StackToIT Migration Intelligence Workspace

Executive lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Architect lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Platform lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Security lens: the sections are in the order this reader usually wants, and Costs and Migration Plan are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Application owner lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Programme lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

FinOps lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Engineering lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Target Fit

How well each STACKIT target fits: service, interface, Terraform, region, maturity, quota, lifecycle, operability, support and security.

Support options with fresh evidence as of 2026-11-07: Essential Support, Advanced Support, Ultimate Support.

How this matrix works

Every STACKIT capability is shown along independent dimensions. There is no overall verdict, no score and no yes or no: a dimension is assessed only where the capability catalogue carries a value for it with evidence, and "not assessed" means the catalogue states nothing, which is not the same as not available. A list of evidenced facts (quota limits, known issues) is counted beside its dimension and does not complete it.

The catalogue holds 321 capabilities; the Terraform facts are derived from the stackit provider schema 0.121.0. Evidence is judged as of 2026-11-07, the date of the assessment; stale evidence is no longer vouched for, which is not the same as false.

Support by family

One row for each family of the units this run holds, read from those units and nothing else: the family is the category the knowledge base's catalogue gives the source type, the counts are of the 11 units counted in the totals, and the evidence is the evidence references of their decisions. Counts are stated with their base and none is a success rate: how many rules exist for a family says nothing about how much of an estate it carries. A family with no unit in this run has no row: nothing here says anything about it. A family none of whose units carries an evidence reference says so.

Support by family: what the run found, how it lands, the draft path, the limits and the evidence (6 families, 11 units)
Family	Source types in this run	Units	How they land	Draft path	Limits	Evidence
Identity	google_secret_manager_secret, google_service_account	5	5 can be drafted with configuration changes	5 of 5 units state a STACKIT target; the draft writes a Terraform resource for 5 (3 experimental, 2 ga in the pinned provider). Services: STACKIT service account, STACKIT Secrets Manager	0 of 5 accounted units automation-eligible; 16 properties the draft names as not carried	10 evidence references
Compute	google_cloud_run_v2_job, google_cloud_run_v2_service	2	2 move into containers	2 of 2 units state a STACKIT target; the draft writes a Terraform resource for 2 (2 ga in the pinned provider). Services: Kubernetes Job/CronJob on SKE, SKE workload (or Cloud Foundry Docker app)	0 of 2 accounted units automation-eligible; 9 properties the draft names as not carried	4 evidence references
Data	google_sql_database_instance	1	1 moves to another service	1 of 1 unit state a STACKIT target; the draft writes a Terraform resource for 1 (1 ga in the pinned provider). Services: STACKIT PostgreSQL Flex	0 of 1 accounted unit automation-eligible; 6 properties the draft names as not carried	3 evidence references
Messaging	google_pubsub_topic	1	1 moves to another service	1 of 1 unit state a STACKIT target; the draft writes a Terraform resource for 1 (1 ga in the pinned provider). Services: STACKIT RabbitMQ	0 of 1 accounted unit automation-eligible; 1 property the draft names as not carried	3 evidence references
Platform	google_firebase_project	1	1 needs manual review	none of the 1 unit states a STACKIT target	0 of 1 accounted unit automation-eligible; 0 properties the draft names as not carried	3 evidence references
Storage	google_storage_bucket	1	1 can be drafted with configuration changes	1 of 1 unit state a STACKIT target; the draft writes a Terraform resource for 1 (1 ga in the pinned provider). Services: STACKIT Object Storage	0 of 1 accounted unit automation-eligible; 6 properties the draft names as not carried	3 evidence references

The 15 units that state a STACKIT target are joined to the catalogue by the resource types of their target: 13 have every type listed by a capability, 1 some, 1 none although the STACKIT provider 0.121.0 has every one of their resource types (the capability metadata for them is incomplete: the resource exists, its fit is not assessed), 0 none with a type the provider schema does not have (the matrix says nothing about these units, which is not the same as unsupported), and 0 need no STACKIT resource. 1 units state no target.

Catalogue standing of the units, counted apart for the units that exist, those whose existence the plan decides and those switched off
Units	State a target	Every type listed	Some listed	Provider has the resource, metadata incomplete	State no target
Exists	10	9	0	1	1
Decided at plan time	5	4	1	0	0
Switched off	0	0	0	0	0

Capabilities that units of this estate reach (10 of 321), by dimension
Capability	Units	Functional parity	Service	API	Terraform	Region	Maturity	Quota	Lifecycle	Operability	Security	Support	Evidence and probes
`cdn.custom-domain`	1	Not assessed	Assessed `AVAILABLE`	Assessed `AVAILABLE`	Assessed `RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,BETA`	Not assessed	Assessed `BETA`	Not assessed	Not assessed	Assessed `ESTABLISHED` REPORTED 1 PROVEN PLATFORM BUG 0 RESOLVED 0 BLOCKING EFFECT 0	Not assessed	Not assessed	Not assessed
`cdn.distribution`	1	Not assessed	Assessed `AVAILABLE`	Assessed `AVAILABLE`	Assessed `RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,BETA`	Not assessed	Assessed `BETA`	Not assessed	Not assessed	Assessed `ESTABLISHED` REPORTED 3 PROVEN PLATFORM BUG 0 RESOLVED 0 BLOCKING EFFECT 0	Not assessed	Not assessed	Not assessed
`compute.managed-kubernetes`	2	Not assessed	Not assessed	Not assessed	Assessed `RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE`	Not assessed	Not assessed	Not assessed	Not assessed	Assessed `ESTABLISHED` REPORTED 3 PROVEN PLATFORM BUG 0 RESOLVED 0 BLOCKING EFFECT 0	Not assessed	Not assessed	Not assessed
`database.postgresql-flex`	1	Not assessed	Assessed `AVAILABLE`	Assessed `AVAILABLE`	Assessed `RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE`	Not assessed	Not assessed	Not assessed	Not assessed	Assessed `ESTABLISHED` REPORTED 1 PROVEN PLATFORM BUG 0 RESOLVED 0 BLOCKING EFFECT 0	Not assessed	Not assessed	Not assessed
`devtools.git`	3	Not assessed	Assessed `AVAILABLE`	Assessed `AVAILABLE`	Assessed `RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,BETA`	Not assessed	Assessed `BETA`	Not assessed	Not assessed	Assessed `ESTABLISHED` REPORTED 3 PROVEN PLATFORM BUG 0 RESOLVED 0 BLOCKING EFFECT 0	Not assessed	Not assessed	Not assessed
`identity.role-assignment`	4	Not assessed	Assessed `AVAILABLE`	Assessed `AVAILABLE`	Assessed `RESOURCE_AVAILABLE,EXPERIMENTAL`	Not assessed	Assessed `EXPERIMENTAL`	Not assessed LIMIT 1	Not assessed	Assessed `ESTABLISHED` REPORTED 1 PROVEN PLATFORM BUG 0 RESOLVED 0 BLOCKING EFFECT 0	Not assessed	Not assessed	Not assessed
`identity.server-service-account`	4	Not assessed	Assessed `AVAILABLE`	Assessed `WRITE_SUPPORTED`	Assessed `RESOURCE_AVAILABLE`	Not assessed	Not assessed	Not assessed LIMIT 1	Not assessed	Not assessed	Not assessed	Not assessed	Assessed `RECORDED` PROBES 11 EVIDENCE ITEMS 0
`messaging.mqtt-broker`	1	Not assessed	Not assessed	Not assessed	Assessed `RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE`	Not assessed	Not assessed	Not assessed	Not assessed	Not assessed	Not assessed	Not assessed	Not assessed
`messaging.rabbitmq-credential`	1	Not assessed	Not assessed	Assessed `AVAILABLE`	Assessed `RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE`	Not assessed	Not assessed	Not assessed	Not assessed	Not assessed	Not assessed	Not assessed	Not assessed
`security.secrets-manager`	2	Not assessed	Not assessed	Assessed `AVAILABLE`	Assessed `RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE`	Not assessed	Not assessed	Not assessed	Not assessed	Not assessed	Not assessed	Not assessed	Not assessed

Why each capability cell has its state

cdn.custom-domain

functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
service — Assessed AVAILABLE. Service availability of the capability, as the registry states it with evidence. [TARGET OFFICIAL DOC: https://docs.stackit.cloud/products/network/load-balancing-and-content-delivery/cdn/basics/features-cdn/; unknown]
api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/cdn/v1/cdn.json:3849-4199 (knowledge-base evidence, not in this folder); unknown]
terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,BETA. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_cdn_custom_domain: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE, BETA; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_cdn_custom_domain; unknown]
region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
maturity — Assessed BETA. Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source. [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 (resource_schemas.stackit_cdn_custom_domain.block.description); unknown]
quota — Not assessed. The registry has no complete statement of the quotas of this capability.
lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
operability — Assessed ESTABLISHED. Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug. [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0: provider.attributes.enable_beta_resources; fresh]
security — Not assessed. The registry states no security features or defaults for this capability.
support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.

cdn.distribution

functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
service — Assessed AVAILABLE. Service availability of the capability, as the registry states it with evidence. [TARGET OFFICIAL DOC: https://docs.stackit.cloud/products/network/load-balancing-and-content-delivery/cdn/basics/features-cdn/; unknown]
api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/cdn/v1/cdn.json:2410-2924 (knowledge-base evidence, not in this folder); unknown]
terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,BETA. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_cdn_distribution: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE, BETA; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_cdn_distribution; unknown]
region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
maturity — Assessed BETA. Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source. [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 (resource_schemas.stackit_cdn_distribution.block.description); unknown]
quota — Not assessed. The registry has no complete statement of the quotas of this capability.
lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
operability — Assessed ESTABLISHED. Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug. [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0: provider.attributes.enable_beta_resources; fresh] [PUBLIC ISSUE: https://github.com/stackitcloud/terraform-provider-stackit/issues/1629; fresh] [PUBLIC ISSUE: https://github.com/stackitcloud/terraform-provider-stackit/issues/1630; fresh]
security — Not assessed. The registry states no security features or defaults for this capability.
support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.

compute.managed-kubernetes

functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
service — Not assessed. The registry states no service availability for this capability.
api — Not assessed. The registry states no API capability for this capability.
terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_ske_cluster: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_ske_cluster; unknown]
region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
maturity — Not assessed. The registry states no maturity for this capability.
quota — Not assessed. The registry has no complete statement of the quotas of this capability.
lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
operability — Assessed ESTABLISHED. Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug. [TARGET OFFICIAL DOC: https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/; fresh] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0: resource_schemas.stackit_ske_cluster extensions.argus; fresh] [PUBLIC ISSUE: https://github.com/stackitcloud/terraform-provider-stackit/issues/1713; fresh]
security — Not assessed. The registry states no security features or defaults for this capability.
support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.

database.postgresql-flex

functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
service — Assessed AVAILABLE. Service availability of the capability, as the registry states it with evidence. [TARGET OFFICIAL DOC: https://docs.stackit.cloud/products/databases/postgresql-flex/basics/architecture-of-postgresql-flex/; stackitcloud/docs.stackit.cloud, products/databases/postgresql-flex/basics/architecture-of-postgresql-flex.txt; unknown]
api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/postgres-flex/v3/postgres-flex.json:2050-2332; stackitcloud/stackit-api-specifications, services/postgres-flex/v3/postgres-flex.json:3554; stackitcloud/stackit-api-specifications, services/postgres-flex/v3/postgres-flex.json:4744 (knowledge-base evidence, not in this folder); unknown]
terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_postgresflex_database: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_postgresflex_instance: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_postgresflex_user: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_postgresflex_database; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_postgresflex_instance; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_postgresflex_user; unknown]
region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
maturity — Not assessed. The registry states no maturity for this capability.
quota — Not assessed. The registry has no complete statement of the quotas of this capability.
lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
operability — Assessed ESTABLISHED. Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug. [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0: resource_schemas.stackit_postgresflex_instance (acl, flavor, replicas deprecated: true); fresh]
security — Not assessed. The registry states no security features or defaults for this capability.
support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.

devtools.git

functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
service — Assessed AVAILABLE. Service availability of the capability, as the registry states it with evidence. [TARGET OFFICIAL DOC: https://docs.stackit.cloud/products/developer-platform/git/; unknown]
api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/git/v1beta/git.json:968-1313 (knowledge-base evidence, not in this folder); unknown]
terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,BETA. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_git: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE, BETA; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_git; unknown]
region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
maturity — Assessed BETA. Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source. [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 (resource_schemas.stackit_git.block.description); unknown]
quota — Not assessed. The registry has no complete statement of the quotas of this capability.
lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
operability — Assessed ESTABLISHED. Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug. [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0: provider.attributes.enable_beta_resources; fresh] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0: resource_schemas.stackit_git block description; fresh] [PUBLIC ISSUE: https://github.com/stackitcloud/terraform-provider-stackit/issues/1633; fresh]
security — Not assessed. The registry states no security features or defaults for this capability.
support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.

identity.role-assignment

functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
service — Assessed AVAILABLE. Service availability of the capability, as the registry states it with evidence. [TARGET OFFICIAL DOC: https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/roles-permissions/; unknown]
api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/authorization/v2/authorization.json:807-840 (knowledge-base evidence, not in this folder); unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown]
terraform — Assessed RESOURCE_AVAILABLE,EXPERIMENTAL. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_authorization_folder_role_assignment: RESOURCE_AVAILABLE, EXPERIMENTAL (experiment iam); stackit_authorization_organization_role_assignment: RESOURCE_AVAILABLE, EXPERIMENTAL (experiment iam); stackit_authorization_project_custom_role: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_authorization_project_role_assignment: RESOURCE_AVAILABLE, EXPERIMENTAL (experiment iam); stackit_authorization_service_account_role_assignment: RESOURCE_AVAILABLE, EXPERIMENTAL (experiment iam); [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_folder_role_assignment; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_organization_role_assignment; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_project_custom_role; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_project_role_assignment; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_service_account_role_assignment; unknown]
region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
maturity — Assessed EXPERIMENTAL. Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source. [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 (resource_schemas.stackit_authorization_project_role_assignment.block.description, ..._folder_..., ..._organization_..., ..._service_account_role_assignment.block.description); unknown]
quota — Not assessed. The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.
lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
operability — Assessed ESTABLISHED. Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug. [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0: provider.attributes.experiments; fresh]
security — Not assessed. The registry states no security features or defaults for this capability.
support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.

identity.server-service-account

functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
service — Assessed AVAILABLE. Service availability of the capability, as the registry states it with evidence. [TARGET OFFICIAL DOC: https://docs.stackit.cloud/products/compute-engine/server/how-tos/attaching-service-account-to-servers/; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown]
api — Assessed WRITE_SUPPORTED. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: STACKIT IaaS API v2 specification (path /v2/projects/{projectId}/regions/{region}/servers/{serverId}/service-accounts/{serviceAccountMail}); unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-09; unknown]
terraform — Assessed RESOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_server_service_account_attach: RESOURCE_AVAILABLE; stackit_service_account: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_server_service_account_attach; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_service_account; unknown]
region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
maturity — Not assessed. The registry states no maturity for this capability.
quota — Not assessed. The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.
lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
operability — Not assessed. No provider or backend behaviour is recorded for this capability. That is not the same as having none.
security — Not assessed. The registry states no security features or defaults for this capability.
support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
evidence — Assessed RECORDED. Probes of the live target and evidence of the capability as a whole. A probe is an observation of one exact variant, not of the capability. A disagreement between sources is listed as a conflict of the row. [LIVE TARGET PROBE: tested on a STACKIT project on 2026-11-06; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-11-06; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-08; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-09; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-09; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-09; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-09; unknown] [LIVE TARGET PROBE: tested on a STACKIT project on 2026-10-10; unknown]

messaging.mqtt-broker

functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
service — Not assessed. The registry states no service availability for this capability.
api — Not assessed. The registry states no API capability for this capability.
terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_rabbitmq_instance: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_rabbitmq_instance; unknown]
region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
maturity — Not assessed. The registry states no maturity for this capability.
quota — Not assessed. The registry has no complete statement of the quotas of this capability.
lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
operability — Not assessed. No provider or backend behaviour is recorded for this capability. That is not the same as having none.
security — Not assessed. The registry states no security features or defaults for this capability.
support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.

messaging.rabbitmq-credential

functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
service — Not assessed. The registry states no service availability for this capability.
api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/rabbitmq/v2/rabbitmq.json:1379 (knowledge-base evidence, not in this folder); unknown]
terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_rabbitmq_credential: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_rabbitmq_credential; unknown]
region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
maturity — Not assessed. The registry states no maturity for this capability.
quota — Not assessed. The registry has no complete statement of the quotas of this capability.
lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
operability — Not assessed. No provider or backend behaviour is recorded for this capability. That is not the same as having none.
security — Not assessed. The registry states no security features or defaults for this capability.
support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.

security.secrets-manager

functional_parity — Not assessed. The model has no field for functional parity or changed semantics, so it is not assessed for any capability.
service — Not assessed. The registry states no service availability for this capability.
api — Assessed AVAILABLE. API capability of the service, as the registry states it with evidence. [TARGET API SPEC: stackitcloud/stackit-api-specifications, services/secrets-manager/v1/secrets-manager.json:481; stackitcloud/stackit-api-specifications, services/secrets-manager/v1/secrets-manager.json:1922 (knowledge-base evidence, not in this folder); unknown]
terraform — Assessed RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE. Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false. stackit_secretsmanager_instance: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; stackit_secretsmanager_user: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE; [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_secretsmanager_instance; unknown] [TARGET PROVIDER SCHEMA: STACKIT provider schema 0.121.0 resource_schemas.stackit_secretsmanager_user; unknown]
region — Not assessed. The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit).
maturity — Not assessed. The registry states no maturity for this capability.
quota — Not assessed. The registry has no complete statement of the quotas of this capability.
lifecycle — Not assessed. The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit.
operability — Not assessed. No provider or backend behaviour is recorded for this capability. That is not the same as having none.
security — Not assessed. The registry states no security features or defaults for this capability.
support — Not assessed. A capability states no support requirement; the support verdict is per application (support_suitability).
evidence — Not assessed. No probe of the live target and no capability-level evidence is recorded for this capability.

STACKIT resource types of the targets that no capability lists (3)

stackit_objectstorage_bucket: 2 units — RESOURCE EXISTS BUT CAPABILITY UNLINKED. The pinned STACKIT provider has this resource; StackToIT's capability metadata for it is incomplete. Terraform: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE. Functional parity: Not assessed.
stackit_objectstorage_credential: 1 units — RESOURCE EXISTS BUT CAPABILITY UNLINKED. The pinned STACKIT provider has this resource; StackToIT's capability metadata for it is incomplete. Terraform: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE. Functional parity: Not assessed.
stackit_objectstorage_credentials_group: 1 units — RESOURCE EXISTS BUT CAPABILITY UNLINKED. The pinned STACKIT provider has this resource; StackToIT's capability metadata for it is incomplete. Terraform: RESOURCE_AVAILABLE, DATA_SOURCE_AVAILABLE. Functional parity: Not assessed.

Requirements only a STACKIT API carries

Where no resource of the STACKIT provider carries a requirement, the tool can write a STACKIT API step, only when the call is evidenced and a converter of the tool writes it. The tool can do this for 28 requirements; 4 more are catalogued only (the call is known, no converter writes it) and are not counted as something the tool carries. Two things are kept apart below: what this build can do (the first table) and what arose on this estate (the second table, counted from the execution plan of this run). In this run 2 of 28 requirements have a step in the plan (2 STACKIT API steps in all), 4 are named by a unit of this estate and have none, and 22 are not used by any unit of this estate. An execution plan without API steps is then not a gap of the tool unless a requirement is named by a unit and has no step.

What this build can do

API-only requirements a converter of this build can write as a STACKIT API step, in general. A step is not a verified one: each row says how far its step has come.
Requirement	Source types	Mode	Operation	Maturity of the step
`compute.image-share`	aws_ami_launch_permission	STACKIT_API	`iaas_v2 SetImageShare`	a converter writes the step; tested offline, not verified live
`compute.run-command`	aws_ssm_document, aws_ssm_association, aws_ssm_maintenance_window_task, awscc_ssm_document, awscc_ssm_association, awscc_ssm_maintenance_window_task	STACKIT_API	`run-command_v2 CreateCommand`	a converter writes the step; not yet tested offline
`compute.snapshot`	aws_ebs_snapshot, google_compute_instant_snapshot, google_compute_region_instant_snapshot	STACKIT_API	`iaas_v2 CreateSnapshot`	a converter writes the step; not yet tested offline
`containers.container-app`	aws_apprunner_service, awscc_apprunner_service, aws_lightsail_container_service_deployment_version	STACKIT_API	`sca_v1alpha CreateApplication`	a converter writes the step; not yet tested offline
`database.postgresql.deletion-protection`	aws_db_instance, aws_rds_cluster, awscc_rds_db_instance, awscc_rds_db_cluster, google_sql_database_instance	STACKIT_API	`postgres-flex_v3 UpdateInstanceProtection`	a converter writes the step; tested offline, not verified live
`database.sqlserver.deletion-protection`	aws_db_instance, awscc_rds_db_instance, google_sql_database_instance	STACKIT_API	`sqlserverflex_v3 UpdateInstanceProtection`	a converter writes the step; tested offline, not verified live
`function.container-image`	aws_lambda_function, awscc_lambda_function	STACKIT_API	`sca_v1alpha CreateApplication`	a converter writes the step; not yet tested offline
`function.http`	aws_lambda_function, awscc_lambda_function, aws_lambda_function_url, aws_lambda_alias, aws_lambda_layer_version, aws_lambda_permission	STACKIT_API	`functions_v1alpha CreateFunction`	a converter writes the step; tested offline, not verified live
`identity.secret`	aws_secretsmanager_secret, aws_ssm_parameter, awscc_secretsmanager_secret, google_secret_manager_secret, google_secret_manager_regional_secret	STACKIT_API	`secretsmanager-vault WriteSecret`	a converter writes the step; tested offline, not verified live
`network.lb-block-list`	aws_wafv2_ip_set, awscc_wafv2_ip_set	STACKIT_API	`lb-ip-lists_v1alpha UploadIPList`	a converter writes the step; tested offline, not verified live
`network.security-group.default-egress-rules`	aws_subnet	STACKIT_API	`iaas_v2 DeleteSecurityGroupRule`	a converter writes the step; tested offline, not verified live
`objectstorage.bucket.cors`	aws_s3_bucket_cors_configuration, google_storage_bucket	STACKIT_API	`s3 PutBucketCors`	a converter writes the step; tested offline, not verified live
`objectstorage.bucket.lifecycle`	aws_s3_bucket_lifecycle_configuration, aws_s3control_bucket_lifecycle_configuration, google_storage_bucket	STACKIT_API	`s3 PutBucketLifecycleConfiguration`	a converter writes the step; tested offline, not verified live
`objectstorage.bucket.policy`	aws_s3_bucket_policy, google_storage_bucket	STACKIT_API	`s3 PutBucketPolicy`	a converter writes the step; not yet tested offline
`objectstorage.bucket.tagging`	aws_s3_bucket	STACKIT_API	`s3 PutBucketTagging`	a converter writes the step; tested offline, not verified live
`objectstorage.bucket.versioning`	aws_s3_bucket_versioning, google_storage_bucket	STACKIT_API	`s3 PutBucketVersioning`	a converter writes the step; tested offline, not verified live
`observability.cdn-log-sink`	aws_cloudfront_realtime_log_config	STACKIT_API	`cdn_v1 PatchDistribution`	a converter writes the step; not yet tested offline
`platform.git-runner`	google_cloudbuild_worker_pool	STACKIT_API	`git_v1beta CreateRunner`	a converter writes the step; not yet tested offline
`platform.service-enablement`		STACKIT_API	`service-enablement_v2 EnableServiceRegional`	a converter writes the step; not yet tested offline
`pubsub.queue`	aws_sqs_queue	STACKIT_API	`pubsub_v1beta create-topic`	a converter writes the step; tested offline, not verified live
`pubsub.subscription`	aws_sns_topic_subscription, google_pubsub_subscription	STACKIT_API	`pubsub_v1beta create-subscription`	a converter writes the step; tested offline, not verified live
`pubsub.subscription.subscriber-grant`	google_pubsub_subscription_iam_member, google_pubsub_subscription_iam_binding	STACKIT_API	`pubsub_v1beta grant-subscription-subscriber-access`	a converter writes the step; not yet tested offline
`pubsub.topic`	aws_sns_topic, google_pubsub_topic	STACKIT_API	`pubsub_v1beta create-topic`	a converter writes the step; tested offline, not verified live
`pubsub.topic.publisher-grant`	google_pubsub_topic_iam_member, google_pubsub_topic_iam_binding	STACKIT_API	`pubsub_v1beta grant-topic-publisher-access`	a converter writes the step; not yet tested offline
`registry.git-repository`	aws_codecommit_repository, awscc_codecommit_repository	STACKIT_API	`stackit-git-forgejo CreateOrgRepo`	a converter writes the step; tested offline, not verified live
`registry.repository`	aws_ecr_repository, awscc_ecr_repository, aws_ecr_pull_through_cache_rule, google_artifact_registry_repository, google_container_registry	STACKIT_API	`registry_v1 CreateArtifactory`	a converter writes the step; tested offline, not verified live
`workflows.airflow`	aws_mwaa_environment	STACKIT_API	`workflows_v1alpha CreateInstance`	a converter writes the step; tested offline, not verified live
`workflows.composer`	google_composer_environment	STACKIT_API	`workflows_v1alpha CreateInstance`	a converter writes the step; not yet tested offline

What arises on this estate

For each requirement above: the units of this estate whose source type it names, and the steps of the execution plan of this run that carry it. Whether a unit gets the step depends on what its source sets.
Requirement	Units that exist	STACKIT API steps	Manual steps	On this estate
`compute.image-share`	0	0	0	Not used by any unit of this estate: no unit has the source type aws_ami_launch_permission.
`compute.run-command`	0	0	0	Not used by any unit of this estate: no unit has one of the source types aws_ssm_document, aws_ssm_association, aws_ssm_maintenance_window_task, awscc_ssm_document, awscc_ssm_association, awscc_ssm_maintenance_window_task.
`compute.snapshot`	0	0	0	Not used by any unit of this estate: no unit has one of the source types aws_ebs_snapshot, google_compute_instant_snapshot, google_compute_region_instant_snapshot.
`containers.container-app`	0	0	0	Not used by any unit of this estate: no unit has one of the source types aws_apprunner_service, awscc_apprunner_service, aws_lightsail_container_service_deployment_version.
`database.postgresql.deletion-protection`	1	0	0	Not used by any unit of this estate: the 1 unit of its source types that exist (google_sql_database_instance.postgres) asks for no deletion protection (deletion_protection is not set to true), so no step is needed.
`database.sqlserver.deletion-protection`	1	0	0	Not used by any unit of this estate: the 1 unit of its source types that exist (google_sql_database_instance.postgres) is drafted onto another STACKIT service than the one this requirement is for (stackit_sqlserverflex_instance), so no step of it is needed.
`function.container-image`	0	0	0	Not used by any unit of this estate: no unit has one of the source types aws_lambda_function, awscc_lambda_function.
`function.http`	0	0	0	Not used by any unit of this estate: no unit has one of the source types aws_lambda_function, awscc_lambda_function, aws_lambda_function_url, aws_lambda_alias, aws_lambda_layer_version, aws_lambda_permission.
`identity.secret`	2	2	0	2 STACKIT API steps, in this run's execution plan.
`network.lb-block-list`	0	0	0	Not used by any unit of this estate: no unit has one of the source types aws_wafv2_ip_set, awscc_wafv2_ip_set.
`network.security-group.default-egress-rules`	0	0	0	Not used by any unit of this estate: no unit has the source type aws_subnet.
`objectstorage.bucket.cors`	1	0	0	1 unit of its source types exist or are decided at plan time (google_storage_bucket.media), and the execution plan holds no step of this requirement: a unit gets the step only when its source sets what the call carries. For these units the plan holds 1 OpenTofu step, 13 manual steps, 1 refused step.
`objectstorage.bucket.lifecycle`	1	0	0	1 unit of its source types exist or are decided at plan time (google_storage_bucket.media), and the execution plan holds no step of this requirement: a unit gets the step only when its source sets what the call carries. For these units the plan holds 1 OpenTofu step, 13 manual steps, 1 refused step.
`objectstorage.bucket.policy`	1	0	0	1 unit of its source types exist or are decided at plan time (google_storage_bucket.media), and the execution plan holds no step of this requirement: a unit gets the step only when its source sets what the call carries. For these units the plan holds 1 OpenTofu step, 13 manual steps, 1 refused step.
`objectstorage.bucket.tagging`	0	0	0	Not used by any unit of this estate: no unit has the source type aws_s3_bucket.
`objectstorage.bucket.versioning`	1	0	0	1 unit of its source types exist or are decided at plan time (google_storage_bucket.media), and the execution plan holds no step of this requirement: a unit gets the step only when its source sets what the call carries. For these units the plan holds 1 OpenTofu step, 13 manual steps, 1 refused step.
`observability.cdn-log-sink`	0	0	0	Not used by any unit of this estate: no unit has the source type aws_cloudfront_realtime_log_config.
`platform.git-runner`	0	0	0	Not used by any unit of this estate: no unit has the source type google_cloudbuild_worker_pool.
`platform.service-enablement`	0	0	0	Not used by any unit of this estate: no unit has one of the source types .
`pubsub.queue`	0	0	0	Not used by any unit of this estate: no unit has the source type aws_sqs_queue.
`pubsub.subscription`	0	0	0	Not used by any unit of this estate: no unit has one of the source types aws_sns_topic_subscription, google_pubsub_subscription.
`pubsub.subscription.subscriber-grant`	0	0	0	Not used by any unit of this estate: no unit has one of the source types google_pubsub_subscription_iam_member, google_pubsub_subscription_iam_binding.
`pubsub.topic`	1	0	1	1 manual step, in this run's execution plan.
`pubsub.topic.publisher-grant`	0	0	0	Not used by any unit of this estate: no unit has one of the source types google_pubsub_topic_iam_member, google_pubsub_topic_iam_binding.
`registry.git-repository`	0	0	0	Not used by any unit of this estate: no unit has one of the source types aws_codecommit_repository, awscc_codecommit_repository.
`registry.repository`	0	0	0	Not used by any unit of this estate: no unit has one of the source types aws_ecr_repository, awscc_ecr_repository, aws_ecr_pull_through_cache_rule, google_artifact_registry_repository, google_container_registry.
`workflows.airflow`	0	0	0	Not used by any unit of this estate: no unit has the source type aws_mwaa_environment.
`workflows.composer`	0	0	0	Not used by any unit of this estate: no unit has the source type google_composer_environment.

Support suitability, judged against the STACKIT support options evidenced as of 2026-11-07 (a business-critical application gets a review, never a plan; stated times are not a contractual SLA)
Application	Verdict	Required support class	Options with fresh evidence	Options offering the stated hours	Why
estate	NOT_ASSESSED	–	Essential Support, Advanced Support, Ultimate Support	–	No criticality stated; pass --applications to state criticality and explicit support requirements

Source and target side by side

Each source unit beside what the draft makes of it, with its settings counted in the rows of the equivalence ledger: kept as they are, changed into another form, accepted by a person on the record, and to do, which is everything else, including anything not known. Over all 16 units: 2 kept, 10 changed, 0 accepted, 189 to do. The units with the most to do come first; migration/source-target.csv lists every unit.

The 15 of 16 units with the most to do; a dash means no setting of the unit was counted
Source unit	STACKIT target	Kept	Changed	To do
`google_cloud_run_v2_service.server`	SKE workload (or Cloud Foundry Docker app)	0	1	30
`google_cloud_run_v2_job.migrate`	Kubernetes Job/CronJob on SKE	0	1	26
`google_sql_database_instance.postgres`	STACKIT PostgreSQL Flex	2	1	22
`google_storage_bucket.media`	STACKIT Object Storage	0	0	20
`google_secret_manager_secret.django_admin_password`	STACKIT Secrets Manager	0	1	13
`google_secret_manager_secret.django_settings`	STACKIT Secrets Manager	0	1	13
`google_cloudbuild_trigger.init`	Left for the architect (REDESIGN): the draft writes no block of this unit, the architect decides its design. Candidate target in the knowledge base: a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD.	0	0	12
`google_cloudbuild_trigger.activategcb`	Left for the architect (REDESIGN): the draft writes no block of this unit, the architect decides its design. Candidate target in the knowledge base: a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD.	0	0	11
`google_cloudbuild_trigger.placeholder`	Left for the architect (REDESIGN): the draft writes no block of this unit, the architect decides its design. Candidate target in the knowledge base: a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD.	0	0	10
`google_firebase_hosting_site.client`	Left for the architect (REDESIGN): the draft writes no block of this unit, the architect decides its design. Candidate target in the knowledge base: STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain.	0	0	6
`google_service_account.automation`	STACKIT service account	0	1	5
`google_service_account.client`	STACKIT service account	0	1	5
`google_service_account.init`	STACKIT service account	0	1	5
`google_service_account.server`	STACKIT service account	0	1	5
`google_firebase_project.default`	No STACKIT target is stated for this unit.	0	0	3

and 1 more in the sheet.

STACKIT target of each unit (15 listed; 1 without a target)
Unit	Target service	Target resources	Maturity	Lifecycle	Region	Catalogue capabilities	Evidence references
`google_cloud_run_v2_job.migrate`	Kubernetes Job/CronJob on SKE	`stackit_ske_cluster` GA	ga	active	eu01, eu02	MATCHED: compute.managed-kubernetes	2
`google_cloud_run_v2_service.server`	SKE workload (or Cloud Foundry Docker app)	`stackit_ske_cluster` GA	ga	active	eu01, eu02	MATCHED: compute.managed-kubernetes	2
`google_cloudbuild_trigger.activategcb`	a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD	`stackit_git` BETA	beta	active	eu01, eu02	MATCHED: devtools.git	15
`google_cloudbuild_trigger.init`	a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD	`stackit_git` BETA	beta	active	eu01, eu02	MATCHED: devtools.git	15
`google_cloudbuild_trigger.placeholder`	a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD	`stackit_git` BETA	beta	active	eu01, eu02	MATCHED: devtools.git	15
`google_firebase_hosting_site.client`	STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain	`stackit_objectstorage_bucket` GA, `stackit_cdn_distribution` BETA, `stackit_cdn_custom_domain` BETA	beta	active	not established by a catalogue snapshot	PARTIAL: cdn.custom-domain, cdn.distribution (not listed by any capability: stackit_objectstorage_bucket; the STACKIT provider has stackit_objectstorage_bucket as resources, StackToIT's capability metadata for them is incomplete)	7
`google_pubsub_topic.faux`	STACKIT RabbitMQ	`stackit_rabbitmq_instance` GA, `stackit_rabbitmq_credential` GA	ga	active	eu01, eu02	MATCHED: messaging.mqtt-broker, messaging.rabbitmq-credential	3
`google_secret_manager_secret.django_admin_password`	STACKIT Secrets Manager	`stackit_secretsmanager_instance` GA, `stackit_secretsmanager_user` GA	ga	active	not established by a catalogue snapshot	MATCHED: security.secrets-manager	2
`google_secret_manager_secret.django_settings`	STACKIT Secrets Manager	`stackit_secretsmanager_instance` GA, `stackit_secretsmanager_user` GA	ga	active	not established by a catalogue snapshot	MATCHED: security.secrets-manager	2
`google_service_account.automation`	STACKIT service account	`stackit_service_account` GA, `stackit_authorization_project_role_assignment` EXPERIMENTAL (feature iam), `stackit_authorization_folder_role_assignment` EXPERIMENTAL (feature iam), `stackit_authorization_organization_role_assignment` EXPERIMENTAL (feature iam), `stackit_authorization_service_account_role_assignment` EXPERIMENTAL (feature iam)	experimental	active	not established by a catalogue snapshot	MATCHED: identity.role-assignment, identity.server-service-account	2
`google_service_account.client`	STACKIT service account	`stackit_service_account` GA, `stackit_authorization_project_role_assignment` EXPERIMENTAL (feature iam), `stackit_authorization_folder_role_assignment` EXPERIMENTAL (feature iam), `stackit_authorization_organization_role_assignment` EXPERIMENTAL (feature iam), `stackit_authorization_service_account_role_assignment` EXPERIMENTAL (feature iam)	experimental	active	not established by a catalogue snapshot	MATCHED: identity.role-assignment, identity.server-service-account	2
`google_service_account.init`	STACKIT service account	`stackit_service_account` GA, `stackit_authorization_project_role_assignment` EXPERIMENTAL (feature iam), `stackit_authorization_folder_role_assignment` EXPERIMENTAL (feature iam), `stackit_authorization_organization_role_assignment` EXPERIMENTAL (feature iam), `stackit_authorization_service_account_role_assignment` EXPERIMENTAL (feature iam)	experimental	active	not established by a catalogue snapshot	MATCHED: identity.role-assignment, identity.server-service-account	2
`google_service_account.server`	STACKIT service account	`stackit_service_account` GA, `stackit_authorization_project_role_assignment` EXPERIMENTAL (feature iam), `stackit_authorization_folder_role_assignment` EXPERIMENTAL (feature iam), `stackit_authorization_organization_role_assignment` EXPERIMENTAL (feature iam), `stackit_authorization_service_account_role_assignment` EXPERIMENTAL (feature iam)	experimental	active	not established by a catalogue snapshot	MATCHED: identity.role-assignment, identity.server-service-account	2
`google_sql_database_instance.postgres`	STACKIT PostgreSQL Flex	`stackit_postgresflex_instance` GA, `stackit_postgresflex_database` GA, `stackit_postgresflex_user` GA	ga	active	eu01, eu02	MATCHED: database.postgresql-flex	3
`google_storage_bucket.media`	STACKIT Object Storage	`stackit_objectstorage_bucket` GA, `stackit_objectstorage_credentials_group` GA, `stackit_objectstorage_credential` GA	ga	active	not established by a catalogue snapshot	RESOURCE EXISTS BUT CAPABILITY UNLINKED (not listed by any capability: stackit_objectstorage_bucket, stackit_objectstorage_credential, stackit_objectstorage_credentials_group; the STACKIT provider has stackit_objectstorage_bucket, stackit_objectstorage_credential, stackit_objectstorage_credentials_group as resources, StackToIT's capability metadata for them is incomplete)	3

Target lifecycle: SKE Kubernetes versions

Units whose target uses it: google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server. The provider presents the target resources as GA. States are derived from published dates only, as of 2026-11-03, the day the sources were read; this page reads no clock, so compare the dates with today. The set is not vouched for after 2027-02-01. The 30-day window that makes a version EXPIRING is a StackToIT parameter, not a provider fact.

SKE Kubernetes versions: production suitability of the capability is SUITABLE (a version with no published end date is never read as safe)
Version	State	Released	Deprecated	Expires	Production suitability	Upgrade action	Migration timing risk
1.36	SUPPORTED	2026-08-27	not stated	2027-06-09	SUITABLE	PLAN	LOW
1.35	UNKNOWN	not stated	not stated	2027-02-10	UNKNOWN	UNKNOWN	UNKNOWN
1.34	EXPIRED	2025-12-16	2026-08-28	2026-10-14	NOT_SUITABLE	MANDATORY_UPDATE_APPLIES	HIGH
1.33	EXPIRED (disputed)	2025-07-29	2026-06-09	2026-06-10 (sources disagree: 2026-07-08)	NOT_SUITABLE	MANDATORY_UPDATE_APPLIES	HIGH
1.32	EXPIRED	not stated	2026-02-20	2026-04-15	NOT_SUITABLE	MANDATORY_UPDATE_APPLIES	HIGH

Day-2 responsibility: when a version reaches its expiry the update is performed by the provider (STACKIT). "If the Kubernetes or OS version of a cluster has reached its expiration date, SKE starts a mandatory update to the highest available patch version of the current minor version, or to the highest patch version of the consecutive minor version that is not classified as preview version." and "mandatory version updates run, even if the auto update for the Kubernetes version is deactivated". Automatic updates otherwise "only update to higher patch levels" in the cluster's maintenance window. Notice: "As a SKE user you will get informed via release notes and via email in case you are operating a cluster with a deprecated Kubernetes version." Customer: "you can check the exact expiration dates for your current Kubernetes and node pool versions in the cluster.status.expiration field via the SKE API". The page does not assign any further duty (workload readiness for the update, testing) to the customer or to STACKIT: not stated.

Sources: https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/operations/version-updates/, https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/, https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/