# Trace of `terraform/security.tf` — 2 blocks

> FOR REVIEW — generated by StackToIT Assess. Architect review required before any decision.

Run `6f8f72b2-1c34-4cfc-8483-344c41245364` · source digest `sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000`

The draft keeps a one-paragraph comment above each block: where it comes from, why its values are what they are, what is not carried and which decision is open. Each section of this file is the whole comment the generators wrote for one block, unabridged and in the order they wrote it: the rule and the knowledge-base stamp, the references with their digests, the evidence of each chosen value, the reason of each attribute that is not written and the caveats of the checks. The `# trace:` line above a block names its section by the anchor, which is the trace id.

<a id="TR-20eecaf8afaa"></a>

## Trace TR-20eecaf8afaa — stackit_secretsmanager_instance.migrated_secrets

| | |
|---|---|
| Block | `stackit_secretsmanager_instance.migrated_secrets` in `terraform/security.tf` |
| Source units | `google_secret_manager_secret.django_admin_password`, `google_secret_manager_secret.django_settings` |
| Comment | 18 lines as the generators wrote it, 13 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
One Secrets Manager instance holds all migrated secrets; recreate each secret as a key in it.
NOT CARRIED (google_secret_manager_secret.django_admin_password): replication, secret_id — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied.
NOT CARRIED (google_secret_manager_secret_iam_binding.django_admin_password): members, role = roles/secretmanager.secretAccessor — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied. Proposed, switched off until it is decided: proposals/proposal_django_admin_password, switch proposal_django_admin_password_enabled.
NOT CARRIED (google_secret_manager_secret_version.django_admin_password): secret_data — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied.
NOT CARRIED (google_secret_manager_secret.django_settings): replication, secret_id — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied.
NOT CARRIED (google_secret_manager_secret_iam_binding.django_settings): members, role = roles/secretmanager.secretAccessor — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied. Proposed, switched off until it is decided: proposals/proposal_django_settings, switch proposal_django_settings_enabled.
NOT CARRIED (google_secret_manager_secret_version.django_settings): secret_data — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied.
google_secret_manager_secret.django_admin_password: WARNING secret-iam-access: The secret has grants for individual principals.
google_secret_manager_secret.django_admin_password: WARNING source-provider-unverified: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint ">= 6, < 8" excludes it (pinned 8.4.0) (stated once for the whole estate)
google_secret_manager_secret.django_settings: WARNING secret-iam-access: The secret has grants for individual principals.
google_secret_manager_secret.django_settings: WARNING source-provider-unverified: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint ">= 6, < 8" excludes it (pinned 8.4.0) (stated once for the whole estate)
replaces: google_secret_manager_secret.django_admin_password, google_secret_manager_secret.django_settings
````

<a id="TR-d46bac8a52a7"></a>

## Trace TR-d46bac8a52a7 — stackit_secretsmanager_user.migration

| | |
|---|---|
| Block | `stackit_secretsmanager_user.migration` in `terraform/security.tf` |
| Source units | `google_secret_manager_secret.django_admin_password`, `google_secret_manager_secret.django_settings` |
| Comment | 3 lines as the generators wrote it, 3 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
The user the API steps of the execution plan log in as to write the migrated secrets into the Secrets Manager instance.
DEFAULT: write_enabled = true gives this user write access to the secrets engine of the whole instance (the provider schema: "If true, the user has writeaccess to the secrets engine"), so every secret of the instance, not one; it exists only for the API steps of the execution plan that write the migrated secrets (the Vault-compatible login of the STACKIT provider guide for Secrets Manager logs in as such a user). STACKIT generates its password; it is the sensitive output stackit_secretsmanager_user_migration_password and the state holds it in plain text. Delete the user (remove this block, then apply) once the secrets are written; a workload that reads a secret gets a user of its own with write_enabled = false, or the instance's role binding.
````