# Trace of `terraform/identity.tf` — 4 blocks

> FOR REVIEW — generated by StackToIT Assess. Architect review required before any decision.

Run `6f8f72b2-1c34-4cfc-8483-344c41245364` · source digest `sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000`

The draft keeps a one-paragraph comment above each block: where it comes from, why its values are what they are, what is not carried and which decision is open. Each section of this file is the whole comment the generators wrote for one block, unabridged and in the order they wrote it: the rule and the knowledge-base stamp, the references with their digests, the evidence of each chosen value, the reason of each attribute that is not written and the caveats of the checks. The `# trace:` line above a block names its section by the anchor, which is the trace id.

<a id="TR-043d09e0acdf"></a>

## Trace TR-043d09e0acdf — stackit_service_account.automation

| | |
|---|---|
| Block | `stackit_service_account.automation` in `terraform/identity.tf` |
| Source units | `google_service_account.automation` |
| Comment | 10 lines as the generators wrote it, 10 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from google_service_account.automation (iam.tf:54) — RECONFIGURE / MEDIUM
rule gcp.service_account/service-account · KB 0.394.0 · target maturity EXPERIMENTAL · lifecycle active · evidence internal · review required
Grant the permissions of the source policies as STACKIT role assignments (provider experiment "iam").
WARNING source-provider-unverified: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint ">= 6, < 8" excludes it (pinned 8.4.0) (stated once for the whole estate)
NOT CARRIED (google_service_account.automation): account_id — the account ID is not visible statically, or the account is declared several times: the STACKIT account is named after the source address.
NOT CARRIED (google_service_account.automation): display_name = Automation service account — stackit_service_account has no display name, only a name besides project_id (pinned provider).
TODO: Decide who may use the STACKIT service account written for google_service_account.automation, what it may do and which workloads run as it: the draft attaches it to nothing — google_service_account.automation is used by the workloads that run as it, by a reading that is KNOWN: google_cloud_run_v2_job.migrate (google_cloud_run_v2_job.migrate#template[0].template[0].service_account); the other places that refer to it: google_cloudbuild_trigger.init, google_project_iam_member.automation_permissions, google_secret_manager_secret_iam_binding.django_admin_password, google_secret_manager_secret_iam_binding.django_settings, google_storage_bucket_iam_member.automation. Its service account is written by the draft's converter of google_service_account, not by this plan, and the plan attaches it to nothing. (phase BEFORE_PILOT, owner Identity Architect)
TODO: 3 Google role grant(s) are not written as STACKIT role assignments: they are repeated (count or for_each), so their roles and members may differ by instance (google_project_iam_member.client_permissions; google_project_iam_member.init_permissions; google_project_iam_member.server_permissions).
TODO: 1 Google role grant(s) are not written as STACKIT role assignments: their role is not visible statically (google_project_iam_member.automation_permissions).
````

<a id="TR-5ca70ac9e6fa"></a>

## Trace TR-5ca70ac9e6fa — stackit_service_account.client

| | |
|---|---|
| Block | `stackit_service_account.client` in `terraform/identity.tf` |
| Source units | `google_service_account.client` |
| Comment | 6 lines as the generators wrote it, 6 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from google_service_account.client (iam.tf:48) — RECONFIGURE / MEDIUM
rule gcp.service_account/service-account · KB 0.394.0 · target maturity EXPERIMENTAL · lifecycle active · evidence internal · review required
Grant the permissions of the source policies as STACKIT role assignments (provider experiment "iam").
WARNING source-provider-unverified: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint ">= 6, < 8" excludes it (pinned 8.4.0) (stated once for the whole estate)
NOT CARRIED (google_service_account.client): account_id — the account ID is not visible statically, or the account is declared several times: the STACKIT account is named after the source address.
NOT CARRIED (google_service_account.client): display_name = Client Frontend service account — stackit_service_account has no display name, only a name besides project_id (pinned provider).
````

<a id="TR-82b9a11ffa8d"></a>

## Trace TR-82b9a11ffa8d — stackit_service_account.init

| | |
|---|---|
| Block | `stackit_service_account.init` in `terraform/identity.tf` |
| Source units | `google_service_account.init` |
| Comment | 7 lines as the generators wrote it, 7 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from google_service_account.init (iam.tf:61) — RECONFIGURE / MEDIUM
rule gcp.service_account/service-account · KB 0.394.0 · target maturity EXPERIMENTAL · lifecycle active · evidence internal · review required
Grant the permissions of the source policies as STACKIT role assignments (provider experiment "iam").
WARNING source-provider-unverified: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint ">= 6, < 8" excludes it (pinned 8.4.0) (stated once for the whole estate)
NOT CARRIED (google_service_account.init): account_id — the account ID is not visible statically, or the account is declared several times: the STACKIT account is named after the source address.
NOT CARRIED (google_service_account.init): display_name = Jump Start App Init SA — stackit_service_account has no display name, only a name besides project_id (pinned provider).
TODO: how many instances google_service_account.init creates is not visible statically (its count/for_each reads a variable that can be set when the source is planned, so the variable's default is not a fact of the source and is not used); this block drafts one instance — repeat it (count/for_each) for the real number and check each instance's settings.
````

<a id="TR-49328bb589c6"></a>

## Trace TR-49328bb589c6 — stackit_service_account.server

| | |
|---|---|
| Block | `stackit_service_account.server` in `terraform/identity.tf` |
| Source units | `google_service_account.server` |
| Comment | 8 lines as the generators wrote it, 8 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from google_service_account.server (iam.tf:42) — RECONFIGURE / MEDIUM
rule gcp.service_account/service-account · KB 0.394.0 · target maturity EXPERIMENTAL · lifecycle active · evidence internal · review required
Grant the permissions of the source policies as STACKIT role assignments (provider experiment "iam").
WARNING source-provider-unverified: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint ">= 6, < 8" excludes it (pinned 8.4.0) (stated once for the whole estate)
NOT CARRIED (google_service_account.server): account_id — the account ID is not visible statically, or the account is declared several times: the STACKIT account is named after the source address.
NOT CARRIED (google_service_account.server): display_name = API Backend service account — stackit_service_account has no display name, only a name besides project_id (pinned provider).
TODO: Decide who may use the STACKIT service account written for google_service_account.server, what it may do and which workloads run as it: the draft attaches it to nothing — google_service_account.server is used by the workloads that run as it, by a reading that is KNOWN: google_cloud_run_v2_service.server (google_cloud_run_v2_service.server#template[0].service_account); the other places that refer to it: google_project_iam_member.server_permissions, google_secret_manager_secret_iam_binding.django_settings, google_storage_bucket_iam_member.server. Its service account is written by the draft's converter of google_service_account, not by this plan, and the plan attaches it to nothing. (phase BEFORE_PILOT, owner Identity Architect)
````