# Trace of `terraform/storage.tf` — 1 blocks

> FOR REVIEW — generated by StackToIT Assess. Architect review required before any decision.

Run `6f8f72b2-1c34-4cfc-8483-344c41245364` · source digest `sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000`

The draft keeps a one-paragraph comment above each block: where it comes from, why its values are what they are, what is not carried and which decision is open. Each section of this file is the whole comment the generators wrote for one block, unabridged and in the order they wrote it: the rule and the knowledge-base stamp, the references with their digests, the evidence of each chosen value, the reason of each attribute that is not written and the caveats of the checks. The `# trace:` line above a block names its section by the anchor, which is the trace id.

<a id="TR-03d7fb936653"></a>

## Trace TR-03d7fb936653 — stackit_objectstorage_bucket.media

| | |
|---|---|
| Block | `stackit_objectstorage_bucket.media` in `terraform/storage.tf` |
| Source units | `google_storage_bucket.media` |
| Comment | 8 lines as the generators wrote it, 8 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
from google_storage_bucket.media (storage.tf:17) — RECONFIGURE / MEDIUM
rule gcp.storage_bucket/gcs · KB 0.394.0 · target maturity GA · lifecycle active · evidence internal · review required
WARNING gcs-force-destroy: force_destroy lets Terraform delete the bucket together with its objects.
WARNING source-provider-unverified: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint ">= 6, < 8" excludes it (pinned 8.4.0) (stated once for the whole estate)
NOT CARRIED (google_storage_bucket.media): storage_class = REGIONAL — stackit_objectstorage_bucket has a name and object_lock only (pinned provider): the bucket's storage class, Autoclass, hierarchical-namespace and requester-pays settings are not generated.
NOT CARRIED (google_storage_bucket.media): force_destroy = true — stackit_objectstorage_bucket has no force-destroy override (pinned provider): deleting a bucket that still holds objects behaves as STACKIT's Object Storage API defines it — empty the bucket (or migrate its objects) before it is destroyed.
NOT CARRIED (google_storage_bucket_iam_member.automation): member, role = roles/storage.admin — the draft of google_storage_bucket.media does not carry this one member's role on the Cloud Storage bucket. Proposed, switched off until it is decided: proposals/proposal_automation, switch proposal_automation_enabled.
NOT CARRIED (google_storage_bucket_iam_member.server): member, role = roles/storage.admin — the draft of google_storage_bucket.media does not carry this one member's role on the Cloud Storage bucket. Proposed, switched off until it is decided: proposals/proposal_server, switch proposal_server_enabled.
````