StackToIT Migration Intelligence Workspace

Executive lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Architect lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Platform lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Security lens: the sections are in the order this reader usually wants, and Costs and Migration Plan are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Application owner lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Programme lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

FinOps lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Engineering lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Operations

Whether the target can be run: identity, audit, observability, backup, restore, support and lifecycle.

Terraform generated is not workload ready: 0 of 11 units carry open workload items. A generated Terraform resource does not mark any of the dimensions below ready: no dimension is ready in this build, and a unit without evidence is not assessed, which is not the same as ready.

0 units need a decision or evidence from a person (0 of them a decision); 2 compute units carry no workload evidence at all. 5 further entries (conditional, switched off, or standing beside a unit whose attachment cannot be decided) are not measured: whether they exist is decided only when OpenTofu plans.

Units by workload dimension and state (11 units)
Dimension	NOT ASSESSED	NOT APPLICABLE
Bootstrap configuration	2	9
Source artifacts	2	9
Target preconditions	2	9
Cutover	2	9
Day 2 operations	2	9

What each dimension asks, and why a unit can be not assessed

Bootstrap configuration: How is the workload installed on this unit? Not assessed: StackToIT cannot see how the workload is installed: no provisioner block, user data or startup script was observed on the unit.
Source artifacts: Which files do the unit's attributes or its bootstrap read that the scan did not find? Not assessed: No file the unit depends on was listed as missing, unreadable or unresolved; that does not establish that the scripts and templates are the right ones.
Target preconditions: What must exist on STACKIT before a resource of the draft works? Not assessed: No plan manual action of the kind target precondition names the unit in this build.
Cutover: What must be true before the cutover? Not assessed: This build reads the cutover from two things only: the DNS endpoint reading (a record whose address the draft re-binds to a generated resource carries the cutover requirement; an A or AAAA record whose address is not bound to one needs evidence) and the manual actions of the plan that are due before the cutover. A unit none of them names is not assessed, which is not ready.
Day 2 operations: What do the plans ask after the move? Not assessed: No plan manual action due on day 2 or for optimisation names the unit in this build.

No unit carries an open workload item in this build.

Dimensions of operational readiness that this build does not state (20)

Each is not assessed. Naming them keeps the gap visible: a generated Terraform resource does not mark them ready.

IAM: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
WIF: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
Audit logs: not assessed — the draft creates and configures no audit log: the record of administrative activity is a platform fact, not something the draft made. STACKIT Audit Log (capability registry security.audit-log): The platform-wide record of administrative activity (who called which API in an organisation, folder or project): on by default, 90 days of history in the Portal, readable with the audit-log.reader role, routed onward with the Telemetry Router. It records API calls, not the resulting configuration. No Terraform resource enables or configures it. The Telemetry Router takes the Audit Logs of STACKIT products only; the link that makes the router receive the project's audit events is not drafted, a person sets it up; the legacy Audit Log API was decommissioned on 2026-06-02, and the Telemetry Router is the way to take the log out.
Application logs: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
Metrics: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
Traces: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
Alerts: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
Backup: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
Restore: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
DR: not assessed — this build states nothing about it; business recovery objectives (RTO, RPO) are not provided to this build
Patching: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
Upgrade lifecycle: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
Support: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
Quota monitoring: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
Incident handling: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
Capacity: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
Cost allocation: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
Security posture: not assessed — the draft does not enable it and the provider has no resource for it: CSPM is a platform fact, not something the draft made. STACKIT Cloud Security Posture Management (capability registry security.posture-management): Managed security posture management (assessment of a project against fixed benchmarks): STACKIT Cloud Security Posture Management, a Portal service (generally available since 2026-10-05; enabled in the Portal or through the Service Enablement API) whose documented API reference is labelled v1beta, with no Terraform resource. It shows a project-level dashboard with a scan every 24 hours and offers no alerting. Managed threat detection is not part of it. It scans against BSI C5, ISO 27000 and the STACKIT standard. Where the estate has Security Command Center settings they are not carried: a person enables CSPM and maps the controls.
Secrets: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure
Runbook ownership: not assessed — this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure

A generated Terraform resource does not mark these ready: no dimension is ready in this build, and a unit without evidence is not assessed, never ready.
A state is read from a typed fact of the assessment or of a plan (an open critical semantic, an observed bootstrap, a source artifact the scan did not find, a manual action with its kind and phase); nothing is inferred from a resource name.
A compute unit is a unit of the catalogue category compute; every other unit applies to a dimension only where a typed fact concerns it.
The cutover requirement is read for the DNS records of this build only (the re-bound address of a public IP address, or an address record with no endpoint binding) and for the manual actions of the plan due before the cutover; the cutover of any other endpoint (load balancer, certificate, allow-list) is not read by this build. StackToIT applies no cutover and the requirement does not change a unit's class, confidence or eligibility.

Data movement

Decision required StackToIT never moves data. 2 stateful source units are listed here: a person must choose a data-movement mechanism for each. The execution plan takes a method for 1 of them (the only method open, or the one an answered decision took; migration/data-movement-plan.json), and this file names no mechanism class for any (the mechanism is UNKNOWN).

Stateful source units (2). The mechanism of every unit is unknown: a person chooses it from the size of the data, the downtime tolerated and the consistency the application needs, none of which the source states.
Unit	Source type	Target service	State	Mechanism	Data class	RPO	Downtime tolerance	Provisioned capacity
`google_sql_database_instance.postgres`	`google_sql_database_instance`	STACKIT PostgreSQL Flex	Decision required	unknown	NOT_PROVIDED	NOT_PROVIDED	NOT_PROVIDED	not stated in the source
`google_storage_bucket.media`	`google_storage_bucket`	STACKIT Object Storage	Decision required	unknown	NOT_PROVIDED	NOT_PROVIDED	NOT_PROVIDED	not stated in the source

google_sql_database_instance.postgres: facets, unknowns and actions

No mechanism is chosen: it depends on the size of the data, the downtime the business tolerates and the consistency the application needs, and the source states none of them. The execution plan holds the typed steps of each method of the move (migration/data-movement-plan.json) behind the decision DEC-GEN-CONVERT-DATA-MOVEMENT; no method is taken until it is answered.

consistency requirements: Not assessed No consistency requirement is stated by the source or by this build; whether the application tolerates a copy that lags the original is a decision for a person.
validation requirement: Observed The execution plan states how the moved data is validated: 3 manual reconcile steps compare the source and the target with the writers stopped, and the move is accepted only on a recorded GO; the checks after the transfer are row-counts, table-checksums, sequences, restore-log, extensions, roles-and-grants, application-check, rollback-limit, replication-lag, last-sync-time, subscription-state (execution-plan.json: the steps of the move of this unit; migration/data-movement-plan.json: the move in full).
cutover dependency: Observed The unit is in wave 1 of the dependency order. It depends on no other unit.
rollback consideration: Observed The execution plan states the way back of the move: on NO-GO take the rollback without switching anything: the clients still point at the source, which is current to the freeze. The point after which a rollback loses data is a check of the reconcile step (rollback-limit) that the owner records before the window.
encryption requirement: Not assessed The source does not state tls-enforcement; an absent setting is not read as a requirement.

Unknown:

The size of the data is not in the source.
The rate at which the data changes is not in the source.
The downtime the business tolerates is not provided.
The recovery point the business requires is not provided.
The classification of the data is not provided.

google_storage_bucket.media: facets, unknowns and actions

This file chooses no mechanism class: it depends on the size of the data, the downtime the business tolerates and the consistency the application needs, and the source states none of them. The execution plan takes the only method open, rclone-copy (migration/data-movement-plan.json, chosen_method); this file names no mechanism class.

consistency requirements: Not assessed No consistency requirement is stated by the source or by this build; whether the application tolerates a copy that lags the original is a decision for a person.
validation requirement: Observed The execution plan states how the moved data is validated: 1 manual reconcile step compares the source and the target with the writers stopped, and the move is accepted only on a recorded GO; the checks after the transfer are object-count-and-bytes, key-lists, content, application-check, rollback-limit (execution-plan.json: the steps of the move of this unit; migration/data-movement-plan.json: the move in full).
cutover dependency: Observed The unit is in wave 2 of the dependency order. It depends on: google_service_account.automation, google_service_account.server.
rollback consideration: Observed The execution plan states the way back of the move: on NO-GO take the rollback without switching anything: the clients still point at the source, which is current to the freeze. The point after which a rollback loses data is a check of the reconcile step (rollback-limit) that the owner records before the window.
encryption requirement: Not assessed This build reads no in-transit encryption requirement for this kind of unit, so the source may state one that is not shown here.

Unknown:

The size of the data is not in the source.
The rate at which the data changes is not in the source.
The downtime the business tolerates is not provided.
The recovery point the business requires is not provided.
The classification of the data is not provided.

The size of the data, its change rate, the duration of a transfer, the transfer rate and the downtime are never stated: the source does not state them and this build has no way to measure them. A provisioned capacity quoted beside a unit is the size of what was provisioned, not the size of the data.
No mechanism is chosen and nothing is executed: StackToIT is out of scope for actual data movement, and a mechanism class is a recommendation a person makes from the size, the downtime tolerated and the consistency the application needs.
A unit is listed when its catalogue kind holds data of its own (a database, a cache, a search domain, a warehouse, a block volume, a file share, an object store). A Kubernetes storage class that provisions volumes, a persistent volume and a persistent volume claim are listed too: the volumes behind a class, and the data on any volume, are in the source cloud and not in the Terraform, so a class is a row of what is not known, never a statement that the cluster holds data. A queue or topic service, and a system installed on a server's disk, are not read as stateful and are not listed. A message broker and a container registry repository are not listed: this build has no definitions export and no image-move steps for the ones of this source's cloud.
The data class, RPO and downtime tolerance are the customer's, from the applications file, word for word; without one, or for a unit outside an application, they are NOT_PROVIDED and no default is assumed.

Resilience

Evidence required Requirement: business requirement not provided. No RTO or RPO was stated (BUSINESS_REQUIREMENT_NOT_PROVIDED): no architecture is called resilient against it, and no value is assumed.

Units that hold state or state a zone, replication or backup fact (2). No unit is called resilient and no resilience intent is chosen.
Unit	Source type	Application	What the source states	Intent	State	Why
`google_sql_database_instance.postgres`	`google_sql_database_instance`	none	`zone of google_sql_database_instance.postgres`: not stated in the source (an absent zone is not read as a default zone)	unknown	Evidence required	Intent UNKNOWN: decision requires evidence. No applications file was given, so no RTO or RPO is stated. The availability-zone and metro placement of the target are NOT_ASSESSED: this build holds no evidence for them.
`google_storage_bucket.media`	`google_storage_bucket`	none	`availability zone`: NOT_ASSESSED: no placement adapter reads this source type in this build (not read, which is not the same as not stated) `contract item geo-replication`: observed unknown; disposition REVIEW (the state of the contract item, not a setting of the target)	unknown	Evidence required	Intent UNKNOWN: decision requires evidence. No applications file was given, so no RTO or RPO is stated. The availability-zone and metro placement of the target are NOT_ASSESSED: this build holds no evidence for them.

No unit is called resilient and no resilience intent is chosen: the intent of every unit is UNKNOWN until a person decides it from a stated requirement and the facts of the source.
No RTO or RPO is defaulted or inferred from a resource name; the requirement is what the applications file states, word for word, or it is not provided.
The zone facts of the source are read by the AWS and the Google Cloud placement adapters; for every other source they are NOT_ASSESSED, which does not mean that the source states none.
The availability zones and metro placement of the STACKIT target are NOT_ASSESSED: this build holds no evidence for them, so nothing here compares the source with the target.
A unit is listed when it holds state or states a failure-domain, replication or backup fact; a unit that states none and holds no data is not looked at, and the network a unit stands in (a subnet, a route table, a security group) is not a unit with an intent of its own: 14 of the 16 units present in the source are not listed here, and the block says nothing about them.