StackToIT Migration Intelligence Workspace

3 units: google_pubsub_topic.faux, google_secret_manager_secret.django_admin_password and 1 more · owner role Platform Architect · required by phase: before the pilot · 3 steps of the plan rest on it directly, and the steps after them wait with them

Options and trade-off

• allow-calls-of-the-api Allow the calls of the API for this migration: the draft already carries it out, so the answer frees the steps that wait for it; in this run it frees 5 steps of the plan by itself

Applications touched

migrate (PROPOSED)

• google_secret_manager_secret.django_settings is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server

Wave

waves 1 to 3 · steps in security, platform services

What an answer frees

The answer that frees most frees 5 steps of the plan (2 of them automated) by itself.

Answer

not answered: no decisions file was given with this run

What the draft does

The draft holds MAN/pubsub.topic/name/google_pubsub_topic.faux, API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password and API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings until this decision is answered by an answer that frees it.

Still open

The target design is open until the decision is answered. The plan calls a STACKIT API that is not generally available (alpha, beta, or a release status its documentation does not state), which may change or be withdrawn, so it makes those calls only after you allow them (2 APIs): until you answer, the calls and the steps of their path wait. Allowing carries them out; refusing keeps the draft's own path where the API's path is an alternative beside it, and leaves the question open where the API is the only carrier of what its call sets. No block of the draft waits for it, and no unit's eligibility rests on it.

Ways out

1. Allow the calls of the API for this migration; effect: The calls of the API the plan states are made as the plan writes them (the request documents of the execution package), and the steps of their path are taken; the migration then depends on an API that may change or vanish.

What closes it

Every API the record lists is answered in the decisions file: allowed, or refused.

Next action

Allow STACKIT's pre-release APIs, which may change or be withdrawn: Pub/Sub v1beta (beta) and Secrets Manager v1 (release status not stated). 3 steps of the plan name this decision and wait for this answer (the steps that come after them are counted in what an answer frees); allowing the calls lets the plan carry them out and makes the migration depend on those APIs. If you say no (record a rejection), the calls are not made: the steps of Pub/Sub and Secrets Manager stay open. Record the answer in the decisions file given with --decisions (decisions-template.yaml); answer each API on its own through the members of the record.

7 units: google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init and 5 more · owner role Platform Architect · required by phase: before the pilot · 4 steps of the plan rest on it directly, and the steps after them wait with them

Options and trade-off

• use-the-proposed-module Use the proposed module, with the stated difference: the draft already carries it out, so the answer frees the steps that wait for it; in this run it frees 4 steps of the plan by itself
• design-it-another-way Design it another way and leave the module off: a person carries it out: the answer frees only the manual step that does; in this run it frees 4 steps of the plan by itself

Applications touched

migrate (PROPOSED)

• google_secret_manager_secret.django_settings is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server
• google_storage_bucket.media is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server

Wave

waves 2 to 3 · steps in data services, workloads

What an answer frees

The answer that frees most frees 4 steps of the plan (none of them automated) by itself.

Answer

not answered: no decisions file was given with this run

What the draft does

The draft holds MAN/unit/google_cloudbuild_trigger.activategcb, MAN/unit/google_cloudbuild_trigger.init, MAN/unit/google_cloudbuild_trigger.placeholder and MAN/unit/google_firebase_hosting_site.client until this decision is answered by an answer that frees it.

Still open

The target design is open until the decision is answered. The target has no equal of a source capability, and the draft holds a STACKIT alternative in a module that is switched off (8 converter decisions): nothing of the module applies until a person accepts the stated difference, gives it its values and sets its switch, or designs the capability another way.

Ways out

1. Use the proposed module, with the stated difference; effect: A person reads the module, sets its values and sets its switch to true: the module is then part of the plan of the draft, with the stated difference from the source. While the switch is false, the module creates nothing.
2. Design it another way and leave the module off; effect: A person designs the capability another way, by hand, and the switch of the module stays false: the module creates nothing and the unit's manual step stays the person's work.

What closes it

An answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option.

Next action

Decide whether a proposed STACKIT alternative replaces a source capability for google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder, google_firebase_hosting_site.client and 3 more: choose one of the 2 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_sql_database_instance.postgres · owner role Data Architect · required by phase: before the pilot · 13 steps of the plan rest on it directly, and the steps after them wait with them

Options and trade-off

• export-and-import-with-the-engine-clients Export the data from the source and import it with the clients of the target engine: a person carries it out: the answer frees only the manual step that does; in this run it frees 4 steps of the plan by itself
• replicate-with-the-engine-replication Replicate the data with the replication of the source engine until the cutover: a person carries it out: the answer frees only the manual step that does; in this run it frees 6 steps of the plan by itself
• copy-the-objects-with-rclone Copy the objects of the bucket with rclone, from the source bucket to the STACKIT bucket: a person carries it out: the answer frees only the manual step that does; in this run it frees no step of the plan
• copy-the-objects-with-the-aws-cli Copy the objects of the bucket with the AWS CLI, through a staging directory: a person carries it out: the answer frees only the manual step that does; in this run it frees no step of the plan
• migrate-with-a-tool-of-my-own Move the data with a migration tool or a replication of the owner's own: a person carries it out: the answer frees only the manual step that does; in this run it frees 3 steps of the plan by itself

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• google_sql_database_instance.postgres is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server

Wave

wave 1 · steps in data services, cutover, decommission

What an answer frees

The answer that frees most frees 6 steps of the plan (none of them automated) by itself; 7 of the 13 steps it holds stay held (7 steps need another option or a path of a person).

Answer

not answered: no decisions file was given with this run

What the draft does

The draft holds MAN/data/google_sql_database_instance.postgres/initial-copy/logical-replication, MAN/data/google_sql_database_instance.postgres/delta-sync/logical-replication, MAN/data/google_sql_database_instance.postgres/write-freeze/dump-restore, MAN/data/google_sql_database_instance.postgres/final-sync/dump-restore, MAN/data/google_sql_database_instance.postgres/reconcile/dump-restore, MAN/data/google_sql_database_instance.postgres/write-freeze/logical-replication, MAN/data/google_sql_database_instance.postgres/final-sync/logical-replication, MAN/data/google_sql_database_instance.postgres/reconcile/logical-replication, MAN/data/google_sql_database_instance.postgres/write-freeze/own-tool, MAN/data/google_sql_database_instance.postgres/final-sync/own-tool and 3 more until this decision is answered by an answer that frees it.

Still open

The target design is open until the decision is answered. The method that moves the data of a store (a database, a cache, a search domain, or the objects of a bucket) to its STACKIT service is a person's choice (1 converter decision): the steps of each method are in the plan where the planner covers the store (a PostgreSQL database and an S3 bucket, each with the runbook of the move), and the plan holds one manual step the person writes where it does not; the steps of the move wait for the choice. The choice decides how the data is moved, not whether it is: every method is work a person does by hand, so the unit that owns one keeps a manual data-migration step, and answering it does not take that step away.

Ways out

1. Export the data from the source and import it with the clients of the target engine; effect: A person exports the data from the source and imports it into the STACKIT instance with the clients of its engine during a window the business accepts, then checks that the copy is complete; the clients reach the instance at the host and port its credential states. The source and the target engine may differ (DynamoDB to MongoDB Flex), so the export is converted where they do. The plan holds the steps of this option as typed steps: for a PostgreSQL database, for a MySQL, MariaDB or Aurora MySQL database moving to MariaDB and for an RDS for SQL Server database moving to SQLServer Flex (the native backup, its copy to a STACKIT S3 bucket and the import_database call) the preflight, the rehearsal, the write freeze, the dump or backup and the restore or import inside it, the reconcile and the cleanup; for an ElastiCache, MemoryDB or ElastiCache serverless cache moving to a Key Value Store the preflight, the rehearsal, the write freeze, the copy by a client, the reconcile and the cleanup; for an Amazon Aurora DSQL cluster moving to PostgreSQL Flex the preflight, the rehearsal, the write freeze, the copy of the tables by a client (the schema from the catalogs of the cluster, or from pg_dump --schema-only where the preflight shows that it works, and the rows through the PostgreSQL protocol: no AWS page read documents a dump of a cluster), the reconcile and the cleanup; for an OpenSearch store the write freeze, the copy and the reconcile. The decision offers this option only for a store whose STACKIT service documents a way in with such clients: PostgreSQL Flex (for an Aurora DSQL cluster, which has no change stream, this option and the tool of the customer's own are the only ones; the replication of the engine is not offered), MariaDB (the mysql client loads a dump into an empty instance), SQLServer Flex (a .bak file imported with import_database), Key Value Store (the tutorial migrates a Redis instance by the MIGRATE command; for an ElastiCache source, where AWS lists migrate among the commands unavailable for caches running Redis OSS, the copy is a client that iterates the keys with SCAN and copies each with DUMP, PTTL and RESTORE; for a MemoryDB source, where AWS lists migrate, sync, psync, bgsave, save and config among the unavailable commands and the cluster mode is always on, the same client copy runs against every shard primary found with CLUSTER NODES or CLUSTER SLOTS, with TLS where the source has it and an ACL user that reaches every key; whether DUMP, RESTORE and PTTL run on a standard MemoryDB cluster is not stated by AWS, and for a member of a multi-Region cluster, whose page lists PTTL as unsupported, the step says the TTLs are not carried) and OpenSearch (the reindex operation). For a store without a documented way in (MongoDB Flex, a memcached cache) it is not offered and the decision offers the tool of the customer's own alone.
2. Replicate the data with the replication of the source engine until the cutover; effect: A person sets up the replication of the source engine so that the STACKIT instance follows the source while the application keeps writing to the source (for PostgreSQL, logical replication: the schema is copied first with pg_dump --schema-only, a publication on the source and a subscription on the target copy the existing rows and then the changes, and the sequences are copied inside the write freeze because they are not replicated). The source needs a change and a reboot to turn replication on, and the target must be able to reach the source. Inside the write freeze the person waits until the target has caught up, compares both sides and switches the clients, then removes the replication. For a PostgreSQL database the plan holds the steps of this option (the initial copy, the watch of the lag, the freeze, the final copy, the reconcile and the cleanup); for an S3 bucket this option is not available, because S3 Replication copies between Amazon S3 buckets and no STACKIT bucket is documented as a destination (the plan holds the two copy tools instead); for any other engine this option is not offered, because no STACKIT service other than PostgreSQL Flex documents the replication of a source engine into it (MariaDB, Key Value Store, OpenSearch and MongoDB Flex document none, and the SQLServer Flex page on transactional replication describes an on-premises publisher and does not name Amazon RDS as one), so the decision of such a store offers the export and the import with the engine clients where its service documents them, and the tool of the customer's own.
3. Copy the objects of the bucket with rclone, from the source bucket to the STACKIT bucket; effect: For an S3 bucket: a person runs rclone on a move host that reaches both endpoints, with two S3 remotes (the source with the AWS credentials of the shell, the target as a provider Other remote at the STACKIT S3 endpoint with a credential of a credentials group, both read from the environment at run time), copies every current object while the writers keep writing, repeats the copy until a pass is short, stops the writers, runs the last pass, settles what the source deleted after the first copy, and compares both sides (the count and the bytes, the key lists and, where a hash is shared, the content) before the applications are switched. The copy carries the current object of every key and nothing of the bucket's configuration: no older version, no delete marker, no retention, no ACL, no policy; those are settled where the draft names them. The plan holds the steps of this option (the initial copy, the passes, the freeze, the last pass, the reconcile and the cleanup) with command templates and no credential value. No copy was run against a STACKIT bucket by StackToIT.
4. Copy the objects of the bucket with the AWS CLI, through a staging directory; effect: For an S3 bucket: a person runs the AWS CLI on a move host with free disk for the data. One command sends its requests to one endpoint, so the objects are downloaded from the AWS bucket into a directory with aws s3 sync and uploaded from it to the STACKIT bucket with aws s3 sync and --endpoint-url set to the STACKIT S3 endpoint, with the credential of a credentials group read from the environment at run time. The data crosses the host twice, one pass after the other; aws s3 sync decides by size and last-modified time and never compares the content, so the comparison before the switch downloads the target and compares the files. The copy carries the current object of every key and nothing of the bucket's configuration, as with rclone. The plan holds the steps of this option with command templates and no credential value. No copy was run against a STACKIT bucket by StackToIT.
5. Move the data with a migration tool or a replication of the owner's own; effect: A person moves the data with a tool or a replication they run (for example a change-data-capture replication that keeps the copy in step until the cutover), writes its steps, the checks before the move, the cutover window and the way back, and carries them out. The STACKIT instance is reached at the host and port its credential states. The plan holds that work as typed steps: the write freeze of the source, the copy as one step whose commands the person writes, and the reconcile that compares both sides; the source stays the way back until the reconcile records GO, which a person checks, since the plan cannot know that the tool leaves the source unchanged. A memcached cache holds a confirmation instead of a copy. A bucket repeated by count or for_each has neither a reconcile nor any other option: its instances and the buckets they move to are not named, so the plan holds the one manual step, which the person writes for each instance after naming them.

What closes it

An answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option.

Next action

Choose how the data is moved for google_sql_database_instance.postgres: choose one of the 5 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

4 units: google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init and 2 more · owner role Platform Architect · required by phase: before the pilot · 4 steps of the plan rest on it directly, and the steps after them wait with them

Options and trade-off

• units-go-to-the-project-variable The units of the source project go to the project the variable project_id names: the draft already carries it out, so the answer frees the steps that wait for it; in this run it frees 1 step of the plan by itself
• units-go-to-the-project-of-their-network The units of the source project go to the project of their network: the draft already carries it out, so the answer frees the steps that wait for it; in this run it frees 1 step of the plan by itself

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• google_sql_database_instance.postgres is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server

Wave

wave 1 · steps in data services, workloads

What an answer frees

The answer that frees most frees 1 step of the plan (none of them automated) by itself.

Answer

not answered: no decisions file was given with this run

What the draft does

The draft does not carry the setting on google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder and google_sql_database_instance.postgres. The draft holds MAN/estate/SOURCE_PROJECT_MAPPING until this decision is answered by an answer that frees it.

Still open

The target design is open until the decision is answered. The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Project and Cloud Build location are data-residency/project-boundary facts with no STACKIT CI/CD resource to remap them onto -- REVIEW. The project of the instance (google 8.4.0 `project`: "The ID of the project in which the resource belongs. If it is not provided, the provider project is used"). A STACKIT project is the scope for ownership, resource consumption and access control (docs.stackit.cloud/platform/resource-manager/basics/projects/): whether the database's source project becomes the project of the rest of the estate is a design decision no rule evidences — a person confirms it — REVIEW (critical).

Ways out

1. The units of the source project go to the project the variable project_id names; effect: A person states that the units of this source project go to the STACKIT project var.project_id names. The source project is carried nowhere: the answer records the person's mapping, changes nothing in the draft, which keeps its own project resolver, and closes the settings of that project.
2. The units of the source project go to the project of their network; effect: A person states that the units of this source project go to the STACKIT project of the network they stand in. The network design maps a source network to a target project, and no map from a source project to a target project exists: the answer records the person's mapping, changes nothing in the draft, which keeps its own project resolver, and closes the settings of that project.

What closes it

A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting. A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. The module terraform/proposals/proposal_activategcb is switched on with its values and checked, or the design that replaces it is set up and checked; the decision records which. The module terraform/proposals/proposal_init is switched on with its values and checked, or the design that replaces it is set up and checked; the decision records which. The module terraform/proposals/proposal_placeholder is switched on with its values and checked, or the design that replaces it is set up and checked; the decision records which.

Next action

State where the units of each source project of the estate go for google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder and google_sql_database_instance.postgres: choose one of the 2 options, in the inputs file given with --inputs (the stubs are in inputs-template.yaml), once for each source project: that closes the settings of the project and does not change the draft.

4 units: google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server and 2 more · owner role Platform Architect · required by phase: before the pilot · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

• map-source-locations-to-the-draft-region Map every source location of the estate to the one STACKIT region the draft builds in (the DEFAULT): the draft already carries it out, so the answer frees the steps that wait for it; in this run it frees 1 step of the plan by itself
• choose-the-region-of-each-location Choose the STACKIT region of each source location: it changes the draft: answer target.region.source_location in the inputs file (--inputs) and run again; the steps stay held until the draft carries it; in this run it frees no step of the plan

Applications touched

migrate (PROPOSED), server (PROPOSED)

• google_sql_database_instance.postgres is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server
• google_storage_bucket.media is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server

Wave

waves 1 to 4 · steps in data services

What an answer frees

The answer that frees most frees 1 step of the plan (none of them automated) by itself.

Answer

not answered: no decisions file was given with this run

What the draft does

The draft does not carry the setting on google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server, google_sql_database_instance.postgres and google_storage_bucket.media. The draft holds MAN/estate/SOURCE_REGION_MAPPING until this decision is answered by an answer that frees it.

Still open

The target design stands on a default that nobody answered: StackToIT chose it, and a person confirms it or changes it in the decisions file. The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The region the service, job or worker pool runs in (google 8.4.0 `location`). A person confirms the region — REVIEW (critical, the value is not verified against the target). The region of the instance (google 8.4.0 `region`; unset means the provider's region). A single-region location (us-central1, europe-west3, ...), or one not visible statically: the draft sets no region on stackit_objectstorage_bucket (`region`: "if not defined, the provider region is used", pinned provider), so the bucket lands in the STACKIT region the user sets, not in the source's — a person confirms the residency — REVIEW.

Ways out

1. Map every source location of the estate to the one STACKIT region the draft builds in; effect: The draft builds every unit in the one region of the estate, and that is what it does with no answer. STACKIT hosts its regions in Germany and Austria, each physically separate from the others, so the region is not shown to hold the residency a source location gave: the option states where the draft builds and claims no equal residency. A review of this option records the confirmation and closes no setting; an answer of target.region.source_location for each location closes the settings of that location.
2. Choose the STACKIT region of each source location; effect: An answer of target.region.source_location names the region of one source location, and the units whose location the scan cannot read are one more subject of the same topic. An answer that names the region the draft builds in closes the settings of that location. The draft builds in one region, so an answer that names another region is recorded, and read by the network design, and closes nothing until the estate is built there (target.region). Whether a region holds the residency of a source location stays the person's statement.; the draft is generated again with it

What closes it

A person confirms the STACKIT region of the SKE cluster the workload runs on holds the residency the source region gave, since no mapping between Google and STACKIT regions is evidenced. A person confirms the STACKIT region of the instance (and of a read replica, decided with its primary) holds the residency the source region gave. A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.

Next action

Map each source location of the estate to a STACKIT region for google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server, google_sql_database_instance.postgres and google_storage_bucket.media: choose one of the 2 options, in the inputs file given with --inputs (the stubs are in inputs-template.yaml), once for each source location: that closes the settings of the location.

1 unit: google_firebase_hosting_site.client · owner role Identity Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group holds an affected unit

Wave

not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in data services

Answer

not answered: no decisions file was given with this run

What the draft does

Confirm the project of the firebase hosting site: The draft does not carry the setting on google_firebase_hosting_site.client; a manual step stands for it (MAN/unit/google_firebase_hosting_site.client).

Still open

Confirm the project of the firebase hosting site: the draft writes nothing for the unit: what the setting becomes depends on what replaces it. Confirm the project of the firebase hosting site: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_firebase_hosting_site.project (identity access): The Google Cloud project the resource is created in. IAM policy, organisation policy and audit configuration are inherited from the project, so it decides who can act on the resource and what it is isolated from. The unit names google_firebase_project.default (google_firebase_project) through this setting (the target does not carry it: it is in the class manual review), so what the reference becomes is part of this setting.

What closes it

Confirm the project of the firebase hosting site: A person decides which STACKIT project, and with it which access rules, holds the replacement.

Next action

Confirm the project of the firebase hosting site: This setting follows the decision on the unit: A person decides which STACKIT project, and with it which access rules, holds the replacement.

1 unit: google_firebase_hosting_site.client · owner role Platform Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group holds an affected unit

Wave

not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in data services

Answer

not answered: no decisions file was given with this run

What the draft does

Confirm the site ID of the firebase hosting site: The draft does not carry the setting on google_firebase_hosting_site.client; a manual step stands for it (MAN/unit/google_firebase_hosting_site.client).

Still open

Confirm the site ID of the firebase hosting site: the draft writes nothing for the unit: what the setting becomes depends on what replaces it. Confirm the site ID of the firebase hosting site: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_firebase_hosting_site.site_id (workload compatibility): A globally unique identifier for the Hosting site; other settings, bindings and clients refer to the object by this id. Firebase Hosting has no STACKIT counterpart, so the site is rebuilt on Object Storage with a CDN.

What closes it

Confirm the site ID of the firebase hosting site: A person sets this up on the bucket, the CDN distribution and the domain that replace Firebase Hosting, or decides to drop it, and records the decision.

Next action

Confirm the site ID of the firebase hosting site: This setting follows the decision on the unit: A person sets this up on the bucket, the CDN distribution and the domain that replace Firebase Hosting, or decides to drop it, and records the decision.

1 unit: google_cloud_run_v2_job.migrate · owner role Identity Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

migrate (PROPOSED)

Wave

wave 4 · steps in platform services

Answer

not answered: no decisions file was given with this run

What the draft does

Review the service identity setting: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/service-identity).

Still open

Review the service identity setting: the target behaviour of this setting is not established. Review the service identity setting: Whether the draft carries this setting is decided by its semantic ledger entry "workload identity", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). The Google service account the workload runs as. target.workload.identity asks the customer which model the pods use.

What closes it

Review the service identity setting: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.

Next action

Review the service identity setting: This setting follows the decision on the unit; it is not decided on its own.

1 unit: google_cloud_run_v2_job.migrate · owner role Network Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

2 options across its settings, each with its trade-off under Technical details

Applications touched

migrate (PROPOSED)

Wave

wave 4 · steps in platform services

Answer

not answered: no decisions file was given with this run

What the draft does

Review the cloud run v2 job network exposure setting: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/cloud-run-v2-job-network-exposure).

Still open

Review the cloud run v2 job network exposure setting: the target behaviour of this setting is not established. Review the cloud run v2 job network exposure setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. template.template.vpc_access.egress, template.template.vpc_access.network_interfaces.network, template.template.vpc_access.network_interfaces.subnetwork, template.template.volumes.cloud_sql_instance.instances (network exposure) — what the resource is reachable from and what it can reach. The draft names these settings NOT CARRIED: which database the job mounts and which network its egress goes through are re-created on the target (a database connection, the network of the workload) by a person. A person decides: REVIEW.

Ways out

1. Review the cloud run v2 job network exposure setting: Carry the setting on Kubernetes Job/CronJob on SKE; effect: You design how Kubernetes Job/CronJob on SKE carries this setting and build it outside the draft. The draft does not change and no step is freed by it.
2. Review the cloud run v2 job network exposure setting: Accept the difference; effect: The target does not carry this setting as the source states it, and you record that as accepted. The draft does not change and no step is freed by it.

What closes it

Review the cloud run v2 job network exposure setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.

Next action

Review the cloud run v2 job network exposure setting: Review the cloud run v2 job network exposure setting for google_cloud_run_v2_job.migrate: Decide how Kubernetes Job/CronJob on SKE carries this setting, or accept the difference. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_cloud_run_v2_job.migrate · owner role Security Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

migrate (PROPOSED)

Wave

wave 4 · steps in platform services

Answer

not answered: no decisions file was given with this run

What the draft does

Create the Kubernetes Secrets for the Secret Manager references: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/secrets).

Still open

Create the Kubernetes Secrets for the Secret Manager references: the target behaviour of this setting is not established. Create the Kubernetes Secrets for the Secret Manager references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A Secret Manager reference in the environment becomes a secretKeyRef of the Deployment or Job and a secret volume a Kubernetes secret volume, and the head of the manifest lists the Secrets to create. The draft writes no Secret, because no value of a secret reaches an output.

What closes it

Create the Kubernetes Secrets for the Secret Manager references: A person creates the Kubernetes Secrets the manifest lists, filled from STACKIT Secrets Manager (for example with an External Secrets Operator).

Next action

Create the Kubernetes Secrets for the Secret Manager references: Create the Kubernetes Secrets for the Secret Manager references for google_cloud_run_v2_job.migrate: A person creates the Kubernetes Secrets the manifest lists, filled from STACKIT Secrets Manager (for example with an External Secrets Operator). Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_cloud_run_v2_service.server · owner role Platform Architect — named by its manual steps; the record states no owner · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

server (PROPOSED)

Wave

wave 4 · steps in platform services

Answer

not answered: no decisions file was given with this run

What the draft does

Review the IAM policy grant setting: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect).

Still open

Review the IAM policy grant setting: the target behaviour of this setting is not established. Review the IAM policy grant setting: A check of the knowledge base (run iam policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). A full IAM policy (member/role bindings) is set directly on the service via policy_data (google 8.4.0); STACKIT has no per-service IAM policy resource, so who may invoke the migrated SKE workload is decided by a person — REVIEW.

What closes it

Review the IAM policy grant setting: A person decides what this finding asks, and records the evidence or the decision. The finding says: A full IAM policy (member/role bindings) is set directly on the service via policy_data; STACKIT has no per-service IAM policy resource, so who may invoke the migrated SKE workload is decided by a person — the draft carries no invocation check.

Next action

Review the IAM policy grant setting: Review the IAM policy grant setting for google_cloud_run_v2_service.server: A person decides what this finding asks, and records the evidence or the decision. The finding says: A full IAM policy (member/role bindings) is set directly on the service via policy_data; STACKIT has no per-service IAM policy resource, so who may invoke the migrated SKE workload is decided by a person — the draft carries no invocation check. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_cloud_run_v2_service.server · owner role Identity Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

server (PROPOSED)

Wave

wave 4 · steps in platform services

Answer

not answered: no decisions file was given with this run

What the draft does

Decide who may invoke the service: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-identity-architect). Review the service identity setting: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-identity-architect).

Still open

Decide who may invoke the service: the target behaviour of this setting is not established Review the service identity setting: the target behaviour of this setting is not established. Decide who may invoke the service: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Cloud Run lets only callers with the invoker role through unless the service is made public. The draft carries no invocation check; the SKE exposure and the authentication of callers (application, authenticating proxy, or no exposure at all) are decided by a person. Review the service identity setting: Whether the draft carries this setting is decided by its semantic ledger entry "workload identity", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). The Google service account the workload runs as. target.workload.identity asks the customer which model the pods use.

What closes it

Decide who may invoke the service: A person decides how callers of the workload are authenticated (in the application, behind an authenticating proxy, or by no exposure at all) and how the SKE exposure is set, since the draft carries no invocation check. Review the service identity setting: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference.

Next action

Decide who may invoke the service: Decide who may invoke the service for google_cloud_run_v2_service.server: A person decides how callers of the workload are authenticated (in the application, behind an authenticating proxy, or by no exposure at all) and how the SKE exposure is set, since the draft carries no invocation check. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_cloud_run_v2_service.server · owner role Network Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

server (PROPOSED)

Wave

wave 4 · steps in platform services

Answer

not answered: no decisions file was given with this run

What the draft does

Decide how the service connects to the database: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/cloud-sql-connection).

Still open

Decide how the service connects to the database: the target behaviour of this setting is not established. Decide how the service connects to the database: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The Cloud SQL connection volume (a connector socket) has no counterpart: the workload connects to the migrated Flex instance endpoint over TLS.

What closes it

Decide how the service connects to the database: A person points the workload at the endpoint of the migrated database instance (a Flex or MariaDB instance) over TLS, because the Cloud SQL connector socket has no counterpart.

Next action

Decide how the service connects to the database: Decide how the service connects to the database for google_cloud_run_v2_service.server: A person points the workload at the endpoint of the migrated database instance (a Flex or MariaDB instance) over TLS, because the Cloud SQL connector socket has no counterpart. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_cloud_run_v2_service.server · owner role Security Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

server (PROPOSED)

Wave

wave 4 · steps in platform services

Answer

not answered: no decisions file was given with this run

What the draft does

Confirm the environment settings: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-security-architect). Create the Kubernetes Secrets for the Secret Manager references: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-security-architect).

Still open

Confirm the environment settings: the target behaviour of this setting is not established Create the Kubernetes Secrets for the Secret Manager references: the target behaviour of this setting is not established. Confirm the environment settings: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The draft writes the environment keys into the ConfigMap and the env of the Deployment or Job. A value is copied only when it is a quantity under a name that says so or a boolean, because any other value can hold a secret, so the rest of the values are a person's. Create the Kubernetes Secrets for the Secret Manager references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A Secret Manager reference in the environment becomes a secretKeyRef of the Deployment or Job and a secret volume a Kubernetes secret volume, and the head of the manifest lists the Secrets to create. The draft writes no Secret, because no value of a secret reaches an output.

What closes it

Confirm the environment settings: A person fills in the values the manifest lists as not copied, in the ConfigMap on the cluster. Create the Kubernetes Secrets for the Secret Manager references: A person creates the Kubernetes Secrets the manifest lists, filled from STACKIT Secrets Manager (for example with an External Secrets Operator).

Next action

Confirm the environment settings: Confirm the environment settings for google_cloud_run_v2_service.server: A person fills in the values the manifest lists as not copied, in the ConfigMap on the cluster. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_cloudbuild_trigger.activategcb · owner role Identity Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group holds an affected unit

Wave

not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in workloads

Answer

not answered: no decisions file was given with this run

What the draft does

Review the build identity setting: The draft does not carry the setting on google_cloudbuild_trigger.activategcb; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.activategcb).

Still open

Review the build identity setting: the draft writes nothing for the unit: what the setting becomes depends on what replaces it. Review the build identity setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The service account the build (or the Pub/Sub push notification) runs as; STACKIT Git Pipelines has its own, differently-shaped identity model -- REVIEW.

What closes it

Review the build identity setting: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting.

Next action

Review the build identity setting: This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied.

1 unit: google_cloudbuild_trigger.activategcb · owner role Platform Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group holds an affected unit

Wave

not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in workloads

Answer

not answered: no decisions file was given with this run

What the draft does

Confirm its dependency on the references: The draft does not carry the setting on google_cloudbuild_trigger.activategcb; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.activategcb). Choose the container image or artifact: The draft does not carry the setting on google_cloudbuild_trigger.activategcb; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.activategcb). Confirm the entry point of the function: The draft does not carry the setting on google_cloudbuild_trigger.activategcb; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.activategcb). Review the log destination setting: The draft does not carry the setting on google_cloudbuild_trigger.activategcb; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.activategcb).

Still open

Confirm its dependency on the references: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Choose the container image or artifact: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Confirm the entry point of the function: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Review the log destination setting: the draft writes nothing for the unit: what the setting becomes depends on what replaces it. Confirm its dependency on the references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger and google_cloudbuild_worker_pool names other units or resources (google_cloudbuild_bitbucket_server_config, google_cloudbuild_worker_pool, google_cloudbuildv2_repository, google_compute_global_address, google_compute_network, google_developer_connect_git_repository_link, google_pubsub_topic, google_secret_manager_secret, google_secret_manager_secret_version, google_service_account, google_sourcerepo_repository, google_storage_bucket). A person confirms how the replacement carries the relation between this unit and the units it names, or accepts the difference. Choose the container image or artifact: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger.build.step.name, artifact or image reference (workload compatibility: a setting that binds the code to its runtime stays CRITICAL). Confirm the entry point of the function: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger.build.step.entrypoint, build.step.script, build.step.args, entry point (workload compatibility: a setting that binds the code to its runtime stays CRITICAL). Review the log destination setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states where/whether build logs are captured or exposed back to GitHub; STACKIT Git Pipelines' own logging model is different -- REVIEW.

What closes it

Confirm its dependency on the references: A person confirms how the replacement carries the relation, or accepts the difference. Choose the container image or artifact: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting. Confirm the entry point of the function: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting. Review the log destination setting: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting.

Next action

Confirm its dependency on the references: This setting follows the decision on the unit: A person confirms how the replacement carries the relation, or accepts the difference.

1 unit: google_cloudbuild_trigger.init · owner role Identity Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group holds an affected unit

Wave

not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in workloads

Answer

not answered: no decisions file was given with this run

What the draft does

Review the build identity setting: The draft does not carry the setting on google_cloudbuild_trigger.init; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.init).

Still open

Review the build identity setting: the draft writes nothing for the unit: what the setting becomes depends on what replaces it. Review the build identity setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The service account the build (or the Pub/Sub push notification) runs as; STACKIT Git Pipelines has its own, differently-shaped identity model -- REVIEW.

What closes it

Review the build identity setting: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting.

Next action

Review the build identity setting: This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied.

1 unit: google_cloudbuild_trigger.init · owner role Platform Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group holds an affected unit

Wave

not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in workloads

Answer

not answered: no decisions file was given with this run

What the draft does

Confirm its dependency on the references: The draft does not carry the setting on google_cloudbuild_trigger.init; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.init). Choose the container image or artifact: The draft does not carry the setting on google_cloudbuild_trigger.init; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.init). Confirm the entry point of the function: The draft does not carry the setting on google_cloudbuild_trigger.init; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.init). Review the log destination setting: The draft does not carry the setting on google_cloudbuild_trigger.init; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.init).

Still open

Confirm its dependency on the references: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Choose the container image or artifact: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Confirm the entry point of the function: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Review the log destination setting: the draft writes nothing for the unit: what the setting becomes depends on what replaces it. Confirm its dependency on the references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger and google_cloudbuild_worker_pool names other units or resources (google_cloudbuild_bitbucket_server_config, google_cloudbuild_worker_pool, google_cloudbuildv2_repository, google_compute_global_address, google_compute_network, google_developer_connect_git_repository_link, google_pubsub_topic, google_secret_manager_secret, google_secret_manager_secret_version, google_service_account, google_sourcerepo_repository, google_storage_bucket). A person confirms how the replacement carries the relation between this unit and the units it names, or accepts the difference. Choose the container image or artifact: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger.build.step.name, artifact or image reference (workload compatibility: a setting that binds the code to its runtime stays CRITICAL). Confirm the entry point of the function: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger.build.step.entrypoint, build.step.script, build.step.args, entry point (workload compatibility: a setting that binds the code to its runtime stays CRITICAL). The unit names google_firebase_hosting_site.client (google_firebase_hosting_site) through this setting (the target does not carry it: it is in the class redesign), so what the reference becomes is part of this setting. Review the log destination setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states where/whether build logs are captured or exposed back to GitHub; STACKIT Git Pipelines' own logging model is different -- REVIEW.

What closes it

Confirm its dependency on the references: A person confirms how the replacement carries the relation, or accepts the difference. Choose the container image or artifact: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting. Confirm the entry point of the function: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting. Review the log destination setting: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting.

Next action

Confirm its dependency on the references: This setting follows the decision on the unit: A person confirms how the replacement carries the relation, or accepts the difference.

1 unit: google_cloudbuild_trigger.placeholder · owner role Identity Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group holds an affected unit

Wave

not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in workloads

Answer

not answered: no decisions file was given with this run

What the draft does

Review the build identity setting: The draft does not carry the setting on google_cloudbuild_trigger.placeholder; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.placeholder).

Still open

Review the build identity setting: the draft writes nothing for the unit: what the setting becomes depends on what replaces it. Review the build identity setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The service account the build (or the Pub/Sub push notification) runs as; STACKIT Git Pipelines has its own, differently-shaped identity model -- REVIEW.

What closes it

Review the build identity setting: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting.

Next action

Review the build identity setting: This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied.

1 unit: google_cloudbuild_trigger.placeholder · owner role Platform Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group holds an affected unit

Wave

not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in workloads

Answer

not answered: no decisions file was given with this run

What the draft does

Confirm its dependency on the references: The draft does not carry the setting on google_cloudbuild_trigger.placeholder; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.placeholder). Choose the container image or artifact: The draft does not carry the setting on google_cloudbuild_trigger.placeholder; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.placeholder). Review the log destination setting: The draft does not carry the setting on google_cloudbuild_trigger.placeholder; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.placeholder).

Still open

Confirm its dependency on the references: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Choose the container image or artifact: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Review the log destination setting: the draft writes nothing for the unit: what the setting becomes depends on what replaces it. Confirm its dependency on the references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger and google_cloudbuild_worker_pool names other units or resources (google_cloudbuild_bitbucket_server_config, google_cloudbuild_worker_pool, google_cloudbuildv2_repository, google_compute_global_address, google_compute_network, google_developer_connect_git_repository_link, google_pubsub_topic, google_secret_manager_secret, google_secret_manager_secret_version, google_service_account, google_sourcerepo_repository, google_storage_bucket). A person confirms how the replacement carries the relation between this unit and the units it names, or accepts the difference. Choose the container image or artifact: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger.build.step.name, artifact or image reference (workload compatibility: a setting that binds the code to its runtime stays CRITICAL). Review the log destination setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states where/whether build logs are captured or exposed back to GitHub; STACKIT Git Pipelines' own logging model is different -- REVIEW.

What closes it

Confirm its dependency on the references: A person confirms how the replacement carries the relation, or accepts the difference. Choose the container image or artifact: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting. Review the log destination setting: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting.

Next action

Confirm its dependency on the references: This setting follows the decision on the unit: A person confirms how the replacement carries the relation, or accepts the difference.

1 unit: google_pubsub_topic.faux · owner role Platform Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group holds an affected unit

Wave

wave 1 · steps in platform services

Answer

not answered: no decisions file was given with this run

What the draft does

Confirm the name of the resource on the target: The draft does not carry the setting on google_pubsub_topic.faux; a manual step stands for it (MAN/semantic/google_pubsub_topic.faux/tc-name).

Still open

Confirm the name of the resource on the target: the target behaviour of this setting is not established. Confirm the name of the resource on the target: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_pubsub_topic.name: The topic's own resource name, which publishers and subscribers address it by; access to it is controlled by IAM, not by the name string itself, and a changed name breaks every client that uses the old one.

What closes it

Confirm the name of the resource on the target: A person confirms the topic name the replacement messaging service carries against the publishers and subscribers that use it, or accepts the new name.

Next action

Confirm the name of the resource on the target: Confirm the name of the resource on the target for google_pubsub_topic.faux: A person confirms the topic name the replacement messaging service carries against the publishers and subscribers that use it, or accepts the new name. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_secret_manager_secret.django_admin_password · owner role Identity Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

migrate (PROPOSED)

Wave

wave 2 · steps in security

Answer

not answered: no decisions file was given with this run

What the draft does

Decide how the secrets are carried: The draft does not carry the setting on google_secret_manager_secret.django_admin_password; a manual step stands for it (MAN/semantic/google_secret_manager_secret.django_admin_password/secret-settings).

Still open

Decide how the secrets are carried: the target behaviour of this setting is not established. Decide how the secrets are carried: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The settings of the secret beside its value (secret-value): STACKIT replicates it itself (no replica locations or per-replica keys), tags and version states have no counterpart, and IAM members and policy map to Secrets Manager users (read-only or read-write for a whole instance) or to experimental role bindings on a secret group — REVIEW.

What closes it

Decide how the secrets are carried: A person recreates the secret in the Secrets Manager instance, since its data is not written into the draft, and decides for each IAM member whether it gets a user of the whole instance, a role binding on a secret group, or a separate instance.

Next action

Decide how the secrets are carried: Decide how the secrets are carried for google_secret_manager_secret.django_admin_password: A person recreates the secret in the Secrets Manager instance, since its data is not written into the draft, and decides for each IAM member whether it gets a user of the whole instance, a role binding on a secret group, or a separate instance. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_secret_manager_secret.django_admin_password · owner role Security Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

migrate (PROPOSED)

Wave

wave 2 · steps in security

Answer

not answered: no decisions file was given with this run

What the draft does

Provide the values of the secrets: The draft does not carry the setting on google_secret_manager_secret.django_admin_password; a manual step stands for it (MAN/semantic/google_secret_manager_secret.django_admin_password/open-settings-security-architect). Confirm the name of the secret: The draft does not carry the setting on google_secret_manager_secret.django_admin_password; a manual step stands for it (MAN/semantic/google_secret_manager_secret.django_admin_password/open-settings-security-architect).

Still open

Provide the values of the secrets: the target behaviour of this setting is not established Confirm the name of the secret: the target behaviour of this setting is not established. Provide the values of the secrets: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_secret_manager_secret_version.secret_data: the value of the secret. StackToIT never reads it and never writes it into the draft; the API step of the secret writes the document the customer supplies. Confirm the name of the secret: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_secret_manager_secret.secret_id: The secret's own resource identifier; access to the secret's value is controlled by IAM bindings and replication/encryption settings, not by the id string itself.

What closes it

Provide the values of the secrets: A person decides where the value comes from, supplies the document and the step has run. Confirm the name of the secret: A person confirms the secret name in STACKIT Secrets Manager against what refers to the source secret ID, or accepts the new name.

Next action

Provide the values of the secrets: Provide the values of the secrets for google_secret_manager_secret.django_admin_password: A person decides where the value comes from, supplies the document and the step has run. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_secret_manager_secret.django_settings · owner role Identity Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• google_secret_manager_secret.django_settings is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server

Wave

wave 3 · steps in security

Answer

not answered: no decisions file was given with this run

What the draft does

Decide how the secrets are carried: The draft does not carry the setting on google_secret_manager_secret.django_settings; a manual step stands for it (MAN/semantic/google_secret_manager_secret.django_settings/secret-settings).

Still open

Decide how the secrets are carried: the target behaviour of this setting is not established. Decide how the secrets are carried: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The settings of the secret beside its value (secret-value): STACKIT replicates it itself (no replica locations or per-replica keys), tags and version states have no counterpart, and IAM members and policy map to Secrets Manager users (read-only or read-write for a whole instance) or to experimental role bindings on a secret group — REVIEW.

What closes it

Decide how the secrets are carried: A person recreates the secret in the Secrets Manager instance, since its data is not written into the draft, and decides for each IAM member whether it gets a user of the whole instance, a role binding on a secret group, or a separate instance.

Next action

Decide how the secrets are carried: Decide how the secrets are carried for google_secret_manager_secret.django_settings: A person recreates the secret in the Secrets Manager instance, since its data is not written into the draft, and decides for each IAM member whether it gets a user of the whole instance, a role binding on a secret group, or a separate instance. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_secret_manager_secret.django_settings · owner role Security Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• google_secret_manager_secret.django_settings is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server

Wave

wave 3 · steps in security

Answer

not answered: no decisions file was given with this run

What the draft does

Provide the values of the secrets: The draft does not carry the setting on google_secret_manager_secret.django_settings; a manual step stands for it (MAN/semantic/google_secret_manager_secret.django_settings/open-settings-security-architect). Confirm the name of the secret: The draft does not carry the setting on google_secret_manager_secret.django_settings; a manual step stands for it (MAN/semantic/google_secret_manager_secret.django_settings/open-settings-security-architect).

Still open

Provide the values of the secrets: the target behaviour of this setting is not established Confirm the name of the secret: the target behaviour of this setting is not established. Provide the values of the secrets: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_secret_manager_secret_version.secret_data: the value of the secret. StackToIT never reads it and never writes it into the draft; the API step of the secret writes the document the customer supplies. Confirm the name of the secret: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_secret_manager_secret.secret_id: The secret's own resource identifier; access to the secret's value is controlled by IAM bindings and replication/encryption settings, not by the id string itself.

What closes it

Provide the values of the secrets: A person decides where the value comes from, supplies the document and the step has run. Confirm the name of the secret: A person confirms the secret name in STACKIT Secrets Manager against what refers to the source secret ID, or accepts the new name.

Next action

Provide the values of the secrets: Provide the values of the secrets for google_secret_manager_secret.django_settings: A person decides where the value comes from, supplies the document and the step has run. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_service_account.automation · owner role Identity Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

1 option across its settings, each with its trade-off under Technical details

Applications touched

migrate (PROPOSED)

Wave

wave 1 · steps in security

What the draft does

Review the account name setting: The draft does not carry the setting on google_service_account.automation; a manual step stands for it (MAN/semantic/google_service_account.automation/open-settings). Map the IAM roles of the service account to STACKIT roles: The draft does not carry the setting on google_service_account.automation; a manual step stands for it (MAN/semantic/google_service_account.automation/open-settings).

Next action

Review the account name setting: This setting follows the decision on the unit: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.

1 unit: google_service_account.client · owner role Identity Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

1 option across its settings, each with its trade-off under Technical details

Applications touched

none: no applications file was given and no suggested group holds an affected unit

Wave

wave 1 · steps in security

What the draft does

Review the account name setting: The draft does not carry the setting on google_service_account.client; a manual step stands for it (MAN/semantic/google_service_account.client/open-settings). Map the IAM roles of the service account to STACKIT roles: The draft does not carry the setting on google_service_account.client; a manual step stands for it (MAN/semantic/google_service_account.client/open-settings).

Next action

Review the account name setting: This setting follows the decision on the unit: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.

1 unit: google_service_account.init · owner role Identity Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

1 option across its settings, each with its trade-off under Technical details

Applications touched

none: no applications file was given and no suggested group holds an affected unit

Wave

not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in security

What the draft does

Review the account name setting: The draft does not carry the setting on google_service_account.init; a manual step stands for it (MAN/semantic/google_service_account.init/open-settings). Map the IAM roles of the service account to STACKIT roles: The draft does not carry the setting on google_service_account.init; a manual step stands for it (MAN/semantic/google_service_account.init/open-settings).

Next action

Review the account name setting: This setting follows the decision on the unit: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.

1 unit: google_service_account.server · owner role Identity Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

1 option across its settings, each with its trade-off under Technical details

Applications touched

server (PROPOSED)

Wave

wave 1 · steps in security

What the draft does

Review the account name setting: The draft does not carry the setting on google_service_account.server; a manual step stands for it (MAN/semantic/google_service_account.server/open-settings). Map the IAM roles of the service account to STACKIT roles: The draft does not carry the setting on google_service_account.server; a manual step stands for it (MAN/semantic/google_service_account.server/open-settings).

Next action

Review the account name setting: This setting follows the decision on the unit: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.

1 unit: google_sql_database_instance.postgres · owner role Identity Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• google_sql_database_instance.postgres is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server

Wave

wave 1 · steps in data services

Answer

not answered: no decisions file was given with this run

What the draft does

Review the database users setting: The draft does not carry the setting on google_sql_database_instance.postgres; a manual step stands for it (MAN/semantic/google_sql_database_instance.postgres/database-users).

Still open

Review the database users setting: the target behaviour of this setting is not established. Review the database users setting: A check of the knowledge base (sql user not generated) needs a value the scan cannot read statically, so it could not decide. A built-in user of a PostgreSQL instance becomes a stackit_postgresflex_user with the same username (pinned provider) — TRANSFORMED. IAM users (and a name or type not visible statically) are not generated — REVIEW (check sql-user-not-generated); users of the other engines are named NOT CARRIED — REVIEW.

What closes it

Review the database users setting: A literal value or a resolved reference in the source lets the check decide, or a person verifies the value.

Next action

Review the database users setting: This setting follows the decision on the unit: A literal value or a resolved reference in the source lets the check decide, or a person verifies the value.

1 unit: google_sql_database_instance.postgres · owner role Network Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

2 options across its settings, each with its trade-off under Technical details

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• google_sql_database_instance.postgres is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server

Wave

wave 1 · steps in data services

Answer

not answered: no decisions file was given with this run

What the draft does

Review the user and database settings setting: The draft does not carry the setting on google_sql_database_instance.postgres; a manual step stands for it (MAN/semantic/google_sql_database_instance.postgres/user-and-database-settings).

Still open

Review the user and database settings setting: the target behaviour of this setting is not established. Review the user and database settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The source password is not copied (STACKIT generates it: stackit_postgresflex_user.password is computed), a host restriction and ABANDON deletion policies have no counterpart (pinned provider) — the draft names them NOT CARRIED — REVIEW.

Ways out

1. Review the user and database settings setting: Carry the setting on STACKIT PostgreSQL Flex; effect: You design how STACKIT PostgreSQL Flex carries this setting and build it outside the draft. The draft does not change and no step is freed by it.
2. Review the user and database settings setting: Accept the difference; effect: The target does not carry this setting as the source states it, and you record that as accepted. The draft does not change and no step is freed by it.

What closes it

Review the user and database settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.

Next action

Review the user and database settings setting: Review the user and database settings setting for google_sql_database_instance.postgres: Decide how STACKIT PostgreSQL Flex carries this setting, or accept the difference. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_sql_database_instance.postgres · owner role Platform Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• google_sql_database_instance.postgres is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server

Wave

wave 1 · steps in data services

Answer

not answered: no decisions file was given with this run

What the draft does

Confirm the name of the resource on the target: The draft does not carry the setting on google_sql_database_instance.postgres; a manual step stands for it (MAN/semantic/google_sql_database_instance.postgres/open-settings-platform-architect). Confirm the name of the SQL database: The draft does not carry the setting on google_sql_database_instance.postgres; a manual step stands for it (MAN/semantic/google_sql_database_instance.postgres/open-settings-platform-architect).

Still open

Confirm the name of the resource on the target: the target behaviour of this setting is not established Confirm the name of the SQL database: the target behaviour of this setting is not established. Confirm the name of the resource on the target: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_sql_database_instance.name: The instance's name/label; does not itself grant access, encrypt data, or control backups/availability/residency. Confirm the name of the SQL database: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_sql_database.name (a facet of the unit): The literal database name; determines the connection target's label but does not itself grant or restrict access, encrypt data, or affect backups/availability/residency.

What closes it

Confirm the name of the resource on the target: A person confirms the instance name the STACKIT database carries against what refers to the source instance name, or accepts the new name. Confirm the name of the SQL database: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.

Next action

Confirm the name of the resource on the target: Confirm the name of the resource on the target for google_sql_database_instance.postgres: A person confirms the instance name the STACKIT database carries against what refers to the source instance name, or accepts the new name. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_storage_bucket.media · owner role Storage Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

2 options across its settings, each with its trade-off under Technical details

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• google_storage_bucket.media is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server

Wave

wave 2 · steps in data services

Answer

not answered: no decisions file was given with this run

What the draft does

Confirm whether the bucket may be deleted with its contents: The draft does not carry the setting on google_storage_bucket.media. The plan refuses REF/semantic/google_storage_bucket.media/force-destroy.

Still open

Confirm whether the bucket may be deleted with its contents: the target behaviour of this setting is not established. Confirm whether the bucket may be deleted with its contents: A check of the knowledge base (gcs force destroy) found a setting the target has no counterpart for (a finding of this unit describes it). stackit_objectstorage_bucket (pinned provider) "cannot be destroyed if the bucket contains objects" (schema description): force_destroy = false — a destroy that stops at a non-empty bucket — is what STACKIT does, PRESERVED; true has no counterpart, UNSUPPORTED (check gcs-force-destroy).

Ways out

1. Confirm whether the bucket may be deleted with its contents: Accept the loss; effect: Nothing on the target carries this setting, and you record that as accepted. The draft does not change and no step is freed by it.
2. Confirm whether the bucket may be deleted with its contents: Rebuild it by hand; effect: Find which applications use the Google client libraries or signed URLs — those need a code change. The draft does not change and no step is freed by it.

What closes it

Confirm whether the bucket may be deleted with its contents: A person accepts the difference or the design changes: nothing in the source can make the target carry it.

Next action

Confirm whether the bucket may be deleted with its contents: Confirm whether the bucket may be deleted with its contents for google_storage_bucket.media: force_destroy lets Terraform delete the bucket together with its objects. STACKIT has no such override: stackit_objectstorage_bucket (the pinned STACKIT provider) "cannot be destroyed if the bucket contains objects" — empty the bucket (or migrate its objects) before destroying it. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_storage_bucket.media · owner role Storage Architect — named by its manual steps; the record states no owner · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• google_storage_bucket.media is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server

Wave

wave 2 · steps in data services

Answer

not answered: no decisions file was given with this run

What the draft does

Review the IAM access setting: The draft does not carry the setting on google_storage_bucket.media; a manual step stands for it (MAN/semantic/google_storage_bucket.media/iam-access).

Still open

Review the IAM access setting: the target behaviour of this setting is not established. Review the IAM access setting: A check of the knowledge base (gcs iam) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states who may access the bucket, granted with IAM bindings or ACL entries.

What closes it

Review the IAM access setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person creates the bucket policies and Object Storage credentials that give the same access on STACKIT.

Next action

Review the IAM access setting: Review the IAM access setting for google_storage_bucket.media: A person creates the bucket policies and Object Storage credentials that give the same access on STACKIT. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_storage_bucket.media · owner role Identity Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• google_storage_bucket.media is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server

Wave

wave 2 · steps in data services

Answer

not answered: no decisions file was given with this run

What the draft does

Review the IAM grant setting: The draft does not carry the setting on google_storage_bucket.media; a manual step stands for it (MAN/semantic/google_storage_bucket.media/open-settings-identity-architect). Review the public access setting: The draft does not carry the setting on google_storage_bucket.media; a manual step stands for it (MAN/semantic/google_storage_bucket.media/open-settings-identity-architect).

Still open

Review the IAM grant setting: the target behaviour of this setting is not established Review the public access setting: the target behaviour of this setting is not established. Review the IAM grant setting: A check of the knowledge base (gcs iam) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The value-level reader of who gets which role (`iam-access` above is the facet as a whole): role, member(s) and condition. A GCP principal (user:, group:, serviceAccount:, allUsers) and a predefined role have no STACKIT counterpart in a bucket policy, whose statements name principals and S3 actions (supported-permissions-in-bucket-policies docs; the draft writes no policy) — a person translates each grant — REVIEW for every value, allUsers included (that one is also public-access, TRANSFORMED). Review the public access setting: A check of the knowledge base (gcs public) needs a value the scan cannot read statically, so it could not decide. The counterpart is a bucket policy with Principal "*" and s3:GetObject (documented sample), but stackit_objectstorage_bucket has no policy attribute and the provider no bucket-policy resource, so the draft writes none: REVIEW, as for the IP rules.

What closes it

Review the IAM grant setting: A person decides what this finding asks, and records the evidence or the decision. The finding says: Bucket access is granted with IAM bindings or ACL entries; on STACKIT it becomes bucket policies and Object Storage credentials. Review the public access setting: A literal value or a resolved reference in the source lets the check decide, or a person verifies the value.

Next action

Review the IAM grant setting: Review the IAM grant setting for google_storage_bucket.media: A person decides what this finding asks, and records the evidence or the decision. The finding says: Bucket access is granted with IAM bindings or ACL entries; on STACKIT it becomes bucket policies and Object Storage credentials. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_storage_bucket.media · owner role Platform Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• google_storage_bucket.media is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server

Wave

wave 2 · steps in data services

Answer

not answered: no decisions file was given with this run

What the draft does

Confirm the name of the Cloud Storage bucket: The draft does not carry the setting on google_storage_bucket.media; a manual step stands for it (MAN/semantic/google_storage_bucket.media/tc-storage-bucket-name).

Still open

Confirm the name of the Cloud Storage bucket: the target behaviour of this setting is not established. Confirm the name of the Cloud Storage bucket: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The name of the Cloud Storage bucket, in lowercase and at most 63 characters per the provider documentation, by which applications address it.

What closes it

Confirm the name of the Cloud Storage bucket: A person confirms the Object Storage bucket name against the applications and tools that use the source bucket name, or accepts the new name.

Next action

Confirm the name of the Cloud Storage bucket: Confirm the name of the Cloud Storage bucket for google_storage_bucket.media: A person confirms the Object Storage bucket name against the applications and tools that use the source bucket name, or accepts the new name. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_storage_bucket.media · owner role Security Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group is known to hold an affected unit

• google_storage_bucket.media is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server

Wave

wave 2 · steps in data services

Answer

not answered: no decisions file was given with this run

What the draft does

Decide the geo-replication: The draft does not carry the setting on google_storage_bucket.media; a manual step stands for it (MAN/semantic/google_storage_bucket.media/geo-replication).

Still open

Decide the geo-replication: the target behaviour of this setting is not established. Decide the geo-replication: The value is read from a variable's default; that is not a fact of the source. A custom_placement_config not visible statically (a dynamic block over an unknown for_each, a whole value from a variable) may be absent: the facts state no replication, the ledger writes no line and a person decides (REVIEW by the case; 2026-09-25 unknown-value audit — it used to be claimed as replicated).

What closes it

Decide the geo-replication: The value is set where the module is called (a literal), the variable is given its value in a variable file of the scan (--var-file), or a person confirms the value production uses.

Next action

Decide the geo-replication: Decide the geo-replication for google_storage_bucket.media: The value is set where the module is called (a literal), the variable is given its value in a variable file of the scan (--var-file), or a person confirms the value production uses. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_cloudbuild_trigger.placeholder · owner role not stated · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group holds an affected unit

Wave

not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in workloads

Answer

not answered: no decisions file was given with this run

What the draft does

Decide which firebase hosting site this resource depends on: The draft does not carry the setting on google_cloudbuild_trigger.placeholder; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.placeholder).

Still open

Decide which firebase hosting site this resource depends on: the draft writes nothing for the unit: what the setting becomes depends on what replaces it. Decide which firebase hosting site this resource depends on: This unit names a resource of the type google_firebase_hosting_site (by an attribute that configures it) and the target does not carry that resource as a mapped unit (it is redesigned, blocked, left for review or has no draft block of its own), and no semantic of this unit's contract reads that type: what the reference becomes on the target is not assessed.

What closes it

Decide which firebase hosting site this resource depends on: The contract of this unit gains a semantic that reads google_firebase_hosting_site (and lists it as carried), or a person decides what the reference to the resource becomes.

Next action

Decide which firebase hosting site this resource depends on: This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied.

1 unit: google_cloud_run_v2_job.migrate · owner role Platform Architect · required by phase: not stated · 2 steps of the plan rest on it directly, and the steps after them wait with them

Options and trade-off

4 options across its settings, each with its trade-off under Technical details

Applications touched

migrate (PROPOSED)

Wave

wave 4 · steps in platform services, workloads

Answer

not answered: no decisions file was given with this run

What the draft does

Choose the container image or artifact: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect). The draft does not carry the image reference; the setting is left to a person. Confirm the entry point of the function: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect). Review the k4 cloud run volume mount cloud run v2 job setting: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect). Confirm the name of the cloud run v2 job: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect). Confirm the name of the env entry of the containers of the template of the template of the cloud run v2 job: The draft carries it on google_cloud_run_v2_job.migrate: step MAN/draft/kubernetes/migrate/manifests-yaml (the 1 environment keys of the source (DJANGO_ENV) are the env entries of `terraform/kubernetes/migrate/manifests.yaml`: the keys are carried, and the values stay the person's). Confirm the name of the volumes entry of the template of the template of the cloud run v2 job: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect). Review the terraform destroy guard setting: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect).

Still open

Choose the container image or artifact: That the same build runs on the target platform. Confirm the entry point of the function: the target behaviour of this setting is not established Review the k4 cloud run volume mount cloud run v2 job setting: the target behaviour of this setting is not established Confirm the name of the cloud run v2 job: the target behaviour of this setting is not established Confirm the name of the env entry of the containers of the template of the template of the cloud run v2 job: a person confirms that the carried value is what the source relies on Confirm the name of the volumes entry of the template of the template of the cloud run v2 job: the target behaviour of this setting is not established Review the terraform destroy guard setting: the target behaviour of this setting is not established. Choose the container image or artifact: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_service.template.spec.containers.image; google_cloud_run_v2_service.template.containers.image, build_config.base_image, build_config.image_uri and 5 more; google_cloud_run_v2_job.template.template.containers.image; google_cloud_run_v2_worker_pool.template.containers.image, artifact or image reference (workload compatibility: a setting that binds the code to its runtime stays CRITICAL). Confirm the entry point of the function: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_service.template.spec.containers.command, template.spec.containers.args, template.spec.containers.working_dir; google_cloud_run_v2_service.template.containers.command, template.containers.args, template.containers.working_dir and 4 more. Review the k4 cloud run volume mount cloud run v2 job setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Where a volume appears in the container, which part of it is mounted there and the gcsfuse flags of a bucket mount (volume_mounts, mount_path and sub_path; volumes, gcs, mount_options). The application opens the bucket or share as a local directory, and the STACKIT draft mounts no volume into a container. Confirm the name of the cloud run v2 job: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_v2_job.name: The job's own name, used for identification. Confirm the name of the env entry of the containers of the template of the template of the cloud run v2 job: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_v2_job.template.template.containers.env.name: The name of an environment variable; an identifier, not the value it carries. Confirm the name of the volumes entry of the template of the template of the cloud run v2 job: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_v2_job.template.template.volumes.name: The volume's own name, used only to cross-reference it from volume_mounts.name; an internal wiring identifier with no security meaning of its own. Review the terraform destroy guard setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. deletion_protection of a Cloud Run service, job or worker pool (on unless the source switches it off, which an explicit false states) only stops Terraform from destroying the resource; it is not an API protection.

Ways out

1. Choose the container image or artifact: Run the container as a workload on SKE; needs the container image and its settings, a SKE cluster; effect: A service or a function that already runs as a container image moves as a Deployment on a SKE cluster, which is a managed Kubernetes service. Scale to zero and the billing per request go away unless an autoscaler that scales to zero is operated on the cluster.; regeneration: not stated — treated as required; risk: Capacity runs, and is billed, whether or not requests arrive.; the draft is generated again with it
2. Choose the container image or artifact: Push the application to STACKIT Cloud Foundry; needs the application in a form Cloud Foundry runs, a Cloud Foundry organization; effect: STACKIT Cloud Foundry is a managed platform for applications that a developer deploys and scales; the application is pushed from its image or its code. Scale to zero and the billing per request go away.; regeneration: not stated — treated as required; risk: The platform differs from the source platform in how it scales and how it is billed.; the draft is generated again with it
3. Confirm the entry point of the function: Carry the setting on Kubernetes Job/CronJob on SKE; effect: You design how Kubernetes Job/CronJob on SKE carries this setting and build it outside the draft. The draft does not change and no step is freed by it.
4. Confirm the entry point of the function: Accept the difference; effect: The target does not carry this setting as the source states it, and you record that as accepted. The draft does not change and no step is freed by it.

What closes it

Choose the container image or artifact: A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there. Confirm the entry point of the function: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the k4 cloud run volume mount cloud run v2 job setting: A person provides the data in the target workload at the path the application expects, with an owner and mode it can use, and checks that it finds its files. Confirm the name of the cloud run v2 job: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the name of the env entry of the containers of the template of the template of the cloud run v2 job: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Confirm the name of the volumes entry of the template of the template of the cloud run v2 job: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting. Review the terraform destroy guard setting: A person decides whether the replacement keeps the guard with lifecycle { prevent_destroy = true } in the Terraform code. Verification: Choose the container image or artifact: the image is pulled or built for the target platform and runs there.

Next action

Choose the container image or artifact: Choose the container image or artifact for google_cloud_run_v2_job.migrate: A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_cloud_run_v2_service.server · owner role Platform Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

2 options across its settings, each with its trade-off under Technical details

Applications touched

server (PROPOSED)

Wave

wave 4 · steps in platform services

Answer

not answered: no decisions file was given with this run

What the draft does

Choose the container image or artifact: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect). The draft does not carry the image reference; the setting is left to a person. Decide how the volume mounts are carried: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect). Confirm the name of the Cloud Run service: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect). Confirm the name of the volumes entry of the template of the Cloud Run service: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect). Review the terraform destroy guard setting: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect).

Still open

Choose the container image or artifact: That the same build runs on the target platform. Decide how the volume mounts are carried: the target behaviour of this setting is not established Confirm the name of the Cloud Run service: the target behaviour of this setting is not established Confirm the name of the volumes entry of the template of the Cloud Run service: the target behaviour of this setting is not established Review the terraform destroy guard setting: the target behaviour of this setting is not established. Choose the container image or artifact: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_service.template.spec.containers.image; google_cloud_run_v2_service.template.containers.image, build_config.base_image, build_config.image_uri and 5 more; google_cloud_run_v2_job.template.template.containers.image; google_cloud_run_v2_worker_pool.template.containers.image, artifact or image reference (workload compatibility: a setting that binds the code to its runtime stays CRITICAL). Decide how the volume mounts are carried: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Where a volume appears in the container, which part of it is mounted there and the gcsfuse flags of a bucket mount (volume_mounts, mount_path and sub_path; volumes, gcs, mount_options). The application opens the bucket or share as a local directory, and the STACKIT draft mounts no volume into a container. Confirm the name of the Cloud Run service: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_v2_service.name: The Service's own name; an identifier used for addressing/reference, not an access-control or safety property in itself. Confirm the name of the volumes entry of the template of the Cloud Run service: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_v2_service.template.volumes.name: The volume's own name, used only to cross-reference it from a volume_mounts.name entry; internal wiring identifier. Review the terraform destroy guard setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. deletion_protection of a Cloud Run service, job or worker pool (on unless the source switches it off, which an explicit false states) only stops Terraform from destroying the resource; it is not an API protection.

Ways out

1. Choose the container image or artifact: Run the container as a workload on SKE; needs the container image and its settings, a SKE cluster; effect: A service or a function that already runs as a container image moves as a Deployment on a SKE cluster, which is a managed Kubernetes service. Scale to zero and the billing per request go away unless an autoscaler that scales to zero is operated on the cluster.; regeneration: not stated — treated as required; risk: Capacity runs, and is billed, whether or not requests arrive.; the draft is generated again with it
2. Choose the container image or artifact: Push the application to STACKIT Cloud Foundry; needs the application in a form Cloud Foundry runs, a Cloud Foundry organization; effect: STACKIT Cloud Foundry is a managed platform for applications that a developer deploys and scales; the application is pushed from its image or its code. Scale to zero and the billing per request go away.; regeneration: not stated — treated as required; risk: The platform differs from the source platform in how it scales and how it is billed.; the draft is generated again with it

What closes it

Choose the container image or artifact: A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there. Decide how the volume mounts are carried: A person provides the data in the target workload at the path the application expects, with an owner and mode it can use, and checks that it finds its files. Confirm the name of the Cloud Run service: A person confirms the workload name on the cluster against what addresses or refers to the Cloud Run service name, or accepts the new name. Confirm the name of the volumes entry of the template of the Cloud Run service: A person keeps each volume name matched with the volume mount that refers to it when the volumes are rebuilt as workload volumes on the cluster. Review the terraform destroy guard setting: A person decides whether the replacement keeps the guard with lifecycle { prevent_destroy = true } in the Terraform code. Verification: Choose the container image or artifact: the image is pulled or built for the target platform and runs there.

Next action

Choose the container image or artifact: Choose the container image or artifact for google_cloud_run_v2_service.server: A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

1 unit: google_firebase_project.default · owner role Identity Architect · required by phase: not stated · 1 step of the plan rests on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

none: no applications file was given and no suggested group holds an affected unit

Wave

wave 1 · steps in platform services

Answer

not answered: no decisions file was given with this run

What the draft does

Confirm the project of the firebase project: The draft does not carry the setting on google_firebase_project.default. The plan refuses REF/unit/google_firebase_project.default.

Still open

Confirm the project of the firebase project: the draft writes nothing for the unit: what the setting becomes depends on what replaces it. Confirm the project of the firebase project: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_firebase_project.project (identity access): The Google Cloud project the resource is created in. IAM policy, organisation policy and audit configuration are inherited from the project, so it decides who can act on the resource and what it is isolated from. Firebase has no STACKIT counterpart, so the registration of the app is not moved and the backend the app talks to is chosen by a person.

What closes it

Confirm the project of the firebase project: A person decides which STACKIT project, and with it which access rules, holds the replacement.

Next action

Confirm the project of the firebase project: The plan refuses REF/unit/google_firebase_project.default for google_firebase_project.default: Nothing on STACKIT holds the registration of an app or the enabling of Firebase on a project. It stays with Google for as long as any Firebase service (push messaging, for example) is used, and a person decides, app by app, which backend replaces the Firebase services the app calls. Adding Firebase to a project cannot be undone (a redesign could go: List the Firebase services each app uses (authentication, database, storage, messaging, remote config); each needs its own replacement; The signing keys and store listings stay with Google Play and the Apple App Store; only the backend the app talks to moves). Decide the redesign before anything rests on this record.

2 units: google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server · owner role Identity Architect · required by phase: before the pilot · 2 steps of the plan rest on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

migrate (PROPOSED), server (PROPOSED)

Wave

wave 4 · steps in prepare

Answer

not answered: no decisions file was given with this run

What the draft does

The draft writes no resource for google_cloud_run_v2_job.migrate and google_cloud_run_v2_service.server.

Still open

The work outside the draft is neither done nor verified by StackToIT. The stackitsa plan of the draft writes no resource for 2 units and states why (the plan states the cause for each unit: google_cloud_run_v2_job.migrate: google_cloud_run_v2_job.migrate is a container task: its 1 identity binding(s) are facts only, and no service account is attached for it (no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account); google_cloud_run_v2_service.server: google_cloud_run_v2_service.server is a container service: its 1 identity binding(s) are facts only, and no service account is attached for it (no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account)): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.

What closes it

The identity fact of google_cloud_run_v2_job.migrate (template[0].template[0].service_account of google_cloud_run_v2_job.migrate names google_service_account.automation) is decided on STACKIT and recorded, or recorded as not needed. The identity fact of google_cloud_run_v2_service.server (template[0].service_account of google_cloud_run_v2_service.server names google_service_account.server) is decided on STACKIT and recorded, or recorded as not needed.

Next action

Outside the draft, for google_cloud_run_v2_job.migrate and google_cloud_run_v2_service.server: Decide how google_cloud_run_v2_job.migrate gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it (and 1 more manual steps); the plan lists it as manual work.

2 units: google_service_account.automation, google_service_account.server · owner role Identity Architect · required by phase: before the pilot · 2 steps of the plan rest on it directly, and the steps after them wait with them

Options and trade-off

none listed: the knowledge base has no options for this kind of decision, so none is invented and a person states the answer in the decisions file

Applications touched

migrate (PROPOSED), server (PROPOSED)

Wave

wave 1 · steps in prepare

Answer

not answered: no decisions file was given with this run

What the draft does

The draft writes no resource for google_service_account.automation and google_service_account.server.

Still open

The work outside the draft is neither done nor verified by StackToIT. The stackitsa plan of the draft writes no resource for 2 units and states why (no resource is written for the unit and the plan names a step beside it): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.

What closes it

The people and the workloads that may use the service account written for google_service_account.automation are named, and the roles it holds are stated. The people and the workloads that may use the service account written for google_service_account.server are named, and the roles it holds are stated.

Next action

Outside the draft, for google_service_account.automation and google_service_account.server: Decide who may use the STACKIT service account written for google_service_account.automation, what it may do and which workloads run as it: the draft attaches it to nothing (and 1 more manual steps); the plan lists it as manual work.