATIVE", "convert:google_cloudbuild_trigger.placeholder:proposal:PROPOSED_ALTERNATIVE", "convert:google_firebase_hosting_site.client:proposal:PROPOSED_ALTERNATIVE", "convert:google_secret_manager_secret_iam_binding.django_admin_password:proposal:PROPOSED_ALTERNATIVE", "convert:google_secret_manager_secret_iam_binding.django_settings:proposal:PROPOSED_ALTERNATIVE", "convert:google_storage_bucket_iam_member.automation:proposal:PROPOSED_ALTERNATIVE", "convert:google_storage_bucket_iam_member.server:proposal:PROPOSED_ALTERNATIVE" ] }, { "id": "DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:bfe72ff4b84be59f91d62c726bb588d393af2d2beebf6f921538125bffe5ffd9", "artifact_sha256": "sha256:5f13672461ff52c8812ef8689225bfb97acab9d2c4a3a7e6671a24c17ea663c2", "kb_dependencies_sha256": "sha256:499099d550b6e4222fa317976fd0988578b8321f689feaf564abc70903c02d1d", "members": [ "convert:estate:source_project:SOURCE_PROJECT_MAPPING", "google_cloudbuild_trigger.activategcb|project-residency", "google_cloudbuild_trigger.init|project-residency", "google_cloudbuild_trigger.placeholder|project-residency", "google_sql_database_instance.postgres|project-scope" ] }, { "id": "DEC-GEN-CONVERT-SOURCE-REGION-MAPPING", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:1be5810bd6bed11fb1fc02fe831c232fd9d2b9eaa1ed6c2f21eb8923722e1372", "artifact_sha256": "sha256:1b7845371e8d741cb3eef090a161d6679f6d28d298bea24c1f5186e5204d1f24", "kb_dependencies_sha256": "sha256:9f089fa98bc5213252824480f45d48fce25196a42c1a14b903267ac4cf2bf279", "members": [ "convert:estate:source_location:SOURCE_REGION_MAPPING", "google_cloud_run_v2_job.migrate|location-residency", "google_cloud_run_v2_service.server|location-residency", "google_sql_database_instance.postgres|region-residency", "google_storage_bucket.media|bucket-region" ] }, { "id": "DEC-IAM-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:6d8e764691c2b3f560403316def3586a0b4f7662f6b183ca8a876e22b4f6ad93", "kb_dependencies_sha256": "sha256:de5130d930b3443183d5b28e0b451069a044b7f2102cdc526edd3df9e6e63492", "members": [ "google_cloud_run_v2_job.migrate|service-identity" ] }, { "id": "DEC-NET-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:5f61f359aed7bddb0e87466e258be5e63147063c19a9cd13dbb420ae4128c575", "kb_dependencies_sha256": "sha256:7619947cac69513468f065e085ea96fa41d749d90aa2164661afc29a1d27bf20", "members": [ "google_cloud_run_v2_job.migrate|cloud-run-v2-job-network-exposure" ] }, { "id": "DEC-OPS-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:685b77a28b897320d29a0b28c3f0b7ecff0c3c23f08ebf48e4fb10892434a8c7", "kb_dependencies_sha256": "sha256:23f816d8acde4a1b38467d66e94c81af79e843f510e81614686937b327b047f7", "members": [ "google_cloud_run_v2_job.migrate|deployment-artifact", "google_cloud_run_v2_job.migrate|entry-point", "google_cloud_run_v2_job.migrate|k4-cloud-run-volume-mount-cloud-run-v2-job", "google_cloud_run_v2_job.migrate|tc-cloud-run-v2-job-name", "google_cloud_run_v2_job.migrate|tc-cloud-run-v2-job-template--template--containers--env--name", "google_cloud_run_v2_job.migrate|tc-cloud-run-v2-job-template--template--volumes--name", "google_cloud_run_v2_job.migrate|terraform-destroy-guard" ] }, { "id": "DEC-SEC-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:eb72d924ef3dca3df509ae9675b4cd2374b14119b591b9ae674c3cc242c6ba62", "kb_dependencies_sha256": "sha256:05323ded731a64941b628473bd15b5e2f03fe0f884b06d9feceb4f924f902e4c", "members": [ "google_cloud_run_v2_job.migrate|secrets" ] }, { "id": "DEC-GEN-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:15f679b726862e403a8aaf12cc8a1b31c16dcc0b586ea26fffb4621d0bd2fcc2", "kb_dependencies_sha256": "sha256:a283a1e6a981f35147d6eb1ac11a22014607c92e729f0c07719a27e656f74bb8", "members": [ "google_cloud_run_v2_service.server|iam-policy-grant" ] }, { "id": "DEC-IAM-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:49a9627d2f1d15f305b977c86b73db0162a769ecd453b5b1fca71650bba2a2e8", "kb_dependencies_sha256": "sha256:769e45c36ad1371d92358ae5dfa9a3e7cdc8cd60355fbc338219885964f449c1", "members": [ "google_cloud_run_v2_service.server|iam-invocation", "google_cloud_run_v2_service.server|service-identity" ] }, { "id": "DEC-NET-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:7ffdff9c041378f4eae6d4342c8775fd97bc2eb295a39ce01f24caa6e06208ea", "kb_dependencies_sha256": "sha256:7cbc235f3121e16aeb96bb232707c733562215e218571c70a5a63316998d150b", "members": [ "google_cloud_run_v2_service.server|cloud-sql-connection" ] }, { "id": "DEC-OPS-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:49a225e8454b013cae4c0796f19f24dec5d3c80788ef6189addeeb19bbb5467c", "kb_dependencies_sha256": "sha256:08117121d8baf3feb598399602f00521c4c81fe308e9a86a19db79824e6c6be8", "members": [ "google_cloud_run_v2_service.server|deployment-artifact", "google_cloud_run_v2_service.server|k4-cloud-run-volume-mount-cloud-run-v2-service", "google_cloud_run_v2_service.server|tc-cloud-run-v2-service-name", "google_cloud_run_v2_service.server|tc-cloud-run-v2-service-template--volumes--name", "google_cloud_run_v2_service.server|terraform-destroy-guard" ] }, { "id": "DEC-SEC-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:a62c4ae04e476e59d71bcc934c792968379d2bec15964708b153e580e7b3c411", "kb_dependencies_sha256": "sha256:9ba3a1bd3e61762c99157e16ecf5d4927ed883e672aa19e0399f56143c69420a", "members": [ "google_cloud_run_v2_service.server|environment", "google_cloud_run_v2_service.server|secrets" ] }, { "id": "DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-ACTIVATEGCB", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:9386141c388d58e556657d741dad4f3973d0a7917c12094e76ed87729a78a697", "kb_dependencies_sha256": "sha256:986fe167bf9a329368f8430b5da2276a3dcf5c4bd1b79fc22533a56446154eac", "members": [ "google_cloudbuild_trigger.activategcb|build-identity" ] }, { "id": "DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-ACTIVATEGCB", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:e0143295cfa5a05eb32a3e9cb7e67db7ffdee678b9d8576c04505e0b9c53e0d6", "kb_dependencies_sha256": "sha256:4eb8ef0b5ba6b230afae8df04c4c76d948a60d07ff869cc7c621ad2b16b82e9e", "members": [ "google_cloudbuild_trigger.activategcb|dep-references", "google_cloudbuild_trigger.activategcb|deployment-artifact", "google_cloudbuild_trigger.activategcb|entry-point", "google_cloudbuild_trigger.activategcb|log-destination" ] }, { "id": "DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-INIT", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:983aef1e0dd9bd041a79bd51beb04d5a8ac24a45e1c9a2a46cefc90d25ee7eb3", "kb_dependencies_sha256": "sha256:986fe167bf9a329368f8430b5da2276a3dcf5c4bd1b79fc22533a56446154eac", "members": [ "google_cloudbuild_trigger.init|build-identity" ] }, { "id": "DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-INIT", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:dde8057fbf100190ede422135467b4944298a15361db3dab48d0eac6ec929497", "kb_dependencies_sha256": "sha256:4eb8ef0b5ba6b230afae8df04c4c76d948a60d07ff869cc7c621ad2b16b82e9e", "members": [ "google_cloudbuild_trigger.init|dep-references", "google_cloudbuild_trigger.init|deployment-artifact", "google_cloudbuild_trigger.init|entry-point", "google_cloudbuild_trigger.init|log-destination" ] }, { "id": "DEC-GEN-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:c674d845100b6fe50690bf19a8f6cb6e1c75ac37f81d12554d22665ec6b82793", "kb_dependencies_sha256": "sha256:2263f44dd94d80de252fce492c6264ad809d936ed18332bf0c4dab3747e0a1d8", "members": [ "google_cloudbuild_trigger.placeholder|linked-dependency:google_firebase_hosting_site" ] }, { "id": "DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:5dd6517fac6668ddfc41409b0b481e67806d0e95fb9a8fcb6d7ed6132d67439b", "kb_dependencies_sha256": "sha256:986fe167bf9a329368f8430b5da2276a3dcf5c4bd1b79fc22533a56446154eac", "members": [ "google_cloudbuild_trigger.placeholder|build-identity" ] }, { "id": "DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:7e70eed61a6fa17edd718e38dd29074b9b3e25e7abd5fc99b629828000c689a8", "kb_dependencies_sha256": "sha256:08f216fcd85c9d6305f60978415fc1d136a6daf9270b7b52bd96a0bf9a3fb4af", "members": [ "google_cloudbuild_trigger.placeholder|dep-references", "google_cloudbuild_trigger.placeholder|deployment-artifact", "google_cloudbuild_trigger.placeholder|log-destination" ] }, { "id": "DEC-IAM-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:b4097e90369c69fe115b52f7ba297fa1a8a151b2f4e4cb927a2477eb7449550e", "kb_dependencies_sha256": "sha256:f55dba7d6b49141ce72d8f9e08bc07f99cb4ee36e013de7545c9e78dec5243be", "members": [ "google_firebase_hosting_site.client|tc-firebase-hosting-site-project" ] }, { "id": "DEC-OPS-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:f1335c383712c8d9a2d9e320a1daa4839dab4858facb100fc6012ff529d7cacc", "kb_dependencies_sha256": "sha256:a631a25906c03485dfab5b0a0a312fc9b2555f35bf1744f986183dd81745237c", "members": [ "google_firebase_hosting_site.client|tcr-firebase-hosting-site-site-id" ] }, { "id": "DEC-IAM-GOOGLE-FIREBASE-PROJECT-DEFAULT", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:667031dd2b2502bc1c1caca38c963530b561e9cde073a8b3faae85c068978e91", "kb_dependencies_sha256": "sha256:85daa99d61e711d84e649385b5c149432e234a88bdc0a8c525deb5ca3a0ef7e7", "members": [ "google_firebase_project.default|tc-firebase-project-project" ] }, { "id": "DEC-OPS-GOOGLE-PUBSUB-TOPIC-FAUX", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:a7d8918bd3887e9683ef3e8136ed581b298c98a4bd2f2c70d955d19659e55ff8", "kb_dependencies_sha256": "sha256:9141875ce7743ffec157132a09b478d7c4c66adccff8d3fc37212a6edbf027de", "members": [ "google_pubsub_topic.faux|tc-name" ] }, { "id": "DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:3e09fec2b3fabb25d58fdb484b8b5ab923f9e3ab186d861af6d5dcf041d7659b", "kb_dependencies_sha256": "sha256:0ccd16d2e735b9486466e3d6dbe99987df23297d09511b6cab689cdb4854aa41", "members": [ "google_secret_manager_secret.django_admin_password|secret-settings" ] }, { "id": "DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:eb29f1eaa95c211eb17973b5c3e485f452884068952077daaa1918823c3c8cf2", "kb_dependencies_sha256": "sha256:3e006b8a81c0ca3b70d5261345ffc7f78b9801324130cf812092e2bf2d4267d2", "members": [ "google_secret_manager_secret.django_admin_password|secret-value", "google_secret_manager_secret.django_admin_password|tcr-secret-id" ] }, { "id": "DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-SETTINGS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:6d6b7e816d8d4ad7005954dceeadfb922b3abfaa5ba54c8f6ea046dc1ee92c0a", "kb_dependencies_sha256": "sha256:0ccd16d2e735b9486466e3d6dbe99987df23297d09511b6cab689cdb4854aa41", "members": [ "google_secret_manager_secret.django_settings|secret-settings" ] }, { "id": "DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-SETTINGS", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:716b1b457e427774c0a7f4b650e4c1b35931c304d406b6d687462a336a072224", "kb_dependencies_sha256": "sha256:3e006b8a81c0ca3b70d5261345ffc7f78b9801324130cf812092e2bf2d4267d2", "members": [ "google_secret_manager_secret.django_settings|secret-value", "google_secret_manager_secret.django_settings|tcr-secret-id" ] }, { "id": "DEC-IAM-GOOGLE-SERVICE-ACCOUNT-AUTOMATION", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:274ca0dfef1c6eb06c78eb115a723bfb517013ac6392e727915c50ba200a2ff8", "kb_dependencies_sha256": "sha256:a2f32f0b19e4dd60b79173e9fabcf5021c17aa2d1102ae21c5a9f31db479c9b6", "members": [ "google_service_account.automation|account-name", "google_service_account.automation|role-bindings" ] }, { "id": "DEC-IAM-GOOGLE-SERVICE-ACCOUNT-CLIENT", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:88ae4b1b16dcb159b368f4323b539cbf6d141a882787af854f5db4709ec45ac9", "kb_dependencies_sha256": "sha256:a2f32f0b19e4dd60b79173e9fabcf5021c17aa2d1102ae21c5a9f31db479c9b6", "members": [ "google_service_account.client|account-name", "google_service_account.client|role-bindings" ] }, { "id": "DEC-IAM-GOOGLE-SERVICE-ACCOUNT-INIT", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:fbe36a66702026998a663181d81729b5b25573a82351a71f48bca28a9039d33d", "kb_dependencies_sha256": "sha256:a2f32f0b19e4dd60b79173e9fabcf5021c17aa2d1102ae21c5a9f31db479c9b6", "members": [ "google_service_account.init|account-name", "google_service_account.init|role-bindings" ] }, { "id": "DEC-IAM-GOOGLE-SERVICE-ACCOUNT-SERVER", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:7036953ced621ef3845bebb3c9ebfeb20a65a2b923fb82cebde5066f39687853", "kb_dependencies_sha256": "sha256:a2f32f0b19e4dd60b79173e9fabcf5021c17aa2d1102ae21c5a9f31db479c9b6", "members": [ "google_service_account.server|account-name", "google_service_account.server|role-bindings" ] }, { "id": "DEC-IAM-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:0a35e53fc17ee2be1fc2c0e5230f1a06bc8fc2064d3432154f560454ac3d7bf1", "kb_dependencies_sha256": "sha256:786401fe2bf3a93712af592b39f26370dffdc000473a1ca2590b6505bbb4e338", "members": [ "google_sql_database_instance.postgres|database-users" ] }, { "id": "DEC-NET-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:ccd4c92d365d49d5bb933ef5ad8b7cc3397c53a84b5773808f2bac8cf9beb0a5", "kb_dependencies_sha256": "sha256:05ec37deefc9709dd4094cc43443e5ea4161bb0fb883d0c31b14f7eab9c97734", "members": [ "google_sql_database_instance.postgres|user-and-database-settings" ] }, { "id": "DEC-OPS-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:b13cd08f1d5978440b0dece1471faff3802205881397bcf65829f41bc7f89a47", "kb_dependencies_sha256": "sha256:78bf9d5ee89c911cfef7286217a3cc65b58d8c90bd4528ac2ff20b4162d37bc7", "members": [ "google_sql_database_instance.postgres|tc-name", "google_sql_database_instance.postgres|tcf-sql-database--name" ] }, { "id": "DEC-DATA-GOOGLE-STORAGE-BUCKET-MEDIA", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:cee2afe3415694523ba90f77fa2e9a367eed61a79003c85f938f4e026e843f95", "kb_dependencies_sha256": "sha256:ff6ca5d3176c5f7bc2f6bb8c2946b4c21f8220ca742aa0d2a5362aa5669dd82b", "members": [ "google_storage_bucket.media|force-destroy" ] }, { "id": "DEC-GEN-GOOGLE-STORAGE-BUCKET-MEDIA", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:4c80dda543fb5e78f94213c2419ad6da54bf1b98a1df79c0ac2a8e5fe8555ac4", "kb_dependencies_sha256": "sha256:b7eeaba8b9c0d94e36ddc3359a7d737791e673d022999d650c4d0d686a4ff250", "members": [ "google_storage_bucket.media|iam-access" ] }, { "id": "DEC-IAM-GOOGLE-STORAGE-BUCKET-MEDIA", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:82968eacb6f72cd72fd95b5501daf787d5707e72dd3c66366c44080dc700a319", "kb_dependencies_sha256": "sha256:501308cb054c71c8e9dff6e445f4fa5dc02da316cf0e5a6cfaf3261af9ec4576", "members": [ "google_storage_bucket.media|iam-grant", "google_storage_bucket.media|public-access" ] }, { "id": "DEC-OPS-GOOGLE-STORAGE-BUCKET-MEDIA", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:ce1bb38d4159e6f1cc5ae1511fe2069c51d893d88b71471ec81e111114565ccd", "kb_dependencies_sha256": "sha256:2e055e5ac4d1a1ac28d8e2cf788d5ee9377a16e102dec0ccf86614ea88b70e93", "members": [ "google_storage_bucket.media|tc-storage-bucket-name" ] }, { "id": "DEC-SEC-GOOGLE-STORAGE-BUCKET-MEDIA", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:218dbf4d063d925c3ec13dcee5b71559568345f3441e250c6353827928621501", "kb_dependencies_sha256": "sha256:23b6a8ae451f9999dffe60eb24069fa7f6a0d1e9462633f32326666d793fe4f4", "members": [ "google_storage_bucket.media|geo-replication" ] }, { "id": "DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:0d87407edba569bfdd79c86e92e517831a240259de9e18c935cbb2e383da0a46", "kb_dependencies_sha256": "sha256:83a8f6eef89167b4a870555fd2ffcf930e8e1486e7893eb941efdfcf7f52cb49", "members": [ "stackitsa:statement:google_cloud_run_v2_job.migrate", "stackitsa:statement:google_cloud_run_v2_service.server" ] }, { "id": "DEC-IAM-STACKITSA-STATEMENT-NOT-DRAFTED", "resolution": "", "reviewed_by": "", "reviewed_at": "", "rationale": "", "evidence_refs": [], "members_sha256": "sha256:e85552354c4f233c6960ca13d2ae813bf9758092a5a48d836f0839a1cb81ab87", "kb_dependencies_sha256": "sha256:fe3be1b899466063f75cf0424168230d97d3a1492d8dd1b68db6325ffa70ccdf", "members": [ "stackitsa:statement:google_service_account.automation", "stackitsa:statement:google_service_account.server" ] } ] }