# Trace of `terraform/data.tf` — 1 blocks

> FOR REVIEW — generated by StackToIT Assess. Architect review required before any decision.

Run `6f8f72b2-1c34-4cfc-8483-344c41245364` · source digest `sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000`

The draft keeps a one-paragraph comment above each block: where it comes from, why its values are what they are, what is not carried and which decision is open. Each section of this file is the whole comment the generators wrote for one block, unabridged and in the order they wrote it: the rule and the knowledge-base stamp, the references with their digests, the evidence of each chosen value, the reason of each attribute that is not written and the caveats of the checks. The `# trace:` line above a block names its section by the anchor, which is the trace id.

<a id="TR-97904614ad56"></a>

## Trace TR-97904614ad56 — stackit_postgresflex_instance.postgres

| | |
|---|---|
| Block | `stackit_postgresflex_instance.postgres` in `terraform/data.tf` |
| Source units | `google_sql_database_instance.postgres` |
| Comment | 15 lines as the generators wrote it, 15 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from google_sql_database_instance.postgres (database.tf:25) — REPLATFORM / MEDIUM
rule gcp.sql_instance/sql-postgres · KB 0.394.0 · target maturity GA · lifecycle active · evidence internal · review required
flavor_id 2.4 = 2 vCPU / 4 GiB, single-node (eu01 catalogue 2026-10-18).
REVIEW: the source disk grows by itself (disk_autoresize is on, the Cloud SQL default), so its disk_size is the size the Terraform file asks for and not necessarily the size of the data today — read the current disk size of the instance before the move and give PostgreSQL Flex at least that much; a PostgreSQL Flex storage has a fixed size and no autoscaling (pinned provider).
backup_schedule is a default (02:00 daily): the source states no backup start time (Cloud SQL then picks one of its own).
PITR on PostgreSQL Flex restores into a new cloned instance; backups are kept 32–90 days.
NOT CARRIED (google_sql_database_instance.postgres): settings.user_labels — labels are metadata and the draft carries none.
WARNING source-provider-unverified: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint ">= 6, < 8" excludes it (pinned 8.4.0) (stated once for the whole estate)
retention_days: the source backup retention is not visible statically; 32 days is the STACKIT minimum (32–90).
LEDGER network exposure: publicly accessible → instance endpoint restricted by ACL — TRANSFORMED
NOT CARRIED (google_sql_user.django): password — the source password is not copied: STACKIT generates the user's password (stackit_postgresflex_user.password is computed, pinned provider) — hand the new one to the application.
NOT CARRIED (google_sql_user.django): deletion_policy — stackit_postgresflex_user is deleted directly (pinned provider): ABANDON (keep the Cloud SQL user, drop it from state only) has no counterpart.
NOT CARRIED (google_sql_user.django): name — a user name is not visible statically: create that user with stackit_postgresflex_user.
NOT CARRIED (google_sql_database.database): deletion_policy — stackit_postgresflex_database is deleted directly (pinned provider): ABANDON (keep the Cloud SQL database, drop it from state only) has no counterpart.
NOT CARRIED (google_sql_database.database): name — a database name (or the number of databases) is not visible statically: create that database with stackit_postgresflex_database.
````