{"schema_version":"0.16.0","discovered":{"input":{"kind":"terraform","origin":"discovered","reason":"Terraform/OpenTofu configuration files (*.tf, *.tf.json, *.tofu, *.tofu.json) in the folder"},"project":{"state":"NONE","reason":"no stacktoit.yaml in the source folder or its parents up to the git root"},"profile":{},"variable_files":{"chosen":["example.tfvars"],"chosen_by":"flag"}},"header":{"assessment":{"source":"gcp-candidates/terraform-dynamic-python-webapp/infra","assessment_schema":"0.24.0","producer":{"tool":"stacktoit","version":"0.6.0-13076-ga19ea28c64","commit":"a19ea28c64","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0"}},"generated_at":"2026-11-07T04:24:17Z","run":{"run_id":"6f8f72b2-1c34-4cfc-8483-344c41245364","source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000"},"run_status":{"run_publication":"COMPLETE","run_reasons":[],"run_source_status":"RUNTIME_TOPOLOGY_PARTIAL","run_draft":"GENERATED"},"source_snapshot":{"status":"RUNTIME_TOPOLOGY_PARTIAL","reason":"5 unit(s) have a count/for_each that is not known statically; whether and how often they exist is decided at plan time","gaps":["RUNTIME_TOPOLOGY_PARTIAL"],"missing_modules":0,"providers":[{"name":"google","status":"UNVERIFIED","tested_against":"8.4.0","identity_evidence":"PINNED_REGISTRY","note":"no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint \"\u003e= 6, \u003c 8\" excludes it (pinned 8.4.0)","constraints":["\u003e= 3.43, \u003c 7","\u003e= 6, \u003c 8"]},{"name":"google-beta","status":"UNVERIFIED","tested_against":"8.4.0","identity_evidence":"PINNED_REGISTRY","note":"no lock file records the version of registry.terraform.io/hashicorp/google-beta, and the constraint \"\u003e= 6, \u003c 8\" excludes it (pinned 8.4.0)","constraints":["\u003e= 3.43, \u003c 7","\u003e= 6, \u003c 8"]},{"name":"http","status":"UNVERIFIED","tested_against":"","identity_evidence":"UNVERIFIED","note":"The knowledge base holds no pinned source schema of this provider, so its version cannot be checked (UNVERIFIED); the row records that the configuration uses it and changes no decision."},{"name":"random","status":"UNVERIFIED","tested_against":"","identity_evidence":"UNVERIFIED","note":"The knowledge base holds no pinned source schema of this provider, so its version cannot be checked (UNVERIFIED); the row records that the configuration uses it and changes no decision.","constraints":["\u003e= 2.2"]},{"name":"time","status":"UNVERIFIED","tested_against":"","identity_evidence":"UNVERIFIED","note":"The knowledge base holds no pinned source schema of this provider, so its version cannot be checked (UNVERIFIED); the row records that the configuration uses it and changes no decision."}],"module_calls":{"total":1,"external":1,"local":0},"checks":"Built-in source checks passed — OpenTofu validation of the source did not run (LOCK_FILE)"},"target_profile":{"id":"STACKIT_STABLE","label":"Stable network model: the experimental STACKIT VPC resources are not used"},"stackit_provider":"0.121.0","kb_version":"0.394.0","evidence_freshness":{"state":"NOT_ASSESSED","text":"Evidence freshness as one measure is not assessed in this build. Dated evidence is shown where it is used: each STACKIT support option and each assurance row states when it was verified (verified_at, and recheck_after for support), in support_suitability and assurance. The date beside a readiness dimension is the assessment date, not a retrieval date."}},"staleness":{"state":"NOT_ASSESSED","text":"This build has no change detection, so there has been no re-check since the assessment was made (Generated 2026-11-07 04:24 UTC). The source may have changed since."},"readiness":[{"id":"source_fidelity","name":"Source Fidelity","coverage_state":"PARTLY_COVERED","migration_decision_state":"BLOCKERS_OPEN","target_validation_state":"NOT_APPLICABLE","coverage":null,"blockers":1,"open_decisions":null,"last_evidence":"2026-11-07T04:24:17Z","derived_from":["assessment.json#/summary/source_status","assessment.json#/summary/source_gaps"],"detail":"For some units, whether and how many times they exist is decided only when OpenTofu plans."},{"id":"semantic_accounting_coverage","name":"Semantic Accounting","coverage_state":"COVERED","migration_decision_state":"BLOCKERS_OPEN","target_validation_state":"NOT_APPLICABLE","coverage":{"part":11,"whole":11,"percent":100,"part_label":"units with a semantic contract and no critical setting unaccounted","rest_label":"units without a contract or with a critical setting unaccounted"},"blockers":11,"open_decisions":null,"last_evidence":"2026-11-07T04:24:17Z","derived_from":["assessment.json#/units/*/result/semantics"],"detail":"Accounted for is not decided. Covered means every unit has a semantic contract and no critical setting is unaccounted; it does not mean the settings are decided, so the blockers still count the 11 units that leave one for a person. 0 units have no semantic contract; 0 units leave a critical setting unaccounted; 11 units leave one for a person to review (accounted for, not decided). A blocker here is a unit that does either of the last two."},{"id":"critical_semantic_resolution","name":"Critical Resolution","coverage_state":"PARTLY_COVERED","migration_decision_state":"BLOCKERS_OPEN","target_validation_state":"NOT_APPLICABLE","coverage":{"part":12,"whole":62,"percent":19,"part_label":"critical settings resolved","rest_label":"critical settings open"},"blockers":11,"open_decisions":null,"last_evidence":"2026-11-07T04:24:17Z","derived_from":["assessment.json#/units/*/result/semantics/items"],"detail":"12 of 62 critical settings are resolved; 11 units hold an open one (accounted for, not decided); 0 units have no semantic contract. A blocker here is a unit that does either."},{"id":"target_functional_fit","name":"Target Functional Fit","coverage_state":"NOT_ASSESSED","migration_decision_state":"NOT_ASSESSED","target_validation_state":"NOT_ASSESSED","coverage":null,"blockers":null,"open_decisions":null,"last_evidence":null,"derived_from":[],"detail":"Not assessed in this build."},{"id":"target_operability","name":"Target Operability","coverage_state":"NOT_ASSESSED","migration_decision_state":"NOT_ASSESSED","target_validation_state":"NOT_ASSESSED","coverage":null,"blockers":null,"open_decisions":null,"last_evidence":null,"derived_from":[],"detail":"Not assessed in this build."},{"id":"terraform_readiness","name":"Terraform Draft Accounting","coverage_state":"NOT_COVERED","migration_decision_state":"BLOCKERS_OPEN","target_validation_state":"STATIC_CHECKS_PASSED","coverage":{"part":0,"whole":11,"percent":0,"part_label":"units whose critical settings are all accounted for in the draft","rest_label":"units with a critical setting left to a person, or without a draft block"},"blockers":11,"open_decisions":null,"last_evidence":"2026-11-07T04:24:17Z","derived_from":["assessment.json#/units/*/property_accounting/automation_eligible"],"detail":"Not a validation. This counts only whether each unit's critical settings are accounted for in the draft; it does not mean the draft validates, plans or applies against STACKIT, and even the coverage state Covered would not mean it."},{"id":"security","name":"Security","coverage_state":"NOT_ASSESSED","migration_decision_state":"NOT_ASSESSED","target_validation_state":"NOT_ASSESSED","coverage":null,"blockers":null,"open_decisions":null,"last_evidence":null,"derived_from":[],"detail":"Not assessed in this build."},{"id":"reliability_resilience","name":"Reliability / Resilience","coverage_state":"NOT_COVERED","migration_decision_state":"BLOCKERS_OPEN","target_validation_state":"NOT_VALIDATED","coverage":null,"blockers":2,"open_decisions":0,"last_evidence":"2026-11-07T04:24:17Z","derived_from":["workspace.json#/resilience"],"detail":"2 units state a failure-domain, replication or backup fact or hold state. 2 units have no RTO or RPO the customer wrote to decide against, and 0 units have one and wait for a person to choose its resilience intent. No unit is called resilient and no intent is chosen: the source states none, and the availability-zone and metro facts of the target are not assessed."},{"id":"operational_readiness","name":"Operational Readiness","coverage_state":"NOT_COVERED","migration_decision_state":"NO_OPEN_ITEMS","target_validation_state":"NOT_VALIDATED","coverage":null,"blockers":0,"open_decisions":0,"last_evidence":"2026-11-07T04:24:17Z","derived_from":["workspace.json#/workload_readiness","workspace.json#/units/*/workload_readiness"],"detail":"Terraform generated is not workload ready: 0 of 11 units carry open workload items. 0 units need a decision or evidence from a person (0 of them a decision; 0 block a readiness claim, a cutover decision being a migration operation and not a blocker); 2 compute units have no workload evidence in this build. The 20 dimensions of the amendment's operational readiness (identity, logs, backup, DR, support and the rest) are not assessed. A generated Terraform resource does not mark any of them ready."},{"id":"sovereignty_exitability","name":"Sovereignty \u0026 Exitability","coverage_state":"NOT_ASSESSED","migration_decision_state":"NOT_ASSESSED","target_validation_state":"NOT_ASSESSED","coverage":null,"blockers":null,"open_decisions":null,"last_evidence":null,"derived_from":[],"detail":"No state is derived for this dimension: this build rates neither sovereignty nor exitability. What it does state (the thirteen dimensions, the source dependencies and the exitability entries, each with its own state) is in assurance/sovereignty.md and on the Sovereignty page."},{"id":"cost_confidence","name":"Cost Confidence","coverage_state":"NOT_ASSESSED","migration_decision_state":"NOT_ASSESSED","target_validation_state":"NOT_ASSESSED","coverage":null,"blockers":null,"open_decisions":null,"last_evidence":null,"derived_from":[],"detail":"Not assessed in this build."},{"id":"evidence_freshness","name":"Evidence Freshness","coverage_state":"NOT_ASSESSED","migration_decision_state":"NOT_ASSESSED","target_validation_state":"NOT_ASSESSED","coverage":null,"blockers":null,"open_decisions":null,"last_evidence":null,"derived_from":[],"detail":"Not assessed in this build."}],"overview":{"biggest_blockers":[{"kind":"OPEN_CRITICAL_SEMANTIC","id":"account-name","title":"account-name","words":"Review the account name setting","owner":"Identity Architect","resources":["google_service_account.automation","google_service_account.client","google_service_account.server"],"closes_when":"A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.","units":3,"dispositions":["REVIEW"],"family":"gcp.service_account","handling":"REVIEW","ref":"open-critical-semantics"},{"kind":"OPEN_CRITICAL_SEMANTIC","id":"role-bindings","title":"role-bindings","words":"Map the IAM roles of the service account to STACKIT roles","owner":"Identity Architect","resources":["google_service_account.automation","google_service_account.client","google_service_account.server"],"closes_when":"A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","units":3,"dispositions":["REVIEW"],"family":"gcp.service_account","handling":"REVIEW","ref":"open-critical-semantics"},{"kind":"FINDING_GROUP","id":"findinggroup:linked-dependency-unread:8bcb492ae42c","title":"linked-dependency-unread","detail":"This unit names google_firebase_hosting_site.client (google_firebase_hosting_site), whose own decision the target does not carry (it is REDESIGN), and the semantic contract of google_cloudbuild_trigger does not read google_firebase_hosting_site, so what the reference becomes is not assessed.","words":"Decide the resource that the unit depends on","owner":"unassigned (a finding records no owner role)","resources":["google_cloudbuild_trigger.init","google_cloudbuild_trigger.placeholder"],"severity":"warning","units":2,"handling":"REVIEW","ref":"findinggroup/linked-dependency-unread%3A8bcb492ae42c"},{"kind":"FINDING_GROUP","id":"findinggroup:run-unsupported-volume:c6a1d4c8671b","title":"run-unsupported-volume","detail":"A container mounts a Cloud SQL connection, a Cloud Storage bucket (through Cloud Storage FUSE) or an NFS share. The draft writes no volume for these and holds the pods until a person decides: connect to the migrated database or object store over the network instead of the mount, or mount a share or a volume of the cluster yourself.","words":"Run unsupported volume","owner":"unassigned (a finding records no owner role)","resources":["google_cloud_run_v2_job.migrate","google_cloud_run_v2_service.server"],"severity":"warning","units":2,"handling":"REVIEW","ref":"findinggroup/run-unsupported-volume%3Ac6a1d4c8671b"},{"kind":"FINDING_GROUP","id":"findinggroup:secret-iam-access:a19fe5290842","title":"secret-iam-access","detail":"The secret has grants for individual principals. Access on STACKIT Secrets Manager is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for the whole secrets engine of its instance, with no scope to one secret or path. Narrower access exists only as role bindings on the instance or on a secret group (a named list of secrets) in the alpha API of the service, and the pinned provider offers them as resources of its experimental IAM feature (stackit_secretsmanager_instance_role_binding_v1 and stackit_secretsmanager_secret_group_role_binding_v1), which its documentation says may change or be removed; the specification does not list the roles a secret group accepts. A grant of one Google principal on one secret therefore cannot be carried one to one: decide per principal whether it gets a user of the whole instance, a role binding on a secret group of the secrets it may read, or a separate Secrets Manager instance.","words":"Decide how each principal with a grant on a secret reaches it on STACKIT","owner":"unassigned (a finding records no owner role)","resources":["google_secret_manager_secret.django_admin_password","google_secret_manager_secret.django_settings"],"severity":"warning","units":2,"handling":"REVIEW","ref":"findinggroup/secret-iam-access%3Aa19fe5290842"},{"kind":"OPEN_CRITICAL_SEMANTIC","id":"deployment-artifact","title":"deployment-artifact","words":"Choose the container image or artifact","owner":"Platform Architect","resources":["google_cloud_run_v2_job.migrate","google_cloud_run_v2_service.server"],"closes_when":"A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there.","units":2,"dispositions":["REVIEW"],"family":"gcp.cloud_run","handling":"REVIEW","ref":"open-critical-semantics"},{"kind":"OPEN_CRITICAL_SEMANTIC","id":"location-residency","title":"location-residency","words":"Confirm the region the data stays in","resources":["google_cloud_run_v2_job.migrate","google_cloud_run_v2_service.server"],"closes_when":"A person confirms the STACKIT region of the SKE cluster the workload runs on holds the residency the source region gave, since no mapping between Google and STACKIT regions is evidenced.","units":2,"dispositions":["REVIEW"],"family":"gcp.cloud_run","handling":"REVIEW","ref":"open-critical-semantics"},{"kind":"OPEN_CRITICAL_SEMANTIC","id":"secret-settings","title":"secret-settings","words":"Decide how the secrets are carried","owner":"Identity Architect","resources":["google_secret_manager_secret.django_admin_password","google_secret_manager_secret.django_settings"],"closes_when":"A person recreates the secret in the Secrets Manager instance, since its data is not written into the draft, and decides for each IAM member whether it gets a user of the whole instance, a role binding on a secret group, or a separate instance.","units":2,"dispositions":["REVIEW"],"family":"gcp.secret","handling":"REVIEW","ref":"open-critical-semantics"},{"kind":"OPEN_CRITICAL_SEMANTIC","id":"secret-value","title":"secret-value","words":"Provide the values of the secrets","owner":"Security Architect","resources":["google_secret_manager_secret.django_admin_password","google_secret_manager_secret.django_settings"],"closes_when":"A person decides where the value comes from, supplies the document and the step has run.","units":2,"dispositions":["REVIEW"],"family":"gcp.secret","handling":"REVIEW","ref":"open-critical-semantics"},{"kind":"OPEN_CRITICAL_SEMANTIC","id":"secrets","title":"secrets","words":"Create the Kubernetes Secrets for the Secret Manager references","owner":"Security Architect","resources":["google_cloud_run_v2_job.migrate","google_cloud_run_v2_service.server"],"closes_when":"A person creates the Kubernetes Secrets the manifest lists, filled from STACKIT Secrets Manager (for example with an External Secrets Operator).","units":2,"dispositions":["REVIEW"],"family":"gcp.cloud_run","handling":"REVIEW","ref":"open-critical-semantics"}],"source_assurance_warnings":[{"kind":"FINDING_GROUP","id":"findinggroup:source-provider-unverified:8a82df957e8e","title":"source-provider-unverified","detail":"no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint \"\u003e= 6, \u003c 8\" excludes it (pinned 8.4.0) (stated once for the whole estate, with the units it covers and the rest of the words)","words":"Verify the version of the source provider","owner":"unassigned (a finding records no owner role)","resources":["google_cloud_run_v2_job.migrate","google_cloud_run_v2_service.server","google_cloudbuild_trigger.activategcb"],"severity":"warning","units":16,"ref":"findinggroup/source-provider-unverified%3A8a82df957e8e"}],"decisions":{"state":"BUILT","records":43,"plan_decisions":13,"by_source":[{"source":"PLAN_DECISION","records":5,"open_items":13,"accepted_items":0,"units":11,"conditional":0,"open_records":5,"open_units":11,"open_default_records":1},{"source":"CRITICAL_SEMANTIC","records":36,"open_items":72,"accepted_items":0,"units":16,"conditional":22,"open_records":36,"open_units":16,"open_confirm_only_items":1},{"source":"MANUAL_ACTION","records":0,"open_items":0,"accepted_items":0,"units":0,"conditional":0},{"source":"PLAN_STATEMENT","records":2,"open_items":4,"accepted_items":0,"units":4,"conditional":0,"open_records":2,"open_units":4}],"rejected":0,"stale":0,"unmatched_reviews":0,"ref":"decisions"},"understood":{"units_in_totals":11,"conditional":5,"switched_off":0,"uncertain_facets":0,"conditional_by_state":{"present_on_defaults":5,"disabled_on_defaults_but_overridable":0,"runtime_data_unknown":0,"variable_unknown":0,"undecided_other_cause":0},"entries":16,"not_traced":9,"trace_coverage":{"active_drafted":{"traced":6,"total":10,"from_recorded_lines":6},"active_no_block":{"traced":0,"total":1},"conditional":{"traced":1,"total":5,"from_recorded_lines":1},"switched_off":{"traced":0,"total":0}},"critical_semantics":{"resolved":12,"total":62,"open":50,"ref":"open-critical-semantics"},"ref":"architecture"},"target_shape":{"units_with_target":15,"units_without_target":1,"services":[{"service":"STACKIT service account","units":4},{"service":"a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD","units":3},{"service":"STACKIT Secrets Manager","units":2},{"service":"Kubernetes Job/CronJob on SKE","units":1},{"service":"SKE workload (or Cloud Foundry Docker app)","units":1},{"service":"STACKIT Object Storage","units":1},{"service":"STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain","units":1},{"service":"STACKIT PostgreSQL Flex","units":1},{"service":"STACKIT RabbitMQ","units":1}],"ref":"target-fit"},"review_split":{"to_review":77,"settings":71,"settings_conditional":22,"plan_decisions":4,"manual_actions":0,"plan_statements":2,"defaults_to_confirm":1,"confirm_only":1,"accepted_change":0,"reviewed":0,"unit":"open critical settings, and open decision records of the register"},"beyond_cap":{"groups":30,"confirm_only":1,"accepted_change":0},"next_steps":[{"code":"REVIEW_CRITICAL_SEMANTICS","text":"Review the 71 open critical settings: a person decides each (index.html, Decisions page; assurance/critical-semantics.json, critical_semantic_resolution.open). 22 of them belong to units that exist only if a plan-time input holds (critical_semantic_resolution.conditional_open). 1 more is carried by the draft already: confirm only.","ref":"open-critical-semantics"},{"code":"REVIEW_PLAN_ITEMS","text":"Review the 4 open plan decisions and 0 manual actions of the draft (index.html, Architecture, Deployment prerequisites). Confirm the 1 default the draft carries out (index.html, Decisions page): no step waits for the answer, a person confirms each or changes it.","ref":"deployment-prerequisites"},{"code":"REVIEW_DRAFT","text":"Review the draft in terraform/: nothing in it is approved, and an architect has to review it before any use.","ref":"engineering"},{"code":"OPEN_WORKSPACE","text":"Open index.html in a browser for the unit-by-unit view (offline, nothing is loaded)."}],"price_coverage":{"priced":3,"not_assessed":2}},"critical_semantic_resolution":{"resolved":12,"total":62,"units_without_contract":0,"open":{"rows_total":50,"by_disposition":{"LEDGER":2,"REVIEW":47,"UNSUPPORTED":1},"units":11}},"estate":{"files":18,"resources":37,"units":11,"instances":11,"dependencies":29,"entries":16,"presence":{"known_present":11,"conditional":5,"absent":0,"uncertain_facets":0,"conditional_by_state":{"present_on_defaults":5,"disabled_on_defaults_but_overridable":0,"runtime_data_unknown":0,"variable_unknown":0,"undecided_other_cause":0}},"by_class":[{"key":"DIRECT","count":0},{"key":"RECONFIGURE","count":6},{"key":"REPLATFORM","count":2},{"key":"CONTAINERIZE","count":2},{"key":"REDESIGN","count":0},{"key":"MANUAL_REVIEW","count":1},{"key":"BLOCKED","count":0}],"by_confidence":[{"key":"HIGH","count":0},{"key":"MEDIUM","count":10},{"key":"LOW","count":1}]},"units":[{"address":"google_cloud_run_v2_job.migrate","type":"google_cloud_run_v2_job","category":"compute","presence":"KNOWN_PRESENT","in_totals":true,"class":"CONTAINERIZE","confidence":"MEDIUM","target_fit":{"service":"Kubernetes Job/CronJob on SKE","resources":["stackit_ske_cluster"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"lifecycle_effects":{"state":"GA","state_reason":"the pinned provider schema has no beta, experimental or deprecated notice on the target's resources","sets":[{"capability":"compute.managed-kubernetes","subject_kind":"kubernetes_minor_version","title":"SKE Kubernetes versions","as_of":"2026-11-03","recheck_after":"2027-02-01","expiring_window_days":30,"production_suitability":"SUITABLE","day2":{"forced_update_by":"PROVIDER","forced_update_statement":"\"If the Kubernetes or OS version of a cluster has reached its expiration date, SKE starts a mandatory update to the highest available patch version of the current minor version, or to the highest patch version of the consecutive minor version that is not classified as preview version.\" and \"mandatory version updates run, even if the auto update for the Kubernetes version is deactivated\". Automatic updates otherwise \"only update to higher patch levels\" in the cluster's maintenance window.","notice":"\"As a SKE user you will get informed via release notes and via email in case you are operating a cluster with a deprecated Kubernetes version.\"","customer_action":"\"you can check the exact expiration dates for your current Kubernetes and node pool versions in the cluster.status.expiration field via the SKE API\". The page does not assign any further duty (workload readiness for the update, testing) to the customer or to STACKIT: not stated."},"versions":[{"subject":"1.36","state":"SUPPORTED","disputed":false,"released_at":{"date":"2026-08-27","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2027-06-09","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-11-03"},"production_suitability":"SUITABLE","upgrade_action":"PLAN","migration_timing_risk":"LOW","note":"The expiry day of 1.36 was not published on 2026-10-08 and is on 2026-11-03; the page has no release column, so the release date is still the one of the release note."},{"subject":"1.35","state":"UNKNOWN","disputed":false,"expires_at":{"date":"2027-02-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-11-03"},"production_suitability":"UNKNOWN","upgrade_action":"UNKNOWN","migration_timing_risk":"UNKNOWN","note":"The pages read give no release date for 1.35 (no release-note entry), so the state stays UNKNOWN: a future expiry date does not say that a version is offered. The 1.34 deprecation entry names 1.35 as the upgrade target, and the SKE API catalogue that ships with this build (fetched 2026-10-18) lists 1.35.8 as supported; the draft of the Kubernetes version reads that catalogue for a row like this one, so a release date is not estimated here."},{"subject":"1.34","state":"EXPIRED","disputed":false,"released_at":{"date":"2025-12-16","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-08-28","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-10-14","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"Clusters still on 1.34 are upgraded to 1.35 by the mandatory update (release note of 2026-08-28); the day it runs inside the maintenance window is not stated, so no forced-update date is recorded."},{"subject":"1.33","state":"EXPIRED","disputed":true,"released_at":{"date":"2025-07-29","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-06-09","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-06-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08","dissent":[{"date":"2026-07-08","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"}]},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"The expiry day differs between the lifecycle page (2026-06-10) and the release note (2026-07-08); the state is EXPIRED under either."},{"subject":"1.32","state":"EXPIRED","disputed":false,"deprecated_at":{"date":"2026-02-20","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-04-15","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"No release date for 1.32 appears in the pages read."}],"sources":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/operations/version-updates/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"]}]},"catalogue":{"state":"MATCHED","capabilities":["compute.managed-kubernetes"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":3,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":4,"properties_not_carried":3,"not_carried":[{"node":"google_cloud_run_v2_job.migrate","property":"deletion_protection","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"deletion-protection","reason":"NOT CARRIED (google_cloud_run_v2_job.migrate): deletion_protection = false — deletion protection is a Google API guard against deleting the resource; the manifests carry no such guard — protect the workload with the access rules of the namespace.","semantic":"terraform-destroy-guard","contract":"gcp.cloud_run","source":"jobs.tf:18"},{"node":"google_cloud_run_v2_job.migrate","property":"template.template.service_account","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (google_cloud_run_v2_job.migrate): template.template.service_account — the identity of the revision is a Google service account; the pods run as the default Kubernetes ServiceAccount of the namespace and the draft gives them no identity — decide the identity of the application (the service account unit of the source and the identity decisions of the draft, identity.tf), and the roles it holds on the services it calls.","semantic":"service-identity","contract":"gcp.cloud_run","source":"jobs.tf:18"},{"node":"google_cloud_run_v2_job.migrate","property":"template.template.volumes.cloud_sql_instance.instances","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (google_cloud_run_v2_job.migrate): template.template.volumes.cloud_sql_instance.instances — a Cloud Run setting with no counterpart in the draft manifests: Kubernetes has its own rollout, health, scheduling and exec behaviour.","semantic":"cloud-run-v2-job-network-exposure","contract":"gcp.cloud_run","source":"jobs.tf:18"}],"refs":{"id":"unit:google_cloud_run_v2_job.migrate","family":"GCP_IDENTITY","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/9","ids":["unit:google_cloud_run_v2_job.migrate"]},{"hop":"intent","state":"NOT_AVAILABLE","kind":"NOT_AVAILABLE","reason":"NO_INTENT_RECORDED"},{"hop":"plan","state":"OPEN","kind":"REPORT_FILE","file":"target-plan.json"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:attach-complete@google_cloud_run_v2_job.migrate","check:final-artifact@google_cloud_run_v2_job.migrate","check:plan-valid@google_cloud_run_v2_job.migrate","check:renders@google_cloud_run_v2_job.migrate","check:round-trip@google_cloud_run_v2_job.migrate"]}],"targets":["target:stackit_ske_cluster.containers"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 1 open decisions, 0 manual actions","open_decisions":[{"id":"convert:estate:source_location:SOURCE_REGION_MAPPING","reasons":["The source places its units in a location the scan cannot read (the value comes from an input a plan can change, or the source does not state it). No mapping between Google and STACKIT regions is evidenced, so the region the draft builds in is not shown to hold the residency of a source location: a person states it once for the estate, by answering target.region.source_location for each location."],"required_by_phase":"BEFORE_PILOT","question":"Map each source location of the estate to a STACKIT region","subjects":["google_cloud_run_v2_job.migrate","google_cloud_run_v2_service.server","google_sql_database_instance.postgres","google_storage_bucket.media"],"default":{"option":"map-source-locations-to-the-draft-region","words":"the draft builds every unit in the STACKIT region eu01, which is what it does with no answer. That is a region the catalogue of this build lists and no claim that it holds the residency of the source: only an answer of target.region.source_location closes the settings this decision holds.","answered_by":"DEFAULT"}}],"manual_actions":[]},"plan_statements":[{"id":"stackitsa:statement:google_cloud_run_v2_job.migrate","family":"stackitsa","reason":"MANUAL_REVIEW","cause":"google_cloud_run_v2_job.migrate is a container task: its 1 identity binding(s) are facts only, and no service account is attached for it (no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account)","manual_actions":[{"id":"stackitsa:facts:google_cloud_run_v2_job.migrate:google_cloud_run_v2_job.migrate#template[0].template[0].service_account","kind":"OTHER","phase":"BEFORE_PILOT","what":"Decide how google_cloud_run_v2_job.migrate gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it","why":"the workload is a container task, not a server an account is attached to (template[0].template[0].service_account of google_cloud_run_v2_job.migrate names google_service_account.automation). no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account"}]}],"workload_readiness":{"applies":true,"dimensions":[{"id":"bootstrap_configuration","state":"NOT_ASSESSED"},{"id":"source_artifacts","state":"NOT_ASSESSED"},{"id":"target_preconditions","state":"NOT_ASSESSED"},{"id":"cutover","state":"NOT_ASSESSED"},{"id":"day2_operations","state":"NOT_ASSESSED"}]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"open_decisions":1,"manual_actions":0,"register":{"open":6,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-SOURCE-REGION-MAPPING"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE","DEC-NET-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE","DEC-OPS-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE","DEC-SEC-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE"]},{"source":"PLAN_STATEMENT","open_records":["DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW"]}],"next_step":{"record":"DEC-GEN-CONVERT-SOURCE-REGION-MAPPING","source":"PLAN_DECISION","text":"Decide \"source region mapping\" (DEC-GEN-CONVERT-SOURCE-REGION-MAPPING): the plan of the draft leaves it open"},"blocks_automation":true}},"target_prices":[{"resource":"stackit_ske_cluster.containers","resource_type":"stackit_ske_cluster","component":"cluster hour","state":"PRICED","sku_id":"ST-0010701","sku_name":"Kubernetes Engine-Cluster Management-EU01","unit_price":"0.09959511998","unit":"Hours","unit_billing":"per cluster/hour","region":"eu01","metro":false,"valid_start":"2026-10-08T07:44:19Z","shared_with":["google_cloud_run_v2_service.server"]}]},{"address":"google_cloud_run_v2_service.server","type":"google_cloud_run_v2_service","category":"compute","presence":"KNOWN_PRESENT","in_totals":true,"class":"CONTAINERIZE","confidence":"MEDIUM","target_fit":{"service":"SKE workload (or Cloud Foundry Docker app)","resources":["stackit_ske_cluster"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"lifecycle_effects":{"state":"GA","state_reason":"the pinned provider schema has no beta, experimental or deprecated notice on the target's resources","sets":[{"capability":"compute.managed-kubernetes","subject_kind":"kubernetes_minor_version","title":"SKE Kubernetes versions","as_of":"2026-11-03","recheck_after":"2027-02-01","expiring_window_days":30,"production_suitability":"SUITABLE","day2":{"forced_update_by":"PROVIDER","forced_update_statement":"\"If the Kubernetes or OS version of a cluster has reached its expiration date, SKE starts a mandatory update to the highest available patch version of the current minor version, or to the highest patch version of the consecutive minor version that is not classified as preview version.\" and \"mandatory version updates run, even if the auto update for the Kubernetes version is deactivated\". Automatic updates otherwise \"only update to higher patch levels\" in the cluster's maintenance window.","notice":"\"As a SKE user you will get informed via release notes and via email in case you are operating a cluster with a deprecated Kubernetes version.\"","customer_action":"\"you can check the exact expiration dates for your current Kubernetes and node pool versions in the cluster.status.expiration field via the SKE API\". The page does not assign any further duty (workload readiness for the update, testing) to the customer or to STACKIT: not stated."},"versions":[{"subject":"1.36","state":"SUPPORTED","disputed":false,"released_at":{"date":"2026-08-27","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2027-06-09","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-11-03"},"production_suitability":"SUITABLE","upgrade_action":"PLAN","migration_timing_risk":"LOW","note":"The expiry day of 1.36 was not published on 2026-10-08 and is on 2026-11-03; the page has no release column, so the release date is still the one of the release note."},{"subject":"1.35","state":"UNKNOWN","disputed":false,"expires_at":{"date":"2027-02-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-11-03"},"production_suitability":"UNKNOWN","upgrade_action":"UNKNOWN","migration_timing_risk":"UNKNOWN","note":"The pages read give no release date for 1.35 (no release-note entry), so the state stays UNKNOWN: a future expiry date does not say that a version is offered. The 1.34 deprecation entry names 1.35 as the upgrade target, and the SKE API catalogue that ships with this build (fetched 2026-10-18) lists 1.35.8 as supported; the draft of the Kubernetes version reads that catalogue for a row like this one, so a release date is not estimated here."},{"subject":"1.34","state":"EXPIRED","disputed":false,"released_at":{"date":"2025-12-16","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-08-28","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-10-14","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"Clusters still on 1.34 are upgraded to 1.35 by the mandatory update (release note of 2026-08-28); the day it runs inside the maintenance window is not stated, so no forced-update date is recorded."},{"subject":"1.33","state":"EXPIRED","disputed":true,"released_at":{"date":"2025-07-29","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"deprecated_at":{"date":"2026-06-09","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-06-10","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08","dissent":[{"date":"2026-07-08","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"}]},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"The expiry day differs between the lifecycle page (2026-06-10) and the release note (2026-07-08); the state is EXPIRED under either."},{"subject":"1.32","state":"EXPIRED","disputed":false,"deprecated_at":{"date":"2026-02-20","kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/","observed_at":"2026-10-08"},"expires_at":{"date":"2026-04-15","kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","observed_at":"2026-10-08"},"production_suitability":"NOT_SUITABLE","upgrade_action":"MANDATORY_UPDATE_APPLIES","migration_timing_risk":"HIGH","note":"No release date for 1.32 appears in the pages read."}],"sources":["https://docs.stackit.cloud/products/runtime/kubernetes-engine/basics/operations/version-updates/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","https://docs.stackit.cloud/products/runtime/kubernetes-engine/release-notes/"]}]},"catalogue":{"state":"MATCHED","capabilities":["compute.managed-kubernetes"],"unmatched_resources":[]}},"blocker_count":3,"finding_count":4,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":4,"properties_not_carried":6,"not_carried":[{"node":"google_cloud_run_v2_service.server","property":"deletion_protection","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"deletion-protection","reason":"NOT CARRIED (google_cloud_run_v2_service.server): deletion_protection = false — deletion protection is a Google API guard against deleting the resource; the manifests carry no such guard — protect the workload with the access rules of the namespace.","semantic":"terraform-destroy-guard","contract":"gcp.cloud_run","source":"service.tf:17"},{"node":"google_cloud_run_v2_service.server","property":"template.labels","source":"service.tf:17"},{"node":"google_cloud_run_v2_service.server","property":"template.service_account","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (google_cloud_run_v2_service.server): template.service_account — the identity of the revision is a Google service account; the pods run as the default Kubernetes ServiceAccount of the namespace and the draft gives them no identity — decide the identity of the application (the service account unit of the source and the identity decisions of the draft, identity.tf), and the roles it holds on the services it calls.","semantic":"service-identity","contract":"gcp.cloud_run","source":"service.tf:17"},{"node":"google_cloud_run_v2_service.server","property":"template.volumes.cloud_sql_instance.instances","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"network-exposure","reason":"NOT CARRIED (google_cloud_run_v2_service.server): template.volumes.cloud_sql_instance.instances — a Cloud Run setting with no counterpart in the draft manifests: Kubernetes has its own rollout, health, scheduling and exec behaviour.","semantic":"cloud-sql-connection","contract":"gcp.cloud_run","source":"service.tf:17"},{"node":"google_cloud_run_v2_service.server","property":"traffic.percent","source":"service.tf:17"},{"node":"google_cloud_run_v2_service.server","property":"traffic.type","source":"service.tf:17"}],"refs":{"id":"unit:google_cloud_run_v2_service.server","family":"GCP_IDENTITY","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/10","ids":["unit:google_cloud_run_v2_service.server"]},{"hop":"intent","state":"NOT_AVAILABLE","kind":"NOT_AVAILABLE","reason":"NO_INTENT_RECORDED"},{"hop":"plan","state":"OPEN","kind":"REPORT_FILE","file":"target-plan.json"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:attach-complete@google_cloud_run_v2_service.server","check:final-artifact@google_cloud_run_v2_service.server","check:plan-valid@google_cloud_run_v2_service.server","check:renders@google_cloud_run_v2_service.server","check:round-trip@google_cloud_run_v2_service.server"]}],"targets":["target:stackit_ske_cluster.containers"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 1 open decisions, 0 manual actions","open_decisions":[{"id":"convert:estate:source_location:SOURCE_REGION_MAPPING","reasons":["The source places its units in a location the scan cannot read (the value comes from an input a plan can change, or the source does not state it). No mapping between Google and STACKIT regions is evidenced, so the region the draft builds in is not shown to hold the residency of a source location: a person states it once for the estate, by answering target.region.source_location for each location."],"required_by_phase":"BEFORE_PILOT","question":"Map each source location of the estate to a STACKIT region","subjects":["google_cloud_run_v2_job.migrate","google_cloud_run_v2_service.server","google_sql_database_instance.postgres","google_storage_bucket.media"],"default":{"option":"map-source-locations-to-the-draft-region","words":"the draft builds every unit in the STACKIT region eu01, which is what it does with no answer. That is a region the catalogue of this build lists and no claim that it holds the residency of the source: only an answer of target.region.source_location closes the settings this decision holds.","answered_by":"DEFAULT"}}],"manual_actions":[]},"plan_statements":[{"id":"stackitsa:statement:google_cloud_run_v2_service.server","family":"stackitsa","reason":"MANUAL_REVIEW","cause":"google_cloud_run_v2_service.server is a container service: its 1 identity binding(s) are facts only, and no service account is attached for it (no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account)","manual_actions":[{"id":"stackitsa:facts:google_cloud_run_v2_service.server:google_cloud_run_v2_service.server#template[0].service_account","kind":"OTHER","phase":"BEFORE_PILOT","what":"Decide how google_cloud_run_v2_service.server gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it","why":"the workload is a container service, not a server an account is attached to (template[0].service_account of google_cloud_run_v2_service.server names google_service_account.server). no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account"}]}],"workload_readiness":{"applies":true,"dimensions":[{"id":"bootstrap_configuration","state":"NOT_ASSESSED"},{"id":"source_artifacts","state":"NOT_ASSESSED"},{"id":"target_preconditions","state":"NOT_ASSESSED"},{"id":"cutover","state":"NOT_ASSESSED"},{"id":"day2_operations","state":"NOT_ASSESSED"}]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"open_decisions":1,"manual_actions":0,"register":{"open":7,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-SOURCE-REGION-MAPPING"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-GEN-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","DEC-IAM-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","DEC-NET-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","DEC-OPS-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","DEC-SEC-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER"]},{"source":"PLAN_STATEMENT","open_records":["DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW"]}],"next_step":{"record":"DEC-GEN-CONVERT-SOURCE-REGION-MAPPING","source":"PLAN_DECISION","text":"Decide \"source region mapping\" (DEC-GEN-CONVERT-SOURCE-REGION-MAPPING): the plan of the draft leaves it open"},"blocks_automation":true}}},{"address":"google_cloudbuild_trigger.activategcb","type":"google_cloudbuild_trigger","category":"compute","presence":"CONDITIONAL","in_totals":false,"conditional_state":"PRESENT_ON_DEFAULTS","class":"REDESIGN","confidence":"MEDIUM","target_fit":{"service":"a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD","resources":["stackit_git"],"maturity":"beta","lifecycle":"active","regions":["eu01","eu02"],"catalogue":{"state":"MATCHED","capabilities":["devtools.git"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":15,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":0,"refs":{"id":"unit:google_cloudbuild_trigger.activategcb","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/11","ids":["unit:google_cloudbuild_trigger.activategcb"]},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NO_DRAFT_BLOCK"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":[]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 2 open decisions, 0 manual actions","open_decisions":[{"id":"convert:estate:source_project:SOURCE_PROJECT_MAPPING","reasons":["The source places its units in the project example-project, and in a project the scan cannot read for some units, and the source project is carried nowhere. A person maps the source projects by answering target.project.source_project for each: var.project_id, or the project of the unit's network (network-project). The answer records that mapping and changes nothing in the draft, which keeps its own project resolver."],"required_by_phase":"BEFORE_PILOT","question":"State where the units of each source project of the estate go","subjects":["google_cloudbuild_trigger.activategcb","google_cloudbuild_trigger.init","google_cloudbuild_trigger.placeholder","google_sql_database_instance.postgres"]},{"id":"convert:google_cloudbuild_trigger.activategcb:proposal:PROPOSED_ALTERNATIVE","reasons":["the target has no equal of this Cloud Build trigger: starts a build on a source event, a Pub/Sub message, a webhook or by hand, with its steps, substitutions, artifacts, secrets and optional approval: Nothing is converted. The same delivery is a workflow of STACKIT Git Pipelines (written for GitHub Actions; STACKIT-managed or custom runners; secrets from Secrets Manager or the repository; a manual-approval action) or the customer's own CI/CD. Trigger conditions, steps, secrets (created again, never copied), the service account (replaced by the credentials the workflow uses against STACKIT), the log destination and the approval are written again by a person. To decide: Which pipelines are still needed, where they run (STACKIT Git Pipelines or the customer's own CI/CD), how each trigger, step, secret and approval is written again, and who owns the workflow files."],"required_by_phase":"BEFORE_PILOT","question":"Decide whether the proposed STACKIT alternative replaces google_cloudbuild_trigger.activategcb: read the module proposals/proposal_activategcb, accept the difference and set its values, or design it another way","subjects":["google_cloudbuild_trigger.activategcb","module.proposal_activategcb[0].stackit_git.this"]}],"manual_actions":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"open_decisions":2,"manual_actions":0,"register":{"open":4,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE","DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-ACTIVATEGCB","DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-ACTIVATEGCB"]}],"next_step":{"record":"DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE","source":"PLAN_DECISION","text":"Decide \"proposed alternative\" (DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE): the plan of the draft leaves it open"},"blocks_automation":true}}},{"address":"google_cloudbuild_trigger.init","type":"google_cloudbuild_trigger","category":"compute","presence":"CONDITIONAL","in_totals":false,"conditional_state":"PRESENT_ON_DEFAULTS","class":"REDESIGN","confidence":"LOW","target_fit":{"service":"a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD","resources":["stackit_git"],"maturity":"beta","lifecycle":"active","regions":["eu01","eu02"],"catalogue":{"state":"MATCHED","capabilities":["devtools.git"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":6,"evidence_count":15,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":0,"refs":{"id":"unit:google_cloudbuild_trigger.init","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/12","ids":["unit:google_cloudbuild_trigger.init"]},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NO_DRAFT_BLOCK"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":[]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 2 open decisions, 0 manual actions","open_decisions":[{"id":"convert:estate:source_project:SOURCE_PROJECT_MAPPING","reasons":["The source places its units in the project example-project, and in a project the scan cannot read for some units, and the source project is carried nowhere. A person maps the source projects by answering target.project.source_project for each: var.project_id, or the project of the unit's network (network-project). The answer records that mapping and changes nothing in the draft, which keeps its own project resolver."],"required_by_phase":"BEFORE_PILOT","question":"State where the units of each source project of the estate go","subjects":["google_cloudbuild_trigger.activategcb","google_cloudbuild_trigger.init","google_cloudbuild_trigger.placeholder","google_sql_database_instance.postgres"]},{"id":"convert:google_cloudbuild_trigger.init:proposal:PROPOSED_ALTERNATIVE","reasons":["the target has no equal of this Cloud Build trigger: starts a build on a source event, a Pub/Sub message, a webhook or by hand, with its steps, substitutions, artifacts, secrets and optional approval: Nothing is converted. The same delivery is a workflow of STACKIT Git Pipelines (written for GitHub Actions; STACKIT-managed or custom runners; secrets from Secrets Manager or the repository; a manual-approval action) or the customer's own CI/CD. Trigger conditions, steps, secrets (created again, never copied), the service account (replaced by the credentials the workflow uses against STACKIT), the log destination and the approval are written again by a person. To decide: Which pipelines are still needed, where they run (STACKIT Git Pipelines or the customer's own CI/CD), how each trigger, step, secret and approval is written again, and who owns the workflow files."],"required_by_phase":"BEFORE_PILOT","question":"Decide whether the proposed STACKIT alternative replaces google_cloudbuild_trigger.init: read the module proposals/proposal_init, accept the difference and set its values, or design it another way","subjects":["google_cloudbuild_trigger.init","module.proposal_init[0].stackit_git.this"]}],"manual_actions":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"open_decisions":2,"manual_actions":0,"register":{"open":4,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE","DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-INIT","DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-INIT"]}],"next_step":{"record":"DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE","source":"PLAN_DECISION","text":"Decide \"proposed alternative\" (DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE): the plan of the draft leaves it open"},"blocks_automation":true}}},{"address":"google_cloudbuild_trigger.placeholder","type":"google_cloudbuild_trigger","category":"compute","presence":"CONDITIONAL","in_totals":false,"conditional_state":"PRESENT_ON_DEFAULTS","class":"REDESIGN","confidence":"LOW","target_fit":{"service":"a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD","resources":["stackit_git"],"maturity":"beta","lifecycle":"active","regions":["eu01","eu02"],"catalogue":{"state":"MATCHED","capabilities":["devtools.git"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":3,"evidence_count":15,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":0,"refs":{"id":"unit:google_cloudbuild_trigger.placeholder","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/13","ids":["unit:google_cloudbuild_trigger.placeholder"]},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NO_DRAFT_BLOCK"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":[]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 2 open decisions, 0 manual actions","open_decisions":[{"id":"convert:estate:source_project:SOURCE_PROJECT_MAPPING","reasons":["The source places its units in the project example-project, and in a project the scan cannot read for some units, and the source project is carried nowhere. A person maps the source projects by answering target.project.source_project for each: var.project_id, or the project of the unit's network (network-project). The answer records that mapping and changes nothing in the draft, which keeps its own project resolver."],"required_by_phase":"BEFORE_PILOT","question":"State where the units of each source project of the estate go","subjects":["google_cloudbuild_trigger.activategcb","google_cloudbuild_trigger.init","google_cloudbuild_trigger.placeholder","google_sql_database_instance.postgres"]},{"id":"convert:google_cloudbuild_trigger.placeholder:proposal:PROPOSED_ALTERNATIVE","reasons":["the target has no equal of this Cloud Build trigger: starts a build on a source event, a Pub/Sub message, a webhook or by hand, with its steps, substitutions, artifacts, secrets and optional approval: Nothing is converted. The same delivery is a workflow of STACKIT Git Pipelines (written for GitHub Actions; STACKIT-managed or custom runners; secrets from Secrets Manager or the repository; a manual-approval action) or the customer's own CI/CD. Trigger conditions, steps, secrets (created again, never copied), the service account (replaced by the credentials the workflow uses against STACKIT), the log destination and the approval are written again by a person. To decide: Which pipelines are still needed, where they run (STACKIT Git Pipelines or the customer's own CI/CD), how each trigger, step, secret and approval is written again, and who owns the workflow files."],"required_by_phase":"BEFORE_PILOT","question":"Decide whether the proposed STACKIT alternative replaces google_cloudbuild_trigger.placeholder: read the module proposals/proposal_placeholder, accept the difference and set its values, or design it another way","subjects":["google_cloudbuild_trigger.placeholder","module.proposal_placeholder[0].stackit_git.this"]}],"manual_actions":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"open_decisions":2,"manual_actions":0,"register":{"open":5,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE","DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-GEN-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER","DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER","DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER"]}],"next_step":{"record":"DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE","source":"PLAN_DECISION","text":"Decide \"proposed alternative\" (DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE): the plan of the draft leaves it open"},"blocks_automation":true}}},{"address":"google_firebase_hosting_site.client","type":"google_firebase_hosting_site","category":"network","presence":"CONDITIONAL","in_totals":false,"conditional_state":"PRESENT_ON_DEFAULTS","class":"REDESIGN","confidence":"LOW","target_fit":{"service":"STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain","resources":["stackit_objectstorage_bucket","stackit_cdn_distribution","stackit_cdn_custom_domain"],"maturity":"beta","lifecycle":"active","regions":[],"catalogue":{"state":"PARTIAL","capabilities":["cdn.custom-domain","cdn.distribution"],"unmatched_resources":["stackit_objectstorage_bucket"],"unlinked_resources":["stackit_objectstorage_bucket"]}},"blocker_count":2,"finding_count":2,"evidence_count":7,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":0,"refs":{"id":"unit:google_firebase_hosting_site.client","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/14","ids":["unit:google_firebase_hosting_site.client"]},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NO_DRAFT_BLOCK"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":[]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 1 open decisions, 0 manual actions","open_decisions":[{"id":"convert:google_firebase_hosting_site.client:proposal:PROPOSED_ALTERNATIVE","reasons":["the target has no equal of this static web hosting site: Static files are published into an Object Storage bucket by a pipeline, and a CDN distribution (a beta resource) with the bucket as origin serves them on a custom domain; the redirects of the site become redirect rules of the distribution. Custom response headers, rewrites to Cloud Run services or Cloud Functions, preview channels and the release history have no counterpart and are restated in the pipeline or in the application. To decide: Which bucket is the origin, which domain the distribution serves, and how rewrites and previews are replaced. The CDN resources are beta."],"required_by_phase":"BEFORE_PILOT","question":"Decide whether the proposed STACKIT alternative replaces google_firebase_hosting_site.client: read the module proposals/proposal_client, accept the difference and set its values, or design it another way","subjects":["google_firebase_hosting_site.client","module.proposal_client[0].stackit_objectstorage_bucket.this"]}],"manual_actions":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"open_decisions":1,"manual_actions":0,"register":{"open":3,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT","DEC-OPS-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT"]}],"next_step":{"record":"DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE","source":"PLAN_DECISION","text":"Decide \"proposed alternative\" (DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE): the plan of the draft leaves it open"},"blocks_automation":true}}},{"address":"google_firebase_project.default","type":"google_firebase_project","category":"platform","presence":"KNOWN_PRESENT","in_totals":true,"class":"MANUAL_REVIEW","confidence":"LOW","target_fit":null,"blocker_count":1,"finding_count":1,"evidence_count":3,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":1,"refs":{"id":"unit:google_firebase_project.default","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/0","ids":["unit:google_firebase_project.default"]},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"NONE","kind":"NOT_AVAILABLE","reason":"NO_DRAFT_BLOCK"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-GOOGLE-FIREBASE-PROJECT-DEFAULT"]}],"next_step":{"record":"DEC-IAM-GOOGLE-FIREBASE-PROJECT-DEFAULT","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of google_firebase_project.default (DEC-IAM-GOOGLE-FIREBASE-PROJECT-DEFAULT): decide each or accept the difference"},"blocks_automation":true}}},{"address":"google_pubsub_topic.faux","type":"google_pubsub_topic","category":"messaging","presence":"KNOWN_PRESENT","in_totals":true,"class":"REPLATFORM","confidence":"MEDIUM","target_fit":{"service":"STACKIT RabbitMQ","resources":["stackit_rabbitmq_instance","stackit_rabbitmq_credential"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"catalogue":{"state":"MATCHED","capabilities":["messaging.mqtt-broker","messaging.rabbitmq-credential"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":1,"evidence_count":3,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":1,"properties_not_carried":1,"not_carried":[{"node":"google_pubsub_topic.faux","property":"name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"workload-compatibility","reason":"NOT CARRIED (google_pubsub_topic.faux): name — the topic becomes an exchange and its subscriptions queues of the shared RabbitMQ instance, created in RabbitMQ by hand (not by this draft): names, delivery, retention and push settings are not generated.","semantic":"tc-name","contract":"gcp.pubsub_topic","source":"postdeployment.tf:32"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"google_pubsub_topic.faux is a resource of the source, declared in postdeployment.tf (lines 32-34). The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/1","id":"google_pubsub_topic.faux"},"expert":{"id_refs":["TL-c72c571f4c97","TL-1649b25a7b0f","TL-32b627c93f61","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","lines":["One RabbitMQ instance hosts all migrated topics as exchanges and subscriptions as queues."],"artefact":{"kind":"IN_MEMORY"},"expert":{"ids":["recorded: finding: source-provider-unverified","recorded: trace: TR-4a61e547964d"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-585f91b2466f","line_ids":["TL-9b340e19f00f","TL-8af2c912ea9b","TL-1216316511e9"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/1","id":"google_pubsub_topic.faux"},"expert":{"ids":["claim: messaging-model = KNOWN, CRITICAL, TRANSFORMED","claim: tc-name = KNOWN, CRITICAL, REVIEW"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-d130b98cad63","line_ids":["TL-0e2ee7c8bf70"],"artefact":{"kind":"REPORT_FILE","file":"terraform/messaging.tf","id":"stackit_rabbitmq_instance.messaging"},"expert":{"id_refs":["TL-80d5f3ebb51a","TL-b59da857cf28","TL-5aac6219bc47"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-959c48ef01bf","line_ids":["TL-84300c5fe338","TL-4650f5c83475","TL-384370564772"],"artefact":{"kind":"IN_MEMORY"},"expert":{"ids":["decision: convert:api:pubsub:v1beta:beta:API_OPT_IN"]}}]},"refs":{"id":"unit:google_pubsub_topic.faux","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/1","ids":["unit:google_pubsub_topic.faux"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/1"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_rabbitmq_instance.messaging"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 1 open decisions, 0 manual actions","open_decisions":[{"id":"convert:api:pubsub:v1beta:beta:API_OPT_IN","reasons":["the pubsub API v1beta is beta: the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for google_pubsub_topic.faux wait for this decision; the draft's own blocks do not"],"required_by_phase":"BEFORE_PILOT","question":"Allow calls of the beta pubsub API v1beta for this migration (the API may change or vanish)? Accept: the pubsub API v1beta path is carried out for google_pubsub_topic.faux: its calls become executable. the RabbitMQ instance the draft writes stays in the draft this run wrote, so its step is held (REGENERATE_REQUIRED) until a draft is generated without it (answer target.messaging.path with pubsub in the inputs file and run again); an instance shared with a queue or topic that has no call of the pubsub API v1beta path stays taken. Refuse: the RabbitMQ instance the draft writes is carried out and the calls and steps of the pubsub API v1beta path are not taken.","subjects":["google_pubsub_topic.faux"]}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"open_decisions":1,"manual_actions":0,"register":{"open":2,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-API-OPT-IN"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-OPS-GOOGLE-PUBSUB-TOPIC-FAUX"]}],"next_step":{"record":"DEC-GEN-CONVERT-API-OPT-IN","source":"PLAN_DECISION","text":"Decide \"api opt in\" (DEC-GEN-CONVERT-API-OPT-IN): the plan of the draft leaves it open"},"blocks_automation":true}},"target_prices":[{"resource":"stackit_rabbitmq_instance.messaging","resource_type":"stackit_rabbitmq_instance","component":"plan","state":"NOT_ASSESSED","reason_code":"KEY_NOT_IN_DRAFT","reason":"NOT_ASSESSED: the draft does not choose the plan (plan_name is var.rabbitmq_plan_name): no SKU is named"}]},{"address":"google_secret_manager_secret.django_admin_password","type":"google_secret_manager_secret","category":"identity","presence":"KNOWN_PRESENT","in_totals":true,"class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT Secrets Manager","resources":["stackit_secretsmanager_instance","stackit_secretsmanager_user"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["security.secrets-manager"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":2,"properties_not_carried":5,"not_carried":[{"node":"google_secret_manager_secret.django_admin_password","property":"replication.user_managed.replicas.location","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"residency-compliance","reason":"NOT CARRIED (google_secret_manager_secret.django_admin_password): replication, secret_id — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied.","semantic":"secret-settings","contract":"gcp.secret","source":"secrets.tf:25"},{"node":"google_secret_manager_secret.django_admin_password","property":"secret_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"secret-handling","reason":"NOT CARRIED (google_secret_manager_secret.django_admin_password): replication, secret_id — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied.","semantic":"tcr-secret-id","contract":"gcp.secret","source":"secrets.tf:25"},{"node":"google_secret_manager_secret_iam_binding.django_admin_password","property":"members","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (google_secret_manager_secret_iam_binding.django_admin_password): members, role = roles/secretmanager.secretAccessor — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied. Proposed, switched off until it is decided: proposals/proposal_django_admin_password, switch proposal_django_admin_password_enabled.","semantic":"secret-settings","contract":"gcp.secret","source":"secrets.tf:39"},{"node":"google_secret_manager_secret_iam_binding.django_admin_password","property":"role","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (google_secret_manager_secret_iam_binding.django_admin_password): members, role = roles/secretmanager.secretAccessor — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied. Proposed, switched off until it is decided: proposals/proposal_django_admin_password, switch proposal_django_admin_password_enabled.","semantic":"secret-settings","contract":"gcp.secret","source":"secrets.tf:39"},{"node":"google_secret_manager_secret_version.django_admin_password","property":"secret_data","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"secret-handling","reason":"NOT CARRIED (google_secret_manager_secret_version.django_admin_password): secret_data — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied.","semantic":"secret-value","contract":"gcp.secret","source":"secrets.tf:45"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"google_secret_manager_secret.django_admin_password is a resource of the source, declared in secrets.tf (lines 25-37). The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/6","id":"google_secret_manager_secret.django_admin_password"},"expert":{"id_refs":["TL-5ceb916b409a","TL-08f76fb5c71a","TL-c5abf7427a0e","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"NONE","summary_id":"TT-48469437839e","artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-5f75b6165ca2","TL-c11b2eb48228","TL-13ce71aece42","TL-503d50b7aa7d"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-1737feb2c87a","line_ids":["TL-9b340e19f00f","TL-06755e954f06","TL-c959b4e71765"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/6","id":"google_secret_manager_secret.django_admin_password"},"expert":{"id_refs":["TL-7451f0ddfebd","TL-a291587bece7","TL-34f62a617dbd","TL-a30957b93362"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-5798af0448aa","TL-0c56d776dcdb"],"artefact":{"kind":"REPORT_FILE","file":"terraform/security.tf","id":"stackit_secretsmanager_instance.migrated_secrets"},"expert":{"id_refs":["TL-f35035518166","TL-00a39791a5cf","TL-e191a34ed084","TL-18f44e45a2a6","TL-82854da0cb04","TL-2a141718f446"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-203b3c44b616","line_ids":["TL-375c470451cb","TL-4e87d5fb0143","TL-94cf3b3e974b","TL-d371c95a6914","TL-4650f5c83475","TL-6ce259dabf9d"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-c8c470bdcd9f","TL-4b5d26e71960"]}}]},"refs":{"id":"unit:google_secret_manager_secret.django_admin_password","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/6","ids":["unit:google_secret_manager_secret.django_admin_password"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/6"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_secretsmanager_instance.migrated_secrets","target:stackit_secretsmanager_user.migration"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 2 open decisions, 0 manual actions","open_decisions":[{"id":"convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN","reasons":["the Secrets Manager Vault-compatible API is of a maturity that is not established (its documentation states no release status and its product documentation does not establish it as generally available): the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for google_secret_manager_secret.django_admin_password, google_secret_manager_secret.django_settings wait for this decision; the draft's own blocks do not"],"required_by_phase":"BEFORE_PILOT","question":"Allow calls of the Secrets Manager Vault-compatible API, whose maturity is not established, for this migration (the API may change or vanish)? Accept: the calls of the Secrets Manager Vault-compatible API (WriteSecret) are carried out for google_secret_manager_secret.django_admin_password, google_secret_manager_secret.django_settings. Refuse: no call is made, a refusal selects no other path (the draft holds no other carrier of what the calls set), and what they set stays open for google_secret_manager_secret.django_admin_password, google_secret_manager_secret.django_settings.","subjects":["google_secret_manager_secret.django_admin_password","google_secret_manager_secret.django_settings"]},{"id":"convert:google_secret_manager_secret_iam_binding.django_admin_password:proposal:PROPOSED_ALTERNATIVE","reasons":["the target has no equal of this the members of one role on the Secret Manager secret: A STACKIT role assignment is not a grant on the Secret Manager secret. It gives one user, group or service account one STACKIT role on a whole project, folder or organisation. The role is a set of STACKIT permissions, not the Google role, and no table maps one to the other. It has no condition and no public member, so what the grant gave to a Google group, a domain, a federated identity or everyone is named again, and the access reaches more than the Secret Manager secret. A binding on a secret group applies to every secret in the group, so it is wider than a grant on one secret unless the secret has a group of its own, and its roles are Secrets Manager roles. The binding was authoritative for its role: STACKIT role assignments are additive, so a person who holds the role through another assignment keeps it, and removing such people is a step of a person. To decide: Which STACKIT role, on which project, folder or organisation, gives the same people the access they need on the Secret Manager secret, knowing it covers everything in that scope; which STACKIT users, groups or service accounts take the place of Google groups, domains, federated identities and a public member; and whether the grant ends with the Secret Manager secret when it has no replacement. For secrets: which secret group holds the secret, who else shares that group, and which Secrets Manager role and subject take the grant. Whether people who hold the role through another assignment keep it. The draft of google_secret_manager_secret.django_admin_password stands as it is: this answer decides the module and nothing of that draft."],"required_by_phase":"BEFORE_PILOT","question":"Decide whether the proposed STACKIT alternative replaces google_secret_manager_secret_iam_binding.django_admin_password: read the module proposals/proposal_django_admin_password, accept the difference and set its values, or design it another way","subjects":["google_secret_manager_secret_iam_binding.django_admin_password","module.proposal_django_admin_password[0].stackit_authorization_project_role_assignment.this"]}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"open_decisions":2,"manual_actions":0,"register":{"open":4,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-API-OPT-IN","DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD","DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD"]}],"next_step":{"record":"DEC-GEN-CONVERT-API-OPT-IN","source":"PLAN_DECISION","text":"Decide \"api opt in\" (DEC-GEN-CONVERT-API-OPT-IN): the plan of the draft leaves it open"},"blocks_automation":true}},"target_prices":[{"resource":"stackit_secretsmanager_instance.migrated_secrets","resource_type":"stackit_secretsmanager_instance","component":"secret version tier","state":"NOT_ASSESSED","reason_code":"AMBIGUOUS_JOIN","reason":"NOT_ASSESSED: 5 public SKUs match the Secrets Manager version hour (Secrets Manager-100-EU01, Secrets Manager-100k-EU01, Secrets Manager-10k-EU01, Secrets Manager-1M-EU01, Secrets Manager-1k-EU01): none is picked; the tier is read as the number of secret versions of the instance, which the draft does not state, and which the price list (1.0.44, page Security) and the documentation of the service (FAQ, 2026-11-02: \"You pay per secret version\") do not define: no tier is assumed","shared_with":["google_secret_manager_secret.django_settings"]}]},{"address":"google_secret_manager_secret.django_settings","type":"google_secret_manager_secret","category":"identity","presence":"KNOWN_PRESENT","in_totals":true,"class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT Secrets Manager","resources":["stackit_secretsmanager_instance","stackit_secretsmanager_user"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["security.secrets-manager"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":3,"properties_not_carried":5,"not_carried":[{"node":"google_secret_manager_secret.django_settings","property":"replication.user_managed.replicas.location","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"residency-compliance","reason":"NOT CARRIED (google_secret_manager_secret.django_settings): replication, secret_id — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied.","semantic":"secret-settings","contract":"gcp.secret","source":"secrets.tf:56"},{"node":"google_secret_manager_secret.django_settings","property":"secret_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"secret-handling","reason":"NOT CARRIED (google_secret_manager_secret.django_settings): replication, secret_id — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied.","semantic":"tcr-secret-id","contract":"gcp.secret","source":"secrets.tf:56"},{"node":"google_secret_manager_secret_iam_binding.django_settings","property":"members","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (google_secret_manager_secret_iam_binding.django_settings): members, role = roles/secretmanager.secretAccessor — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied. Proposed, switched off until it is decided: proposals/proposal_django_settings, switch proposal_django_settings_enabled.","semantic":"secret-settings","contract":"gcp.secret","source":"secrets.tf:80"},{"node":"google_secret_manager_secret_iam_binding.django_settings","property":"role","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (google_secret_manager_secret_iam_binding.django_settings): members, role = roles/secretmanager.secretAccessor — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied. Proposed, switched off until it is decided: proposals/proposal_django_settings, switch proposal_django_settings_enabled.","semantic":"secret-settings","contract":"gcp.secret","source":"secrets.tf:80"},{"node":"google_secret_manager_secret_version.django_settings","property":"secret_data","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"secret-handling","reason":"NOT CARRIED (google_secret_manager_secret_version.django_settings): secret_data — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as a literal, and the value is never read from the source); none of its settings is generated as a resource. Access on STACKIT is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for every secret of the instance, and only the experimental role bindings on a secret group (stackit_secretsmanager_secret_group_role_binding_v1, pinned provider) narrow it to named secrets, so a grant of one principal on one secret is decided, not copied.","semantic":"secret-value","contract":"gcp.secret","source":"secrets.tf:71"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"google_secret_manager_secret.django_settings is a resource of the source, declared in secrets.tf (lines 56-68). The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/8","id":"google_secret_manager_secret.django_settings"},"expert":{"id_refs":["TL-5ceb916b409a","TL-08f76fb5c71a","TL-c5abf7427a0e","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"NONE","summary_id":"TT-48469437839e","artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-5f75b6165ca2","TL-c11b2eb48228","TL-13ce71aece42","TL-503d50b7aa7d"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-1737feb2c87a","line_ids":["TL-9b340e19f00f","TL-06755e954f06","TL-c959b4e71765"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/8","id":"google_secret_manager_secret.django_settings"},"expert":{"id_refs":["TL-7451f0ddfebd","TL-a291587bece7","TL-34f62a617dbd","TL-a30957b93362"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-c5508c270aa7","line_ids":["TL-5798af0448aa","TL-0c56d776dcdb"],"artefact":{"kind":"REPORT_FILE","file":"terraform/security.tf","id":"stackit_secretsmanager_instance.migrated_secrets"},"expert":{"id_refs":["TL-f35035518166","TL-00a39791a5cf","TL-e191a34ed084","TL-18f44e45a2a6","TL-82854da0cb04","TL-2a141718f446"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-203b3c44b616","line_ids":["TL-8360e12ae19c","TL-330f53e1c971","TL-f8cda5a50a4e","TL-d371c95a6914","TL-4650f5c83475","TL-6ce259dabf9d"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-c8c470bdcd9f","TL-4b5d26e71960"]}}]},"refs":{"id":"unit:google_secret_manager_secret.django_settings","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/8","ids":["unit:google_secret_manager_secret.django_settings"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/8"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_secretsmanager_instance.migrated_secrets","target:stackit_secretsmanager_user.migration"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 2 open decisions, 0 manual actions","open_decisions":[{"id":"convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN","reasons":["the Secrets Manager Vault-compatible API is of a maturity that is not established (its documentation states no release status and its product documentation does not establish it as generally available): the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for google_secret_manager_secret.django_admin_password, google_secret_manager_secret.django_settings wait for this decision; the draft's own blocks do not"],"required_by_phase":"BEFORE_PILOT","question":"Allow calls of the Secrets Manager Vault-compatible API, whose maturity is not established, for this migration (the API may change or vanish)? Accept: the calls of the Secrets Manager Vault-compatible API (WriteSecret) are carried out for google_secret_manager_secret.django_admin_password, google_secret_manager_secret.django_settings. Refuse: no call is made, a refusal selects no other path (the draft holds no other carrier of what the calls set), and what they set stays open for google_secret_manager_secret.django_admin_password, google_secret_manager_secret.django_settings.","subjects":["google_secret_manager_secret.django_admin_password","google_secret_manager_secret.django_settings"]},{"id":"convert:google_secret_manager_secret_iam_binding.django_settings:proposal:PROPOSED_ALTERNATIVE","reasons":["the target has no equal of this the members of one role on the Secret Manager secret: A STACKIT role assignment is not a grant on the Secret Manager secret. It gives one user, group or service account one STACKIT role on a whole project, folder or organisation. The role is a set of STACKIT permissions, not the Google role, and no table maps one to the other. It has no condition and no public member, so what the grant gave to a Google group, a domain, a federated identity or everyone is named again, and the access reaches more than the Secret Manager secret. A binding on a secret group applies to every secret in the group, so it is wider than a grant on one secret unless the secret has a group of its own, and its roles are Secrets Manager roles. The binding was authoritative for its role: STACKIT role assignments are additive, so a person who holds the role through another assignment keeps it, and removing such people is a step of a person. To decide: Which STACKIT role, on which project, folder or organisation, gives the same people the access they need on the Secret Manager secret, knowing it covers everything in that scope; which STACKIT users, groups or service accounts take the place of Google groups, domains, federated identities and a public member; and whether the grant ends with the Secret Manager secret when it has no replacement. For secrets: which secret group holds the secret, who else shares that group, and which Secrets Manager role and subject take the grant. Whether people who hold the role through another assignment keep it. The draft of google_secret_manager_secret.django_settings stands as it is: this answer decides the module and nothing of that draft."],"required_by_phase":"BEFORE_PILOT","question":"Decide whether the proposed STACKIT alternative replaces google_secret_manager_secret_iam_binding.django_settings: read the module proposals/proposal_django_settings, accept the difference and set its values, or design it another way","subjects":["google_secret_manager_secret_iam_binding.django_settings","module.proposal_django_settings[0].stackit_authorization_project_role_assignment.this"]}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"open_decisions":2,"manual_actions":0,"register":{"open":4,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-API-OPT-IN","DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-SETTINGS","DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-SETTINGS"]}],"next_step":{"record":"DEC-GEN-CONVERT-API-OPT-IN","source":"PLAN_DECISION","text":"Decide \"api opt in\" (DEC-GEN-CONVERT-API-OPT-IN): the plan of the draft leaves it open"},"blocks_automation":true}}},{"address":"google_service_account.automation","type":"google_service_account","category":"identity","presence":"KNOWN_PRESENT","in_totals":true,"class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT service account","resources":["stackit_service_account","stackit_authorization_project_role_assignment","stackit_authorization_folder_role_assignment","stackit_authorization_organization_role_assignment","stackit_authorization_service_account_role_assignment"],"maturity":"experimental","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["identity.role-assignment","identity.server-service-account"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":1,"properties_not_carried":2,"not_carried":[{"node":"google_service_account.automation","property":"account_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (google_service_account.automation): account_id — the account ID is not visible statically, or the account is declared several times: the STACKIT account is named after the source address.","semantic":"account-name","contract":"gcp.service_account","source":"iam.tf:54"},{"node":"google_service_account.automation","property":"display_name","source":"iam.tf:54"}],"refs":{"id":"unit:google_service_account.automation","family":"GCP_IDENTITY","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/2","ids":["unit:google_service_account.automation"]},{"hop":"intent","state":"NOT_AVAILABLE","kind":"NOT_AVAILABLE","reason":"NO_INTENT_RECORDED"},{"hop":"plan","state":"OPEN","kind":"REPORT_FILE","file":"target-plan.json"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:attach-complete@google_service_account.automation","check:final-artifact@google_service_account.automation","check:plan-valid@google_service_account.automation","check:renders@google_service_account.automation","check:round-trip@google_service_account.automation"]}],"targets":["target:stackit_service_account.automation"]},"plan_statements":[{"id":"stackitsa:statement:google_service_account.automation","family":"stackitsa","reason":"NOT_DRAFTED","cause":"google_service_account.automation is an identity of the source whose service account is written by the draft's converter of google_service_account, not by this plan: the plan states what uses it and attaches it to nothing","manual_actions":[{"id":"stackitsa:held:principal:google_service_account.automation","kind":"OTHER","phase":"BEFORE_PILOT","what":"Decide who may use the STACKIT service account written for google_service_account.automation, what it may do and which workloads run as it: the draft attaches it to nothing","why":"google_service_account.automation is used by the workloads that run as it, by a reading that is KNOWN: google_cloud_run_v2_job.migrate (google_cloud_run_v2_job.migrate#template[0].template[0].service_account); the other places that refer to it: google_cloudbuild_trigger.init, google_project_iam_member.automation_permissions, google_secret_manager_secret_iam_binding.django_admin_password, google_secret_manager_secret_iam_binding.django_settings, google_storage_bucket_iam_member.automation. Its service account is written by the draft's converter of google_service_account, not by this plan, and the plan attaches it to nothing."}]}],"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":2,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-GOOGLE-SERVICE-ACCOUNT-AUTOMATION"]},{"source":"PLAN_STATEMENT","open_records":["DEC-IAM-STACKITSA-STATEMENT-NOT-DRAFTED"]}],"next_step":{"record":"DEC-IAM-GOOGLE-SERVICE-ACCOUNT-AUTOMATION","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of google_service_account.automation (DEC-IAM-GOOGLE-SERVICE-ACCOUNT-AUTOMATION): decide each or accept the difference"},"blocks_automation":true}}},{"address":"google_service_account.client","type":"google_service_account","category":"identity","presence":"KNOWN_PRESENT","in_totals":true,"class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT service account","resources":["stackit_service_account","stackit_authorization_project_role_assignment","stackit_authorization_folder_role_assignment","stackit_authorization_organization_role_assignment","stackit_authorization_service_account_role_assignment"],"maturity":"experimental","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["identity.role-assignment","identity.server-service-account"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":1,"properties_not_carried":2,"not_carried":[{"node":"google_service_account.client","property":"account_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (google_service_account.client): account_id — the account ID is not visible statically, or the account is declared several times: the STACKIT account is named after the source address.","semantic":"account-name","contract":"gcp.service_account","source":"iam.tf:48"},{"node":"google_service_account.client","property":"display_name","source":"iam.tf:48"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"google_service_account.client is a resource of the source, declared in iam.tf (lines 48-52). The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","lines":["from google_service_account.client (iam.tf:48) — RECONFIGURE / MEDIUM"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/3","id":"google_service_account.client"},"expert":{"id_refs":["TL-ad58d14c653f","TL-f933a6edf2f2","TL-7746014398df","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-d9a5f7378646"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-c11b2eb48228","TL-84428ae7503a","TL-2a26f9d81a54"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-0a1b0dbee66e","line_ids":["TL-9b340e19f00f","TL-b5f912d83e77","TL-5e7f92073316"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/3","id":"google_service_account.client"},"expert":{"id_refs":["TL-8e146c99b99d","TL-0098b008d5a1","TL-b6eef9695340"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-d130b98cad63","line_ids":["TL-f7d3539d5d56"],"artefact":{"kind":"REPORT_FILE","file":"terraform/identity.tf","id":"stackit_service_account.client"},"expert":{"id_refs":["TL-7ec765d9e4dd","TL-1961a5b14f0a","TL-f4a0c3b59d97"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-0235368c68f5","line_ids":["TL-b433a26e0503","TL-b7f2b6f96617","TL-4650f5c83475"],"artefact":{"kind":"IN_MEMORY"},"expert":{}}]},"refs":{"id":"unit:google_service_account.client","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/3","ids":["unit:google_service_account.client"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/3"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_service_account.client"]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-GOOGLE-SERVICE-ACCOUNT-CLIENT"]}],"next_step":{"record":"DEC-IAM-GOOGLE-SERVICE-ACCOUNT-CLIENT","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of google_service_account.client (DEC-IAM-GOOGLE-SERVICE-ACCOUNT-CLIENT): decide each or accept the difference"},"blocks_automation":true}}},{"address":"google_service_account.init","type":"google_service_account","category":"identity","presence":"CONDITIONAL","in_totals":false,"conditional_state":"PRESENT_ON_DEFAULTS","class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT service account","resources":["stackit_service_account","stackit_authorization_project_role_assignment","stackit_authorization_folder_role_assignment","stackit_authorization_organization_role_assignment","stackit_authorization_service_account_role_assignment"],"maturity":"experimental","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["identity.role-assignment","identity.server-service-account"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":0,"properties_not_carried":2,"not_carried":[{"node":"google_service_account.init","property":"account_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (google_service_account.init): account_id — the account ID is not visible statically, or the account is declared several times: the STACKIT account is named after the source address.","semantic":"account-name","contract":"gcp.service_account","source":"iam.tf:61"},{"node":"google_service_account.init","property":"display_name","source":"iam.tf:61"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"google_service_account.init is a resource of the source, declared in iam.tf (lines 61-66). Whether it exists is decided only when OpenTofu plans. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","lines":["from google_service_account.init (iam.tf:61) — RECONFIGURE / MEDIUM"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/15","id":"google_service_account.init"},"expert":{"id_refs":["TL-ad58d14c653f","TL-f933a6edf2f2","TL-7746014398df","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-d9a5f7378646"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-c11b2eb48228","TL-84428ae7503a","TL-3e14ab827c67"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-0a1b0dbee66e","line_ids":["TL-9b340e19f00f","TL-b5f912d83e77","TL-5e7f92073316"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/15","id":"google_service_account.init"},"expert":{"id_refs":["TL-8e146c99b99d","TL-0098b008d5a1","TL-b6eef9695340"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-d130b98cad63","line_ids":["TL-038469fbde1f"],"artefact":{"kind":"REPORT_FILE","file":"terraform/identity.tf","id":"stackit_service_account.init"},"expert":{"id_refs":["TL-7ec765d9e4dd","TL-7b43413ea2a6","TL-916a67083a18"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-58928f2709b6","line_ids":["TL-b433a26e0503","TL-b9c1a19073a9","TL-4650f5c83475","TL-fcfcb45fdd01"],"artefact":{"kind":"IN_MEMORY"},"expert":{}}]},"refs":{"id":"unit:google_service_account.init","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/15","ids":["unit:google_service_account.init"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/15"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_service_account.init"]},"coverage":"TRACED","open_work":{"open_steps":2,"register":{"open":1,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-GOOGLE-SERVICE-ACCOUNT-INIT"]}],"next_step":{"record":"DEC-IAM-GOOGLE-SERVICE-ACCOUNT-INIT","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of google_service_account.init (DEC-IAM-GOOGLE-SERVICE-ACCOUNT-INIT): decide each or accept the difference"},"blocks_automation":true}}},{"address":"google_service_account.server","type":"google_service_account","category":"identity","presence":"KNOWN_PRESENT","in_totals":true,"class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT service account","resources":["stackit_service_account","stackit_authorization_project_role_assignment","stackit_authorization_folder_role_assignment","stackit_authorization_organization_role_assignment","stackit_authorization_service_account_role_assignment"],"maturity":"experimental","lifecycle":"active","regions":[],"catalogue":{"state":"MATCHED","capabilities":["identity.role-assignment","identity.server-service-account"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":2,"evidence_count":2,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":1,"properties_not_carried":2,"not_carried":[{"node":"google_service_account.server","property":"account_id","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (google_service_account.server): account_id — the account ID is not visible statically, or the account is declared several times: the STACKIT account is named after the source address.","semantic":"account-name","contract":"gcp.service_account","source":"iam.tf:42"},{"node":"google_service_account.server","property":"display_name","source":"iam.tf:42"}],"refs":{"id":"unit:google_service_account.server","family":"GCP_IDENTITY","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/4","ids":["unit:google_service_account.server"]},{"hop":"intent","state":"NOT_AVAILABLE","kind":"NOT_AVAILABLE","reason":"NO_INTENT_RECORDED"},{"hop":"plan","state":"OPEN","kind":"REPORT_FILE","file":"target-plan.json"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"ESTABLISHED","kind":"IN_MEMORY","ids":["check:attach-complete@google_service_account.server","check:final-artifact@google_service_account.server","check:plan-valid@google_service_account.server","check:renders@google_service_account.server","check:round-trip@google_service_account.server"]}],"targets":["target:stackit_service_account.server"]},"plan_statements":[{"id":"stackitsa:statement:google_service_account.server","family":"stackitsa","reason":"NOT_DRAFTED","cause":"google_service_account.server is an identity of the source whose service account is written by the draft's converter of google_service_account, not by this plan: the plan states what uses it and attaches it to nothing","manual_actions":[{"id":"stackitsa:held:principal:google_service_account.server","kind":"OTHER","phase":"BEFORE_PILOT","what":"Decide who may use the STACKIT service account written for google_service_account.server, what it may do and which workloads run as it: the draft attaches it to nothing","why":"google_service_account.server is used by the workloads that run as it, by a reading that is KNOWN: google_cloud_run_v2_service.server (google_cloud_run_v2_service.server#template[0].service_account); the other places that refer to it: google_project_iam_member.server_permissions, google_secret_manager_secret_iam_binding.django_settings, google_storage_bucket_iam_member.server. Its service account is written by the draft's converter of google_service_account, not by this plan, and the plan attaches it to nothing."}]}],"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"NOT_TRACED_IN_THIS_BUILD","open_work":{"register":{"open":2,"accepted":0,"by_source":[{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-GOOGLE-SERVICE-ACCOUNT-SERVER"]},{"source":"PLAN_STATEMENT","open_records":["DEC-IAM-STACKITSA-STATEMENT-NOT-DRAFTED"]}],"next_step":{"record":"DEC-IAM-GOOGLE-SERVICE-ACCOUNT-SERVER","source":"CRITICAL_SEMANTIC","text":"Review the critical settings of google_service_account.server (DEC-IAM-GOOGLE-SERVICE-ACCOUNT-SERVER): decide each or accept the difference"},"blocks_automation":true}}},{"address":"google_sql_database_instance.postgres","type":"google_sql_database_instance","category":"data","presence":"KNOWN_PRESENT","in_totals":true,"class":"REPLATFORM","confidence":"MEDIUM","target_fit":{"service":"STACKIT PostgreSQL Flex","resources":["stackit_postgresflex_instance","stackit_postgresflex_database","stackit_postgresflex_user"],"maturity":"ga","lifecycle":"active","regions":["eu01","eu02"],"catalogue":{"state":"MATCHED","capabilities":["database.postgresql-flex"],"unmatched_resources":[]}},"blocker_count":2,"finding_count":3,"evidence_count":3,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":1,"properties_not_carried":6,"not_carried":[{"node":"google_sql_database_instance.postgres","property":"settings.user_labels","source":"database.tf:25"},{"node":"google_sql_database.database","property":"deletion_policy","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"deletion-protection","reason":"NOT CARRIED (google_sql_database.database): deletion_policy — stackit_postgresflex_database is deleted directly (pinned provider): ABANDON (keep the Cloud SQL database, drop it from state only) has no counterpart.","semantic":"user-and-database-settings","contract":"gcp.sql_instance","source":"database.tf:41"},{"node":"google_sql_database.database","property":"name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"workload-compatibility","reason":"NOT CARRIED (google_sql_database.database): name — a database name (or the number of databases) is not visible statically: create that database with stackit_postgresflex_database.","semantic":"tcf-sql-database--name","contract":"gcp.sql_instance","source":"database.tf:41"},{"node":"google_sql_user.django","property":"deletion_policy","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"deletion-protection","reason":"NOT CARRIED (google_sql_user.django): deletion_policy — stackit_postgresflex_user is deleted directly (pinned provider): ABANDON (keep the Cloud SQL user, drop it from state only) has no counterpart.","semantic":"user-and-database-settings","contract":"gcp.sql_instance","source":"database.tf:50"},{"node":"google_sql_user.django","property":"name","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (google_sql_user.django): name — a user name is not visible statically: create that user with stackit_postgresflex_user.","semantic":"database-users","contract":"gcp.sql_instance","source":"database.tf:50"},{"node":"google_sql_user.django","property":"password","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"secret-handling","reason":"NOT CARRIED (google_sql_user.django): password — the source password is not copied: STACKIT generates the user's password (stackit_postgresflex_user.password is computed, pinned provider) — hand the new one to the application.","semantic":"user-and-database-settings","contract":"gcp.sql_instance","source":"database.tf:50"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"google_sql_database_instance.postgres is a resource of the source, declared in database.tf (lines 25-38). The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","lines":["from google_sql_database_instance.postgres (database.tf:25) — REPLATFORM / MEDIUM"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/5","id":"google_sql_database_instance.postgres"},"expert":{"id_refs":["TL-9b9dd3a28121","TL-f515dc6cd3d2","TL-3fccb67a47a7","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"ESTABLISHED","summary_id":"TT-157dcc58b082","line_ids":["TL-b657e20901a7","TL-58023aeb183b","TL-6434d6be105d","TL-9dbb5f8333d6","TL-bdcb1a0dfe46"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-c11b2eb48228","TL-30986cd22262","TL-cfd7a7579712"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-cd1dc4f7b042","line_ids":["TL-27f3a4627dfd","TL-9b340e19f00f","TL-b801052d81ab","TL-f1ec41938106","TL-831e32157956"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/5","id":"google_sql_database_instance.postgres"},"expert":{"id_refs":["TL-f10bfd5a8baa","TL-1deb9236882e","TL-e2cba8df4bae","TL-b33949aaa668","TL-b3ee0cbcdc8a","TL-5c3e9dcd32d3","TL-0dc40386f958","TL-b3306b8eabe5","TL-6c37c393a923","TL-2f5f7c1eeb1a","TL-18961919f6a2"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-d130b98cad63","line_ids":["TL-3c80bf4c8508"],"artefact":{"kind":"REPORT_FILE","file":"terraform/data.tf","id":"stackit_postgresflex_instance.postgres"},"expert":{"id_refs":["TL-0143a4f3b878","TL-b3da39ca70f7","TL-6fdf2e403494"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-438cc76716fb","line_ids":["TL-0b9ad6d89847","TL-4b050dadf8ee","TL-61ddfceeefef","TL-9b1e882cdba7","TL-2e8b6e94ca72","TL-c77e25347112","TL-4650f5c83475","TL-2617e179fc00"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-1baa75712dde","TL-65e6682564ab","TL-d88062febb16"]}}]},"refs":{"id":"unit:google_sql_database_instance.postgres","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/5","ids":["unit:google_sql_database_instance.postgres"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/5"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_postgresflex_instance.postgres"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 3 open decisions, 0 manual actions","open_decisions":[{"id":"convert:estate:source_location:SOURCE_REGION_MAPPING","reasons":["The source places its units in a location the scan cannot read (the value comes from an input a plan can change, or the source does not state it). No mapping between Google and STACKIT regions is evidenced, so the region the draft builds in is not shown to hold the residency of a source location: a person states it once for the estate, by answering target.region.source_location for each location."],"required_by_phase":"BEFORE_PILOT","question":"Map each source location of the estate to a STACKIT region","subjects":["google_cloud_run_v2_job.migrate","google_cloud_run_v2_service.server","google_sql_database_instance.postgres","google_storage_bucket.media"],"default":{"option":"map-source-locations-to-the-draft-region","words":"the draft builds every unit in the STACKIT region eu01, which is what it does with no answer. That is a region the catalogue of this build lists and no claim that it holds the residency of the source: only an answer of target.region.source_location closes the settings this decision holds.","answered_by":"DEFAULT"}},{"id":"convert:estate:source_project:SOURCE_PROJECT_MAPPING","reasons":["The source places its units in the project example-project, and in a project the scan cannot read for some units, and the source project is carried nowhere. A person maps the source projects by answering target.project.source_project for each: var.project_id, or the project of the unit's network (network-project). The answer records that mapping and changes nothing in the draft, which keeps its own project resolver."],"required_by_phase":"BEFORE_PILOT","question":"State where the units of each source project of the estate go","subjects":["google_cloudbuild_trigger.activategcb","google_cloudbuild_trigger.init","google_cloudbuild_trigger.placeholder","google_sql_database_instance.postgres"]},{"id":"convert:google_sql_database_instance.postgres:data:DATA_MOVEMENT","reasons":["the plan defines both methods of the engine (a dump restored inside the write freeze, and a logical replication that follows the changes until the freeze) and keeps them open: which one applies depends on the size of the data, the write rate and the downtime the business accepts, and the source states none of them; the steps of the methods wait for the answer"],"required_by_phase":"BEFORE_PILOT","question":"Choose how the data of google_sql_database_instance.postgres moves from google_sql_database_instance to PostgreSQL Flex (stackit_postgresflex_instance.postgres): a dump restored inside the write freeze, the engine's logical replication, or a tool of your own","subjects":["google_sql_database_instance.postgres","stackit_postgresflex_instance.postgres"]}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"open_decisions":3,"manual_actions":0,"register":{"open":6,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING","DEC-GEN-CONVERT-SOURCE-REGION-MAPPING"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-IAM-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES","DEC-NET-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES","DEC-OPS-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES"]}],"next_step":{"record":"DEC-GEN-CONVERT-DATA-MOVEMENT","source":"PLAN_DECISION","text":"Decide \"data movement\" (DEC-GEN-CONVERT-DATA-MOVEMENT): the plan of the draft leaves it open"},"blocks_automation":true}},"target_prices":[{"resource":"stackit_postgresflex_instance.postgres","resource_type":"stackit_postgresflex_instance","component":"flavor","join_key":"flavor_id = \"2.4\"","state":"PRICED","sku_id":"ST-0025701","sku_name":"PostgreSQL-Flex-2.4-Single-EU01","unit_price":"0.12598444444","unit":"Hours","unit_billing":"per hour","region":"eu01","metro":false,"valid_start":"2026-10-08T07:44:29Z"}]},{"address":"google_storage_bucket.media","type":"google_storage_bucket","category":"storage","presence":"KNOWN_PRESENT","in_totals":true,"class":"RECONFIGURE","confidence":"MEDIUM","target_fit":{"service":"STACKIT Object Storage","resources":["stackit_objectstorage_bucket","stackit_objectstorage_credentials_group","stackit_objectstorage_credential"],"maturity":"ga","lifecycle":"active","regions":[],"catalogue":{"state":"RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED","capabilities":[],"unmatched_resources":["stackit_objectstorage_bucket","stackit_objectstorage_credential","stackit_objectstorage_credentials_group"],"unlinked_resources":["stackit_objectstorage_bucket","stackit_objectstorage_credential","stackit_objectstorage_credentials_group"]}},"blocker_count":2,"finding_count":4,"evidence_count":3,"automation_eligible":false,"automation_ceiling":"NOT_AUTOMATABLE","wave":2,"properties_not_carried":6,"not_carried":[{"node":"google_storage_bucket.media","property":"force_destroy","property_class":"CRITICAL","gate_closure":"CLOSED:NC+UNSUPPORTED","category":"deletion-protection","reason":"NOT CARRIED (google_storage_bucket.media): force_destroy = true — stackit_objectstorage_bucket has no force-destroy override (pinned provider): deleting a bucket that still holds objects behaves as STACKIT's Object Storage API defines it — empty the bucket (or migrate its objects) before it is destroyed.","semantic":"force-destroy","contract":"gcp.storage_bucket","source":"storage.tf:17"},{"node":"google_storage_bucket.media","property":"storage_class","source":"storage.tf:17"},{"node":"google_storage_bucket_iam_member.automation","property":"member","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (google_storage_bucket_iam_member.automation): member, role = roles/storage.admin — the draft of google_storage_bucket.media does not carry this one member's role on the Cloud Storage bucket. Proposed, switched off until it is decided: proposals/proposal_automation, switch proposal_automation_enabled.","semantic":"iam-grant","contract":"gcp.storage_bucket","source":"storage.tf:33"},{"node":"google_storage_bucket_iam_member.automation","property":"role","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (google_storage_bucket_iam_member.automation): member, role = roles/storage.admin — the draft of google_storage_bucket.media does not carry this one member's role on the Cloud Storage bucket. Proposed, switched off until it is decided: proposals/proposal_automation, switch proposal_automation_enabled.","semantic":"iam-grant","contract":"gcp.storage_bucket","source":"storage.tf:33"},{"node":"google_storage_bucket_iam_member.server","property":"member","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (google_storage_bucket_iam_member.server): member, role = roles/storage.admin — the draft of google_storage_bucket.media does not carry this one member's role on the Cloud Storage bucket. Proposed, switched off until it is decided: proposals/proposal_server, switch proposal_server_enabled.","semantic":"iam-grant","contract":"gcp.storage_bucket","source":"storage.tf:27"},{"node":"google_storage_bucket_iam_member.server","property":"role","property_class":"CRITICAL","gate_closure":"CLOSED:NC+REVIEW","category":"identity-access","reason":"NOT CARRIED (google_storage_bucket_iam_member.server): member, role = roles/storage.admin — the draft of google_storage_bucket.media does not carry this one member's role on the Cloud Storage bucket. Proposed, switched off until it is decided: proposals/proposal_server, switch proposal_server_enabled.","semantic":"iam-grant","contract":"gcp.storage_bucket","source":"storage.tf:27"}],"trace":{"outcome":"FROM_RECORDED_LINES","arrows":[{"stage":"SOURCE","state":"ESTABLISHED","summary":"google_storage_bucket.media is a resource of the source, declared in storage.tf (lines 17-25). The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.","lines":["from google_storage_bucket.media (storage.tf:17) — RECONFIGURE / MEDIUM"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/7","id":"google_storage_bucket.media"},"expert":{"id_refs":["TL-ccc248853d64","TL-d674fb3be129","TL-e307263d6d83","TL-964869bde1d0"]}},{"stage":"EVIDENCE","state":"NONE","summary_id":"TT-49f7559eb2a2","artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-bfecd2feb306","TL-c11b2eb48228","TL-b04b701df7e2","TL-60584d093b95"]}},{"stage":"SEMANTIC_CLAIM","state":"OPEN","summary_id":"TT-9f2cc9376199","line_ids":["TL-3545a21a7bd6","TL-185c870bf3cc","TL-2504dbf62e2c"],"artefact":{"kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/7","id":"google_storage_bucket.media"},"expert":{"id_refs":["TL-b7540011238d","TL-036332d57455","TL-2ac14f61113b","TL-555c5bdcead1","TL-7a225d66b674","TL-3f8a5f7320ef","TL-405c1bd9d17b"]}},{"stage":"RENDER","state":"ESTABLISHED","summary_id":"TT-d130b98cad63","line_ids":["TL-ef2ecd6b642d"],"artefact":{"kind":"REPORT_FILE","file":"terraform/storage.tf","id":"stackit_objectstorage_bucket.media"},"expert":{"id_refs":["TL-2f1101bbfe8f","TL-14805476ce24","TL-eb286fde8661"]}},{"stage":"RESIDUAL_DIFFERENCE","state":"OPEN","summary_id":"TT-5d552dfb783c","line_ids":["TL-2b16c070f231","TL-bfebdb5f8d89","TL-2fba04c78ffa","TL-309577fb8601","TL-90d3dbeb2580","TL-4650f5c83475","TL-2617e179fc00"],"artefact":{"kind":"IN_MEMORY"},"expert":{"id_refs":["TL-1baa75712dde","TL-b72a4bd8bcdb","TL-c4d6b1793833"]}}]},"refs":{"id":"unit:google_storage_bucket.media","family":"LEGACY_GENERATOR","hops":[{"hop":"source","state":"ESTABLISHED","kind":"REPORT_FILE","file":"assessment.json","pointer":"/units/7","ids":["unit:google_storage_bucket.media"]},{"hop":"claims","state":"OPEN","kind":"REPORT_FILE","file":"assessment.json","pointer":"/kernel/units/7"},{"hop":"intent","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"plan","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"LEGACY_GENERATOR"},{"hop":"hcl","state":"ESTABLISHED","kind":"REPORT_FILE"},{"hop":"validation","state":"UNSUPPORTED","kind":"NOT_AVAILABLE","reason":"NO_PER_UNIT_CHECK_FOR_THIS_FAMILY"}],"targets":["target:stackit_objectstorage_bucket.media"]},"deployment_prerequisites":{"statement":"passed StackToIT's own draft checks; tofu validate: PASSED; NOT deployment-ready: 2 open decisions (3 questions), 0 manual actions","open_decisions":[{"id":"convert:estate:source_location:SOURCE_REGION_MAPPING","reasons":["The source places its units in a location the scan cannot read (the value comes from an input a plan can change, or the source does not state it). No mapping between Google and STACKIT regions is evidenced, so the region the draft builds in is not shown to hold the residency of a source location: a person states it once for the estate, by answering target.region.source_location for each location."],"required_by_phase":"BEFORE_PILOT","question":"Map each source location of the estate to a STACKIT region","subjects":["google_cloud_run_v2_job.migrate","google_cloud_run_v2_service.server","google_sql_database_instance.postgres","google_storage_bucket.media"],"default":{"option":"map-source-locations-to-the-draft-region","words":"the draft builds every unit in the STACKIT region eu01, which is what it does with no answer. That is a region the catalogue of this build lists and no claim that it holds the residency of the source: only an answer of target.region.source_location closes the settings this decision holds.","answered_by":"DEFAULT"}},{"id":"convert:google_storage_bucket_iam_member.automation:proposal:PROPOSED_ALTERNATIVE","reasons":["the target has no equal of this one member's role on the Cloud Storage bucket: A STACKIT credentials group is not a grant on the Cloud Storage bucket. It is the principal that a bucket policy names, a set of S3 keys with no Google identity behind it, and by itself it gives no access to the bucket and takes none away. The statement that grants it something is a statement of the bucket policy, in the policy language of STACKIT (a credentials group or * as the principal, S3 actions, five condition keys), which no Terraform resource sets. The Google role is not mapped to S3 actions by any table, the condition of the grant has no counterpart unless it can be written with those five condition keys, and a Google group, a domain, a federated identity and allUsers or allAuthenticatedUsers are named again as credentials groups or as *. To decide: Which credentials group stands for each member of the grant, which S3 actions of the bucket policy give the same people the access they need and no more than the Google role gave, what becomes of the condition, of public members (allUsers, allAuthenticatedUsers), of Google groups, domains and federated identities, and whether the grant ends with the Cloud Storage bucket when it has no replacement. Which bucket the grant is on, because the scan does not hold it. The draft of google_storage_bucket.media stands as it is: this answer decides the module and nothing of that draft."],"required_by_phase":"BEFORE_PILOT","question":"Decide whether the proposed STACKIT alternative replaces google_storage_bucket_iam_member.automation: read the module proposals/proposal_automation, accept the difference and set its values, or design it another way","subjects":["google_storage_bucket_iam_member.automation","module.proposal_automation[0].stackit_objectstorage_credentials_group.this"]},{"id":"convert:google_storage_bucket_iam_member.server:proposal:PROPOSED_ALTERNATIVE","reasons":["the target has no equal of this one member's role on the Cloud Storage bucket: A STACKIT credentials group is not a grant on the Cloud Storage bucket. It is the principal that a bucket policy names, a set of S3 keys with no Google identity behind it, and by itself it gives no access to the bucket and takes none away. The statement that grants it something is a statement of the bucket policy, in the policy language of STACKIT (a credentials group or * as the principal, S3 actions, five condition keys), which no Terraform resource sets. The Google role is not mapped to S3 actions by any table, the condition of the grant has no counterpart unless it can be written with those five condition keys, and a Google group, a domain, a federated identity and allUsers or allAuthenticatedUsers are named again as credentials groups or as *. To decide: Which credentials group stands for each member of the grant, which S3 actions of the bucket policy give the same people the access they need and no more than the Google role gave, what becomes of the condition, of public members (allUsers, allAuthenticatedUsers), of Google groups, domains and federated identities, and whether the grant ends with the Cloud Storage bucket when it has no replacement. Which bucket the grant is on, because the scan does not hold it. The draft of google_storage_bucket.media stands as it is: this answer decides the module and nothing of that draft."],"required_by_phase":"BEFORE_PILOT","question":"Decide whether the proposed STACKIT alternative replaces google_storage_bucket_iam_member.server: read the module proposals/proposal_server, accept the difference and set its values, or design it another way","subjects":["google_storage_bucket_iam_member.server","module.proposal_server[0].stackit_objectstorage_credentials_group.this"]}],"manual_actions":[]},"workload_readiness":{"applies":false,"dimensions":[]},"coverage":"TRACED","open_work":{"open_steps":2,"open_decisions":3,"manual_actions":0,"register":{"open":7,"accepted":0,"by_source":[{"source":"PLAN_DECISION","open_records":["DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE","DEC-GEN-CONVERT-SOURCE-REGION-MAPPING"]},{"source":"CRITICAL_SEMANTIC","open_records":["DEC-DATA-GOOGLE-STORAGE-BUCKET-MEDIA","DEC-GEN-GOOGLE-STORAGE-BUCKET-MEDIA","DEC-IAM-GOOGLE-STORAGE-BUCKET-MEDIA","DEC-OPS-GOOGLE-STORAGE-BUCKET-MEDIA","DEC-SEC-GOOGLE-STORAGE-BUCKET-MEDIA"]}],"next_step":{"record":"DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE","source":"PLAN_DECISION","text":"Decide \"proposed alternative\" (DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE): the plan of the draft leaves it open"},"blocks_automation":true}},"target_prices":[{"resource":"stackit_objectstorage_bucket.media","resource_type":"stackit_objectstorage_bucket","component":"object storage","state":"PRICED","sku_id":"ST-0010801","sku_name":"Object Storage Premium-EU01","unit_price":"0.00003697772","unit":"Gigabyte Hours","unit_billing":"per GB/hour","region":"eu01","metro":false,"valid_start":"2026-10-08T07:44:33Z"}]}],"shared_instances":[],"evidence":{"units":16,"units_with_evidence":16,"evidence_references":80,"findings":41,"findings_by_severity":[{"key":"warning","count":28},{"key":"info","count":13}],"units_with_region_evidence":7,"property_accounting":{"units":11,"units_not_generated":5,"meaningful":69,"unaccounted":0,"not_carried":40,"units_with_unaccounted":0}},"decision_register":{"state":"BUILT","basis":"Records group four lists: the open decisions of the TargetPlans of the draft this run wrote, by the family of the producer (security group, routing, identity, logs, server) and the kind of the decision (plan decisions); the open critical semantics of the units, by the contract family and the semantic (critical semantics); the manual actions of the plans, by the family of the producer and the kind of the action (manual actions); and the open statements of the plans about units they write no resource for (a redesign, a review, a block, a failed model, or a step beside a unit whose draft a converter writes), by the family of the producer and the reason (plan statements). Plan decisions and manual actions cover only drafted units whose draft passed StackToIT's own checks, and only the families whose draft this run wrote from a plan: a family with no plan has none to list. A plan statement covers a unit the plan writes nothing for, whether or not a draft check ran over it; a statement that leaves nothing to a person (a unit the plan does not draft and no manual action of it names) is counted (closed_statements) and is no record. A record shows the review of an overlay beside the open state the engine reached; a review closes no critical semantic and changes no draft, target plan, gate, class, confidence or eligibility. An accepted plan decision frees the steps of the execution plan that wait for it only when the answer's effect acknowledges the current draft; an option that changes the draft keeps them held until the draft carries that option (the line of the option in decisions-template.yaml says whether an answer of the inputs file writes it or no answer of this build does). The one exception is an option that declines a default of the draft (choose-the-size, choose-the-snapshot-count, choose-the-zone-per-server, keep-the-source-rules-and-redesign-a-firewall, machine-type-with-a-local-disk, persistent-volume-for-the-data): the run that reads that answer writes its draft without the default, and the value the default stood for is yours to set. Records of the family \"convert\" are decisions of the converter's own generators, outside every plan: a CONSTRAINT_CONFLICT (a variable whose consumers' STACKIT bounds exclude one another keeps the source default) and an AMBIGUOUS_* selection (the source does not prove which instance, interface, key pair, gateway, peer, subnet, proxy, URL map or health check it means, so the draft holds a required variable without a default); the unit that owns one is not automation-eligible. They are listed for a drafted unit whose plan checks did not fail.","plan_read":true,"groups":[{"id":"GRP-PLAN-DECISION-convert","source":"PLAN_DECISION","family":"convert","title":"Plan decisions · convert","record_ids":["DEC-GEN-CONVERT-API-OPT-IN","DEC-GEN-CONVERT-DATA-MOVEMENT","DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE","DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING","DEC-GEN-CONVERT-SOURCE-REGION-MAPPING"],"records":5,"status":"OPEN","open_items":21,"accepted_items":0,"units":11,"by_status":[{"key":"OPEN","count":5},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Data Architect","Platform Architect"],"earliest_phase":"BEFORE_PILOT","conditional":3},{"id":"GRP-CRITICAL-SEMANTIC-gcp.cloud_run","source":"CRITICAL_SEMANTIC","family":"gcp.cloud_run","title":"Critical semantics · gcp.cloud_run","record_ids":["DEC-IAM-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE","DEC-NET-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE","DEC-OPS-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE","DEC-SEC-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE","DEC-GEN-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","DEC-IAM-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","DEC-NET-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","DEC-OPS-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","DEC-SEC-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER"],"records":9,"status":"OPEN","open_items":21,"accepted_items":0,"units":2,"by_status":[{"key":"OPEN","count":9},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Identity Architect","NOT_STATED","Network Architect","Platform Architect","Security Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-gcp.cloudbuild","source":"CRITICAL_SEMANTIC","family":"gcp.cloudbuild","title":"Critical semantics · gcp.cloudbuild","record_ids":["DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-ACTIVATEGCB","DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-ACTIVATEGCB","DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-INIT","DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-INIT","DEC-GEN-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER","DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER","DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER"],"records":7,"status":"OPEN","open_items":15,"accepted_items":0,"units":3,"by_status":[{"key":"OPEN","count":7},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Identity Architect","NOT_STATED","Platform Architect"],"earliest_phase":"NOT_STATED","conditional":15},{"id":"GRP-CRITICAL-SEMANTIC-gcp.firebase_hosting_site","source":"CRITICAL_SEMANTIC","family":"gcp.firebase_hosting_site","title":"Critical semantics · gcp.firebase_hosting_site","record_ids":["DEC-IAM-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT","DEC-OPS-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT"],"records":2,"status":"OPEN","open_items":2,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":2},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Identity Architect","Platform Architect"],"earliest_phase":"NOT_STATED","conditional":2},{"id":"GRP-CRITICAL-SEMANTIC-gcp.firebase_project","source":"CRITICAL_SEMANTIC","family":"gcp.firebase_project","title":"Critical semantics · gcp.firebase_project","record_ids":["DEC-IAM-GOOGLE-FIREBASE-PROJECT-DEFAULT"],"records":1,"status":"OPEN","open_items":1,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":1},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Identity Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-gcp.pubsub_topic","source":"CRITICAL_SEMANTIC","family":"gcp.pubsub_topic","title":"Critical semantics · gcp.pubsub_topic","record_ids":["DEC-OPS-GOOGLE-PUBSUB-TOPIC-FAUX"],"records":1,"status":"OPEN","open_items":1,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":1},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Platform Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-gcp.secret","source":"CRITICAL_SEMANTIC","family":"gcp.secret","title":"Critical semantics · gcp.secret","record_ids":["DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD","DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD","DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-SETTINGS","DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-SETTINGS"],"records":4,"status":"OPEN","open_items":6,"accepted_items":0,"units":2,"by_status":[{"key":"OPEN","count":4},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Identity Architect","Security Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-gcp.service_account","source":"CRITICAL_SEMANTIC","family":"gcp.service_account","title":"Critical semantics · gcp.service_account","record_ids":["DEC-IAM-GOOGLE-SERVICE-ACCOUNT-AUTOMATION","DEC-IAM-GOOGLE-SERVICE-ACCOUNT-CLIENT","DEC-IAM-GOOGLE-SERVICE-ACCOUNT-INIT","DEC-IAM-GOOGLE-SERVICE-ACCOUNT-SERVER"],"records":4,"status":"OPEN","open_items":8,"accepted_items":0,"units":4,"by_status":[{"key":"OPEN","count":4},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Identity Architect"],"earliest_phase":"NOT_STATED","conditional":2},{"id":"GRP-CRITICAL-SEMANTIC-gcp.sql_instance","source":"CRITICAL_SEMANTIC","family":"gcp.sql_instance","title":"Critical semantics · gcp.sql_instance","record_ids":["DEC-IAM-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES","DEC-NET-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES","DEC-OPS-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES"],"records":3,"status":"OPEN","open_items":4,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":3},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Identity Architect","Network Architect","Platform Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-CRITICAL-SEMANTIC-gcp.storage_bucket","source":"CRITICAL_SEMANTIC","family":"gcp.storage_bucket","title":"Critical semantics · gcp.storage_bucket","record_ids":["DEC-DATA-GOOGLE-STORAGE-BUCKET-MEDIA","DEC-GEN-GOOGLE-STORAGE-BUCKET-MEDIA","DEC-IAM-GOOGLE-STORAGE-BUCKET-MEDIA","DEC-OPS-GOOGLE-STORAGE-BUCKET-MEDIA","DEC-SEC-GOOGLE-STORAGE-BUCKET-MEDIA"],"records":5,"status":"OPEN","open_items":6,"accepted_items":0,"units":1,"by_status":[{"key":"OPEN","count":5},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Identity Architect","NOT_STATED","Platform Architect","Security Architect","Storage Architect"],"earliest_phase":"NOT_STATED","conditional":0},{"id":"GRP-PLAN-STATEMENT-stackitsa","source":"PLAN_STATEMENT","family":"stackitsa","title":"Plan statements · stackitsa","record_ids":["DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW","DEC-IAM-STACKITSA-STATEMENT-NOT-DRAFTED"],"records":2,"status":"OPEN","open_items":4,"accepted_items":0,"units":4,"by_status":[{"key":"OPEN","count":2},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"categories":[],"owner_roles":["Identity Architect"],"earliest_phase":"BEFORE_PILOT","conditional":0}],"id_grammar":"DEC-\u003cAREA\u003e-\u003cKEY\u003e; AREA one of NET, IAM, DATA, SEC, OPS, CMP, GEN; KEY 5 to 64 characters A-Z, 0-9, - (first A-Z or 0-9); built here as DEC-\u003cAREA\u003e-\u003cFAMILY\u003e-\u003cKIND\u003e","counts":{"records":43,"plan_records":5,"plan_decisions":13,"plan_decision_states":{"pending":13,"accepted_awaiting_verification":0,"rejected":0,"stale":0},"semantic_records":36,"open_critical_semantics":72,"conditional_semantics":22,"action_records":0,"manual_actions":0,"statement_records":2,"plan_statements":4,"closed_statements":0,"units":16,"by_status":[{"key":"OPEN","count":43},{"key":"PARTIAL","count":0},{"key":"ACCEPTED","count":0},{"key":"STALE","count":0},{"key":"REJECTED","count":0}],"by_source":[{"source":"PLAN_DECISION","records":5,"open_items":13,"accepted_items":0,"units":11,"conditional":0,"open_records":5,"open_units":11,"open_default_records":1},{"source":"CRITICAL_SEMANTIC","records":36,"open_items":72,"accepted_items":0,"units":16,"conditional":22,"open_records":36,"open_units":16,"open_confirm_only_items":1},{"source":"MANUAL_ACTION","records":0,"open_items":0,"accepted_items":0,"units":0,"conditional":0},{"source":"PLAN_STATEMENT","records":2,"open_items":4,"accepted_items":0,"units":4,"conditional":0,"open_records":2,"open_units":4}],"by_cause":[{"key":"CUSTOMER_INPUT","count":3},{"key":"TARGET_LIMIT","count":2},{"key":"EVIDENCE_GAP","count":0},{"key":"IMPLEMENTATION_GAP","count":4},{"key":"APPLY_TIME","count":0},{"key":"DEPENDS_ON_UNIT","count":12},{"key":"NOT_CLASSIFIED","count":10},{"key":"MIXED","count":12}],"root_causes":1,"dependent_units":1,"by_blocker_class":[{"class":"ROOT_BLOCKER","records":3,"items":3},{"class":"GENUINELY_UNACCOUNTED","records":32,"items":63},{"class":"OPTIONAL_CONDITIONAL","records":7,"items":22},{"class":"PROPAGATED_IMPACT","records":1,"items":1}]},"review_input":{"state":"NOT_PROVIDED","entries":0},"unmatched_reviews":[],"state_definitions":{"review_state":"ARCHITECT_REVIEWED: a review of the decisions file, bound to this run (source digest, knowledge base and members all hold), covers every member of the record and accepts or rejects it; the outcome is the status and the review of the record. UNREVIEWED: none was given, it covers only some members, or its binding no longer holds. A review never closes a plan decision, a critical semantic or a manual action.","design_state":"OPEN: this run's plan or draft still carries the item. DESIGN_RESOLVED: stated only for an entry of the decisions file that this run's register does not hold, written for another source digest and the same knowledge base, in a run that read the plans of a generated draft without a degraded reading: the item is gone from the plan or draft of the later source. It is inferred from the absent id, so an id misspelled in the file reads the same way; a review never sets it.","validation_state":"TECHNICAL_VALIDATION_PASSED: this run ran tofu validate on the draft, it passed, and the record belongs to a family of the draft (security group, routing, identity or logs) that the validation covered. NOT_VALIDATED: tofu validate was not asked for, did not run, or the record is a critical semantic of the source, which a schema check of the draft does not cover. FAILED: tofu validate rejected the draft that holds the family. It is a static check against the pinned provider schema, not target behaviour and not approval."},"root_causes":[{"id":"google_firebase_hosting_site.client","unit":"google_firebase_hosting_site.client","source_type":"google_firebase_hosting_site","why":"it is REDESIGN","conditional":true,"records":["DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE","DEC-IAM-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT","DEC-OPS-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT"],"dependent_units":["google_cloudbuild_trigger.placeholder"],"dependent_records":["DEC-GEN-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER"],"dependent_items":1,"next_step":"Decide whether a proposed STACKIT alternative replaces a source capability for google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder, google_firebase_hosting_site.client and 3 more: choose one of the 2 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","next_record":"DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE"}],"decisions":[{"id":"DEC-GEN-CONVERT-API-OPT-IN","kind":"API_OPT_IN","family":"convert","source":"PLAN_DECISION","group":"GRP-PLAN-DECISION-convert","block":"API_OPT_IN","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"options":[{"id":"allow-calls-of-the-api","title":"Allow the calls of the API for this migration","effect":"The calls of the API the plan states are made as the plan writes them (the request documents of the execution package), and the steps of their path are taken; the migration then depends on an API that may change or vanish.","execution_effect":"ACK_CURRENT_ARTIFACT","evidence":[{"url":"https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/functions/v1alpha/functions.json#L767-L771","class":"SOURCE_CODE_VERIFIED","checked_at":"2026-10-23","quote":"\"info\": {\"description\": \"This API provides endpoints for managing STACKIT Functions.\", \"title\": \"STACKIT Functions Core API\", \"version\": \"1alpha\"}"}]}],"recommended_option":null,"blocking_effect":"TARGET_DESIGN_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":2}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"The plan calls a STACKIT API that is not generally available (alpha, beta, or a release status its documentation does not state), which may change or be withdrawn, so it makes those calls only after you allow them (2 APIs): until you answer, the calls and the steps of their path wait. Allowing carries them out; refusing keeps the draft's own path where the API's path is an alternative beside it, and leaves the question open where the API is the only carrier of what its call sets. No block of the draft waits for it, and no unit's eligibility rests on it.","required_evidence":["the Secrets Manager Vault-compatible API is of a maturity that is not established (its documentation states no release status and its product documentation does not establish it as generally available): the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for google_secret_manager_secret.django_admin_password, google_secret_manager_secret.django_settings wait for this decision; the draft's own blocks do not","the pubsub API v1beta is beta: the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for google_pubsub_topic.faux wait for this decision; the draft's own blocks do not","the platform's consent to depend on an API that may change or vanish (alpha, beta, or a maturity the documentation does not establish)"],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:ad0b4646256d69e513051c7a948486002928b0d8da0e8c103efc9f267ec3d9fe","artifact_sha256":"sha256:4dcc4d547c199508ac6d33000affd676431fd849c5ce9b11aefb886b2717ff5f","kb_dependencies_sha256":"sha256:03735a47b22c84235c95ed16b33e929eb21e905431c7a1c2103a67e6c13f9395"},"member_count":2,"affected_unit_count":3,"evidence_ref_count":3,"resolution":{"decision_id":"DEC-GEN-CONVERT-API-OPT-IN","source_family":"convert","source_semantic":"API_OPT_IN","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"TARGET_DESIGN_OPEN","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":3,"resolution_paths":[{"id":"allow-calls-of-the-api","title":"Allow the calls of the API for this migration","prerequisites":[],"effects":["The calls of the API the plan states are made as the plan writes them (the request documents of the execution package), and the steps of their path are taken; the migration then depends on an API that may change or vanish."],"risk":[],"evidence":["https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/functions/v1alpha/functions.json#L767-L771"],"regeneration_required":false}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":["https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/functions/v1alpha/functions.json#L767-L771"],"state_reason":"a person's decision or input is still open","source_observation":"The plan leaves this decision open on google_pubsub_topic.faux, google_secret_manager_secret.django_admin_password and google_secret_manager_secret.django_settings.","generated_target_behavior":"The draft holds MAN/pubsub.topic/name/google_pubsub_topic.faux, API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password and API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings until this decision is answered by an answer that frees it.","residual_difference":"the target design is open until the decision is answered","execution_effect":"3 steps of the plan wait for it until it is answered: MAN/pubsub.topic/name/google_pubsub_topic.faux, API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password and API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings.","next_action":"Allow STACKIT's pre-release APIs, which may change or be withdrawn: Pub/Sub v1beta (beta) and Secrets Manager v1 (release status not stated). 3 steps of the plan name this decision and wait for this answer (the steps that come after them are counted in what an answer frees); allowing the calls lets the plan carry them out and makes the migration depend on those APIs. If you say no (record a rejection), the calls are not made: the steps of Pub/Sub and Secrets Manager stay open. Record the answer in the decisions file given with --decisions (decisions-template.yaml); answer each API on its own through the members of the record.","why_open":["The plan calls a STACKIT API that is not generally available (alpha, beta, or a release status its documentation does not state), which may change or be withdrawn, so it makes those calls only after you allow them (2 APIs): until you answer, the calls and the steps of their path wait. Allowing carries them out; refusing keeps the draft's own path where the API's path is an alternative beside it, and leaves the question open where the API is the only carrier of what its call sets. No block of the draft waits for it, and no unit's eligibility rests on it."],"closes_when":["Every API the record lists is answered in the decisions file: allowed, or refused."],"required_inputs":["the Secrets Manager Vault-compatible API is of a maturity that is not established (its documentation states no release status and its product documentation does not establish it as generally available): the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for google_secret_manager_secret.django_admin_password, google_secret_manager_secret.django_settings wait for this decision; the draft's own blocks do not","the pubsub API v1beta is beta: the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for google_pubsub_topic.faux wait for this decision; the draft's own blocks do not","the platform's consent to depend on an API that may change or vanish (alpha, beta, or a maturity the documentation does not establish)"]},"unblocks":{"holds":5,"alone":5,"shared":0,"best_option":"allow-calls-of-the-api","options":[{"option":"allow-calls-of-the-api","effects":["ACK_CURRENT_ARTIFACT"],"alone":5,"shared":0},{"option":"","effects":["ACK_CURRENT_ARTIFACT"],"alone":5,"shared":0}]}},{"id":"DEC-GEN-CONVERT-DATA-MOVEMENT","kind":"DATA_MOVEMENT","family":"convert","source":"PLAN_DECISION","group":"GRP-PLAN-DECISION-convert","block":"DATA_MOVEMENT","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Data Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"options":[{"id":"export-and-import-with-the-engine-clients","title":"Export the data from the source and import it with the clients of the target engine","effect":"A person exports the data from the source and imports it into the STACKIT instance with the clients of its engine during a window the business accepts, then checks that the copy is complete; the clients reach the instance at the host and port its credential states. The source and the target engine may differ (DynamoDB to MongoDB Flex), so the export is converted where they do. The plan holds the steps of this option as typed steps: for a PostgreSQL database, for a MySQL, MariaDB or Aurora MySQL database moving to MariaDB and for an RDS for SQL Server database moving to SQLServer Flex (the native backup, its copy to a STACKIT S3 bucket and the import_database call) the preflight, the rehearsal, the write freeze, the dump or backup and the restore or import inside it, the reconcile and the cleanup; for an ElastiCache, MemoryDB or ElastiCache serverless cache moving to a Key Value Store the preflight, the rehearsal, the write freeze, the copy by a client, the reconcile and the cleanup; for an Amazon Aurora DSQL cluster moving to PostgreSQL Flex the preflight, the rehearsal, the write freeze, the copy of the tables by a client (the schema from the catalogs of the cluster, or from pg_dump --schema-only where the preflight shows that it works, and the rows through the PostgreSQL protocol: no AWS page read documents a dump of a cluster), the reconcile and the cleanup; for an OpenSearch store the write freeze, the copy and the reconcile. The decision offers this option only for a store whose STACKIT service documents a way in with such clients: PostgreSQL Flex (for an Aurora DSQL cluster, which has no change stream, this option and the tool of the customer's own are the only ones; the replication of the engine is not offered), MariaDB (the mysql client loads a dump into an empty instance), SQLServer Flex (a .bak file imported with import_database), Key Value Store (the tutorial migrates a Redis instance by the MIGRATE command; for an ElastiCache source, where AWS lists migrate among the commands unavailable for caches running Redis OSS, the copy is a client that iterates the keys with SCAN and copies each with DUMP, PTTL and RESTORE; for a MemoryDB source, where AWS lists migrate, sync, psync, bgsave, save and config among the unavailable commands and the cluster mode is always on, the same client copy runs against every shard primary found with CLUSTER NODES or CLUSTER SLOTS, with TLS where the source has it and an ACL user that reaches every key; whether DUMP, RESTORE and PTTL run on a standard MemoryDB cluster is not stated by AWS, and for a member of a multi-Region cluster, whose page lists PTTL as unsupported, the step says the TTLs are not carried) and OpenSearch (the reindex operation). For a store without a documented way in (MongoDB Flex, a memcached cache) it is not offered and the decision offers the tool of the customer's own alone.","execution_effect":"MANUAL_ALTERNATIVE","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-23","quote":"Read-Only: host (String), hosts (List of String), ..., port (Number), uri (String, Sensitive)"},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_user.md#L59-L63","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-23","quote":"Read-Only: host (String), ..., port (Number), uri (String, Sensitive)"},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_credential.md#L51-L57","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-23","quote":"Read-Only: host (String), hosts (List of String), ..., port (Number), ..., uri (String, Sensitive)"},{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_credential.md#L51-L57","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-23","quote":"Read-Only: host (String), hosts (List of String), load_balanced_host (String), ..., port (Number), uri (String, Sensitive) Connection URI."},{"url":"https://docs.stackit.cloud/products/databases/mariadb/how-tos/backup-and-restore/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"Connect to the database and import the backup."},{"url":"https://docs.stackit.cloud/products/databases/sqlserver-flex/how-tos/import-database-backup-from-stackit-s3-into-sqlserver-flex/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"You have uploaded the database to be imported as .bak file(s) to the STACKIT S3 bucket"},{"url":"https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"The main strategy to migrate the whole dataset from the source to the target is based on the MIGRATE command."},{"url":"https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/SupportedCommands.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"For caches running Redis OSS, the following commands are unavailable:"},{"url":"https://docs.aws.amazon.com/memorydb/latest/devguide/restrictedcommands.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"To deliver a managed service experience, MemoryDB restricts access to certain commands that require advanced privileges. The following commands are unavailable:"},{"url":"https://docs.stackit.cloud/products/databases/opensearch/how-tos/migrate-elasticsearch-data-to-an-opensearch2-service-instance/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"to use the `reindex` Data Operation"}]},{"id":"replicate-with-the-engine-replication","title":"Replicate the data with the replication of the source engine until the cutover","effect":"A person sets up the replication of the source engine so that the STACKIT instance follows the source while the application keeps writing to the source (for PostgreSQL, logical replication: the schema is copied first with pg_dump --schema-only, a publication on the source and a subscription on the target copy the existing rows and then the changes, and the sequences are copied inside the write freeze because they are not replicated). The source needs a change and a reboot to turn replication on, and the target must be able to reach the source. Inside the write freeze the person waits until the target has caught up, compares both sides and switches the clients, then removes the replication. For a PostgreSQL database the plan holds the steps of this option (the initial copy, the watch of the lag, the freeze, the final copy, the reconcile and the cleanup); for an S3 bucket this option is not available, because S3 Replication copies between Amazon S3 buckets and no STACKIT bucket is documented as a destination (the plan holds the two copy tools instead); for any other engine this option is not offered, because no STACKIT service other than PostgreSQL Flex documents the replication of a source engine into it (MariaDB, Key Value Store, OpenSearch and MongoDB Flex document none, and the SQLServer Flex page on transactional replication describes an on-premises publisher and does not name Amazon RDS as one), so the decision of such a store offers the export and the import with the engine clients where its service documents them, and the tool of the customer's own.","execution_effect":"MANUAL_ALTERNATIVE","evidence":[{"url":"https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"You can use replication to enable automatic, asynchronous copying of objects across Amazon S3 buckets."},{"url":"https://www.postgresql.org/docs/current/logical-replication-restrictions.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-29","quote":"The database schema and DDL commands are not replicated. The initial schema can be copied by hand using pg_dump --schema-only."},{"url":"https://www.postgresql.org/docs/current/logical-replication-restrictions.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-29","quote":"Sequence data is not replicated."},{"url":"https://www.postgresql.org/docs/current/sql-createsubscription.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-29","quote":"To be able to create a subscription, you must have the privileges of the pg_create_subscription role, as well as CREATE privileges on the current database."},{"url":"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-29","quote":"Set the rds.logical_replication static parameter to 1."},{"url":"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-29","quote":"Reboot the DB instance for the static rds.logical_replication parameter to take effect."}]},{"id":"copy-the-objects-with-rclone","title":"Copy the objects of the bucket with rclone, from the source bucket to the STACKIT bucket","effect":"For an S3 bucket: a person runs rclone on a move host that reaches both endpoints, with two S3 remotes (the source with the AWS credentials of the shell, the target as a provider Other remote at the STACKIT S3 endpoint with a credential of a credentials group, both read from the environment at run time), copies every current object while the writers keep writing, repeats the copy until a pass is short, stops the writers, runs the last pass, settles what the source deleted after the first copy, and compares both sides (the count and the bytes, the key lists and, where a hash is shared, the content) before the applications are switched. The copy carries the current object of every key and nothing of the bucket's configuration: no older version, no delete marker, no retention, no ACL, no policy; those are settled where the draft names them. The plan holds the steps of this option (the initial copy, the passes, the freeze, the last pass, the reconcile and the cleanup) with command templates and no credential value. No copy was run against a STACKIT bucket by StackToIT.","execution_effect":"MANUAL_ALTERNATIVE","evidence":[{"url":"https://docs.stackit.cloud/products/storage/object-storage/tutorials/migrate-data-using-rclone/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"rclone copy source:/BUCKET_NAME destination:/BUCKET_NAME --s3-upload-cutoff 0 --progress --log-file /tmp/rclone.log"},{"url":"https://rclone.org/commands/rclone_copy/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"Copy files from source to dest, skipping identical files. ... Doesn't delete files from the destination."},{"url":"https://rclone.org/commands/rclone_check/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"compares sizes and hashes (MD5 or SHA1) and logs a report of files that don't match."},{"url":"https://docs.stackit.cloud/products/storage/object-storage/reference/supported-operations-on-buckets-and-objects/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"Create Multipart Upload: Initiates a multipart upload and returns an upload ID."}]},{"id":"copy-the-objects-with-the-aws-cli","title":"Copy the objects of the bucket with the AWS CLI, through a staging directory","effect":"For an S3 bucket: a person runs the AWS CLI on a move host with free disk for the data. One command sends its requests to one endpoint, so the objects are downloaded from the AWS bucket into a directory with aws s3 sync and uploaded from it to the STACKIT bucket with aws s3 sync and --endpoint-url set to the STACKIT S3 endpoint, with the credential of a credentials group read from the environment at run time. The data crosses the host twice, one pass after the other; aws s3 sync decides by size and last-modified time and never compares the content, so the comparison before the switch downloads the target and compares the files. The copy carries the current object of every key and nothing of the bucket's configuration, as with rclone. The plan holds the steps of this option with command templates and no credential value. No copy was run against a STACKIT bucket by StackToIT.","execution_effect":"MANUAL_ALTERNATIVE","evidence":[{"url":"https://docs.aws.amazon.com/cli/latest/reference/s3/sync.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"An S3 object will require copying if the sizes of the two S3 objects differ, the last modified time of the source is newer than the last modified time of the destination, or the S3 object does not exist under the specified bucket and prefix destination."},{"url":"https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-options.html","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"--endpoint-url \u003cstring\u003e Specifies the URL to send the request to."},{"url":"https://docs.stackit.cloud/products/storage/object-storage/how-tos/manage-encryption/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-30","quote":"aws s3 cp ./my-file.txt s3://my-bucket/ --sse AES256 --endpoint-url https://object.storage.eu01.onstackit.cloud"}]},{"id":"migrate-with-a-tool-of-my-own","title":"Move the data with a migration tool or a replication of the owner's own","effect":"A person moves the data with a tool or a replication they run (for example a change-data-capture replication that keeps the copy in step until the cutover), writes its steps, the checks before the move, the cutover window and the way back, and carries them out. The STACKIT instance is reached at the host and port its credential states. The plan holds that work as typed steps: the write freeze of the source, the copy as one step whose commands the person writes, and the reconcile that compares both sides; the source stays the way back until the reconcile records GO, which a person checks, since the plan cannot know that the tool leaves the source unchanged. A memcached cache holds a confirmation instead of a copy. A bucket repeated by count or for_each has neither a reconcile nor any other option: its instances and the buckets they move to are not named, so the plan holds the one manual step, which the person writes for each instance after naming them.","execution_effect":"MANUAL_ALTERNATIVE","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-10-23","quote":"Read-Only: host (String), hosts (List of String), ..., port (Number), uri (String, Sensitive)"}]}],"recommended_option":null,"blocking_effect":"TARGET_DESIGN_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"The method that moves the data of a store (a database, a cache, a search domain, or the objects of a bucket) to its STACKIT service is a person's choice (1 converter decision): the steps of each method are in the plan where the planner covers the store (a PostgreSQL database and an S3 bucket, each with the runbook of the move), and the plan holds one manual step the person writes where it does not; the steps of the move wait for the choice. The choice decides how the data is moved, not whether it is: every method is work a person does by hand, so the unit that owns one keeps a manual data-migration step, and answering it does not take that step away.","required_evidence":["the plan defines both methods of the engine (a dump restored inside the write freeze, and a logical replication that follows the changes until the freeze) and keeps them open: which one applies depends on the size of the data, the write rate and the downtime the business accepts, and the source states none of them; the steps of the methods wait for the answer","the size of the data, the downtime the business tolerates and the consistency the application needs, to choose the method and the cutover window"],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:84bb3ebfd40276eeeabadf6428f1d880feb76324d64e689f3269ad76bb2b327d","artifact_sha256":"sha256:a4f94232ca78f136bc3cea3ddd554e90886d26cf333ee677b940028baa86d050","kb_dependencies_sha256":"sha256:610870c4321b580122859ef332af5301a6bd3a8973057240bd04c7d631e03a41"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-GEN-CONVERT-DATA-MOVEMENT","source_family":"convert","source_semantic":"DATA_MOVEMENT","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"NOT_STATED","owner_role":"Data Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"TARGET_DESIGN_OPEN","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":13,"resolution_paths":[{"id":"export-and-import-with-the-engine-clients","title":"Export the data from the source and import it with the clients of the target engine","prerequisites":[],"effects":["A person exports the data from the source and imports it into the STACKIT instance with the clients of its engine during a window the business accepts, then checks that the copy is complete; the clients reach the instance at the host and port its credential states. The source and the target engine may differ (DynamoDB to MongoDB Flex), so the export is converted where they do. The plan holds the steps of this option as typed steps: for a PostgreSQL database, for a MySQL, MariaDB or Aurora MySQL database moving to MariaDB and for an RDS for SQL Server database moving to SQLServer Flex (the native backup, its copy to a STACKIT S3 bucket and the import_database call) the preflight, the rehearsal, the write freeze, the dump or backup and the restore or import inside it, the reconcile and the cleanup; for an ElastiCache, MemoryDB or ElastiCache serverless cache moving to a Key Value Store the preflight, the rehearsal, the write freeze, the copy by a client, the reconcile and the cleanup; for an Amazon Aurora DSQL cluster moving to PostgreSQL Flex the preflight, the rehearsal, the write freeze, the copy of the tables by a client (the schema from the catalogs of the cluster, or from pg_dump --schema-only where the preflight shows that it works, and the rows through the PostgreSQL protocol: no AWS page read documents a dump of a cluster), the reconcile and the cleanup; for an OpenSearch store the write freeze, the copy and the reconcile. The decision offers this option only for a store whose STACKIT service documents a way in with such clients: PostgreSQL Flex (for an Aurora DSQL cluster, which has no change stream, this option and the tool of the customer's own are the only ones; the replication of the engine is not offered), MariaDB (the mysql client loads a dump into an empty instance), SQLServer Flex (a .bak file imported with import_database), Key Value Store (the tutorial migrates a Redis instance by the MIGRATE command; for an ElastiCache source, where AWS lists migrate among the commands unavailable for caches running Redis OSS, the copy is a client that iterates the keys with SCAN and copies each with DUMP, PTTL and RESTORE; for a MemoryDB source, where AWS lists migrate, sync, psync, bgsave, save and config among the unavailable commands and the cluster mode is always on, the same client copy runs against every shard primary found with CLUSTER NODES or CLUSTER SLOTS, with TLS where the source has it and an ACL user that reaches every key; whether DUMP, RESTORE and PTTL run on a standard MemoryDB cluster is not stated by AWS, and for a member of a multi-Region cluster, whose page lists PTTL as unsupported, the step says the TTLs are not carried) and OpenSearch (the reindex operation). For a store without a documented way in (MongoDB Flex, a memcached cache) it is not offered and the decision offers the tool of the customer's own alone."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_user.md#L59-L63","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_credential.md#L51-L57","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_credential.md#L51-L57","https://docs.stackit.cloud/products/databases/mariadb/how-tos/backup-and-restore/","https://docs.stackit.cloud/products/databases/sqlserver-flex/how-tos/import-database-backup-from-stackit-s3-into-sqlserver-flex/","https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/","https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/SupportedCommands.html","https://docs.aws.amazon.com/memorydb/latest/devguide/restrictedcommands.html","https://docs.stackit.cloud/products/databases/opensearch/how-tos/migrate-elasticsearch-data-to-an-opensearch2-service-instance/"],"regeneration_required":false},{"id":"replicate-with-the-engine-replication","title":"Replicate the data with the replication of the source engine until the cutover","prerequisites":[],"effects":["A person sets up the replication of the source engine so that the STACKIT instance follows the source while the application keeps writing to the source (for PostgreSQL, logical replication: the schema is copied first with pg_dump --schema-only, a publication on the source and a subscription on the target copy the existing rows and then the changes, and the sequences are copied inside the write freeze because they are not replicated). The source needs a change and a reboot to turn replication on, and the target must be able to reach the source. Inside the write freeze the person waits until the target has caught up, compares both sides and switches the clients, then removes the replication. For a PostgreSQL database the plan holds the steps of this option (the initial copy, the watch of the lag, the freeze, the final copy, the reconcile and the cleanup); for an S3 bucket this option is not available, because S3 Replication copies between Amazon S3 buckets and no STACKIT bucket is documented as a destination (the plan holds the two copy tools instead); for any other engine this option is not offered, because no STACKIT service other than PostgreSQL Flex documents the replication of a source engine into it (MariaDB, Key Value Store, OpenSearch and MongoDB Flex document none, and the SQLServer Flex page on transactional replication describes an on-premises publisher and does not name Amazon RDS as one), so the decision of such a store offers the export and the import with the engine clients where its service documents them, and the tool of the customer's own."],"risk":[],"evidence":["https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html","https://www.postgresql.org/docs/current/logical-replication-restrictions.html","https://www.postgresql.org/docs/current/logical-replication-restrictions.html","https://www.postgresql.org/docs/current/sql-createsubscription.html","https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html","https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html"],"regeneration_required":false},{"id":"copy-the-objects-with-rclone","title":"Copy the objects of the bucket with rclone, from the source bucket to the STACKIT bucket","prerequisites":[],"effects":["For an S3 bucket: a person runs rclone on a move host that reaches both endpoints, with two S3 remotes (the source with the AWS credentials of the shell, the target as a provider Other remote at the STACKIT S3 endpoint with a credential of a credentials group, both read from the environment at run time), copies every current object while the writers keep writing, repeats the copy until a pass is short, stops the writers, runs the last pass, settles what the source deleted after the first copy, and compares both sides (the count and the bytes, the key lists and, where a hash is shared, the content) before the applications are switched. The copy carries the current object of every key and nothing of the bucket's configuration: no older version, no delete marker, no retention, no ACL, no policy; those are settled where the draft names them. The plan holds the steps of this option (the initial copy, the passes, the freeze, the last pass, the reconcile and the cleanup) with command templates and no credential value. No copy was run against a STACKIT bucket by StackToIT."],"risk":[],"evidence":["https://docs.stackit.cloud/products/storage/object-storage/tutorials/migrate-data-using-rclone/","https://rclone.org/commands/rclone_copy/","https://rclone.org/commands/rclone_check/","https://docs.stackit.cloud/products/storage/object-storage/reference/supported-operations-on-buckets-and-objects/"],"regeneration_required":false},{"id":"copy-the-objects-with-the-aws-cli","title":"Copy the objects of the bucket with the AWS CLI, through a staging directory","prerequisites":[],"effects":["For an S3 bucket: a person runs the AWS CLI on a move host with free disk for the data. One command sends its requests to one endpoint, so the objects are downloaded from the AWS bucket into a directory with aws s3 sync and uploaded from it to the STACKIT bucket with aws s3 sync and --endpoint-url set to the STACKIT S3 endpoint, with the credential of a credentials group read from the environment at run time. The data crosses the host twice, one pass after the other; aws s3 sync decides by size and last-modified time and never compares the content, so the comparison before the switch downloads the target and compares the files. The copy carries the current object of every key and nothing of the bucket's configuration, as with rclone. The plan holds the steps of this option with command templates and no credential value. No copy was run against a STACKIT bucket by StackToIT."],"risk":[],"evidence":["https://docs.aws.amazon.com/cli/latest/reference/s3/sync.html","https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-options.html","https://docs.stackit.cloud/products/storage/object-storage/how-tos/manage-encryption/"],"regeneration_required":false},{"id":"migrate-with-a-tool-of-my-own","title":"Move the data with a migration tool or a replication of the owner's own","prerequisites":[],"effects":["A person moves the data with a tool or a replication they run (for example a change-data-capture replication that keeps the copy in step until the cutover), writes its steps, the checks before the move, the cutover window and the way back, and carries them out. The STACKIT instance is reached at the host and port its credential states. The plan holds that work as typed steps: the write freeze of the source, the copy as one step whose commands the person writes, and the reconcile that compares both sides; the source stays the way back until the reconcile records GO, which a person checks, since the plan cannot know that the tool leaves the source unchanged. A memcached cache holds a confirmation instead of a copy. A bucket repeated by count or for_each has neither a reconcile nor any other option: its instances and the buckets they move to are not named, so the plan holds the one manual step, which the person writes for each instance after naming them."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57"],"regeneration_required":false}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_user.md#L59-L63","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_credential.md#L51-L57","https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_credential.md#L51-L57","https://docs.stackit.cloud/products/databases/mariadb/how-tos/backup-and-restore/","https://docs.stackit.cloud/products/databases/sqlserver-flex/how-tos/import-database-backup-from-stackit-s3-into-sqlserver-flex/","https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/","https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/SupportedCommands.html","https://docs.aws.amazon.com/memorydb/latest/devguide/restrictedcommands.html","https://docs.stackit.cloud/products/databases/opensearch/how-tos/migrate-elasticsearch-data-to-an-opensearch2-service-instance/","https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html","https://www.postgresql.org/docs/current/logical-replication-restrictions.html","https://www.postgresql.org/docs/current/sql-createsubscription.html","https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html","https://docs.stackit.cloud/products/storage/object-storage/tutorials/migrate-data-using-rclone/","https://rclone.org/commands/rclone_copy/","https://rclone.org/commands/rclone_check/","https://docs.stackit.cloud/products/storage/object-storage/reference/supported-operations-on-buckets-and-objects/","https://docs.aws.amazon.com/cli/latest/reference/s3/sync.html","https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-options.html","https://docs.stackit.cloud/products/storage/object-storage/how-tos/manage-encryption/"],"state_reason":"a person's decision or input is still open","source_observation":"The plan leaves this decision open on google_sql_database_instance.postgres.","generated_target_behavior":"The draft holds MAN/data/google_sql_database_instance.postgres/initial-copy/logical-replication, MAN/data/google_sql_database_instance.postgres/delta-sync/logical-replication, MAN/data/google_sql_database_instance.postgres/write-freeze/dump-restore, MAN/data/google_sql_database_instance.postgres/final-sync/dump-restore, MAN/data/google_sql_database_instance.postgres/reconcile/dump-restore, MAN/data/google_sql_database_instance.postgres/write-freeze/logical-replication, MAN/data/google_sql_database_instance.postgres/final-sync/logical-replication, MAN/data/google_sql_database_instance.postgres/reconcile/logical-replication, MAN/data/google_sql_database_instance.postgres/write-freeze/own-tool, MAN/data/google_sql_database_instance.postgres/final-sync/own-tool and 3 more until this decision is answered by an answer that frees it.","residual_difference":"the target design is open until the decision is answered","execution_effect":"13 steps of the plan wait for it until it is answered: MAN/data/google_sql_database_instance.postgres/initial-copy/logical-replication, MAN/data/google_sql_database_instance.postgres/delta-sync/logical-replication, MAN/data/google_sql_database_instance.postgres/write-freeze/dump-restore, MAN/data/google_sql_database_instance.postgres/final-sync/dump-restore, MAN/data/google_sql_database_instance.postgres/reconcile/dump-restore, MAN/data/google_sql_database_instance.postgres/write-freeze/logical-replication, MAN/data/google_sql_database_instance.postgres/final-sync/logical-replication, MAN/data/google_sql_database_instance.postgres/reconcile/logical-replication, MAN/data/google_sql_database_instance.postgres/write-freeze/own-tool, MAN/data/google_sql_database_instance.postgres/final-sync/own-tool and 3 more.","next_action":"Choose how the data is moved for google_sql_database_instance.postgres: choose one of the 5 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["The method that moves the data of a store (a database, a cache, a search domain, or the objects of a bucket) to its STACKIT service is a person's choice (1 converter decision): the steps of each method are in the plan where the planner covers the store (a PostgreSQL database and an S3 bucket, each with the runbook of the move), and the plan holds one manual step the person writes where it does not; the steps of the move wait for the choice. The choice decides how the data is moved, not whether it is: every method is work a person does by hand, so the unit that owns one keeps a manual data-migration step, and answering it does not take that step away."],"closes_when":["an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option"],"required_inputs":["the plan defines both methods of the engine (a dump restored inside the write freeze, and a logical replication that follows the changes until the freeze) and keeps them open: which one applies depends on the size of the data, the write rate and the downtime the business accepts, and the source states none of them; the steps of the methods wait for the answer","the size of the data, the downtime the business tolerates and the consistency the application needs, to choose the method and the cutover window"]},"unblocks":{"holds":13,"alone":6,"shared":0,"best_option":"replicate-with-the-engine-replication","options":[{"option":"export-and-import-with-the-engine-clients","effects":["MANUAL_ALTERNATIVE"],"alone":4,"shared":0},{"option":"replicate-with-the-engine-replication","effects":["MANUAL_ALTERNATIVE"],"alone":6,"shared":0},{"option":"copy-the-objects-with-rclone","effects":["MANUAL_ALTERNATIVE"],"alone":0,"shared":0},{"option":"copy-the-objects-with-the-aws-cli","effects":["MANUAL_ALTERNATIVE"],"alone":0,"shared":0},{"option":"migrate-with-a-tool-of-my-own","effects":["MANUAL_ALTERNATIVE"],"alone":3,"shared":0}]}},{"id":"DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE","kind":"PROPOSED_ALTERNATIVE","family":"convert","source":"PLAN_DECISION","group":"GRP-PLAN-DECISION-convert","block":"PROPOSED_ALTERNATIVE","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"options":[{"id":"use-the-proposed-module","title":"Use the proposed module, with the stated difference","effect":"A person reads the module, sets its values and sets its switch to true: the module is then part of the plan of the draft, with the stated difference from the source. While the switch is false, the module creates nothing.","execution_effect":"ACK_CURRENT_ARTIFACT","evidence":[{"url":"https://opentofu.org/docs/language/meta-arguments/count/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-11-05","quote":"If a resource or module block includes a count argument whose value is a whole number, OpenTofu will create that many instances."}]},{"id":"design-it-another-way","title":"Design it another way and leave the module off","effect":"A person designs the capability another way, by hand, and the switch of the module stays false: the module creates nothing and the unit's manual step stays the person's work.","execution_effect":"MANUAL_ALTERNATIVE","evidence":[{"url":"https://opentofu.org/docs/language/meta-arguments/count/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-11-05","quote":"If a resource or module block includes a count argument whose value is a whole number, OpenTofu will create that many instances."}]}],"recommended_option":null,"blocking_effect":"TARGET_DESIGN_OPEN","causes":[{"cause":"TARGET_LIMIT","members":8}],"blocker_class":"ROOT_BLOCKER","why":"The target has no equal of a source capability, and the draft holds a STACKIT alternative in a module that is switched off (8 converter decisions): nothing of the module applies until a person accepts the stated difference, gives it its values and sets its switch, or designs the capability another way.","required_evidence":["the target has no equal of this Cloud Build trigger: starts a build on a source event, a Pub/Sub message, a webhook or by hand, with its steps, substitutions, artifacts, secrets and optional approval: Nothing is converted. The same delivery is a workflow of STACKIT Git Pipelines (written for GitHub Actions; STACKIT-managed or custom runners; secrets from Secrets Manager or the repository; a manual-approval action) or the customer's own CI/CD. Trigger conditions, steps, secrets (created again, never copied), the service account (replaced by the credentials the workflow uses against STACKIT), the log destination and the approval are written again by a person. To decide: Which pipelines are still needed, where they run (STACKIT Git Pipelines or the customer's own CI/CD), how each trigger, step, secret and approval is written again, and who owns the workflow files.","the target has no equal of this one member's role on the Cloud Storage bucket: A STACKIT credentials group is not a grant on the Cloud Storage bucket. It is the principal that a bucket policy names, a set of S3 keys with no Google identity behind it, and by itself it gives no access to the bucket and takes none away. The statement that grants it something is a statement of the bucket policy, in the policy language of STACKIT (a credentials group or * as the principal, S3 actions, five condition keys), which no Terraform resource sets. The Google role is not mapped to S3 actions by any table, the condition of the grant has no counterpart unless it can be written with those five condition keys, and a Google group, a domain, a federated identity and allUsers or allAuthenticatedUsers are named again as credentials groups or as *. To decide: Which credentials group stands for each member of the grant, which S3 actions of the bucket policy give the same people the access they need and no more than the Google role gave, what becomes of the condition, of public members (allUsers, allAuthenticatedUsers), of Google groups, domains and federated identities, and whether the grant ends with the Cloud Storage bucket when it has no replacement. Which bucket the grant is on, because the scan does not hold it. The draft of google_storage_bucket.media stands as it is: this answer decides the module and nothing of that draft.","the target has no equal of this static web hosting site: Static files are published into an Object Storage bucket by a pipeline, and a CDN distribution (a beta resource) with the bucket as origin serves them on a custom domain; the redirects of the site become redirect rules of the distribution. Custom response headers, rewrites to Cloud Run services or Cloud Functions, preview channels and the release history have no counterpart and are restated in the pipeline or in the application. To decide: Which bucket is the origin, which domain the distribution serves, and how rewrites and previews are replaced. The CDN resources are beta.","the target has no equal of this the members of one role on the Secret Manager secret: A STACKIT role assignment is not a grant on the Secret Manager secret. It gives one user, group or service account one STACKIT role on a whole project, folder or organisation. The role is a set of STACKIT permissions, not the Google role, and no table maps one to the other. It has no condition and no public member, so what the grant gave to a Google group, a domain, a federated identity or everyone is named again, and the access reaches more than the Secret Manager secret. A binding on a secret group applies to every secret in the group, so it is wider than a grant on one secret unless the secret has a group of its own, and its roles are Secrets Manager roles. The binding was authoritative for its role: STACKIT role assignments are additive, so a person who holds the role through another assignment keeps it, and removing such people is a step of a person. To decide: Which STACKIT role, on which project, folder or organisation, gives the same people the access they need on the Secret Manager secret, knowing it covers everything in that scope; which STACKIT users, groups or service accounts take the place of Google groups, domains, federated identities and a public member; and whether the grant ends with the Secret Manager secret when it has no replacement. For secrets: which secret group holds the secret, who else shares that group, and which Secrets Manager role and subject take the grant. Whether people who hold the role through another assignment keep it. The draft of google_secret_manager_secret.django_admin_password stands as it is: this answer decides the module and nothing of that draft.","the target has no equal of this the members of one role on the Secret Manager secret: A STACKIT role assignment is not a grant on the Secret Manager secret. It gives one user, group or service account one STACKIT role on a whole project, folder or organisation. The role is a set of STACKIT permissions, not the Google role, and no table maps one to the other. It has no condition and no public member, so what the grant gave to a Google group, a domain, a federated identity or everyone is named again, and the access reaches more than the Secret Manager secret. A binding on a secret group applies to every secret in the group, so it is wider than a grant on one secret unless the secret has a group of its own, and its roles are Secrets Manager roles. The binding was authoritative for its role: STACKIT role assignments are additive, so a person who holds the role through another assignment keeps it, and removing such people is a step of a person. To decide: Which STACKIT role, on which project, folder or organisation, gives the same people the access they need on the Secret Manager secret, knowing it covers everything in that scope; which STACKIT users, groups or service accounts take the place of Google groups, domains, federated identities and a public member; and whether the grant ends with the Secret Manager secret when it has no replacement. For secrets: which secret group holds the secret, who else shares that group, and which Secrets Manager role and subject take the grant. Whether people who hold the role through another assignment keep it. The draft of google_secret_manager_secret.django_settings stands as it is: this answer decides the module and nothing of that draft.","that the stated difference from the source is acceptable for what depends on it","the values the module asks for, which the draft does not invent"],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:af35ed50b2c8832725ee5a41a11f947f09e19ee3a5aad77e3417356fd0bd96e9","artifact_sha256":"sha256:1faf18cdde50f305c706a8770f6ab7e3fdc8ea913deff4b820878f73ad61058a","kb_dependencies_sha256":"sha256:4e2f49836dda938009c1e17d3985cef438eb78acb823da060a7d4677f36dd7f9"},"member_count":8,"affected_unit_count":7,"evidence_ref_count":3,"resolution":{"decision_id":"DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE","source_family":"convert","source_semantic":"PROPOSED_ALTERNATIVE","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"TARGET_DESIGN_OPEN","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":4,"resolution_paths":[{"id":"use-the-proposed-module","title":"Use the proposed module, with the stated difference","prerequisites":[],"effects":["A person reads the module, sets its values and sets its switch to true: the module is then part of the plan of the draft, with the stated difference from the source. While the switch is false, the module creates nothing."],"risk":[],"evidence":["https://opentofu.org/docs/language/meta-arguments/count/"],"regeneration_required":false},{"id":"design-it-another-way","title":"Design it another way and leave the module off","prerequisites":[],"effects":["A person designs the capability another way, by hand, and the switch of the module stays false: the module creates nothing and the unit's manual step stays the person's work."],"risk":[],"evidence":["https://opentofu.org/docs/language/meta-arguments/count/"],"regeneration_required":false}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":["https://opentofu.org/docs/language/meta-arguments/count/"],"state_reason":"a person's decision or input is still open","source_observation":"The plan leaves this decision open on google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder, google_firebase_hosting_site.client and 3 more.","generated_target_behavior":"The draft holds MAN/unit/google_cloudbuild_trigger.activategcb, MAN/unit/google_cloudbuild_trigger.init, MAN/unit/google_cloudbuild_trigger.placeholder and MAN/unit/google_firebase_hosting_site.client until this decision is answered by an answer that frees it.","residual_difference":"the target design is open until the decision is answered","execution_effect":"4 steps of the plan wait for it until it is answered: MAN/unit/google_cloudbuild_trigger.activategcb, MAN/unit/google_cloudbuild_trigger.init, MAN/unit/google_cloudbuild_trigger.placeholder and MAN/unit/google_firebase_hosting_site.client.","next_action":"Decide whether a proposed STACKIT alternative replaces a source capability for google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder, google_firebase_hosting_site.client and 3 more: choose one of the 2 options, and record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["The target has no equal of a source capability, and the draft holds a STACKIT alternative in a module that is switched off (8 converter decisions): nothing of the module applies until a person accepts the stated difference, gives it its values and sets its switch, or designs the capability another way."],"closes_when":["an answer whose effect frees the steps that wait for it: an acknowledgement of the current draft in the decisions file given with --decisions (decisions-template.yaml), or the inputs answer (or the change of the source) that makes the draft carry another option"],"required_inputs":["the target has no equal of this Cloud Build trigger: starts a build on a source event, a Pub/Sub message, a webhook or by hand, with its steps, substitutions, artifacts, secrets and optional approval: Nothing is converted. The same delivery is a workflow of STACKIT Git Pipelines (written for GitHub Actions; STACKIT-managed or custom runners; secrets from Secrets Manager or the repository; a manual-approval action) or the customer's own CI/CD. Trigger conditions, steps, secrets (created again, never copied), the service account (replaced by the credentials the workflow uses against STACKIT), the log destination and the approval are written again by a person. To decide: Which pipelines are still needed, where they run (STACKIT Git Pipelines or the customer's own CI/CD), how each trigger, step, secret and approval is written again, and who owns the workflow files.","the target has no equal of this one member's role on the Cloud Storage bucket: A STACKIT credentials group is not a grant on the Cloud Storage bucket. It is the principal that a bucket policy names, a set of S3 keys with no Google identity behind it, and by itself it gives no access to the bucket and takes none away. The statement that grants it something is a statement of the bucket policy, in the policy language of STACKIT (a credentials group or * as the principal, S3 actions, five condition keys), which no Terraform resource sets. The Google role is not mapped to S3 actions by any table, the condition of the grant has no counterpart unless it can be written with those five condition keys, and a Google group, a domain, a federated identity and allUsers or allAuthenticatedUsers are named again as credentials groups or as *. To decide: Which credentials group stands for each member of the grant, which S3 actions of the bucket policy give the same people the access they need and no more than the Google role gave, what becomes of the condition, of public members (allUsers, allAuthenticatedUsers), of Google groups, domains and federated identities, and whether the grant ends with the Cloud Storage bucket when it has no replacement. Which bucket the grant is on, because the scan does not hold it. The draft of google_storage_bucket.media stands as it is: this answer decides the module and nothing of that draft.","the target has no equal of this static web hosting site: Static files are published into an Object Storage bucket by a pipeline, and a CDN distribution (a beta resource) with the bucket as origin serves them on a custom domain; the redirects of the site become redirect rules of the distribution. Custom response headers, rewrites to Cloud Run services or Cloud Functions, preview channels and the release history have no counterpart and are restated in the pipeline or in the application. To decide: Which bucket is the origin, which domain the distribution serves, and how rewrites and previews are replaced. The CDN resources are beta.","the target has no equal of this the members of one role on the Secret Manager secret: A STACKIT role assignment is not a grant on the Secret Manager secret. It gives one user, group or service account one STACKIT role on a whole project, folder or organisation. The role is a set of STACKIT permissions, not the Google role, and no table maps one to the other. It has no condition and no public member, so what the grant gave to a Google group, a domain, a federated identity or everyone is named again, and the access reaches more than the Secret Manager secret. A binding on a secret group applies to every secret in the group, so it is wider than a grant on one secret unless the secret has a group of its own, and its roles are Secrets Manager roles. The binding was authoritative for its role: STACKIT role assignments are additive, so a person who holds the role through another assignment keeps it, and removing such people is a step of a person. To decide: Which STACKIT role, on which project, folder or organisation, gives the same people the access they need on the Secret Manager secret, knowing it covers everything in that scope; which STACKIT users, groups or service accounts take the place of Google groups, domains, federated identities and a public member; and whether the grant ends with the Secret Manager secret when it has no replacement. For secrets: which secret group holds the secret, who else shares that group, and which Secrets Manager role and subject take the grant. Whether people who hold the role through another assignment keep it. The draft of google_secret_manager_secret.django_admin_password stands as it is: this answer decides the module and nothing of that draft.","the target has no equal of this the members of one role on the Secret Manager secret: A STACKIT role assignment is not a grant on the Secret Manager secret. It gives one user, group or service account one STACKIT role on a whole project, folder or organisation. The role is a set of STACKIT permissions, not the Google role, and no table maps one to the other. It has no condition and no public member, so what the grant gave to a Google group, a domain, a federated identity or everyone is named again, and the access reaches more than the Secret Manager secret. A binding on a secret group applies to every secret in the group, so it is wider than a grant on one secret unless the secret has a group of its own, and its roles are Secrets Manager roles. The binding was authoritative for its role: STACKIT role assignments are additive, so a person who holds the role through another assignment keeps it, and removing such people is a step of a person. To decide: Which STACKIT role, on which project, folder or organisation, gives the same people the access they need on the Secret Manager secret, knowing it covers everything in that scope; which STACKIT users, groups or service accounts take the place of Google groups, domains, federated identities and a public member; and whether the grant ends with the Secret Manager secret when it has no replacement. For secrets: which secret group holds the secret, who else shares that group, and which Secrets Manager role and subject take the grant. Whether people who hold the role through another assignment keep it. The draft of google_secret_manager_secret.django_settings stands as it is: this answer decides the module and nothing of that draft.","that the stated difference from the source is acceptable for what depends on it","the values the module asks for, which the draft does not invent"]},"unblocks":{"holds":4,"alone":4,"shared":0,"best_option":"use-the-proposed-module","options":[{"option":"use-the-proposed-module","effects":["ACK_CURRENT_ARTIFACT"],"alone":4,"shared":0},{"option":"design-it-another-way","effects":["MANUAL_ALTERNATIVE"],"alone":4,"shared":0}]}},{"id":"DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING","kind":"SOURCE_PROJECT_MAPPING","family":"convert","source":"PLAN_DECISION","group":"GRP-PLAN-DECISION-convert","block":"SOURCE_PROJECT_MAPPING","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"sources":["PLAN_DECISION","CRITICAL_SEMANTIC"],"blocking_effects":["TARGET_DESIGN_OPEN","CRITICAL_SEMANTIC_OPEN"],"conditional_members":3,"options":[{"id":"units-go-to-the-project-variable","title":"The units of the source project go to the project the variable project_id names","effect":"A person states that the units of this source project go to the STACKIT project var.project_id names. The source project is carried nowhere: the answer records the person's mapping, changes nothing in the draft, which keeps its own project resolver, and closes the settings of that project.","execution_effect":"ACK_CURRENT_ARTIFACT","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network.md","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-11-06","quote":"`project_id` (String) STACKIT project ID to which the network is associated."}]},{"id":"units-go-to-the-project-of-their-network","title":"The units of the source project go to the project of their network","effect":"A person states that the units of this source project go to the STACKIT project of the network they stand in. The network design maps a source network to a target project, and no map from a source project to a target project exists: the answer records the person's mapping, changes nothing in the draft, which keeps its own project resolver, and closes the settings of that project.","execution_effect":"ACK_CURRENT_ARTIFACT","evidence":[{"url":"https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network.md","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-11-06","quote":"`project_id` (String) STACKIT project ID to which the network is associated."}]}],"recommended_option":null,"blocking_effect":"TARGET_DESIGN_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"DEPENDS_ON_UNIT","members":3},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"Where the units of each source project go is one statement a person makes for the estate: the source project is carried nowhere, the draft keeps its own project resolver, and the answer changes nothing in the draft. There is no default. It holds 4 open critical settings of the estate: an answer in the inputs file closes those of its place, and a review of this record records the confirmation and closes none of them.","required_evidence":["The source places its units in the project example-project, and in a project the scan cannot read for some units, and the source project is carried nowhere. A person maps the source projects by answering target.project.source_project for each: var.project_id, or the project of the unit's network (network-project). The answer records that mapping and changes nothing in the draft, which keeps its own project resolver.","which source projects stay one STACKIT project and which do not, and who owns each"],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:bfe72ff4b84be59f91d62c726bb588d393af2d2beebf6f921538125bffe5ffd9","artifact_sha256":"sha256:5f13672461ff52c8812ef8689225bfb97acab9d2c4a3a7e6671a24c17ea663c2","kb_dependencies_sha256":"sha256:499099d550b6e4222fa317976fd0988578b8321f689feaf564abc70903c02d1d"},"member_count":5,"affected_unit_count":4,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING","source_family":"convert","source_semantic":"SOURCE_PROJECT_MAPPING","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":4,"resolution_paths":[{"id":"units-go-to-the-project-variable","title":"The units of the source project go to the project the variable project_id names","prerequisites":[],"effects":["A person states that the units of this source project go to the STACKIT project var.project_id names. The source project is carried nowhere: the answer records the person's mapping, changes nothing in the draft, which keeps its own project resolver, and closes the settings of that project."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network.md"],"regeneration_required":false},{"id":"units-go-to-the-project-of-their-network","title":"The units of the source project go to the project of their network","prerequisites":[],"effects":["A person states that the units of this source project go to the STACKIT project of the network they stand in. The network design maps a source network to a target project, and no map from a source project to a target project exists: the answer records the person's mapping, changes nothing in the draft, which keeps its own project resolver, and closes the settings of that project."],"risk":[],"evidence":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network.md"],"regeneration_required":false}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":["https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network.md"],"state_reason":"a person's decision or input is still open","source_observation":"The source states the setting on google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder and google_sql_database_instance.postgres. The plan leaves this decision open on google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder and google_sql_database_instance.postgres.","generated_target_behavior":"The draft does not carry the setting on google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder and google_sql_database_instance.postgres. The draft holds MAN/estate/SOURCE_PROJECT_MAPPING until this decision is answered by an answer that frees it.","residual_difference":"the target design is open until the decision is answered","execution_effect":"1 step of the plan waits for it until it is answered: MAN/estate/SOURCE_PROJECT_MAPPING. Held by something else first: MAN/unit/google_cloudbuild_trigger.activategcb, MAN/unit/google_cloudbuild_trigger.init and MAN/unit/google_cloudbuild_trigger.placeholder.","next_action":"State where the units of each source project of the estate go for google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder and google_sql_database_instance.postgres: choose one of the 2 options, in the inputs file given with --inputs (the stubs are in inputs-template.yaml), once for each source project: that closes the settings of the project and does not change the draft.","why_open":["The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Project and Cloud Build location are data-residency/project-boundary facts with no STACKIT CI/CD resource to remap them onto -- REVIEW.","The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The project of the instance (google 8.4.0 `project`: \"The ID of the project in which the resource belongs. If it is not provided, the provider project is used\"). A STACKIT project is the scope for ownership, resource consumption and access control (docs.stackit.cloud/platform/resource-manager/basics/projects/): whether the database's source project becomes the project of the rest of the estate is a design decision no rule evidences — a person confirms it — REVIEW (critical)."],"closes_when":["A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting.","A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","the module terraform/proposals/proposal_activategcb is switched on with its values and checked, or the design that replaces it is set up and checked; the decision records which","the module terraform/proposals/proposal_init is switched on with its values and checked, or the design that replaces it is set up and checked; the decision records which","the module terraform/proposals/proposal_placeholder is switched on with its values and checked, or the design that replaces it is set up and checked; the decision records which"],"required_inputs":["The source places its units in the project example-project, and in a project the scan cannot read for some units, and the source project is carried nowhere. A person maps the source projects by answering target.project.source_project for each: var.project_id, or the project of the unit's network (network-project). The answer records that mapping and changes nothing in the draft, which keeps its own project resolver.","which source projects stay one STACKIT project and which do not, and who owns each","what the customer decides: Which pipelines are still needed, where they run (STACKIT Git Pipelines or the customer's own CI/CD), how each trigger, step, secret and approval is written again, and who owns the workflow files. the review the assessment asks for: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents; Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied; Write the trigger conditions again as the on: section of the workflow and verify each event kind against the Forgejo Actions reference; Decide where images and artifacts go: the package registry of STACKIT Git takes container images from any OCI client, or keep your own registry, and change the image names in the deploy steps.; whether google_cloudbuild_trigger.activategcb exists in production, and with how many instances: the value production gives var.init","what the customer decides: Which pipelines are still needed, where they run (STACKIT Git Pipelines or the customer's own CI/CD), how each trigger, step, secret and approval is written again, and who owns the workflow files. the review the assessment asks for: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents; Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied; Write the trigger conditions again as the on: section of the workflow and verify each event kind against the Forgejo Actions reference; Decide where images and artifacts go: the package registry of STACKIT Git takes container images from any OCI client, or keep your own registry, and change the image names in the deploy steps.; whether google_cloudbuild_trigger.init exists in production, and with how many instances: the value production gives var.init","what the customer decides: Which pipelines are still needed, where they run (STACKIT Git Pipelines or the customer's own CI/CD), how each trigger, step, secret and approval is written again, and who owns the workflow files. the review the assessment asks for: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents; Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied; Write the trigger conditions again as the on: section of the workflow and verify each event kind against the Forgejo Actions reference; Decide where images and artifacts go: the package registry of STACKIT Git takes container images from any OCI client, or keep your own registry, and change the image names in the deploy steps.; whether google_cloudbuild_trigger.placeholder exists in production, and with how many instances: the value production gives var.init"]},"unblocks":{"holds":1,"alone":1,"shared":0,"best_option":"units-go-to-the-project-variable","options":[{"option":"units-go-to-the-project-variable","effects":["ACK_CURRENT_ARTIFACT"],"alone":1,"shared":0},{"option":"units-go-to-the-project-of-their-network","effects":["ACK_CURRENT_ARTIFACT"],"alone":1,"shared":0},{"option":"","effects":["ACK_CURRENT_ARTIFACT"],"alone":1,"shared":0}]}},{"id":"DEC-GEN-CONVERT-SOURCE-REGION-MAPPING","kind":"SOURCE_REGION_MAPPING","family":"convert","source":"PLAN_DECISION","group":"GRP-PLAN-DECISION-convert","block":"SOURCE_REGION_MAPPING","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"sources":["PLAN_DECISION","CRITICAL_SEMANTIC"],"blocking_effects":["TARGET_DESIGN_OPEN","CRITICAL_SEMANTIC_OPEN"],"options":[{"id":"map-source-locations-to-the-draft-region","title":"Map every source location of the estate to the one STACKIT region the draft builds in","effect":"The draft builds every unit in the one region of the estate, and that is what it does with no answer. STACKIT hosts its regions in Germany and Austria, each physically separate from the others, so the region is not shown to hold the residency a source location gave: the option states where the draft builds and claims no equal residency. A review of this option records the confirmation and closes no setting; an answer of target.region.source_location for each location closes the settings of that location.","execution_effect":"ACK_CURRENT_ARTIFACT","evidence":[{"url":"https://docs.stackit.cloud/platform/regions/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-11-05","quote":"STACKIT hosts all regions exclusively in Germany (eu01) and Austria (eu02)."},{"url":"https://docs.stackit.cloud/platform/regions/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-11-05","quote":"Each region remains physically separate from others."}],"default":true},{"id":"choose-the-region-of-each-location","title":"Choose the STACKIT region of each source location","effect":"An answer of target.region.source_location names the region of one source location, and the units whose location the scan cannot read are one more subject of the same topic. An answer that names the region the draft builds in closes the settings of that location. The draft builds in one region, so an answer that names another region is recorded, and read by the network design, and closes nothing until the estate is built there (target.region). Whether a region holds the residency of a source location stays the person's statement.","execution_effect":"REGENERATE_REQUIRED","evidence":[{"url":"https://docs.stackit.cloud/platform/regions/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-11-05","quote":"STACKIT hosts all regions exclusively in Germany (eu01) and Austria (eu02)."},{"url":"https://docs.stackit.cloud/platform/regions/","class":"OFFICIAL_DOCUMENTED","checked_at":"2026-11-05","quote":"While STACKIT maintains parity across all locations, we may release specialized services or newer features in specific regions first."}]}],"recommended_option":null,"defaults":[{"member":"convert:estate:source_location:SOURCE_REGION_MAPPING","option":"map-source-locations-to-the-draft-region","words":"the draft builds every unit in the STACKIT region eu01, which is what it does with no answer. That is a region the catalogue of this build lists and no claim that it holds the residency of the source: only an answer of target.region.source_location closes the settings this decision holds.","answered_by":"DEFAULT"}],"blocking_effect":"TARGET_DESIGN_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":3},{"cause":"NOT_CLASSIFIED","members":2}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"Each source location the estate uses maps to one STACKIT region, once for the estate: the draft builds in one region and states it as a default to confirm, no mapping between the source's regions and STACKIT's is evidenced, and a default closes nothing. A location answered with another region places its buckets, databases and caches there; what needs a network stays in the region of the draft. It holds 4 open critical settings of the estate: an answer in the inputs file closes those of its place, and a review of this record records the confirmation and closes none of them.","required_evidence":["The source places its units in a location the scan cannot read (the value comes from an input a plan can change, or the source does not state it). No mapping between Google and STACKIT regions is evidenced, so the region the draft builds in is not shown to hold the residency of a source location: a person states it once for the estate, by answering target.region.source_location for each location.","the residency requirement behind each source location (a law, a contract, a policy) and the STACKIT region that meets it"],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:1be5810bd6bed11fb1fc02fe831c232fd9d2b9eaa1ed6c2f21eb8923722e1372","artifact_sha256":"sha256:1b7845371e8d741cb3eef090a161d6679f6d28d298bea24c1f5186e5204d1f24","kb_dependencies_sha256":"sha256:9f089fa98bc5213252824480f45d48fce25196a42c1a14b903267ac4cf2bf279"},"member_count":5,"affected_unit_count":4,"evidence_ref_count":2,"resolution":{"decision_id":"DEC-GEN-CONVERT-SOURCE-REGION-MAPPING","source_family":"convert","source_semantic":"SOURCE_REGION_MAPPING","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[{"id":"map-source-locations-to-the-draft-region","title":"Map every source location of the estate to the one STACKIT region the draft builds in","prerequisites":[],"effects":["The draft builds every unit in the one region of the estate, and that is what it does with no answer. STACKIT hosts its regions in Germany and Austria, each physically separate from the others, so the region is not shown to hold the residency a source location gave: the option states where the draft builds and claims no equal residency. A review of this option records the confirmation and closes no setting; an answer of target.region.source_location for each location closes the settings of that location."],"risk":[],"evidence":["https://docs.stackit.cloud/platform/regions/","https://docs.stackit.cloud/platform/regions/"],"regeneration_required":false},{"id":"choose-the-region-of-each-location","title":"Choose the STACKIT region of each source location","prerequisites":[],"effects":["An answer of target.region.source_location names the region of one source location, and the units whose location the scan cannot read are one more subject of the same topic. An answer that names the region the draft builds in closes the settings of that location. The draft builds in one region, so an answer that names another region is recorded, and read by the network design, and closes nothing until the estate is built there (target.region). Whether a region holds the residency of a source location stays the person's statement."],"risk":[],"evidence":["https://docs.stackit.cloud/platform/regions/","https://docs.stackit.cloud/platform/regions/"],"regeneration_required":true}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":["https://docs.stackit.cloud/platform/regions/"],"state_reason":"a person's decision or input is still open","source_observation":"The source states the setting on google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server, google_sql_database_instance.postgres and google_storage_bucket.media. The plan leaves this decision open on google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server, google_sql_database_instance.postgres and google_storage_bucket.media.","generated_target_behavior":"The draft does not carry the setting on google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server, google_sql_database_instance.postgres and google_storage_bucket.media. The draft holds MAN/estate/SOURCE_REGION_MAPPING until this decision is answered by an answer that frees it.","residual_difference":"the target design stands on a default that nobody answered: StackToIT chose it, and a person confirms it or changes it in the decisions file","execution_effect":"1 step of the plan waits for it until it is answered: MAN/estate/SOURCE_REGION_MAPPING.","next_action":"Map each source location of the estate to a STACKIT region for google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server, google_sql_database_instance.postgres and google_storage_bucket.media: choose one of the 2 options, in the inputs file given with --inputs (the stubs are in inputs-template.yaml), once for each source location: that closes the settings of the location.","why_open":["The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The region the service, job or worker pool runs in (google 8.4.0 `location`). A person confirms the region — REVIEW (critical, the value is not verified against the target).","The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The region of the instance (google 8.4.0 `region`; unset means the provider's region). A person confirms the region — REVIEW (critical, the value is not verified against the target).","The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A single-region location (us-central1, europe-west3, ...), or one not visible statically: the draft sets no region on stackit_objectstorage_bucket (`region`: \"if not defined, the provider region is used\", pinned provider), so the bucket lands in the STACKIT region the user sets, not in the source's — a person confirms the residency — REVIEW."],"closes_when":["A person confirms the STACKIT region of the SKE cluster the workload runs on holds the residency the source region gave, since no mapping between Google and STACKIT regions is evidenced.","A person confirms the STACKIT region of the instance (and of a read replica, decided with its primary) holds the residency the source region gave.","A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":["The source places its units in a location the scan cannot read (the value comes from an input a plan can change, or the source does not state it). No mapping between Google and STACKIT regions is evidenced, so the region the draft builds in is not shown to hold the residency of a source location: a person states it once for the estate, by answering target.region.source_location for each location.","the residency requirement behind each source location (a law, a contract, a policy) and the STACKIT region that meets it"]},"unblocks":{"holds":1,"alone":1,"shared":0,"best_option":"map-source-locations-to-the-draft-region","options":[{"option":"map-source-locations-to-the-draft-region","effects":["ACK_CURRENT_ARTIFACT"],"alone":1,"shared":0},{"option":"choose-the-region-of-each-location","effects":["REGENERATE_REQUIRED"],"alone":0,"shared":0}]}},{"id":"DEC-IAM-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE","kind":"unit-review","family":"gcp.cloud_run","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.cloud_run","block":"google_cloud_run_v2_job.migrate","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of google_cloud_run_v2_job.migrate: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:6d8e764691c2b3f560403316def3586a0b4f7662f6b183ca8a876e22b4f6ad93","kb_dependencies_sha256":"sha256:de5130d930b3443183d5b28e0b451069a044b7f2102cdc526edd3df9e6e63492"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-IAM-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE","source_family":"gcp.cloud_run","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"LEDGER","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on google_cloud_run_v2_job.migrate that the knowledge base cannot decide: Review the service identity setting.","generated_target_behavior":"Review the service identity setting: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/service-identity).","residual_difference":"Review the service identity setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_cloud_run_v2_job.migrate/service-identity now.","next_action":"Review the service identity setting: This setting follows the decision on the unit; it is not decided on its own.","why_open":["Review the service identity setting: Whether the draft carries this setting is decided by its semantic ledger entry \"workload identity\", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). The Google service account the workload runs as. target.workload.identity asks the customer which model the pods use."],"closes_when":["Review the service identity setting: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference."],"required_inputs":[]}},{"id":"DEC-NET-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE","kind":"unit-review","family":"gcp.cloud_run","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.cloud_run","block":"google_cloud_run_v2_job.migrate","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of google_cloud_run_v2_job.migrate: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:5f61f359aed7bddb0e87466e258be5e63147063c19a9cd13dbb420ae4128c575","kb_dependencies_sha256":"sha256:7619947cac69513468f065e085ea96fa41d749d90aa2164661afc29a1d27bf20"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-NET-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE","source_family":"gcp.cloud_run","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[{"id":"cloud-run-v2-job-network-exposure/derived-carry-on-the-target-ae560c1053b1","title":"Review the cloud run v2 job network exposure setting: Carry the setting on Kubernetes Job/CronJob on SKE","prerequisites":[],"effects":["You design how Kubernetes Job/CronJob on SKE carries this setting and build it outside the draft. The draft does not change and no step is freed by it."],"risk":[],"evidence":[],"regeneration_required":false},{"id":"cloud-run-v2-job-network-exposure/derived-accept-the-difference-ae560c1053b1","title":"Review the cloud run v2 job network exposure setting: Accept the difference","prerequisites":[],"effects":["The target does not carry this setting as the source states it, and you record that as accepted. The draft does not change and no step is freed by it."],"risk":[],"evidence":[],"regeneration_required":false}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on google_cloud_run_v2_job.migrate that the knowledge base cannot decide: Review the cloud run v2 job network exposure setting.","generated_target_behavior":"Review the cloud run v2 job network exposure setting: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/cloud-run-v2-job-network-exposure).","residual_difference":"Review the cloud run v2 job network exposure setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_cloud_run_v2_job.migrate/cloud-run-v2-job-network-exposure now.","next_action":"Review the cloud run v2 job network exposure setting: Review the cloud run v2 job network exposure setting for google_cloud_run_v2_job.migrate: Decide how Kubernetes Job/CronJob on SKE carries this setting, or accept the difference. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the cloud run v2 job network exposure setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. template.template.vpc_access.egress, template.template.vpc_access.network_interfaces.network, template.template.vpc_access.network_interfaces.subnetwork, template.template.volumes.cloud_sql_instance.instances (network exposure) — what the resource is reachable from and what it can reach. The draft names these settings NOT CARRIED: which database the job mounts and which network its egress goes through are re-created on the target (a database connection, the network of the workload) by a person. A person decides: REVIEW."],"closes_when":["Review the cloud run v2 job network exposure setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":[]}},{"id":"DEC-OPS-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE","kind":"unit-review","family":"gcp.cloud_run","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.cloud_run","block":"google_cloud_run_v2_job.migrate","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"confirm_only_members":1,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"IMPLEMENTATION_GAP","members":3},{"cause":"NOT_CLASSIFIED","members":3}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":7,"why":"The knowledge base cannot decide 7 critical settings of google_cloud_run_v2_job.migrate: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is carried by the draft already: a person only confirms it. The review step of the execution plan for these settings is MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect.","required_evidence":["where the image is built or pulled from"],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:685b77a28b897320d29a0b28c3f0b7ecff0c3c23f08ebf48e4fb10892434a8c7","kb_dependencies_sha256":"sha256:23f816d8acde4a1b38467d66e94c81af79e843f510e81614686937b327b047f7"},"member_count":7,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-OPS-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE","source_family":"gcp.cloud_run","source_semantic":"unit-review","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"serverless-integration","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":2,"resolution_paths":[{"id":"deployment-artifact/workload-on-ske","title":"Choose the container image or artifact: Run the container as a workload on SKE","prerequisites":["the container image and its settings","a SKE cluster"],"effects":["A service or a function that already runs as a container image moves as a Deployment on a SKE cluster, which is a managed Kubernetes service. Scale to zero and the billing per request go away unless an autoscaler that scales to zero is operated on the cluster.","regeneration: not stated — treated as required"],"risk":["Capacity runs, and is billed, whether or not requests arrive."],"evidence":["provider-docs mirror stackit/docs.stackit.cloud/products/runtime/kubernetes-engine.html: \"STACKIT Kubernetes Engine (SKE) is a robust, scalable, and managed Kubernetes service.\""],"regeneration_required":true},{"id":"deployment-artifact/app-on-cloud-foundry","title":"Choose the container image or artifact: Push the application to STACKIT Cloud Foundry","prerequisites":["the application in a form Cloud Foundry runs","a Cloud Foundry organization"],"effects":["STACKIT Cloud Foundry is a managed platform for applications that a developer deploys and scales; the application is pushed from its image or its code. Scale to zero and the billing per request go away.","regeneration: not stated — treated as required"],"risk":["The platform differs from the source platform in how it scales and how it is billed."],"evidence":["provider-docs mirror stackit/docs.stackit.cloud/products/runtime/cloud-foundry.html: \"STACKIT Cloud Foundry is a fully managed platform as a service (PaaS) that enables developers to build, deploy, and scale applications effortlessly.\""],"regeneration_required":true},{"id":"entry-point/derived-carry-on-the-target-ae560c1053b1","title":"Confirm the entry point of the function: Carry the setting on Kubernetes Job/CronJob on SKE","prerequisites":[],"effects":["You design how Kubernetes Job/CronJob on SKE carries this setting and build it outside the draft. The draft does not change and no step is freed by it."],"risk":[],"evidence":[],"regeneration_required":false},{"id":"entry-point/derived-accept-the-difference-ae560c1053b1","title":"Confirm the entry point of the function: Accept the difference","prerequisites":[],"effects":["The target does not carry this setting as the source states it, and you record that as accepted. The draft does not change and no step is freed by it."],"risk":[],"evidence":[],"regeneration_required":false}],"required_verification":["Choose the container image or artifact: the image is pulled or built for the target platform and runs there"],"next_run_changes":["A rerun does not build or pull the image; an answer in the decisions file records the choice and writes nothing."],"remains_manual":["Choose the container image or artifact: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note gcp.cloud_run/deployment-artifact: \"A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there.\""],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Choose the container image or artifact; the 7 settings of the record state their own.","source_observation":"The source states 7 critical settings on google_cloud_run_v2_job.migrate that the knowledge base cannot decide: Choose the container image or artifact; Confirm the entry point of the function; Review the k4 cloud run volume mount cloud run v2 job setting; Confirm the name of the cloud run v2 job; Confirm the name of the env entry of the containers of the template of the template of the cloud run v2 job; Confirm the name of the volumes entry of the template of the template of the cloud run v2 job; Review the terraform destroy guard setting.","generated_target_behavior":"Choose the container image or artifact: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect). The draft does not carry the image reference; the setting is left to a person. Confirm the entry point of the function: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect). Review the k4 cloud run volume mount cloud run v2 job setting: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect). Confirm the name of the cloud run v2 job: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect). Confirm the name of the env entry of the containers of the template of the template of the cloud run v2 job: The draft carries it on google_cloud_run_v2_job.migrate: step MAN/draft/kubernetes/migrate/manifests-yaml (the 1 environment keys of the source (DJANGO_ENV) are the env entries of `terraform/kubernetes/migrate/manifests.yaml`: the keys are carried, and the values stay the person's). Confirm the name of the volumes entry of the template of the template of the cloud run v2 job: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect). Review the terraform destroy guard setting: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect).","residual_difference":"Choose the container image or artifact: That the same build runs on the target platform. Confirm the entry point of the function: the target behaviour of this setting is not established Review the k4 cloud run volume mount cloud run v2 job setting: the target behaviour of this setting is not established Confirm the name of the cloud run v2 job: the target behaviour of this setting is not established Confirm the name of the env entry of the containers of the template of the template of the cloud run v2 job: a person confirms that the carried value is what the source relies on Confirm the name of the volumes entry of the template of the template of the cloud run v2 job: the target behaviour of this setting is not established Review the terraform destroy guard setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect now.","next_action":"Choose the container image or artifact: Choose the container image or artifact for google_cloud_run_v2_job.migrate: A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Choose the container image or artifact: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_service.template.spec.containers.image; google_cloud_run_v2_service.template.containers.image, build_config.base_image, build_config.image_uri and 5 more; google_cloud_run_v2_job.template.template.containers.image; google_cloud_run_v2_worker_pool.template.containers.image, artifact or image reference (workload compatibility: a setting that binds the code to its runtime stays CRITICAL).","Confirm the entry point of the function: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_service.template.spec.containers.command, template.spec.containers.args, template.spec.containers.working_dir; google_cloud_run_v2_service.template.containers.command, template.containers.args, template.containers.working_dir and 4 more.","Review the k4 cloud run volume mount cloud run v2 job setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Where a volume appears in the container, which part of it is mounted there and the gcsfuse flags of a bucket mount (volume_mounts, mount_path and sub_path; volumes, gcs, mount_options). The application opens the bucket or share as a local directory, and the STACKIT draft mounts no volume into a container.","Confirm the name of the cloud run v2 job: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_v2_job.name: The job's own name, used for identification.","Confirm the name of the env entry of the containers of the template of the template of the cloud run v2 job: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_v2_job.template.template.containers.env.name: The name of an environment variable; an identifier, not the value it carries.","Confirm the name of the volumes entry of the template of the template of the cloud run v2 job: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_v2_job.template.template.volumes.name: The volume's own name, used only to cross-reference it from volume_mounts.name; an internal wiring identifier with no security meaning of its own.","Review the terraform destroy guard setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. deletion_protection of a Cloud Run service, job or worker pool (on unless the source switches it off, which an explicit false states) only stops Terraform from destroying the resource; it is not an API protection."],"closes_when":["Choose the container image or artifact: A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there.","Confirm the entry point of the function: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Review the k4 cloud run volume mount cloud run v2 job setting: A person provides the data in the target workload at the path the application expects, with an owner and mode it can use, and checks that it finds its files.","Confirm the name of the cloud run v2 job: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Confirm the name of the env entry of the containers of the template of the template of the cloud run v2 job: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Confirm the name of the volumes entry of the template of the template of the cloud run v2 job: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.","Review the terraform destroy guard setting: A person decides whether the replacement keeps the guard with lifecycle { prevent_destroy = true } in the Terraform code."],"required_inputs":["where the image is built or pulled from"]}},{"id":"DEC-SEC-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE","kind":"unit-review","family":"gcp.cloud_run","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.cloud_run","block":"google_cloud_run_v2_job.migrate","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of google_cloud_run_v2_job.migrate: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:eb72d924ef3dca3df509ae9675b4cd2374b14119b591b9ae674c3cc242c6ba62","kb_dependencies_sha256":"sha256:05323ded731a64941b628473bd15b5e2f03fe0f884b06d9feceb4f924f902e4c"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-SEC-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE","source_family":"gcp.cloud_run","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on google_cloud_run_v2_job.migrate that the knowledge base cannot decide: Create the Kubernetes Secrets for the Secret Manager references.","generated_target_behavior":"Create the Kubernetes Secrets for the Secret Manager references: The draft does not carry the setting on google_cloud_run_v2_job.migrate; a manual step stands for it (MAN/semantic/google_cloud_run_v2_job.migrate/secrets).","residual_difference":"Create the Kubernetes Secrets for the Secret Manager references: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_cloud_run_v2_job.migrate/secrets now.","next_action":"Create the Kubernetes Secrets for the Secret Manager references: Create the Kubernetes Secrets for the Secret Manager references for google_cloud_run_v2_job.migrate: A person creates the Kubernetes Secrets the manifest lists, filled from STACKIT Secrets Manager (for example with an External Secrets Operator). Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Create the Kubernetes Secrets for the Secret Manager references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A Secret Manager reference in the environment becomes a secretKeyRef of the Deployment or Job and a secret volume a Kubernetes secret volume, and the head of the manifest lists the Secrets to create. The draft writes no Secret, because no value of a secret reaches an output."],"closes_when":["Create the Kubernetes Secrets for the Secret Manager references: A person creates the Kubernetes Secrets the manifest lists, filled from STACKIT Secrets Manager (for example with an External Secrets Operator)."],"required_inputs":[]}},{"id":"DEC-GEN-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","kind":"unit-review","family":"gcp.cloud_run","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.cloud_run","block":"google_cloud_run_v2_service.server","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"NOT_STATED","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of google_cloud_run_v2_service.server: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:15f679b726862e403a8aaf12cc8a1b31c16dcc0b586ea26fffb4621d0bd2fcc2","kb_dependencies_sha256":"sha256:a283a1e6a981f35147d6eb1ac11a22014607c92e729f0c07719a27e656f74bb8"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-GEN-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","source_family":"gcp.cloud_run","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"NOT_STATED","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on google_cloud_run_v2_service.server that the knowledge base cannot decide: Review the IAM policy grant setting.","generated_target_behavior":"Review the IAM policy grant setting: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect).","residual_difference":"Review the IAM policy grant setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect now.","next_action":"Review the IAM policy grant setting: Review the IAM policy grant setting for google_cloud_run_v2_service.server: A person decides what this finding asks, and records the evidence or the decision. The finding says: A full IAM policy (member/role bindings) is set directly on the service via policy_data; STACKIT has no per-service IAM policy resource, so who may invoke the migrated SKE workload is decided by a person — the draft carries no invocation check. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the IAM policy grant setting: A check of the knowledge base (run iam policy) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). A full IAM policy (member/role bindings) is set directly on the service via policy_data (google 8.4.0); STACKIT has no per-service IAM policy resource, so who may invoke the migrated SKE workload is decided by a person — REVIEW."],"closes_when":["Review the IAM policy grant setting: A person decides what this finding asks, and records the evidence or the decision. The finding says: A full IAM policy (member/role bindings) is set directly on the service via policy_data; STACKIT has no per-service IAM policy resource, so who may invoke the migrated SKE workload is decided by a person — the draft carries no invocation check."],"required_inputs":[]}},{"id":"DEC-IAM-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","kind":"unit-review","family":"gcp.cloud_run","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.cloud_run","block":"google_cloud_run_v2_service.server","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":1},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":2,"why":"The knowledge base cannot decide 2 critical settings of google_cloud_run_v2_service.server: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/google_cloud_run_v2_service.server/open-settings-identity-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:49a9627d2f1d15f305b977c86b73db0162a769ecd453b5b1fca71650bba2a2e8","kb_dependencies_sha256":"sha256:769e45c36ad1371d92358ae5dfa9a3e7cdc8cd60355fbc338219885964f449c1"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-IAM-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","source_family":"gcp.cloud_run","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW, LEDGER","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Decide who may invoke the service; the 2 settings of the record state their own.","source_observation":"The source states 2 critical settings on google_cloud_run_v2_service.server that the knowledge base cannot decide: Decide who may invoke the service; Review the service identity setting.","generated_target_behavior":"Decide who may invoke the service: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-identity-architect). Review the service identity setting: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-identity-architect).","residual_difference":"Decide who may invoke the service: the target behaviour of this setting is not established Review the service identity setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_cloud_run_v2_service.server/open-settings-identity-architect now.","next_action":"Decide who may invoke the service: Decide who may invoke the service for google_cloud_run_v2_service.server: A person decides how callers of the workload are authenticated (in the application, behind an authenticating proxy, or by no exposure at all) and how the SKE exposure is set, since the draft carries no invocation check. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Decide who may invoke the service: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Cloud Run lets only callers with the invoker role through unless the service is made public. The draft carries no invocation check; the SKE exposure and the authentication of callers (application, authenticating proxy, or no exposure at all) are decided by a person.","Review the service identity setting: Whether the draft carries this setting is decided by its semantic ledger entry \"workload identity\", and that entry does not state it as carried (it reads review or unsupported, is missing, or rests on a variable's default). The Google service account the workload runs as. target.workload.identity asks the customer which model the pods use."],"closes_when":["Decide who may invoke the service: A person decides how callers of the workload are authenticated (in the application, behind an authenticating proxy, or by no exposure at all) and how the SKE exposure is set, since the draft carries no invocation check.","Review the service identity setting: The ledger entry reads preserved or transformed with a value that is a fact of the source, or a person accepts the difference."],"required_inputs":[]}},{"id":"DEC-NET-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","kind":"unit-review","family":"gcp.cloud_run","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.cloud_run","block":"google_cloud_run_v2_service.server","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of google_cloud_run_v2_service.server: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:7ffdff9c041378f4eae6d4342c8775fd97bc2eb295a39ce01f24caa6e06208ea","kb_dependencies_sha256":"sha256:7cbc235f3121e16aeb96bb232707c733562215e218571c70a5a63316998d150b"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-NET-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","source_family":"gcp.cloud_run","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on google_cloud_run_v2_service.server that the knowledge base cannot decide: Decide how the service connects to the database.","generated_target_behavior":"Decide how the service connects to the database: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/cloud-sql-connection).","residual_difference":"Decide how the service connects to the database: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_cloud_run_v2_service.server/cloud-sql-connection now.","next_action":"Decide how the service connects to the database: Decide how the service connects to the database for google_cloud_run_v2_service.server: A person points the workload at the endpoint of the migrated database instance (a Flex or MariaDB instance) over TLS, because the Cloud SQL connector socket has no counterpart. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Decide how the service connects to the database: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The Cloud SQL connection volume (a connector socket) has no counterpart: the workload connects to the migrated Flex instance endpoint over TLS."],"closes_when":["Decide how the service connects to the database: A person points the workload at the endpoint of the migrated database instance (a Flex or MariaDB instance) over TLS, because the Cloud SQL connector socket has no counterpart."],"required_inputs":[]}},{"id":"DEC-OPS-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","kind":"unit-review","family":"gcp.cloud_run","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.cloud_run","block":"google_cloud_run_v2_service.server","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"IMPLEMENTATION_GAP","members":2},{"cause":"NOT_CLASSIFIED","members":2}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":5,"why":"The knowledge base cannot decide 5 critical settings of google_cloud_run_v2_service.server: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect.","required_evidence":["where the image is built or pulled from"],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:49a225e8454b013cae4c0796f19f24dec5d3c80788ef6189addeeb19bbb5467c","kb_dependencies_sha256":"sha256:08117121d8baf3feb598399602f00521c4c81fe308e9a86a19db79824e6c6be8"},"member_count":5,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-OPS-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","source_family":"gcp.cloud_run","source_semantic":"unit-review","affected_application":[],"action_type":"DESIGN_CHOICE","work_package":"serverless-integration","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"deployment-artifact/workload-on-ske","title":"Choose the container image or artifact: Run the container as a workload on SKE","prerequisites":["the container image and its settings","a SKE cluster"],"effects":["A service or a function that already runs as a container image moves as a Deployment on a SKE cluster, which is a managed Kubernetes service. Scale to zero and the billing per request go away unless an autoscaler that scales to zero is operated on the cluster.","regeneration: not stated — treated as required"],"risk":["Capacity runs, and is billed, whether or not requests arrive."],"evidence":["provider-docs mirror stackit/docs.stackit.cloud/products/runtime/kubernetes-engine.html: \"STACKIT Kubernetes Engine (SKE) is a robust, scalable, and managed Kubernetes service.\""],"regeneration_required":true},{"id":"deployment-artifact/app-on-cloud-foundry","title":"Choose the container image or artifact: Push the application to STACKIT Cloud Foundry","prerequisites":["the application in a form Cloud Foundry runs","a Cloud Foundry organization"],"effects":["STACKIT Cloud Foundry is a managed platform for applications that a developer deploys and scales; the application is pushed from its image or its code. Scale to zero and the billing per request go away.","regeneration: not stated — treated as required"],"risk":["The platform differs from the source platform in how it scales and how it is billed."],"evidence":["provider-docs mirror stackit/docs.stackit.cloud/products/runtime/cloud-foundry.html: \"STACKIT Cloud Foundry is a fully managed platform as a service (PaaS) that enables developers to build, deploy, and scale applications effortlessly.\""],"regeneration_required":true}],"required_verification":["Choose the container image or artifact: the image is pulled or built for the target platform and runs there"],"next_run_changes":["A rerun does not build or pull the image; an answer in the decisions file records the choice and writes nothing."],"remains_manual":["Choose the container image or artifact: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note gcp.cloud_run/deployment-artifact: \"A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there.\""],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Choose the container image or artifact; the 5 settings of the record state their own.","source_observation":"The source states 5 critical settings on google_cloud_run_v2_service.server that the knowledge base cannot decide: Choose the container image or artifact; Decide how the volume mounts are carried; Confirm the name of the Cloud Run service; Confirm the name of the volumes entry of the template of the Cloud Run service; Review the terraform destroy guard setting.","generated_target_behavior":"Choose the container image or artifact: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect). The draft does not carry the image reference; the setting is left to a person. Decide how the volume mounts are carried: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect). Confirm the name of the Cloud Run service: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect). Confirm the name of the volumes entry of the template of the Cloud Run service: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect). Review the terraform destroy guard setting: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect).","residual_difference":"Choose the container image or artifact: That the same build runs on the target platform. Decide how the volume mounts are carried: the target behaviour of this setting is not established Confirm the name of the Cloud Run service: the target behaviour of this setting is not established Confirm the name of the volumes entry of the template of the Cloud Run service: the target behaviour of this setting is not established Review the terraform destroy guard setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect now.","next_action":"Choose the container image or artifact: Choose the container image or artifact for google_cloud_run_v2_service.server: A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Choose the container image or artifact: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_service.template.spec.containers.image; google_cloud_run_v2_service.template.containers.image, build_config.base_image, build_config.image_uri and 5 more; google_cloud_run_v2_job.template.template.containers.image; google_cloud_run_v2_worker_pool.template.containers.image, artifact or image reference (workload compatibility: a setting that binds the code to its runtime stays CRITICAL).","Decide how the volume mounts are carried: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. Where a volume appears in the container, which part of it is mounted there and the gcsfuse flags of a bucket mount (volume_mounts, mount_path and sub_path; volumes, gcs, mount_options). The application opens the bucket or share as a local directory, and the STACKIT draft mounts no volume into a container.","Confirm the name of the Cloud Run service: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_v2_service.name: The Service's own name; an identifier used for addressing/reference, not an access-control or safety property in itself.","Confirm the name of the volumes entry of the template of the Cloud Run service: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloud_run_v2_service.template.volumes.name: The volume's own name, used only to cross-reference it from a volume_mounts.name entry; internal wiring identifier.","Review the terraform destroy guard setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. deletion_protection of a Cloud Run service, job or worker pool (on unless the source switches it off, which an explicit false states) only stops Terraform from destroying the resource; it is not an API protection."],"closes_when":["Choose the container image or artifact: A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there.","Decide how the volume mounts are carried: A person provides the data in the target workload at the path the application expects, with an owner and mode it can use, and checks that it finds its files.","Confirm the name of the Cloud Run service: A person confirms the workload name on the cluster against what addresses or refers to the Cloud Run service name, or accepts the new name.","Confirm the name of the volumes entry of the template of the Cloud Run service: A person keeps each volume name matched with the volume mount that refers to it when the volumes are rebuilt as workload volumes on the cluster.","Review the terraform destroy guard setting: A person decides whether the replacement keeps the guard with lifecycle { prevent_destroy = true } in the Terraform code."],"required_inputs":["where the image is built or pulled from"]}},{"id":"DEC-SEC-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","kind":"unit-review","family":"gcp.cloud_run","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.cloud_run","block":"google_cloud_run_v2_service.server","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"NOT_CLASSIFIED","members":2}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":2,"why":"The knowledge base cannot decide 2 critical settings of google_cloud_run_v2_service.server: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/google_cloud_run_v2_service.server/open-settings-security-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:a62c4ae04e476e59d71bcc934c792968379d2bec15964708b153e580e7b3c411","kb_dependencies_sha256":"sha256:9ba3a1bd3e61762c99157e16ecf5d4927ed883e672aa19e0399f56143c69420a"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-SEC-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","source_family":"gcp.cloud_run","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm the environment settings; the 2 settings of the record state their own.","source_observation":"The source states 2 critical settings on google_cloud_run_v2_service.server that the knowledge base cannot decide: Confirm the environment settings; Create the Kubernetes Secrets for the Secret Manager references.","generated_target_behavior":"Confirm the environment settings: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-security-architect). Create the Kubernetes Secrets for the Secret Manager references: The draft does not carry the setting on google_cloud_run_v2_service.server; a manual step stands for it (MAN/semantic/google_cloud_run_v2_service.server/open-settings-security-architect).","residual_difference":"Confirm the environment settings: the target behaviour of this setting is not established Create the Kubernetes Secrets for the Secret Manager references: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_cloud_run_v2_service.server/open-settings-security-architect now.","next_action":"Confirm the environment settings: Confirm the environment settings for google_cloud_run_v2_service.server: A person fills in the values the manifest lists as not copied, in the ConfigMap on the cluster. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Confirm the environment settings: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The draft writes the environment keys into the ConfigMap and the env of the Deployment or Job. A value is copied only when it is a quantity under a name that says so or a boolean, because any other value can hold a secret, so the rest of the values are a person's.","Create the Kubernetes Secrets for the Secret Manager references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. A Secret Manager reference in the environment becomes a secretKeyRef of the Deployment or Job and a secret volume a Kubernetes secret volume, and the head of the manifest lists the Secrets to create. The draft writes no Secret, because no value of a secret reaches an output."],"closes_when":["Confirm the environment settings: A person fills in the values the manifest lists as not copied, in the ConfigMap on the cluster.","Create the Kubernetes Secrets for the Secret Manager references: A person creates the Kubernetes Secrets the manifest lists, filled from STACKIT Secrets Manager (for example with an External Secrets Operator)."],"required_inputs":[]}},{"id":"DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-ACTIVATEGCB","kind":"unit-review","family":"gcp.cloudbuild","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.cloudbuild","block":"google_cloudbuild_trigger.activategcb","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"conditional_members":1,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"OPTIONAL_CONDITIONAL","item_count":1,"shape":"RSH-68efa90e8f69","subject":"google_cloudbuild_trigger.activategcb","review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:9386141c388d58e556657d741dad4f3973d0a7917c12094e76ed87729a78a697","kb_dependencies_sha256":"sha256:986fe167bf9a329368f8430b5da2276a3dcf5c4bd1b79fc22533a56446154eac"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-ACTIVATEGCB","source_family":"gcp.cloudbuild","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-ACTIVATEGCB","kind":"unit-review","family":"gcp.cloudbuild","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.cloudbuild","block":"google_cloudbuild_trigger.activategcb","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"conditional_members":4,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":4}],"blocker_class":"OPTIONAL_CONDITIONAL","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of google_cloudbuild_trigger.activategcb: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 4 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:e0143295cfa5a05eb32a3e9cb7e67db7ffdee678b9d8576c04505e0b9c53e0d6","kb_dependencies_sha256":"sha256:4eb8ef0b5ba6b230afae8df04c4c76d948a60d07ff869cc7c621ad2b16b82e9e"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-ACTIVATEGCB","source_family":"gcp.cloudbuild","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm its dependency on the references; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on google_cloudbuild_trigger.activategcb that the knowledge base cannot decide: Confirm its dependency on the references; Choose the container image or artifact; Confirm the entry point of the function; Review the log destination setting.","generated_target_behavior":"Confirm its dependency on the references: The draft does not carry the setting on google_cloudbuild_trigger.activategcb; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.activategcb). Choose the container image or artifact: The draft does not carry the setting on google_cloudbuild_trigger.activategcb; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.activategcb). Confirm the entry point of the function: The draft does not carry the setting on google_cloudbuild_trigger.activategcb; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.activategcb). Review the log destination setting: The draft does not carry the setting on google_cloudbuild_trigger.activategcb; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.activategcb).","residual_difference":"Confirm its dependency on the references: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Choose the container image or artifact: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Confirm the entry point of the function: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Review the log destination setting: the draft writes nothing for the unit: what the setting becomes depends on what replaces it","execution_effect":"No step waits for it. Held by something else first: MAN/unit/google_cloudbuild_trigger.activategcb.","next_action":"Confirm its dependency on the references: This setting follows the decision on the unit: A person confirms how the replacement carries the relation, or accepts the difference.","why_open":["Confirm its dependency on the references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger and google_cloudbuild_worker_pool names other units or resources (google_cloudbuild_bitbucket_server_config, google_cloudbuild_worker_pool, google_cloudbuildv2_repository, google_compute_global_address, google_compute_network, google_developer_connect_git_repository_link, google_pubsub_topic, google_secret_manager_secret, google_secret_manager_secret_version, google_service_account, google_sourcerepo_repository, google_storage_bucket). A person confirms how the replacement carries the relation between this unit and the units it names, or accepts the difference.","Choose the container image or artifact: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger.build.step.name, artifact or image reference (workload compatibility: a setting that binds the code to its runtime stays CRITICAL).","Confirm the entry point of the function: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger.build.step.entrypoint, build.step.script, build.step.args, entry point (workload compatibility: a setting that binds the code to its runtime stays CRITICAL).","Review the log destination setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states where/whether build logs are captured or exposed back to GitHub; STACKIT Git Pipelines' own logging model is different -- REVIEW."],"closes_when":["Confirm its dependency on the references: A person confirms how the replacement carries the relation, or accepts the difference.","Choose the container image or artifact: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting.","Confirm the entry point of the function: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting.","Review the log destination setting: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting."],"required_inputs":[]}},{"id":"DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-INIT","kind":"unit-review","family":"gcp.cloudbuild","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.cloudbuild","block":"google_cloudbuild_trigger.init","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"conditional_members":1,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"OPTIONAL_CONDITIONAL","item_count":1,"shape":"RSH-68efa90e8f69","subject":"google_cloudbuild_trigger.init","review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:983aef1e0dd9bd041a79bd51beb04d5a8ac24a45e1c9a2a46cefc90d25ee7eb3","kb_dependencies_sha256":"sha256:986fe167bf9a329368f8430b5da2276a3dcf5c4bd1b79fc22533a56446154eac"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-INIT","source_family":"gcp.cloudbuild","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-INIT","kind":"unit-review","family":"gcp.cloudbuild","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.cloudbuild","block":"google_cloudbuild_trigger.init","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"conditional_members":4,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":4}],"blocker_class":"OPTIONAL_CONDITIONAL","item_count":4,"why":"The knowledge base cannot decide 4 critical settings of google_cloudbuild_trigger.init: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 4 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:dde8057fbf100190ede422135467b4944298a15361db3dab48d0eac6ec929497","kb_dependencies_sha256":"sha256:4eb8ef0b5ba6b230afae8df04c4c76d948a60d07ff869cc7c621ad2b16b82e9e"},"member_count":4,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-INIT","source_family":"gcp.cloudbuild","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm its dependency on the references; the 4 settings of the record state their own.","source_observation":"The source states 4 critical settings on google_cloudbuild_trigger.init that the knowledge base cannot decide: Confirm its dependency on the references; Choose the container image or artifact; Confirm the entry point of the function; Review the log destination setting.","generated_target_behavior":"Confirm its dependency on the references: The draft does not carry the setting on google_cloudbuild_trigger.init; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.init). Choose the container image or artifact: The draft does not carry the setting on google_cloudbuild_trigger.init; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.init). Confirm the entry point of the function: The draft does not carry the setting on google_cloudbuild_trigger.init; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.init). Review the log destination setting: The draft does not carry the setting on google_cloudbuild_trigger.init; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.init).","residual_difference":"Confirm its dependency on the references: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Choose the container image or artifact: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Confirm the entry point of the function: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Review the log destination setting: the draft writes nothing for the unit: what the setting becomes depends on what replaces it","execution_effect":"No step waits for it. Held by something else first: MAN/unit/google_cloudbuild_trigger.init.","next_action":"Confirm its dependency on the references: This setting follows the decision on the unit: A person confirms how the replacement carries the relation, or accepts the difference.","why_open":["Confirm its dependency on the references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger and google_cloudbuild_worker_pool names other units or resources (google_cloudbuild_bitbucket_server_config, google_cloudbuild_worker_pool, google_cloudbuildv2_repository, google_compute_global_address, google_compute_network, google_developer_connect_git_repository_link, google_pubsub_topic, google_secret_manager_secret, google_secret_manager_secret_version, google_service_account, google_sourcerepo_repository, google_storage_bucket). A person confirms how the replacement carries the relation between this unit and the units it names, or accepts the difference.","Choose the container image or artifact: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger.build.step.name, artifact or image reference (workload compatibility: a setting that binds the code to its runtime stays CRITICAL).","Confirm the entry point of the function: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger.build.step.entrypoint, build.step.script, build.step.args, entry point (workload compatibility: a setting that binds the code to its runtime stays CRITICAL). The unit names google_firebase_hosting_site.client (google_firebase_hosting_site) through this setting (the target does not carry it: it is REDESIGN), so what the reference becomes is part of this setting.","Review the log destination setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states where/whether build logs are captured or exposed back to GitHub; STACKIT Git Pipelines' own logging model is different -- REVIEW."],"closes_when":["Confirm its dependency on the references: A person confirms how the replacement carries the relation, or accepts the difference.","Choose the container image or artifact: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting.","Confirm the entry point of the function: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting.","Review the log destination setting: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting."],"required_inputs":[]}},{"id":"DEC-GEN-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER","kind":"unit-review","family":"gcp.cloudbuild","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.cloudbuild","block":"google_cloudbuild_trigger.placeholder","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"NOT_STATED","required_by_phase":"NOT_STATED","affected_applications":[],"conditional_members":1,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"PROPAGATED_IMPACT","root_ids":["google_firebase_hosting_site.client"],"propagated_members":1,"item_count":1,"why":"The knowledge base cannot decide 1 critical setting of google_cloudbuild_trigger.placeholder: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:c674d845100b6fe50690bf19a8f6cb6e1c75ac37f81d12554d22665ec6b82793","kb_dependencies_sha256":"sha256:2263f44dd94d80de252fce492c6264ad809d936ed18332bf0c4dab3747e0a1d8"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-GEN-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER","source_family":"gcp.cloudbuild","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"NOT_STATED","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on google_cloudbuild_trigger.placeholder that the knowledge base cannot decide: Decide which firebase hosting site this resource depends on.","generated_target_behavior":"Decide which firebase hosting site this resource depends on: The draft does not carry the setting on google_cloudbuild_trigger.placeholder; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.placeholder).","residual_difference":"Decide which firebase hosting site this resource depends on: the draft writes nothing for the unit: what the setting becomes depends on what replaces it","execution_effect":"No step waits for it. Held by something else first: MAN/unit/google_cloudbuild_trigger.placeholder.","next_action":"Decide which firebase hosting site this resource depends on: This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied.","why_open":["Decide which firebase hosting site this resource depends on: This unit names a resource of the type google_firebase_hosting_site (by an attribute that configures it) and the target does not carry that resource as a mapped unit (it is redesigned, blocked, left for review or has no draft block of its own), and no semantic of this unit's contract reads that type: what the reference becomes on the target is not assessed."],"closes_when":["Decide which firebase hosting site this resource depends on: The contract of this unit gains a semantic that reads google_firebase_hosting_site (and lists it as carried), or a person decides what the reference to the resource becomes."],"required_inputs":[]}},{"id":"DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER","kind":"unit-review","family":"gcp.cloudbuild","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.cloudbuild","block":"google_cloudbuild_trigger.placeholder","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"conditional_members":1,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"OPTIONAL_CONDITIONAL","item_count":1,"shape":"RSH-68efa90e8f69","subject":"google_cloudbuild_trigger.placeholder","review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:5dd6517fac6668ddfc41409b0b481e67806d0e95fb9a8fcb6d7ed6132d67439b","kb_dependencies_sha256":"sha256:986fe167bf9a329368f8430b5da2276a3dcf5c4bd1b79fc22533a56446154eac"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER","source_family":"gcp.cloudbuild","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER","kind":"unit-review","family":"gcp.cloudbuild","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.cloudbuild","block":"google_cloudbuild_trigger.placeholder","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"conditional_members":3,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":3}],"blocker_class":"OPTIONAL_CONDITIONAL","item_count":3,"why":"The knowledge base cannot decide 3 critical settings of google_cloudbuild_trigger.placeholder: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 3 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:7e70eed61a6fa17edd718e38dd29074b9b3e25e7abd5fc99b629828000c689a8","kb_dependencies_sha256":"sha256:08f216fcd85c9d6305f60978415fc1d136a6daf9270b7b52bd96a0bf9a3fb4af"},"member_count":3,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER","source_family":"gcp.cloudbuild","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm its dependency on the references; the 3 settings of the record state their own.","source_observation":"The source states 3 critical settings on google_cloudbuild_trigger.placeholder that the knowledge base cannot decide: Confirm its dependency on the references; Choose the container image or artifact; Review the log destination setting.","generated_target_behavior":"Confirm its dependency on the references: The draft does not carry the setting on google_cloudbuild_trigger.placeholder; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.placeholder). Choose the container image or artifact: The draft does not carry the setting on google_cloudbuild_trigger.placeholder; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.placeholder). Review the log destination setting: The draft does not carry the setting on google_cloudbuild_trigger.placeholder; a manual step stands for it (MAN/unit/google_cloudbuild_trigger.placeholder).","residual_difference":"Confirm its dependency on the references: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Choose the container image or artifact: the draft writes nothing for the unit: what the setting becomes depends on what replaces it Review the log destination setting: the draft writes nothing for the unit: what the setting becomes depends on what replaces it","execution_effect":"No step waits for it. Held by something else first: MAN/unit/google_cloudbuild_trigger.placeholder.","next_action":"Confirm its dependency on the references: This setting follows the decision on the unit: A person confirms how the replacement carries the relation, or accepts the difference.","why_open":["Confirm its dependency on the references: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger and google_cloudbuild_worker_pool names other units or resources (google_cloudbuild_bitbucket_server_config, google_cloudbuild_worker_pool, google_cloudbuildv2_repository, google_compute_global_address, google_compute_network, google_developer_connect_git_repository_link, google_pubsub_topic, google_secret_manager_secret, google_secret_manager_secret_version, google_service_account, google_sourcerepo_repository, google_storage_bucket). A person confirms how the replacement carries the relation between this unit and the units it names, or accepts the difference.","Choose the container image or artifact: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_cloudbuild_trigger.build.step.name, artifact or image reference (workload compatibility: a setting that binds the code to its runtime stays CRITICAL).","Review the log destination setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The setting states where/whether build logs are captured or exposed back to GitHub; STACKIT Git Pipelines' own logging model is different -- REVIEW."],"closes_when":["Confirm its dependency on the references: A person confirms how the replacement carries the relation, or accepts the difference.","Choose the container image or artifact: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting.","Review the log destination setting: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting."],"required_inputs":[]}},{"id":"DEC-IAM-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT","kind":"unit-review","family":"gcp.firebase_hosting_site","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.firebase_hosting_site","block":"google_firebase_hosting_site.client","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"conditional_members":1,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"ROOT_BLOCKER","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of google_firebase_hosting_site.client: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:b4097e90369c69fe115b52f7ba297fa1a8a151b2f4e4cb927a2477eb7449550e","kb_dependencies_sha256":"sha256:f55dba7d6b49141ce72d8f9e08bc07f99cb4ee36e013de7545c9e78dec5243be"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-IAM-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT","source_family":"gcp.firebase_hosting_site","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on google_firebase_hosting_site.client that the knowledge base cannot decide: Confirm the project of the firebase hosting site.","generated_target_behavior":"Confirm the project of the firebase hosting site: The draft does not carry the setting on google_firebase_hosting_site.client; a manual step stands for it (MAN/unit/google_firebase_hosting_site.client).","residual_difference":"Confirm the project of the firebase hosting site: the draft writes nothing for the unit: what the setting becomes depends on what replaces it","execution_effect":"No step waits for it. Held by something else first: MAN/unit/google_firebase_hosting_site.client.","next_action":"Confirm the project of the firebase hosting site: This setting follows the decision on the unit: A person decides which STACKIT project, and with it which access rules, holds the replacement.","why_open":["Confirm the project of the firebase hosting site: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_firebase_hosting_site.project (identity access): The Google Cloud project the resource is created in. IAM policy, organisation policy and audit configuration are inherited from the project, so it decides who can act on the resource and what it is isolated from. The unit names google_firebase_project.default (google_firebase_project) through this setting (the target does not carry it: it is MANUAL_REVIEW), so what the reference becomes is part of this setting."],"closes_when":["Confirm the project of the firebase hosting site: A person decides which STACKIT project, and with it which access rules, holds the replacement."],"required_inputs":[]}},{"id":"DEC-OPS-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT","kind":"unit-review","family":"gcp.firebase_hosting_site","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.firebase_hosting_site","block":"google_firebase_hosting_site.client","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"conditional_members":1,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"ROOT_BLOCKER","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of google_firebase_hosting_site.client: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:f1335c383712c8d9a2d9e320a1daa4839dab4858facb100fc6012ff529d7cacc","kb_dependencies_sha256":"sha256:a631a25906c03485dfab5b0a0a312fc9b2555f35bf1744f986183dd81745237c"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-OPS-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT","source_family":"gcp.firebase_hosting_site","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on google_firebase_hosting_site.client that the knowledge base cannot decide: Confirm the site ID of the firebase hosting site.","generated_target_behavior":"Confirm the site ID of the firebase hosting site: The draft does not carry the setting on google_firebase_hosting_site.client; a manual step stands for it (MAN/unit/google_firebase_hosting_site.client).","residual_difference":"Confirm the site ID of the firebase hosting site: the draft writes nothing for the unit: what the setting becomes depends on what replaces it","execution_effect":"No step waits for it. Held by something else first: MAN/unit/google_firebase_hosting_site.client.","next_action":"Confirm the site ID of the firebase hosting site: This setting follows the decision on the unit: A person sets this up on the bucket, the CDN distribution and the domain that replace Firebase Hosting, or decides to drop it, and records the decision.","why_open":["Confirm the site ID of the firebase hosting site: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_firebase_hosting_site.site_id (workload compatibility): A globally unique identifier for the Hosting site; other settings, bindings and clients refer to the object by this id. Firebase Hosting has no STACKIT counterpart, so the site is rebuilt on Object Storage with a CDN."],"closes_when":["Confirm the site ID of the firebase hosting site: A person sets this up on the bucket, the CDN distribution and the domain that replace Firebase Hosting, or decides to drop it, and records the decision."],"required_inputs":[]}},{"id":"DEC-IAM-GOOGLE-FIREBASE-PROJECT-DEFAULT","kind":"unit-review","family":"gcp.firebase_project","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.firebase_project","block":"google_firebase_project.default","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of google_firebase_project.default: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:667031dd2b2502bc1c1caca38c963530b561e9cde073a8b3faae85c068978e91","kb_dependencies_sha256":"sha256:85daa99d61e711d84e649385b5c149432e234a88bdc0a8c525deb5ca3a0ef7e7"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-IAM-GOOGLE-FIREBASE-PROJECT-DEFAULT","source_family":"gcp.firebase_project","source_semantic":"unit-review","affected_application":[],"action_type":"BLOCKED_OR_UNSUPPORTED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"BLOCKED","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"the execution plan refuses REF/unit/google_firebase_project.default, which carries the record","source_observation":"The source states 1 critical setting on google_firebase_project.default that the knowledge base cannot decide: Confirm the project of the firebase project.","generated_target_behavior":"Confirm the project of the firebase project: The draft does not carry the setting on google_firebase_project.default. The plan refuses REF/unit/google_firebase_project.default.","residual_difference":"Confirm the project of the firebase project: the draft writes nothing for the unit: what the setting becomes depends on what replaces it","execution_effect":"No step waits for it. Held by something else first: REF/unit/google_firebase_project.default.","next_action":"Confirm the project of the firebase project: The plan refuses REF/unit/google_firebase_project.default for google_firebase_project.default: Nothing on STACKIT holds the registration of an app or the enabling of Firebase on a project. It stays with Google for as long as any Firebase service (push messaging, for example) is used, and a person decides, app by app, which backend replaces the Firebase services the app calls. Adding Firebase to a project cannot be undone (a redesign could go: List the Firebase services each app uses (authentication, database, storage, messaging, remote config); each needs its own replacement; The signing keys and store listings stay with Google Play and the Apple App Store; only the backend the app talks to moves). Decide the redesign before anything rests on this record.","why_open":["Confirm the project of the firebase project: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_firebase_project.project (identity access): The Google Cloud project the resource is created in. IAM policy, organisation policy and audit configuration are inherited from the project, so it decides who can act on the resource and what it is isolated from. Firebase has no STACKIT counterpart, so the registration of the app is not moved and the backend the app talks to is chosen by a person."],"closes_when":["Confirm the project of the firebase project: A person decides which STACKIT project, and with it which access rules, holds the replacement."],"required_inputs":[]}},{"id":"DEC-OPS-GOOGLE-PUBSUB-TOPIC-FAUX","kind":"unit-review","family":"gcp.pubsub_topic","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.pubsub_topic","block":"google_pubsub_topic.faux","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of google_pubsub_topic.faux: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:a7d8918bd3887e9683ef3e8136ed581b298c98a4bd2f2c70d955d19659e55ff8","kb_dependencies_sha256":"sha256:9141875ce7743ffec157132a09b478d7c4c66adccff8d3fc37212a6edbf027de"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-GOOGLE-PUBSUB-TOPIC-FAUX","source_family":"gcp.pubsub_topic","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on google_pubsub_topic.faux that the knowledge base cannot decide: Confirm the name of the resource on the target.","generated_target_behavior":"Confirm the name of the resource on the target: The draft does not carry the setting on google_pubsub_topic.faux; a manual step stands for it (MAN/semantic/google_pubsub_topic.faux/tc-name).","residual_difference":"Confirm the name of the resource on the target: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_pubsub_topic.faux/tc-name now.","next_action":"Confirm the name of the resource on the target: Confirm the name of the resource on the target for google_pubsub_topic.faux: A person confirms the topic name the replacement messaging service carries against the publishers and subscribers that use it, or accepts the new name. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Confirm the name of the resource on the target: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_pubsub_topic.name: The topic's own resource name, which publishers and subscribers address it by; access to it is controlled by IAM, not by the name string itself, and a changed name breaks every client that uses the old one."],"closes_when":["Confirm the name of the resource on the target: A person confirms the topic name the replacement messaging service carries against the publishers and subscribers that use it, or accepts the new name."],"required_inputs":[]}},{"id":"DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD","kind":"unit-review","family":"gcp.secret","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.secret","block":"google_secret_manager_secret.django_admin_password","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-07fa85711d49","subject":"google_secret_manager_secret.django_admin_password","review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:3e09fec2b3fabb25d58fdb484b8b5ab923f9e3ab186d861af6d5dcf041d7659b","kb_dependencies_sha256":"sha256:0ccd16d2e735b9486466e3d6dbe99987df23297d09511b6cab689cdb4854aa41"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD","source_family":"gcp.secret","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD","kind":"unit-review","family":"gcp.secret","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.secret","block":"google_secret_manager_secret.django_admin_password","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":2,"shape":"RSH-c07ca4685b85","subject":"google_secret_manager_secret.django_admin_password","review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:eb29f1eaa95c211eb17973b5c3e485f452884068952077daaa1918823c3c8cf2","kb_dependencies_sha256":"sha256:3e006b8a81c0ca3b70d5261345ffc7f78b9801324130cf812092e2bf2d4267d2"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD","source_family":"gcp.secret","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-SETTINGS","kind":"unit-review","family":"gcp.secret","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.secret","block":"google_secret_manager_secret.django_settings","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"shape":"RSH-07fa85711d49","subject":"google_secret_manager_secret.django_settings","review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:6d6b7e816d8d4ad7005954dceeadfb922b3abfaa5ba54c8f6ea046dc1ee92c0a","kb_dependencies_sha256":"sha256:0ccd16d2e735b9486466e3d6dbe99987df23297d09511b6cab689cdb4854aa41"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-SETTINGS","source_family":"gcp.secret","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-SETTINGS","kind":"unit-review","family":"gcp.secret","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.secret","block":"google_secret_manager_secret.django_settings","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":2,"shape":"RSH-c07ca4685b85","subject":"google_secret_manager_secret.django_settings","review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:716b1b457e427774c0a7f4b650e4c1b35931c304d406b6d687462a336a072224","kb_dependencies_sha256":"sha256:3e006b8a81c0ca3b70d5261345ffc7f78b9801324130cf812092e2bf2d4267d2"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-SETTINGS","source_family":"gcp.secret","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1}},{"id":"DEC-IAM-GOOGLE-SERVICE-ACCOUNT-AUTOMATION","kind":"unit-review","family":"gcp.service_account","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.service_account","block":"google_service_account.automation","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":2,"shape":"RSH-0c7479aef85e","subject":"google_service_account.automation","review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:274ca0dfef1c6eb06c78eb115a723bfb517013ac6392e727915c50ba200a2ff8","kb_dependencies_sha256":"sha256:a2f32f0b19e4dd60b79173e9fabcf5021c17aa2d1102ae21c5a9f31db479c9b6"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-IAM-GOOGLE-SERVICE-ACCOUNT-AUTOMATION","source_family":"gcp.service_account","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1}},{"id":"DEC-IAM-GOOGLE-SERVICE-ACCOUNT-CLIENT","kind":"unit-review","family":"gcp.service_account","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.service_account","block":"google_service_account.client","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":2,"why":"The knowledge base cannot decide 2 critical settings of google_service_account.client: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/google_service_account.client/open-settings.","required_evidence":["the members that act as or manage the service account"],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:88ae4b1b16dcb159b368f4323b539cbf6d141a882787af854f5db4709ec45ac9","kb_dependencies_sha256":"sha256:a2f32f0b19e4dd60b79173e9fabcf5021c17aa2d1102ae21c5a9f31db479c9b6"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-GOOGLE-SERVICE-ACCOUNT-CLIENT","source_family":"gcp.service_account","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"role-bindings/bind-a-role-on-the-service-account","title":"Map the IAM roles of the service account to STACKIT roles: Bind a role of the STACKIT service account to the member","prerequisites":["the Google roles granted on the service account and what each one allowed","the roles the authorization API lists for the STACKIT service account"],"effects":["A role assignment on a STACKIT service account gives a role the authorization API lists for that account to a user, a service account or a client; given to a service account, it grants the Act-As permission, which lets that account impersonate the target account. A person re-maps each Google role on the account (using it, creating its keys, managing it) to a role of the STACKIT service account and binds it to the member. The assignment carries no condition and has no setting that removes the other holders of a role, so if the Google resource was authoritative (a binding for its role, a policy for the whole account) the replacing effect is not carried: a person lists who else holds a role on the account and removes what the source did not list. The resource is part of an experimental feature that is likely to change or be removed. The documents read do not state how a person, as opposed to a service account, acts as the account."],"risk":["A role chosen too wide lets a member act as the account more than the source allowed."],"evidence":["provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_service_account_role_assignment.md: \"`resource_id` (String) Service-account Resource to assign the role to.\"","provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_service_account_role_assignment.md: \"`subject` (String) Identifier of user, service account or client.\"","provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_service_account_role_assignment.md: \"Use this resource to grant 'Act-As' permissions. This allows a service-account (the `subject`) to impersonate the target Service Account.\"","provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_folder_role_assignment.md: \"This resource is part of the experimental feature iam and is likely going to undergo significant changes or be removed in the future. Use it at your own discretion.\""],"regeneration_required":false}],"required_verification":["Map the IAM roles of the service account to STACKIT roles: each member can do what the source role allowed on the service account and nothing more, tried on the target"],"next_run_changes":["A rerun writes no further role assignment on its own; an answer in the decisions file records the choice and writes nothing."],"remains_manual":["Map the IAM roles of the service account to STACKIT roles: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note gcp.service_account/role-bindings: \"Role assignments need the experimental IAM feature of the pinned STACKIT provider.\""],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the account name setting; the 2 settings of the record state their own.","source_observation":"The source states 2 critical settings on google_service_account.client that the knowledge base cannot decide: Review the account name setting; Map the IAM roles of the service account to STACKIT roles.","generated_target_behavior":"Review the account name setting: The draft does not carry the setting on google_service_account.client; a manual step stands for it (MAN/semantic/google_service_account.client/open-settings). Map the IAM roles of the service account to STACKIT roles: The draft does not carry the setting on google_service_account.client; a manual step stands for it (MAN/semantic/google_service_account.client/open-settings). The draft writes the service account, and a STACKIT role assignment of the account for each grant on a project, a folder or an organisation whose role and members are visible statically and that has no condition; a grant that lets another account act as it is written as an Act-As assignment. A grant with a condition, a policy document, a repeated grant and a grant whose role or members are not visible statically are listed in the draft and not written.","residual_difference":"Review the account name setting: the target behaviour of this setting is not established Map the IAM roles of the service account to STACKIT roles: Which STACKIT role gives a member the access the Google role gave on the service account, and that no member gets more.","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_service_account.client/open-settings now.","next_action":"Review the account name setting: This setting follows the decision on the unit: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.","why_open":["Review the account name setting: A check of the knowledge base (sa account id not visible) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The account ID becomes the stackit_service_account name (shortened to the STACKIT name rules; pinned provider) — TRANSFORMED; the e-mail address changes. An ID not visible statically (or a repeated account) is named NOT CARRIED — REVIEW (check sa-account-id-not-visible).","Map the IAM roles of the service account to STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The grants of the estate that name the account: a grant on a project, a folder or an organisation is written as a STACKIT role assignment of the account when its role and members are visible statically and it has no condition, and a grant that lets another account act as it is written as an Act-As assignment. A Google role is written as a STACKIT role only where the mapping shows the STACKIT role holds the same permissions or fewer on a project; every other role is an input that names the candidates, and a person confirms each. A binding or a policy is authoritative (it removes the members of its role that it does not list) and a role assignment only adds, which the draft says on each: members that hold the role outside the configuration keep it on STACKIT until a person removes them."],"closes_when":["Review the account name setting: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.","Map the IAM roles of the service account to STACKIT roles: The knowledge base's note on this setting states no closing condition; it is done when a person has chosen a way out above, recorded the choice, and the target is checked as the verification says.","Map the IAM roles of the service account to STACKIT roles: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":["the members that act as or manage the service account"]}},{"id":"DEC-IAM-GOOGLE-SERVICE-ACCOUNT-INIT","kind":"unit-review","family":"gcp.service_account","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.service_account","block":"google_service_account.init","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"conditional_members":2,"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"OPTIONAL_CONDITIONAL","item_count":2,"why":"The knowledge base cannot decide 2 critical settings of google_service_account.init: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 2 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them. The review step of the execution plan for these settings is MAN/semantic/google_service_account.init/open-settings.","required_evidence":["the members that act as or manage the service account"],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:fbe36a66702026998a663181d81729b5b25573a82351a71f48bca28a9039d33d","kb_dependencies_sha256":"sha256:a2f32f0b19e4dd60b79173e9fabcf5021c17aa2d1102ae21c5a9f31db479c9b6"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-GOOGLE-SERVICE-ACCOUNT-INIT","source_family":"gcp.service_account","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1,"resolution_paths":[{"id":"role-bindings/bind-a-role-on-the-service-account","title":"Map the IAM roles of the service account to STACKIT roles: Bind a role of the STACKIT service account to the member","prerequisites":["the Google roles granted on the service account and what each one allowed","the roles the authorization API lists for the STACKIT service account"],"effects":["A role assignment on a STACKIT service account gives a role the authorization API lists for that account to a user, a service account or a client; given to a service account, it grants the Act-As permission, which lets that account impersonate the target account. A person re-maps each Google role on the account (using it, creating its keys, managing it) to a role of the STACKIT service account and binds it to the member. The assignment carries no condition and has no setting that removes the other holders of a role, so if the Google resource was authoritative (a binding for its role, a policy for the whole account) the replacing effect is not carried: a person lists who else holds a role on the account and removes what the source did not list. The resource is part of an experimental feature that is likely to change or be removed. The documents read do not state how a person, as opposed to a service account, acts as the account."],"risk":["A role chosen too wide lets a member act as the account more than the source allowed."],"evidence":["provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_service_account_role_assignment.md: \"`resource_id` (String) Service-account Resource to assign the role to.\"","provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_service_account_role_assignment.md: \"`subject` (String) Identifier of user, service account or client.\"","provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_service_account_role_assignment.md: \"Use this resource to grant 'Act-As' permissions. This allows a service-account (the `subject`) to impersonate the target Service Account.\"","provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_folder_role_assignment.md: \"This resource is part of the experimental feature iam and is likely going to undergo significant changes or be removed in the future. Use it at your own discretion.\""],"regeneration_required":false}],"required_verification":["Map the IAM roles of the service account to STACKIT roles: each member can do what the source role allowed on the service account and nothing more, tried on the target"],"next_run_changes":["A rerun writes no further role assignment on its own; an answer in the decisions file records the choice and writes nothing."],"remains_manual":["Map the IAM roles of the service account to STACKIT roles: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note gcp.service_account/role-bindings: \"Role assignments need the experimental IAM feature of the pinned STACKIT provider.\""],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the account name setting; the 2 settings of the record state their own.","source_observation":"The source states 2 critical settings on google_service_account.init that the knowledge base cannot decide: Review the account name setting; Map the IAM roles of the service account to STACKIT roles.","generated_target_behavior":"Review the account name setting: The draft does not carry the setting on google_service_account.init; a manual step stands for it (MAN/semantic/google_service_account.init/open-settings). Map the IAM roles of the service account to STACKIT roles: The draft does not carry the setting on google_service_account.init; a manual step stands for it (MAN/semantic/google_service_account.init/open-settings). The draft writes the service account, and a STACKIT role assignment of the account for each grant on a project, a folder or an organisation whose role and members are visible statically and that has no condition; a grant that lets another account act as it is written as an Act-As assignment. A grant with a condition, a policy document, a repeated grant and a grant whose role or members are not visible statically are listed in the draft and not written.","residual_difference":"Review the account name setting: the target behaviour of this setting is not established Map the IAM roles of the service account to STACKIT roles: Which STACKIT role gives a member the access the Google role gave on the service account, and that no member gets more.","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_service_account.init/open-settings now.","next_action":"Review the account name setting: This setting follows the decision on the unit: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.","why_open":["Review the account name setting: A check of the knowledge base (sa account id not visible) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The account ID becomes the stackit_service_account name (shortened to the STACKIT name rules; pinned provider) — TRANSFORMED; the e-mail address changes. An ID not visible statically (or a repeated account) is named NOT CARRIED — REVIEW (check sa-account-id-not-visible).","Map the IAM roles of the service account to STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The grants of the estate that name the account: a grant on a project, a folder or an organisation is written as a STACKIT role assignment of the account when its role and members are visible statically and it has no condition, and a grant that lets another account act as it is written as an Act-As assignment. A Google role is written as a STACKIT role only where the mapping shows the STACKIT role holds the same permissions or fewer on a project; every other role is an input that names the candidates, and a person confirms each. A binding or a policy is authoritative (it removes the members of its role that it does not list) and a role assignment only adds, which the draft says on each: members that hold the role outside the configuration keep it on STACKIT until a person removes them."],"closes_when":["Review the account name setting: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.","Map the IAM roles of the service account to STACKIT roles: The knowledge base's note on this setting states no closing condition; it is done when a person has chosen a way out above, recorded the choice, and the target is checked as the verification says.","Map the IAM roles of the service account to STACKIT roles: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":["the members that act as or manage the service account"]}},{"id":"DEC-IAM-GOOGLE-SERVICE-ACCOUNT-SERVER","kind":"unit-review","family":"gcp.service_account","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.service_account","block":"google_service_account.server","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1},{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":2,"shape":"RSH-0c7479aef85e","subject":"google_service_account.server","review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:7036953ced621ef3845bebb3c9ebfeb20a65a2b923fb82cebde5066f39687853","kb_dependencies_sha256":"sha256:a2f32f0b19e4dd60b79173e9fabcf5021c17aa2d1102ae21c5a9f31db479c9b6"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-IAM-GOOGLE-SERVICE-ACCOUNT-SERVER","source_family":"gcp.service_account","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"STATED","related_execution_step_count":1}},{"id":"DEC-IAM-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES","kind":"unit-review","family":"gcp.sql_instance","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.sql_instance","block":"google_sql_database_instance.postgres","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of google_sql_database_instance.postgres: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:0a35e53fc17ee2be1fc2c0e5230f1a06bc8fc2064d3432154f560454ac3d7bf1","kb_dependencies_sha256":"sha256:786401fe2bf3a93712af592b39f26370dffdc000473a1ca2590b6505bbb4e338"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES","source_family":"gcp.sql_instance","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on google_sql_database_instance.postgres that the knowledge base cannot decide: Review the database users setting.","generated_target_behavior":"Review the database users setting: The draft does not carry the setting on google_sql_database_instance.postgres; a manual step stands for it (MAN/semantic/google_sql_database_instance.postgres/database-users).","residual_difference":"Review the database users setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_sql_database_instance.postgres/database-users now.","next_action":"Review the database users setting: This setting follows the decision on the unit: A literal value or a resolved reference in the source lets the check decide, or a person verifies the value.","why_open":["Review the database users setting: A check of the knowledge base (sql user not generated) needs a value the scan cannot read statically, so it could not decide. A built-in user of a PostgreSQL instance becomes a stackit_postgresflex_user with the same username (pinned provider) — TRANSFORMED. IAM users (and a name or type not visible statically) are not generated — REVIEW (check sql-user-not-generated); users of the other engines are named NOT CARRIED — REVIEW."],"closes_when":["Review the database users setting: A literal value or a resolved reference in the source lets the check decide, or a person verifies the value."],"required_inputs":[]}},{"id":"DEC-NET-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES","kind":"unit-review","family":"gcp.sql_instance","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.sql_instance","block":"google_sql_database_instance.postgres","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of google_sql_database_instance.postgres: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:ccd4c92d365d49d5bb933ef5ad8b7cc3397c53a84b5773808f2bac8cf9beb0a5","kb_dependencies_sha256":"sha256:05ec37deefc9709dd4094cc43443e5ea4161bb0fb883d0c31b14f7eab9c97734"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-NET-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES","source_family":"gcp.sql_instance","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Network Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[{"id":"user-and-database-settings/derived-carry-on-the-target-25abe723033e","title":"Review the user and database settings setting: Carry the setting on STACKIT PostgreSQL Flex","prerequisites":[],"effects":["You design how STACKIT PostgreSQL Flex carries this setting and build it outside the draft. The draft does not change and no step is freed by it."],"risk":[],"evidence":[],"regeneration_required":false},{"id":"user-and-database-settings/derived-accept-the-difference-25abe723033e","title":"Review the user and database settings setting: Accept the difference","prerequisites":[],"effects":["The target does not carry this setting as the source states it, and you record that as accepted. The draft does not change and no step is freed by it."],"risk":[],"evidence":[],"regeneration_required":false}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on google_sql_database_instance.postgres that the knowledge base cannot decide: Review the user and database settings setting.","generated_target_behavior":"Review the user and database settings setting: The draft does not carry the setting on google_sql_database_instance.postgres; a manual step stands for it (MAN/semantic/google_sql_database_instance.postgres/user-and-database-settings).","residual_difference":"Review the user and database settings setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_sql_database_instance.postgres/user-and-database-settings now.","next_action":"Review the user and database settings setting: Review the user and database settings setting for google_sql_database_instance.postgres: Decide how STACKIT PostgreSQL Flex carries this setting, or accept the difference. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the user and database settings setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The source password is not copied (STACKIT generates it: stackit_postgresflex_user.password is computed), a host restriction and ABANDON deletion policies have no counterpart (pinned provider) — the draft names them NOT CARRIED — REVIEW."],"closes_when":["Review the user and database settings setting: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":[]}},{"id":"DEC-OPS-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES","kind":"unit-review","family":"gcp.sql_instance","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.sql_instance","block":"google_sql_database_instance.postgres","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":2}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":2,"why":"The knowledge base cannot decide 2 critical settings of google_sql_database_instance.postgres: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/google_sql_database_instance.postgres/open-settings-platform-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:b13cd08f1d5978440b0dece1471faff3802205881397bcf65829f41bc7f89a47","kb_dependencies_sha256":"sha256:78bf9d5ee89c911cfef7286217a3cc65b58d8c90bd4528ac2ff20b4162d37bc7"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES","source_family":"gcp.sql_instance","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Confirm the name of the resource on the target; the 2 settings of the record state their own.","source_observation":"The source states 2 critical settings on google_sql_database_instance.postgres that the knowledge base cannot decide: Confirm the name of the resource on the target; Confirm the name of the SQL database.","generated_target_behavior":"Confirm the name of the resource on the target: The draft does not carry the setting on google_sql_database_instance.postgres; a manual step stands for it (MAN/semantic/google_sql_database_instance.postgres/open-settings-platform-architect). Confirm the name of the SQL database: The draft does not carry the setting on google_sql_database_instance.postgres; a manual step stands for it (MAN/semantic/google_sql_database_instance.postgres/open-settings-platform-architect).","residual_difference":"Confirm the name of the resource on the target: the target behaviour of this setting is not established Confirm the name of the SQL database: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_sql_database_instance.postgres/open-settings-platform-architect now.","next_action":"Confirm the name of the resource on the target: Confirm the name of the resource on the target for google_sql_database_instance.postgres: A person confirms the instance name the STACKIT database carries against what refers to the source instance name, or accepts the new name. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Confirm the name of the resource on the target: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_sql_database_instance.name: The instance's name/label; does not itself grant access, encrypt data, or control backups/availability/residency.","Confirm the name of the SQL database: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_sql_database.name (a facet of the unit): The literal database name; determines the connection target's label but does not itself grant or restrict access, encrypt data, or affect backups/availability/residency."],"closes_when":["Confirm the name of the resource on the target: A person confirms the instance name the STACKIT database carries against what refers to the source instance name, or accepts the new name.","Confirm the name of the SQL database: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":[]}},{"id":"DEC-DATA-GOOGLE-STORAGE-BUCKET-MEDIA","kind":"unit-review","family":"gcp.storage_bucket","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.storage_bucket","block":"google_storage_bucket.media","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Storage Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"TARGET_LIMIT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of google_storage_bucket.media: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:cee2afe3415694523ba90f77fa2e9a367eed61a79003c85f938f4e026e843f95","kb_dependencies_sha256":"sha256:ff6ca5d3176c5f7bc2f6bb8c2946b4c21f8220ca742aa0d2a5362aa5669dd82b"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-DATA-GOOGLE-STORAGE-BUCKET-MEDIA","source_family":"gcp.storage_bucket","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Storage Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"UNSUPPORTED","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[{"id":"force-destroy/derived-accept-the-loss-5d7d37005886","title":"Confirm whether the bucket may be deleted with its contents: Accept the loss","prerequisites":[],"effects":["Nothing on the target carries this setting, and you record that as accepted. The draft does not change and no step is freed by it."],"risk":[],"evidence":[],"regeneration_required":false},{"id":"force-destroy/derived-rebuild-by-hand-5d7d37005886","title":"Confirm whether the bucket may be deleted with its contents: Rebuild it by hand","prerequisites":[],"effects":["Find which applications use the Google client libraries or signed URLs — those need a code change. The draft does not change and no step is freed by it."],"risk":[],"evidence":[],"regeneration_required":false}],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"the execution plan refuses REF/semantic/google_storage_bucket.media/force-destroy because the target has no counterpart for the setting: a person accepts the difference or redesigns, and the step stays refused","source_observation":"The source states 1 critical setting on google_storage_bucket.media that the knowledge base cannot decide: Confirm whether the bucket may be deleted with its contents.","generated_target_behavior":"Confirm whether the bucket may be deleted with its contents: The draft does not carry the setting on google_storage_bucket.media. The plan refuses REF/semantic/google_storage_bucket.media/force-destroy.","residual_difference":"Confirm whether the bucket may be deleted with its contents: the target behaviour of this setting is not established","execution_effect":"No step waits for it. Held by something else first: REF/semantic/google_storage_bucket.media/force-destroy.","next_action":"Confirm whether the bucket may be deleted with its contents: Confirm whether the bucket may be deleted with its contents for google_storage_bucket.media: force_destroy lets Terraform delete the bucket together with its objects. STACKIT has no such override: stackit_objectstorage_bucket (the pinned STACKIT provider) \"cannot be destroyed if the bucket contains objects\" — empty the bucket (or migrate its objects) before destroying it. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Confirm whether the bucket may be deleted with its contents: A check of the knowledge base (gcs force destroy) found a setting the target has no counterpart for (a finding of this unit describes it). stackit_objectstorage_bucket (pinned provider) \"cannot be destroyed if the bucket contains objects\" (schema description): force_destroy = false — a destroy that stops at a non-empty bucket — is what STACKIT does, PRESERVED; true has no counterpart, UNSUPPORTED (check gcs-force-destroy)."],"closes_when":["Confirm whether the bucket may be deleted with its contents: A person accepts the difference or the design changes: nothing in the source can make the target carry it."],"required_inputs":[]}},{"id":"DEC-GEN-GOOGLE-STORAGE-BUCKET-MEDIA","kind":"unit-review","family":"gcp.storage_bucket","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.storage_bucket","block":"google_storage_bucket.media","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"NOT_STATED","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of google_storage_bucket.media: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:4c80dda543fb5e78f94213c2419ad6da54bf1b98a1df79c0ac2a8e5fe8555ac4","kb_dependencies_sha256":"sha256:b7eeaba8b9c0d94e36ddc3359a7d737791e673d022999d650c4d0d686a4ff250"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-GEN-GOOGLE-STORAGE-BUCKET-MEDIA","source_family":"gcp.storage_bucket","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"NOT_STATED","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on google_storage_bucket.media that the knowledge base cannot decide: Review the IAM access setting.","generated_target_behavior":"Review the IAM access setting: The draft does not carry the setting on google_storage_bucket.media; a manual step stands for it (MAN/semantic/google_storage_bucket.media/iam-access).","residual_difference":"Review the IAM access setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_storage_bucket.media/iam-access now.","next_action":"Review the IAM access setting: Review the IAM access setting for google_storage_bucket.media: A person creates the bucket policies and Object Storage credentials that give the same access on STACKIT. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the IAM access setting: A check of the knowledge base (gcs iam) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The setting states who may access the bucket, granted with IAM bindings or ACL entries."],"closes_when":["Review the IAM access setting: A person decides it as that finding asks, and the finding's closing evidence or decision is recorded. A person creates the bucket policies and Object Storage credentials that give the same access on STACKIT."],"required_inputs":[]}},{"id":"DEC-IAM-GOOGLE-STORAGE-BUCKET-MEDIA","kind":"unit-review","family":"gcp.storage_bucket","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.storage_bucket","block":"google_storage_bucket.media","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":1},{"cause":"NOT_CLASSIFIED","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":2,"why":"The knowledge base cannot decide 2 critical settings of google_storage_bucket.media: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/google_storage_bucket.media/open-settings-identity-architect.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:82968eacb6f72cd72fd95b5501daf787d5707e72dd3c66366c44080dc700a319","kb_dependencies_sha256":"sha256:501308cb054c71c8e9dff6e445f4fa5dc02da316cf0e5a6cfaf3261af9ec4576"},"member_count":2,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-IAM-GOOGLE-STORAGE-BUCKET-MEDIA","source_family":"gcp.storage_bucket","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the IAM grant setting; the 2 settings of the record state their own.","source_observation":"The source states 2 critical settings on google_storage_bucket.media that the knowledge base cannot decide: Review the IAM grant setting; Review the public access setting.","generated_target_behavior":"Review the IAM grant setting: The draft does not carry the setting on google_storage_bucket.media; a manual step stands for it (MAN/semantic/google_storage_bucket.media/open-settings-identity-architect). Review the public access setting: The draft does not carry the setting on google_storage_bucket.media; a manual step stands for it (MAN/semantic/google_storage_bucket.media/open-settings-identity-architect).","residual_difference":"Review the IAM grant setting: the target behaviour of this setting is not established Review the public access setting: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_storage_bucket.media/open-settings-identity-architect now.","next_action":"Review the IAM grant setting: Review the IAM grant setting for google_storage_bucket.media: A person decides what this finding asks, and records the evidence or the decision. The finding says: Bucket access is granted with IAM bindings or ACL entries; on STACKIT it becomes bucket policies and Object Storage credentials. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Review the IAM grant setting: A check of the knowledge base (gcs iam) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The value-level reader of who gets which role (`iam-access` above is the facet as a whole): role, member(s) and condition. A GCP principal (user:, group:, serviceAccount:, allUsers) and a predefined role have no STACKIT counterpart in a bucket policy, whose statements name principals and S3 actions (supported-permissions-in-bucket-policies docs; the draft writes no policy) — a person translates each grant — REVIEW for every value, allUsers included (that one is also public-access, TRANSFORMED).","Review the public access setting: A check of the knowledge base (gcs public) needs a value the scan cannot read statically, so it could not decide. The counterpart is a bucket policy with Principal \"*\" and s3:GetObject (documented sample), but stackit_objectstorage_bucket has no policy attribute and the provider no bucket-policy resource, so the draft writes none: REVIEW, as for the IP rules."],"closes_when":["Review the IAM grant setting: A person decides what this finding asks, and records the evidence or the decision. The finding says: Bucket access is granted with IAM bindings or ACL entries; on STACKIT it becomes bucket policies and Object Storage credentials.","Review the public access setting: A literal value or a resolved reference in the source lets the check decide, or a person verifies the value."],"required_inputs":[]}},{"id":"DEC-OPS-GOOGLE-STORAGE-BUCKET-MEDIA","kind":"unit-review","family":"gcp.storage_bucket","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.storage_bucket","block":"google_storage_bucket.media","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of google_storage_bucket.media: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:ce1bb38d4159e6f1cc5ae1511fe2069c51d893d88b71471ec81e111114565ccd","kb_dependencies_sha256":"sha256:2e055e5ac4d1a1ac28d8e2cf788d5ee9377a16e102dec0ccf86614ea88b70e93"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-OPS-GOOGLE-STORAGE-BUCKET-MEDIA","source_family":"gcp.storage_bucket","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Platform Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on google_storage_bucket.media that the knowledge base cannot decide: Confirm the name of the Cloud Storage bucket.","generated_target_behavior":"Confirm the name of the Cloud Storage bucket: The draft does not carry the setting on google_storage_bucket.media; a manual step stands for it (MAN/semantic/google_storage_bucket.media/tc-storage-bucket-name).","residual_difference":"Confirm the name of the Cloud Storage bucket: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_storage_bucket.media/tc-storage-bucket-name now.","next_action":"Confirm the name of the Cloud Storage bucket: Confirm the name of the Cloud Storage bucket for google_storage_bucket.media: A person confirms the Object Storage bucket name against the applications and tools that use the source bucket name, or accepts the new name. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Confirm the name of the Cloud Storage bucket: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The name of the Cloud Storage bucket, in lowercase and at most 63 characters per the provider documentation, by which applications address it."],"closes_when":["Confirm the name of the Cloud Storage bucket: A person confirms the Object Storage bucket name against the applications and tools that use the source bucket name, or accepts the new name."],"required_inputs":[]}},{"id":"DEC-SEC-GOOGLE-STORAGE-BUCKET-MEDIA","kind":"unit-review","family":"gcp.storage_bucket","source":"CRITICAL_SEMANTIC","group":"GRP-CRITICAL-SEMANTIC-gcp.storage_bucket","block":"google_storage_bucket.media","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"CRITICAL_SEMANTIC_OPEN","causes":[{"cause":"CUSTOMER_INPUT","members":1}],"blocker_class":"GENUINELY_UNACCOUNTED","item_count":1,"why":"The knowledge base cannot decide 1 critical setting of google_storage_bucket.media: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:218dbf4d063d925c3ec13dcee5b71559568345f3441e250c6353827928621501","kb_dependencies_sha256":"sha256:23b6a8ae451f9999dffe60eb24069fa7f6a0d1e9462633f32326666d793fe4f4"},"member_count":1,"affected_unit_count":1,"evidence_ref_count":1,"resolution":{"decision_id":"DEC-SEC-GOOGLE-STORAGE-BUCKET-MEDIA","source_family":"gcp.storage_bucket","source_semantic":"unit-review","affected_application":[],"action_type":"NOT_STATED","work_package":"NOT_STATED","owner_role":"Security Architect","required_by_phase":"NOT_STATED","raw_semantic_status":"REVIEW","review_status":"OPEN","customer_action_status":"OPEN_INPUT","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":1,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on google_storage_bucket.media that the knowledge base cannot decide: Decide the geo-replication.","generated_target_behavior":"Decide the geo-replication: The draft does not carry the setting on google_storage_bucket.media; a manual step stands for it (MAN/semantic/google_storage_bucket.media/geo-replication).","residual_difference":"Decide the geo-replication: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/google_storage_bucket.media/geo-replication now.","next_action":"Decide the geo-replication: Decide the geo-replication for google_storage_bucket.media: The value is set where the module is called (a literal), the variable is given its value in a variable file of the scan (--var-file), or a person confirms the value production uses. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Decide the geo-replication: The value is read from a variable's default; that is not a fact of the source. A custom_placement_config not visible statically (a dynamic block over an unknown for_each, a whole value from a variable) may be absent: the facts state no replication, the ledger writes no line and a person decides (REVIEW by the case; 2026-09-25 unknown-value audit — it used to be claimed as replicated)."],"closes_when":["Decide the geo-replication: The value is set where the module is called (a literal), the variable is given its value in a variable file of the scan (--var-file), or a person confirms the value production uses."],"required_inputs":[]}},{"id":"DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW","kind":"MANUAL_REVIEW","family":"stackitsa","source":"PLAN_STATEMENT","group":"GRP-PLAN-STATEMENT-stackitsa","block":"MANUAL_REVIEW","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"PLAN_STATEMENT_OPEN","causes":[{"cause":"DEPENDS_ON_UNIT","members":2}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"The stackitsa plan of the draft writes no resource for 2 units and states why (the plan states the cause for each unit: google_cloud_run_v2_job.migrate: google_cloud_run_v2_job.migrate is a container task: its 1 identity binding(s) are facts only, and no service account is attached for it (no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account); google_cloud_run_v2_service.server: google_cloud_run_v2_service.server is a container service: its 1 identity binding(s) are facts only, and no service account is attached for it (no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account)): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:0d87407edba569bfdd79c86e92e517831a240259de9e18c935cbb2e383da0a46","kb_dependencies_sha256":"sha256:83a8f6eef89167b4a870555fd2ffcf930e8e1486e7893eb941efdfcf7f52cb49"},"member_count":2,"affected_unit_count":2,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW","source_family":"stackitsa","source_semantic":"MANUAL_REVIEW","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"PLAN_STATEMENT_OPEN","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":2,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"the plan writes no resource for the unit and names the work a person does instead","source_observation":"The plan writes no resource for google_cloud_run_v2_job.migrate: google_cloud_run_v2_job.migrate is a container task: its 1 identity binding(s) are facts only, and no service account is attached for it (no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account). The plan writes no resource for google_cloud_run_v2_service.server: google_cloud_run_v2_service.server is a container service: its 1 identity binding(s) are facts only, and no service account is attached for it (no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account).","generated_target_behavior":"The draft writes no resource for google_cloud_run_v2_job.migrate and google_cloud_run_v2_service.server.","residual_difference":"the work outside the draft is neither done nor verified by StackToIT","execution_effect":"No step waits for it. The plan can start MAN/identity/facts:google_cloud_run_v2_job.migrate:google_cloud_run_v2_job.migrate.template.0.template.0.service_account-8dc3e1 and MAN/identity/facts:google_cloud_run_v2_service.server:google_cloud_run_v2_service.server.template.0.service_account-5ccce9 now.","next_action":"Outside the draft, for google_cloud_run_v2_job.migrate and google_cloud_run_v2_service.server: Decide how google_cloud_run_v2_job.migrate gets its application identity on STACKIT (a service account of its own, workload federation): the draft does not write it (and 1 more manual steps); the plan lists it as manual work.","why_open":["The stackitsa plan of the draft writes no resource for 2 units and states why (the plan states the cause for each unit: google_cloud_run_v2_job.migrate: google_cloud_run_v2_job.migrate is a container task: its 1 identity binding(s) are facts only, and no service account is attached for it (no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account); google_cloud_run_v2_service.server: google_cloud_run_v2_service.server is a container service: its 1 identity binding(s) are facts only, and no service account is attached for it (no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account)): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan."],"closes_when":["the identity fact of google_cloud_run_v2_job.migrate (template[0].template[0].service_account of google_cloud_run_v2_job.migrate names google_service_account.automation) is decided on STACKIT and recorded, or recorded as not needed","the identity fact of google_cloud_run_v2_service.server (template[0].service_account of google_cloud_run_v2_service.server names google_service_account.server) is decided on STACKIT and recorded, or recorded as not needed"],"required_inputs":[]}},{"id":"DEC-IAM-STACKITSA-STATEMENT-NOT-DRAFTED","kind":"NOT_DRAFTED","family":"stackitsa","source":"PLAN_STATEMENT","group":"GRP-PLAN-STATEMENT-stackitsa","block":"NOT_DRAFTED","scope":{"kind":"estate","id":"estate","artifact":"workspace.json","pointer":"/estate"},"status":"OPEN","review_state":"UNREVIEWED","design_state":"OPEN","validation_state":"NOT_VALIDATED","owner_role":"Identity Architect","required_by_phase":"BEFORE_PILOT","affected_applications":[],"options":[],"recommended_option":null,"blocking_effect":"PLAN_STATEMENT_OPEN","causes":[{"cause":"IMPLEMENTATION_GAP","members":2}],"blocker_class":"GENUINELY_UNACCOUNTED","why":"The stackitsa plan of the draft writes no resource for 2 units and states why (no resource is written for the unit and the plan names a step beside it): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.","required_evidence":[],"review_binding":{"source_digest":"sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000","kb_version":"0.394.0","kb_sha256":"480e323d0c501840bc553e30e3073fca5f51c5c45a9e7d91ed4a4ff36d6a50d0","members_sha256":"sha256:e85552354c4f233c6960ca13d2ae813bf9758092a5a48d836f0839a1cb81ab87","kb_dependencies_sha256":"sha256:fe3be1b899466063f75cf0424168230d97d3a1492d8dd1b68db6325ffa70ccdf"},"member_count":2,"affected_unit_count":2,"evidence_ref_count":0,"resolution":{"decision_id":"DEC-IAM-STACKITSA-STATEMENT-NOT-DRAFTED","source_family":"stackitsa","source_semantic":"NOT_DRAFTED","affected_application":[],"action_type":"MANUAL_IMPLEMENTATION","work_package":"NOT_STATED","owner_role":"Identity Architect","required_by_phase":"BEFORE_PILOT","raw_semantic_status":"PLAN_STATEMENT_OPEN","review_status":"OPEN","customer_action_status":"MANUAL_IMPLEMENTATION","applied_input_refs":[],"recommended_path_if_proven":null,"guidance_status":"NOT_STATED","guidance_note":"resolution guidance: not stated for this semantic","related_execution_step_count":2,"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[],"state_reason":"the plan writes no resource for the unit and names the work a person does instead","source_observation":"The plan writes no resource for google_service_account.automation: google_service_account.automation is an identity of the source whose service account is written by the draft's converter of google_service_account, not by this plan: the plan states what uses it and attaches it to nothing. The plan writes no resource for google_service_account.server: google_service_account.server is an identity of the source whose service account is written by the draft's converter of google_service_account, not by this plan: the plan states what uses it and attaches it to nothing.","generated_target_behavior":"The draft writes no resource for google_service_account.automation and google_service_account.server.","residual_difference":"the work outside the draft is neither done nor verified by StackToIT","execution_effect":"No step waits for it. The plan can start MAN/identity/held:principal:google_service_account.automation and MAN/identity/held:principal:google_service_account.server now.","next_action":"Outside the draft, for google_service_account.automation and google_service_account.server: Decide who may use the STACKIT service account written for google_service_account.automation, what it may do and which workloads run as it: the draft attaches it to nothing (and 1 more manual steps); the plan lists it as manual work.","why_open":["The stackitsa plan of the draft writes no resource for 2 units and states why (no resource is written for the unit and the plan names a step beside it): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan."],"closes_when":["the people and the workloads that may use the service account written for google_service_account.automation are named, and the roles it holds are stated","the people and the workloads that may use the service account written for google_service_account.server are named, and the roles it holds are stated"],"required_inputs":[]}}],"record_shapes":[{"id":"RSH-07fa85711d49","why":"The knowledge base cannot decide 1 critical setting of {subject}: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.","required_evidence":[],"resolution":{"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on {subject} that the knowledge base cannot decide: Decide how the secrets are carried.","generated_target_behavior":"Decide how the secrets are carried: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/secret-settings).","residual_difference":"Decide how the secrets are carried: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/{subject}/secret-settings now.","next_action":"Decide how the secrets are carried: Decide how the secrets are carried for {subject}: A person recreates the secret in the Secrets Manager instance, since its data is not written into the draft, and decides for each IAM member whether it gets a user of the whole instance, a role binding on a secret group, or a separate instance. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Decide how the secrets are carried: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The settings of the secret beside its value (secret-value): STACKIT replicates it itself (no replica locations or per-replica keys), tags and version states have no counterpart, and IAM members and policy map to Secrets Manager users (read-only or read-write for a whole instance) or to experimental role bindings on a secret group — REVIEW."],"closes_when":["Decide how the secrets are carried: A person recreates the secret in the Secrets Manager instance, since its data is not written into the draft, and decides for each IAM member whether it gets a user of the whole instance, a role binding on a secret group, or a separate instance."],"required_inputs":[],"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[]}},{"id":"RSH-0c7479aef85e","why":"The knowledge base cannot decide 2 critical settings of {subject}: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings.","required_evidence":["the members that act as or manage the service account"],"resolution":{"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Review the account name setting; the 2 settings of the record state their own.","source_observation":"The source states 2 critical settings on {subject} that the knowledge base cannot decide: Review the account name setting; Map the IAM roles of the service account to STACKIT roles.","generated_target_behavior":"Review the account name setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). Map the IAM roles of the service account to STACKIT roles: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings). The draft writes the service account, and a STACKIT role assignment of the account for each grant on a project, a folder or an organisation whose role and members are visible statically and that has no condition; a grant that lets another account act as it is written as an Act-As assignment. A grant with a condition, a policy document, a repeated grant and a grant whose role or members are not visible statically are listed in the draft and not written.","residual_difference":"Review the account name setting: the target behaviour of this setting is not established Map the IAM roles of the service account to STACKIT roles: Which STACKIT role gives a member the access the Google role gave on the service account, and that no member gets more.","execution_effect":"No step waits for it. The plan can start MAN/semantic/{subject}/open-settings now.","next_action":"Review the account name setting: This setting follows the decision on the unit: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.","why_open":["Review the account name setting: A check of the knowledge base (sa account id not visible) fired on this unit and leaves the setting to a person: the target does not settle it by itself (a finding of this unit describes it). The account ID becomes the stackit_service_account name (shortened to the STACKIT name rules; pinned provider) — TRANSFORMED; the e-mail address changes. An ID not visible statically (or a repeated account) is named NOT CARRIED — REVIEW (check sa-account-id-not-visible).","Map the IAM roles of the service account to STACKIT roles: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The grants of the estate that name the account: a grant on a project, a folder or an organisation is written as a STACKIT role assignment of the account when its role and members are visible statically and it has no condition, and a grant that lets another account act as it is written as an Act-As assignment. A Google role is written as a STACKIT role only where the mapping shows the STACKIT role holds the same permissions or fewer on a project; every other role is an input that names the candidates, and a person confirms each. A binding or a policy is authoritative (it removes the members of its role that it does not list) and a role assignment only adds, which the draft says on each: members that hold the role outside the configuration keep it on STACKIT until a person removes them."],"closes_when":["Review the account name setting: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.","Map the IAM roles of the service account to STACKIT roles: The knowledge base's note on this setting states no closing condition; it is done when a person has chosen a way out above, recorded the choice, and the target is checked as the verification says.","Map the IAM roles of the service account to STACKIT roles: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting."],"required_inputs":["the members that act as or manage the service account"],"resolution_paths":[{"id":"role-bindings/bind-a-role-on-the-service-account","title":"Map the IAM roles of the service account to STACKIT roles: Bind a role of the STACKIT service account to the member","prerequisites":["the Google roles granted on the service account and what each one allowed","the roles the authorization API lists for the STACKIT service account"],"effects":["A role assignment on a STACKIT service account gives a role the authorization API lists for that account to a user, a service account or a client; given to a service account, it grants the Act-As permission, which lets that account impersonate the target account. A person re-maps each Google role on the account (using it, creating its keys, managing it) to a role of the STACKIT service account and binds it to the member. The assignment carries no condition and has no setting that removes the other holders of a role, so if the Google resource was authoritative (a binding for its role, a policy for the whole account) the replacing effect is not carried: a person lists who else holds a role on the account and removes what the source did not list. The resource is part of an experimental feature that is likely to change or be removed. The documents read do not state how a person, as opposed to a service account, acts as the account."],"risk":["A role chosen too wide lets a member act as the account more than the source allowed."],"evidence":["provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_service_account_role_assignment.md: \"`resource_id` (String) Service-account Resource to assign the role to.\"","provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_service_account_role_assignment.md: \"`subject` (String) Identifier of user, service account or client.\"","provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_service_account_role_assignment.md: \"Use this resource to grant 'Act-As' permissions. This allows a service-account (the `subject`) to impersonate the target Service Account.\"","provider-docs mirror stackit/terraform-provider-stackit-0.119.0/docs/resources/authorization_folder_role_assignment.md: \"This resource is part of the experimental feature iam and is likely going to undergo significant changes or be removed in the future. Use it at your own discretion.\""],"regeneration_required":false}],"required_verification":["Map the IAM roles of the service account to STACKIT roles: each member can do what the source role allowed on the service account and nothing more, tried on the target"],"next_run_changes":["A rerun writes no further role assignment on its own; an answer in the decisions file records the choice and writes nothing."],"remains_manual":["Map the IAM roles of the service account to STACKIT roles: Manual work remains: a person closes the semantic, the draft does not."],"evidence_refs":["contract note gcp.service_account/role-bindings: \"Role assignments need the experimental IAM feature of the pinned STACKIT provider.\""]}},{"id":"RSH-68efa90e8f69","why":"The knowledge base cannot decide 1 critical setting of {subject}: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.","required_evidence":[],"resolution":{"state_reason":"a person's decision or input is still open","source_observation":"The source states 1 critical setting on {subject} that the knowledge base cannot decide: Review the build identity setting.","generated_target_behavior":"Review the build identity setting: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/unit/{subject}).","residual_difference":"Review the build identity setting: the draft writes nothing for the unit: what the setting becomes depends on what replaces it","execution_effect":"No step waits for it. Held by something else first: MAN/unit/{subject}.","next_action":"Review the build identity setting: This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied.","why_open":["Review the build identity setting: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. The service account the build (or the Pub/Sub push notification) runs as; STACKIT Git Pipelines has its own, differently-shaped identity model -- REVIEW."],"closes_when":["Review the build identity setting: A person decides the setting with what replaces the unit once the architect has chosen it, or the knowledge base gains a rule that decides this setting."],"required_inputs":[],"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[]}},{"id":"RSH-c07ca4685b85","why":"The knowledge base cannot decide 2 critical settings of {subject}: for each, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The review step of the execution plan for these settings is MAN/semantic/{subject}/open-settings-security-architect.","required_evidence":[],"resolution":{"state_reason":"a person's decision or input is still open This is the state of the setting of this unit that asks the most, Provide the values of the secrets; the 2 settings of the record state their own.","source_observation":"The source states 2 critical settings on {subject} that the knowledge base cannot decide: Provide the values of the secrets; Confirm the name of the secret.","generated_target_behavior":"Provide the values of the secrets: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-security-architect). Confirm the name of the secret: The draft does not carry the setting on {subject}; a manual step stands for it (MAN/semantic/{subject}/open-settings-security-architect).","residual_difference":"Provide the values of the secrets: the target behaviour of this setting is not established Confirm the name of the secret: the target behaviour of this setting is not established","execution_effect":"No step waits for it. The plan can start MAN/semantic/{subject}/open-settings-security-architect now.","next_action":"Provide the values of the secrets: Provide the values of the secrets for {subject}: A person decides where the value comes from, supplies the document and the step has run. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).","why_open":["Provide the values of the secrets: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_secret_manager_secret_version.secret_data: the value of the secret. StackToIT never reads it and never writes it into the draft; the API step of the secret writes the document the customer supplies.","Confirm the name of the secret: The mapping rule for this kind of unit recognises the unit but only passes this setting to a person; it does not decide its value. google_secret_manager_secret.secret_id: The secret's own resource identifier; access to the secret's value is controlled by IAM bindings and replication/encryption settings, not by the id string itself."],"closes_when":["Provide the values of the secrets: A person decides where the value comes from, supplies the document and the step has run.","Confirm the name of the secret: A person confirms the secret name in STACKIT Secrets Manager against what refers to the source secret ID, or accepts the new name."],"required_inputs":[],"resolution_paths":[],"required_verification":[],"next_run_changes":[],"remains_manual":[],"evidence_refs":[]}}]},"applications":{"input":{"state":"NOT_PROVIDED","reason":"No applications file was given, so no unit is grouped into an application. Pass --applications FILE (stacktoit assess --help names the schema of the file) to state the applications and the selectors that assign units to them."},"proposed":{"state":"SUGGESTED","reason":"Suggested from the workloads of the source, not confirmed by the customer: these groups are a reading of names, tags and references in the Terraform. Nothing is an application until the applications file (--applications) or the review file states it, and where it does the stated applications win and the suggestion is shown as a diff against them.","authority":"NOT_CUSTOMER_CONFIRMED","rule":"One group per workload that is switched on: an ECS service, a Lambda function, a Kubernetes deployment, stateful set, daemon set, replication controller, pod, job or cron job, a load balancer with the instances and Auto Scaling groups it routes to, an instance or Auto Scaling group no load balancer fronts, or an EKS cluster when the estate holds no Kubernetes workload (such a group is a platform: its workloads are not visible in Terraform). A group holds its workload and the datastores, security groups, roles, log groups, secrets, keys and similar units that only that workload reaches: what the workload depends on (for an ECS service what its task definition names, for a Lambda function what its environment names, for a load balancer what it routes to), what those depend on in turn, the queues, streams, topics, buckets and EventBridge rules that feed a member (an event source mapping, a subscription, a rule target or the permission that names the rule, a bucket notification), the units a policy of a member names in a statement that is not a Deny, the units a DNS record that the workload names points at (a DNS record or a service-discovery registration that only points at a member is shown and adds no member), the datastore behind a security group whose ingress names a security group the workload itself uses, and the units that exist only for a member and depend on it (volumes, autoscaling targets, the secret of a database, the roles and node security group of a cluster, the Service, Ingress, autoscaler, network policy and disruption budget of a Kubernetes workload). An application tag the source states as a literal (Application, App, ApplicationName, AppName, ApplicationId, Workload, or Service where there is none of those) names the application: workloads that share the value are one group, a tagged unit no workload reaches joins the group of its value, and a unit tagged with another value than the group that reaches it is shared. A tag read from a variable is shown and never decides. A unit that more than one group reaches is shared and belongs to no group, unless exactly one of them carries the unit's tag value. The network, the ECS cluster and the gateways belong to no group, and a module name never makes one. A group is named by its application tag, else by the name of its workload, else by the family of its task definition, else by its address. For Google Cloud: a workload is a Cloud Run service, job or worker pool, a Cloud Function, a Compute Engine instance or managed instance group no load balancer fronts, the forwarding rule of a load balancer with the instances, groups and serverless services behind its backend services (the target proxy and the URL map are followed), or a GKE cluster when the estate holds no Kubernetes workload (a platform). A group holds the Cloud SQL, Memorystore, Spanner, Bigtable, Firestore, AlloyDB and Cloud Storage units, and the service accounts, secrets, keys, topics, queues, repositories, disks and addresses, that only the workload reaches: what its runtime configuration names (the environment and the secret mounts of a Cloud Run service or a Cloud Function), what those depend on in turn, and the resources an IAM role binding or member names together with the service account of a member (the role is not read, so it is a reference and not a stated grant). An application label the source states as a literal (application, app, workload, or service where there is none of those) names the application as a tag does; a label read from a variable is shown and never decides.","groups":[{"id":"migrate","name":"migrate","basis":"CLOUD_RUN_SERVICE","name_from":"RESOURCE_LABEL","anchor":"google_cloud_run_v2_job.migrate","confidence":"MEDIUM","confidence_reason":"The references of the source make the group; no application tag confirms it.","members_sha256":"6a785e14c522b2e7d9d742bba14e04ddfeb860b857f06f47a70524b61e0c37cf","evidence":[],"members":[{"unit":"google_cloud_run_v2_job.migrate","source_type":"google_cloud_run_v2_job","role":"WORKLOAD","via":"THE_WORKLOAD","in_totals":true,"evidence":[]},{"unit":"google_secret_manager_secret.django_admin_password","source_type":"google_secret_manager_secret","role":"SUPPORT","via":"REFERENCED_BY_A_MEMBER","in_totals":true,"evidence":[{"origin":"IAM_POLICY_REFERENCE","source":"TERRAFORM_REFERENCE","rank":5,"decides":true,"from":"google_secret_manager_secret_iam_binding.django_admin_password","to":"google_secret_manager_secret.django_admin_password","edge":"DEPENDS_ON","via":"secret_id","note":"the IAM resource google_secret_manager_secret_iam_binding.django_admin_password names the service account google_service_account.automation and google_secret_manager_secret.django_admin_password; an IAM policy of a member names it in a statement that is not a Deny (a unit that only a Deny names is no member); the actions are not read, so this is a reference and not a stated grant"}]},{"unit":"google_service_account.automation","source_type":"google_service_account","role":"SUPPORT","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"google_cloud_run_v2_job.migrate","to":"google_service_account.automation","edge":"DEPENDS_ON","via":"template.template.service_account"}]}],"selectors":["google_cloud_run_v2_job.migrate","google_secret_manager_secret.django_admin_password","google_service_account.automation"],"totals":{"entries":3,"counted_in_totals":3,"units_by_class":[{"key":"CONTAINERIZE","count":1},{"key":"RECONFIGURE","count":2}]},"depends_on_groups":[],"shared_units":["google_secret_manager_secret.django_settings","google_sql_database_instance.postgres","google_storage_bucket.media"],"dependencies":"NO_SDK_USE_FOUND","dependencies_detail":{"origin":"STATIC_CODE_HINT","reason":"No AWS SDK use found in the 4 code files in the whole source (no folder of this proposed group's units is known) (static scan of Python, JavaScript, TypeScript, Go, Java, Kotlin and C# files, origin STATIC_CODE_HINT).","scope":"WHOLE_SOURCE"},"answers":{"can_move":{"steps":5,"free_of_decisions_and_prerequisites":4,"runs_as_written":0,"waiting_for_value":4,"on_unconfirmed_default":0,"after_manual":0,"waiting_for_decisions":1,"not_executable":0,"manual_waiting_for_decisions":3},"blocked_by":[{"record":"DEC-GEN-CONVERT-API-OPT-IN","steps":3,"frees_alone":3},{"record":"DEC-GEN-CONVERT-SOURCE-REGION-MAPPING","steps":1,"frees_alone":1}],"top_decisions":["DEC-GEN-CONVERT-API-OPT-IN","DEC-GEN-CONVERT-SOURCE-REGION-MAPPING"],"top_frees_together":4,"work":{"manual_steps":14,"data_moves":0},"accept":[{"record":"DEC-IAM-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE","area":"IAM","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD","area":"IAM","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-IAM-GOOGLE-SERVICE-ACCOUNT-AUTOMATION","area":"IAM","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-NET-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE","area":"NET","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-SEC-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE","area":"SEC","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD","area":"SEC","kind":"SECURITY_DECISION_OPEN"}],"shared":{"units":3,"manual_steps":33,"data_moves":2,"data_stores":["google_sql_database_instance.postgres","google_storage_bucket.media"]}}},{"id":"server","name":"server","basis":"CLOUD_RUN_SERVICE","name_from":"RESOURCE_LABEL","anchor":"google_cloud_run_v2_service.server","confidence":"MEDIUM","confidence_reason":"The references of the source make the group; no application tag confirms it.","members_sha256":"660eb97068c757548fa9ea547aa64902965c4abe0319c963374b74e45596fe67","evidence":[],"members":[{"unit":"google_cloud_run_v2_service.server","source_type":"google_cloud_run_v2_service","role":"WORKLOAD","via":"THE_WORKLOAD","in_totals":true,"evidence":[]},{"unit":"google_service_account.server","source_type":"google_service_account","role":"SUPPORT","via":"REFERENCED_BY_THE_WORKLOAD","in_totals":true,"evidence":[{"origin":"REFERENCE","source":"TERRAFORM_REFERENCE","rank":2,"decides":true,"from":"google_cloud_run_v2_service.server","to":"google_service_account.server","edge":"DEPENDS_ON","via":"template.service_account"}]}],"selectors":["google_cloud_run_v2_service.server","google_service_account.server"],"totals":{"entries":2,"counted_in_totals":2,"units_by_class":[{"key":"CONTAINERIZE","count":1},{"key":"RECONFIGURE","count":1}]},"depends_on_groups":[],"shared_units":["google_secret_manager_secret.django_settings","google_sql_database_instance.postgres","google_storage_bucket.media"],"dependencies":"NO_SDK_USE_FOUND","dependencies_detail":{"origin":"STATIC_CODE_HINT","reason":"No AWS SDK use found in the 4 code files in the whole source (no folder of this proposed group's units is known) (static scan of Python, JavaScript, TypeScript, Go, Java, Kotlin and C# files, origin STATIC_CODE_HINT).","scope":"WHOLE_SOURCE"},"answers":{"can_move":{"steps":2,"free_of_decisions_and_prerequisites":2,"runs_as_written":0,"waiting_for_value":2,"on_unconfirmed_default":0,"after_manual":0,"waiting_for_decisions":0,"not_executable":0,"manual_waiting_for_decisions":1},"blocked_by":[{"record":"DEC-GEN-CONVERT-SOURCE-REGION-MAPPING","steps":1,"frees_alone":1}],"top_decisions":["DEC-GEN-CONVERT-SOURCE-REGION-MAPPING"],"work":{"manual_steps":10,"data_moves":0},"accept":[{"record":"DEC-IAM-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","area":"IAM","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-IAM-GOOGLE-SERVICE-ACCOUNT-SERVER","area":"IAM","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-NET-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","area":"NET","kind":"SECURITY_DECISION_OPEN"},{"record":"DEC-SEC-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER","area":"SEC","kind":"SECURITY_DECISION_OPEN"}],"shared":{"units":3,"manual_steps":33,"data_moves":2,"data_stores":["google_sql_database_instance.postgres","google_storage_bucket.media"]}}}],"shared":[{"unit":"google_secret_manager_secret.django_settings","source_type":"google_secret_manager_secret","groups":["migrate","server"],"reason":"REACHED_BY_SEVERAL"},{"unit":"google_sql_database_instance.postgres","source_type":"google_sql_database_instance","groups":["migrate","server"],"reason":"REACHED_BY_SEVERAL"},{"unit":"google_storage_bucket.media","source_type":"google_storage_bucket","groups":["migrate","server"],"reason":"REACHED_BY_SEVERAL"}]},"unused_selectors":[],"applications":[],"conflicts":[],"code_dependencies":{"origin":"STATIC_CODE_HINT","code_files":4,"unsupported_code_files":0,"oversize_files":0,"not_text_files":0,"symlinks_skipped":0,"limits":{"max_code_files":5000,"max_file_bytes":1048576,"max_entries":200000,"max_hits":5000,"skipped_directories":["node_modules","vendor","build","dist","target","out","bin","obj","__pycache__","site-packages","venv","cdk.out","bower_components"]},"rule":"A code file belongs to an application when it sits under the common folder of that application's units (the folder of the files that declare them, relative to the source). The deepest such folder wins. A folder that two applications share, a file under no application's folder and an application whose units share no folder below the source root tie nothing: the hits of such a file are listed under the estate, and an application with no folder of its own reads the whole source and says so.","services":[],"hits":[],"estate_hits":0},"kubernetes_manifests":{"origin":"KUBERNETES_MANIFEST_FILE","objects":2,"helm_charts":0,"tied_to_terraform":0,"not_tied":2,"references_resolved_in_terraform":0,"rule":"A manifest object ties to a Terraform unit only when both state the same kind, the same name and the same namespace as literals (a kubernetes_* resource), or, for a Helm chart, when a helm_release names the chart by the literal local path of its folder. A name or namespace that is a variable, an expression or absent in the manifest ties nothing, and so does a namespace of the resource that is a variable or an expression; a kubernetes_* resource that states no namespace at all stands in the namespace default, which the hashicorp/kubernetes provider gives it, so only a manifest that states the namespace default ties to it. An object that more than one object or unit answers is not tied. A tie is evidence for the PROPOSED group that holds the unit (on every group that reaches a shared unit, labelled shared; on the tie itself when no group holds the unit) and never adds or removes a member. A Secret or ConfigMap that a manifest names and no manifest declares is resolved in Terraform only by the same literal name and namespace of exactly one kubernetes_secret or kubernetes_config_map.","ties":[]},"outside":{"shared":{"units":3,"manual_steps":33,"data_moves":2,"data_stores":["google_sql_database_instance.postgres","google_storage_bucket.media"]},"unassigned":{"units":8,"manual_steps":9,"data_moves":0}}},"target_fit_matrix":{"catalogue":{"provider":"stackit","version":"0.121.0","sha256":"60bdce0074519d22377d9657ddc61160ef40e60a9c4bc6b269c74319b8af507d","rows":321},"as_of":"2026-11-07","dimensions":[{"id":"functional_parity","name":"Functional parity","stock":{"state":"NOT_ASSESSED","basis":"The model has no field for functional parity or changed semantics, so it is not assessed for any capability."}},{"id":"service","name":"Service","stock":{"state":"NOT_ASSESSED","basis":"The registry states no service availability for this capability."}},{"id":"api","name":"API","stock":{"state":"NOT_ASSESSED","basis":"The registry states no API capability for this capability."}},{"id":"terraform","name":"Terraform","stock":{"state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability."}},{"id":"region","name":"Region","stock":{"state":"NOT_ASSESSED","basis":"The registry states no regions for this capability. Where a catalogue snapshot offers a unit's target in a region, the unit says so (Target Fit page, per unit)."}},{"id":"maturity","name":"Maturity","stock":{"state":"NOT_ASSESSED","basis":"The registry states no maturity for this capability."}},{"id":"quota","name":"Quota","stock":{"state":"NOT_ASSESSED","basis":"The registry has no complete statement of the quotas of this capability."}},{"id":"lifecycle","name":"Lifecycle","stock":{"state":"NOT_ASSESSED","basis":"The registry states no lifecycle for this capability. The typed lifecycle of a target with dated lifecycle data is shown per unit."}},{"id":"operability","name":"Operability","stock":{"state":"NOT_ASSESSED","basis":"No provider or backend behaviour is recorded for this capability. That is not the same as having none."}},{"id":"security","name":"Security","stock":{"state":"NOT_ASSESSED","basis":"The registry states no security features or defaults for this capability."}},{"id":"support","name":"Support","stock":{"state":"NOT_ASSESSED","basis":"A capability states no support requirement; the support verdict is per application (support_suitability)."}},{"id":"evidence","name":"Evidence and probes","stock":{"state":"NOT_ASSESSED","basis":"No probe of the live target and no capability-level evidence is recorded for this capability."}}],"rows":[{"capability_id":"account.console-customization","ref":"capability:account.console-customization","description":"Per-account display settings of the management console (colour, visible regions and services).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"account.contact-management","ref":"capability:account.contact-management","description":"A contact object of the cloud account (primary contact: name, address, phone).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"account.quota-automation","ref":"capability:account.quota-automation","description":"Templates and automatic management of quotas across new projects or accounts.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"account.quota-increase","ref":"capability:account.quota-increase","description":"A resource that raises a quota of the account or project (a limit request with a status).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ai-ops.operations-agent","ref":"capability:ai-ops.operations-agent","description":"AI operations and incident investigation agent (AWS DevOps Agent).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ai.agent-registry","ref":"capability:ai.agent-registry","description":"A catalogue of agents, tools and MCP servers with an approval workflow.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ai.contact-centre-assistant","ref":"capability:ai.contact-centre-assistant","description":"A contact-centre agent-assist service (real-time knowledge and generative answers for agents).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ai.managed-ai-apis","ref":"capability:ai.managed-ai-apis","description":"Managed AI service accounts / cognitive APIs / model invocation logging beyond model serving.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ai.model-guardrails","ref":"capability:ai.model-guardrails","description":"Managed content-safety, topic, word and personal-data filtering of model input and output.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"alerting.sms-receiver","ref":"capability:alerting.sms-receiver","description":"An SMS (text message) receiver for alert notifications.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"analytics.managed-business-intelligence","ref":"capability:analytics.managed-business-intelligence","description":"A managed business-intelligence, dashboard or embedded-analytics service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"applications.supply-chain-management","ref":"capability:applications.supply-chain-management","description":"A supply-chain planning and visibility application with its own data lake (demand and supply planning, n-tier supplier visibility).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"backup.hypervisor-gateway","ref":"capability:backup.hypervisor-gateway","description":"Backup gateway to a customer hypervisor.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"billing.invoice-configuration","ref":"capability:billing.invoice-configuration","description":"Configuration of invoice units and the delivery of e-invoices to procurement portals.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"block-storage.default-encryption-key","ref":"capability:block-storage.default-encryption-key","description":"A project-wide default customer key for the encryption of new volumes.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"block-storage.scheduled-snapshots-by-label","ref":"capability:block-storage.scheduled-snapshots-by-label","description":"Snapshots of block volumes taken on a schedule, the volumes chosen by label/tag, a retention count or age kept (AWS Data Lifecycle Manager, GCP snapshot schedule policies, the EBS part of AWS Backup).","unit_services":[],"provided_by":["stackit_volume_automation"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,BETA","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_volume_automation","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","BETA"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_volume_automation","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.enable_beta_resources","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"block-storage.snapshot-sharing","ref":"capability:block-storage.snapshot-sharing","description":"Sharing of volume snapshots with other projects or accounts.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"block-storage.volume-encryption","ref":"capability:block-storage.volume-encryption","description":"Encryption at rest of STACKIT block storage volumes (stackit_volume: the computed encrypted flag and the optional encryption_parameters that name a STACKIT KMS key). Source counterparts: aws_ebs_volume.encrypted / kms_key_id, azurerm_managed_disk.disk_encryption_set_id, google_compute_disk.disk_encryption_key.","unit_services":[],"provided_by":["stackit_volume"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_volume","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_volume","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: resource_schemas.stackit_volume attribute encryption_parameters","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"blockchain.node-access","ref":"capability:blockchain.node-access","description":"Managed access to public blockchain networks with billing tokens.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"cdn.custom-domain","ref":"capability:cdn.custom-domain","description":"A customer domain on a CDN distribution with a managed or an uploaded certificate (stackit_cdn_custom_domain). Source counterparts: aws_cloudfront_distribution aliases with an ACM certificate, azurerm_cdn_frontdoor_custom_domain, a custom domain of a Cloud CDN backend.","unit_services":["STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain"],"provided_by":["stackit_cdn_custom_domain"],"units":1,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/network/load-balancing-and-content-delivery/cdn/basics/features-cdn/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/cdn/v1/cdn.json:3849-4199","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,BETA","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_cdn_custom_domain","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","BETA"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_cdn_custom_domain","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"BETA","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 (resource_schemas.stackit_cdn_custom_domain.block.description)","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.enable_beta_resources","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"cdn.distribution","ref":"capability:cdn.distribution","description":"A content delivery network distribution in front of an HTTP origin or an S3-compatible bucket (stackit_cdn_distribution: origin, regions, geoblocking, blocked IPs, cache duration, cache key (query-string vary and request headers, in the pinned provider), redirects, TLS versions, WAF, Image Optimizer). Source counterparts: aws_cloudfront_distribution, azurerm_cdn_* / azurerm_cdn_frontdoor_*, google_compute_backend_bucket with Cloud CDN.","unit_services":["STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain"],"provided_by":["stackit_cdn_distribution"],"units":1,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/network/load-balancing-and-content-delivery/cdn/basics/features-cdn/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/cdn/v1/cdn.json:2410-2924","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,BETA","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_cdn_distribution","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","BETA"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_cdn_distribution","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"BETA","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 (resource_schemas.stackit_cdn_distribution.block.description)","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":3},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.enable_beta_resources","freshness":"FRESH"},{"kind":"PUBLIC_ISSUE","source":"https://github.com/stackitcloud/terraform-provider-stackit/issues/1629","freshness":"FRESH"},{"kind":"PUBLIC_ISSUE","source":"https://github.com/stackitcloud/terraform-provider-stackit/issues/1630","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"chatops.integration","ref":"capability:chatops.integration","description":"A ChatOps / Slack / Teams notification integration.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compliance.multicloud-inventory","ref":"capability:compliance.multicloud-inventory","description":"Configuration inventory and compliance assessment of resources in another cloud (AWS Config connector to Azure).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.container-applications","ref":"capability:compute.container-applications","description":"A managed platform for container applications (STACKIT Container Applications, SCA: environments, applications, events, logs). Source counterparts: AWS App Runner, Cloud Run, Azure Container Apps. No docs.stackit.cloud product page for it was found (searched 2026-10-17). The pinned provider has no resource type for it.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/sca/v1alpha/sca.json:953","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability. Whether STACKIT offers this service is not established. A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT drafts no Terraform for it; it writes STACKIT API steps as scripts for part of it, and the rest needs extra implementation."},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"PREVIEW","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/sca/v1alpha/sca.json:953","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.edge-vision-appliance","ref":"capability:compute.edge-vision-appliance","description":"A managed appliance and application deployment service for computer vision at a camera site.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.function-service","ref":"capability:compute.function-service","description":"A generally available function-as-a-service (event triggers, aliases, versions, URLs, layers, capacity providers).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.functions","ref":"capability:compute.functions","description":"A managed function-as-a-service (STACKIT Functions: functions, revisions, pull credentials). Source counterpart: AWS Lambda (the knowledge base drafts a Cloud Foundry app instead). No docs.stackit.cloud product page for it was found (searched 2026-10-17 and again 2026-10-28: the docs site has no Functions page (https://docs.stackit.cloud/products/runtime/functions/ answers 404), the release notes name no Functions release, and a marketing page of 2026-08-26 names STACKIT Functions without a status), so its official status is not established. The pinned provider has no resource type for it (the pinned provider schema: no function resource other than the Cloud Foundry organization).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/functions/v1alpha/functions.json:774","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability. Whether STACKIT offers this service is not established. A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT drafts no Terraform for it; it writes STACKIT API steps as scripts for part of it, and the rest needs extra implementation."},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"PREVIEW","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/functions/v1alpha/functions.json:774","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.hybrid-k8s-management","ref":"capability:compute.hybrid-k8s-management","description":"Hybrid / fleet Kubernetes management (Arc, GKE Fleet).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.image-building","ref":"capability:compute.image-building","description":"A managed image-building pipeline (recipes, components, schedules, distribution, lifecycle).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.mainframe-runtime","ref":"capability:compute.mainframe-runtime","description":"A managed runtime for modernised mainframe applications.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.managed-batch","ref":"capability:compute.managed-batch","description":"A managed batch service: job queues with priority and fair share, job definitions, compute environments, quota shares and consumable resources.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.managed-desktop-instances","ref":"capability:compute.managed-desktop-instances","description":"Managed desktop instances registered with a streaming service, with licence specifications.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.managed-kubernetes","ref":"capability:compute.managed-kubernetes","description":"Managed Kubernetes control plane and node pools (STACKIT Kubernetes Engine, SKE).","unit_services":["Kubernetes Job/CronJob on SKE","SKE workload (or Cloud Foundry Docker app)"],"provided_by":["stackit_ske_cluster"],"units":2,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_ske_cluster","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_ske_cluster","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":3},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/kubernetes-engine/reference/lifecycle/","freshness":"FRESH"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: resource_schemas.stackit_ske_cluster extensions.argus","freshness":"FRESH"},{"kind":"PUBLIC_ISSUE","source":"https://github.com/stackitcloud/terraform-provider-stackit/issues/1713","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.managed-paas-source-deploy","ref":"capability:compute.managed-paas-source-deploy","description":"A managed service that builds and deploys a web application from a source repository.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.microvm-service","ref":"capability:compute.microvm-service","description":"A managed microVM service (images, instances with a dedicated endpoint, network connectors).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.outposts","ref":"capability:compute.outposts","description":"Outposts-style on-premises rack extension (racks, sites, capacity tasks, volumes and snapshots on a rack, EKS on a rack).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.rightsizing-recommendations","ref":"capability:compute.rightsizing-recommendations","description":"A service that recommends other sizes from measured utilisation.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.robot-fleet-and-simulation","ref":"capability:compute.robot-fleet-and-simulation","description":"A robot fleet registry with software deployment and a managed robotics simulation service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.secure-browser","ref":"capability:compute.secure-browser","description":"Managed isolated (remote) browsing with a portal, browser policy, IP rules, session logging and identity provider.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.server-volume-encryption","ref":"capability:compute.server-volume-encryption","description":"Encryption at rest of the volumes a STACKIT server runs from (stackit_server boot_volume: an image or a volume as the boot source). Source counterparts: aws_instance.root_block_device and aws_launch_template block_device_mappings (encrypted, kms_key_id), azurerm_*_virtual_machine os_disk.disk_encryption_set_id and encryption_at_host_enabled, google_compute_instance boot_disk (kms_key_self_link).","unit_services":[],"provided_by":["stackit_server"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_server","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_server","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: data_source_schemas.stackit_image_v2 block description","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.spatial-simulation","ref":"capability:compute.spatial-simulation","description":"A managed distributed spatial simulation runtime with worlds, partitions and snapshots.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.spot-capacity","ref":"capability:compute.spot-capacity","description":"Spot, preemptible or interruptible server capacity bought at a discount, and its billing data feed.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.systems-management-service-settings","ref":"capability:compute.systems-management-service-settings","description":"Account-level settings of a systems-management service (Parameter Store tiers, automation logging, default host management, document sharing).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.virtual-desktop","ref":"capability:compute.virtual-desktop","description":"Managed virtual desktops (persistent or pooled) with directory sign-in, session timeouts and IP access control.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.virtual-workstations","ref":"capability:compute.virtual-workstations","description":"A service that streams graphics workstations (with a session broker, clipboard and session-length control) to studio users.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.vm-autoscaling","ref":"capability:compute.vm-autoscaling","description":"Managed autoscaling of server groups (elastic fleets that grow and shrink on load).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"compute.vmware-platform","ref":"capability:compute.vmware-platform","description":"A VMware Cloud Foundation environment (vCenter, NSX, vSAN) run as a cloud service (Amazon EVS).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"contact-centre.cloud-contact-centre","ref":"capability:contact-centre.cloud-contact-centre","description":"Cloud contact centre with telephony, queues, routing, flows, outbound campaigns and agent workspace (Amazon Connect).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"container.registry-account-settings","ref":"capability:container.registry-account-settings","description":"Registry-wide settings, resource policy and creation templates of a container registry.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"container.registry-public","ref":"capability:container.registry-public","description":"Anonymous public pulls from a container registry.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"cost.budget-alerts","ref":"capability:cost.budget-alerts","description":"Budgets with spend threshold alerts.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"cost.budgets","ref":"capability:cost.budgets","description":"A budget with a limit and alerting, attachable to resources.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"cost.categorization","ref":"capability:cost.categorization","description":"Rule-based cost allocation / categorization.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"cost.commitment-plans","ref":"capability:cost.commitment-plans","description":"A purchasable usage commitment (savings plan) that discounts compute and service usage.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"cost.invoice-grouping","ref":"capability:cost.invoice-grouping","description":"Regrouping of accounts or projects into separate invoices.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"cost.recommendations","ref":"capability:cost.recommendations","description":"Cost optimisation recommendations with savings estimates.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"cost.usage-report-export","ref":"capability:cost.usage-report-export","description":"Scheduled cost and usage report export to object storage in a billing data format (AWS Cost and Usage Reports).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"customer-data.profile-unification","ref":"capability:customer-data.profile-unification","description":"Customer data platform: unified customer profiles from many sources with calculated attributes, segments, event triggers and recommendations (Amazon Connect Customer Profiles).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data-protection.recycle-bin","ref":"capability:data-protection.recycle-bin","description":"Retention of deleted snapshots and images for undeletion.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data-transfer.managed-sync","ref":"capability:data-transfer.managed-sync","description":"Managed data transfer and synchronisation between storage systems (agent, locations, tasks).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data-transfer.storage-discovery","ref":"capability:data-transfer.storage-discovery","description":"Discovery of on-premises storage systems for sizing.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.analytics-zero-etl","ref":"capability:data.analytics-zero-etl","description":"Managed continuous replication of an operational database into an analytics store.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.cache-user-acl","ref":"capability:data.cache-user-acl","description":"Per-user access strings, user groups and ACLs for an in-memory data store.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.commitment-reservations","ref":"capability:data.commitment-reservations","description":"A reservation or commitment resource for database capacity.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.cross-region-replication","ref":"capability:data.cross-region-replication","description":"Managed replication of a database, table or cache across regions, and multi-region active-active SQL.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.customer-profiles","ref":"capability:data.customer-profiles","description":"A customer-data platform with profile unification and identity resolution.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.data-warehouse","ref":"capability:data.data-warehouse","description":"A managed columnar data warehouse (Redshift-class) and its serverless form.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.database-connection-pool","ref":"capability:data.database-connection-pool","description":"A managed database connection pool or proxy with extra endpoints.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.database-engine-iam-role","ref":"capability:data.database-engine-iam-role","description":"An IAM role the database engine assumes to call other services (S3 import and export, Lambda).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.database-event-notifications","ref":"capability:data.database-event-notifications","description":"A database lifecycle event feed (failover, maintenance, backup) to a notification channel.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.database-snapshot-resource","ref":"capability:data.database-snapshot-resource","description":"A named, shareable, copyable database snapshot as a resource.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.database-stop-start","ref":"capability:data.database-stop-start","description":"Stopping and starting a managed database or warehouse (pause, resume, scheduled).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.dremio","ref":"capability:data.dremio","description":"A managed Dremio data lakehouse instance and its local users (stackit_dremio_instance, stackit_dremio_user). Source counterparts: none established; the AWS, Azure and Google lakehouse and query services (Athena, Synapse, BigQuery) are not equivalents of Dremio and no rule maps to it on a feature level.","unit_services":[],"provided_by":["stackit_dremio_instance","stackit_dremio_user"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"PREVIEW","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/data-and-ai/dremio/release-notes/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/dremio/v1beta/dremio.json:518-845","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,EXPERIMENTAL","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_dremio_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"dremio"},{"type":"stackit_dremio_user","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"dremio"}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_dremio_instance","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_dremio_user","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"EXPERIMENTAL","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 (resource_schemas.stackit_dremio_instance.block.description, resource_schemas.stackit_dremio_user.block.description)","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.experiments","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.dynamodb-compatible-store","ref":"capability:data.dynamodb-compatible-store","description":"A DynamoDB-compatible key-value store and its accelerator, index, stream and policy objects.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.genomics-store","ref":"capability:data.genomics-store","description":"A managed genomics store (sequence, reference, annotation or variant data) and workflow runs.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.horizontal-sharding-relational","ref":"capability:data.horizontal-sharding-relational","description":"A horizontally sharded relational database behind one endpoint (Aurora Limitless).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.ledger-database","ref":"capability:data.ledger-database","description":"A managed immutable ledger database with a verifiable journal.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.managed-cassandra","ref":"capability:data.managed-cassandra","description":"A managed Cassandra-compatible wide-column service (CQL).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.managed-ingestion-pipeline","ref":"capability:data.managed-ingestion-pipeline","description":"A managed Data Prepper style ingestion pipeline into a search service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.managed-mysql","ref":"capability:data.managed-mysql","description":"A managed MySQL engine (MariaDB is the closest).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.managed-oracle","ref":"capability:data.managed-oracle","description":"A managed Oracle (or Db2) database.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.opensearch-instance","ref":"capability:data.opensearch-instance","description":"A managed OpenSearch instance and its credentials (stackit_opensearch_instance, stackit_opensearch_credential). Among the sources the AWS rules map to it: aws_opensearch_domain and aws_elasticsearch_domain. The serverless and identity-integration absences stay recorded under data.search-serverless and data.search-identity-integration.","unit_services":[],"provided_by":["stackit_opensearch_credential","stackit_opensearch_instance"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/opensearch/v2/opensearch.json:837; stackitcloud/stackit-api-specifications, services/opensearch/v2/opensearch.json:1337","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_opensearch_credential","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_opensearch_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_opensearch_credential","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_opensearch_instance","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.search-identity-integration","ref":"capability:data.search-identity-integration","description":"SAML, Cognito or Identity Center sign-in and principal-scoped data access policies for a search service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.search-serverless","ref":"capability:data.search-serverless","description":"A serverless search service with auto-scaling capacity units and capacity groups.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.time-series-database","ref":"capability:data.time-series-database","description":"A managed time-series database (Timestream SQL, managed InfluxDB).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.transfer-scheduler","ref":"capability:data.transfer-scheduler","description":"A managed scheduled data transfer / ETL connector.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.valkey-instance","ref":"capability:data.valkey-instance","description":"A managed Key Value Store (Valkey) instance and its credentials (stackit_valkey_instance, stackit_valkey_credential). Among the sources the AWS rules map to it: aws_elasticache_replication_group and aws_elasticache_cluster.","unit_services":[],"provided_by":["stackit_valkey_credential","stackit_valkey_instance"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/valkey/v2/valkey.json:864; stackitcloud/stackit-api-specifications, services/valkey/v2/valkey.json:1364","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_valkey_credential","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_valkey_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_valkey_credential","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_valkey_instance","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.warehouse-data-sharing","ref":"capability:data.warehouse-data-sharing","description":"Live data sharing between warehouses and accounts, endpoint grants and partner integrations.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"data.workflows","ref":"capability:data.workflows","description":"A managed Apache Airflow service (STACKIT Workflows: instances, DAG bundles, a DAG repository). Source counterparts: Amazon MWAA and Cloud Composer. It is DAG orchestration only: the low-code integration and per-task queue parts of the capability workflow.orchestration are not part of it. The pinned provider has no resource type for it (checked against the pinned provider schema: no workflow resource).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/data-and-ai/workflows/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/workflows/v1alpha/workflows.json:1133","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability. STACKIT offers this service (preview). A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT drafts no Terraform for it; it writes STACKIT API steps as scripts for part of it, and the rest needs extra implementation."},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"PREVIEW","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_API_SPEC","source":"STACKIT API specification workflows_v1alpha","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"database.instance-protection","ref":"capability:database.instance-protection","services":["postgres-flex","sqlserverflex"],"unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}],"conflicts":[{"origin":"EVIDENCE_CONFLICT","id":"database.instance-protection","disposition":"MANUAL_ACTION","legs":[{"source_kind":"service_api","state":"SUPPORTED","source":"stackit-api-specifications services/postgres-flex/v3/postgres-flex.json (POST /v3/projects/{projectId}/regions/{region}/instances/{instanceId}/protections, operationId UpdateInstanceProtection, body isDeletable \"Protect instance from deletion.\"; GetInstanceResponse.isDeletable; lines 4452-4455, 1088-1106, 1700-1704 of the mirror) and services/sqlserverflex/v3/sqlserverflex.json (same path); https://github.com/stackitcloud/stackit-api-specifications","checked":"2026-10-07"},{"source_kind":"official_doc","state":"SUPPORTED","source":"https://docs.stackit.cloud/products/databases/postgresql-flex/how-tos/create-and-manage-instances-for-postgresql-flex/#instance-protection (\"Instance Protection prevents an instance from being deleted. While it is active, deletion calls are rejected.\") and the FAQ https://docs.stackit.cloud/products/databases/postgresql-flex/faq/ (\"deleting an instance is immediate, permanent, and unrecoverable ... To prevent accidental deletion, enable Instance Protection.\"). The pages name the feature but not the tool that enables it: they do not state that Terraform supports it.","checked":"2026-10-07"},{"source_kind":"observed_provider_schema","state":"NOT_CONFIRMED","source":"STACKIT provider schema 0.121.0 (the pinned provider version), re-read 2026-11-02: stackit_postgresflex_instance (attributes acl, backup_schedule, connection_info, encryption, flavor, flavor_id, id, instance_id, name, network, project_id, region, replicas, retention_days, storage, version) and stackit_sqlserverflex_instance (the same plus edition and options): no protection / deletable attribute, and no data source of the two services has one. The only attributes of the whole schema (resources and data sources) whose name contains protect, protection or deletable are protected (stackit_image, stackit_image_v2 and, new in 0.119.0, the results of the data source stackit_images: an image's protected flag), and protection (stackit_kms_key, stackit_kms_wrapping_key), all unrelated. The attribute sets of the two instance resources are the same as in the 0.116.0, 0.117.0 and 0.118.0 schemas (compared 2026-10-08 and 2026-10-10), and the STACKIT provider documentation of postgresflex_instance and sqlserverflex_instance (terraform-provider-stackit v0.116.0, local mirror) name no such attribute either. The fact holds on the pin: this refreshes the record of 2026-10-07, which cited the 0.117.0 schema and said that a 0.118.0 schema was not present, and was re-read on the 0.119.0 pin on 2026-10-10 (the 0.119.0 schema differs from 0.118.0 by two data sources and one resource description only) and again on the 0.120.0 pin on 2026-10-16 (the 0.120.0 schema differs from 0.119.0 by 17 block descriptions of the dremio, observability and secretsmanager services only, none of them a postgres/sqlserver flex type, an attribute or a type) and again on the 0.121.0 pin on 2026-11-02 (the 0.121.0 schema differs from 0.120.0 by one added attribute, config.cache_config of stackit_cdn_distribution, and one added data source, stackit_networks, found by a whole-tree comparison of the two files).","checked":"2026-11-02"}]}]},{"capability_id":"database.managed-mysql","ref":"capability:database.managed-mysql","description":"A managed MySQL engine.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"database.mariadb","ref":"capability:database.mariadb","description":"A managed MariaDB instance and its credentials (stackit_mariadb_instance, stackit_mariadb_credential). MariaDB, not MySQL: the absence of a managed MySQL engine stays recorded under data.managed-mysql and database.managed-mysql, and nothing here says that a MySQL source carries over unchanged. Among the sources the AWS rules map to it: aws_db_instance and aws_rds_cluster with a MySQL or MariaDB engine.","unit_services":[],"provided_by":["stackit_mariadb_credential","stackit_mariadb_instance"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/mariadb/v2/mariadb.json:778; stackitcloud/stackit-api-specifications, services/mariadb/v2/mariadb.json:1278","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_mariadb_credential","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_mariadb_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_mariadb_credential","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_mariadb_instance","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"database.mongodb-flex","ref":"capability:database.mongodb-flex","description":"A managed MongoDB Flex instance and its users (stackit_mongodbflex_instance, stackit_mongodbflex_user). Among the sources the AWS rules map to it: aws_docdb_cluster and, as a redesign of the data model, aws_dynamodb_table; a document store is not a key-value table and nothing here says the application's access pattern carries over.","unit_services":[],"provided_by":["stackit_mongodbflex_instance","stackit_mongodbflex_user"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/mongodb-flex/v2/mongodb-flex.json:1185; stackitcloud/stackit-api-specifications, services/mongodb-flex/v2/mongodb-flex.json:2924","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_mongodbflex_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_mongodbflex_user","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_mongodbflex_instance","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_mongodbflex_user","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"database.postgresql-flex","ref":"capability:database.postgresql-flex","description":"A managed PostgreSQL Flex instance with its databases and users (stackit_postgresflex_instance, stackit_postgresflex_database, stackit_postgresflex_user). Among the sources the AWS rules map to it: aws_db_instance and aws_rds_cluster with the PostgreSQL engine.","unit_services":["STACKIT PostgreSQL Flex"],"provided_by":["stackit_postgresflex_database","stackit_postgresflex_instance","stackit_postgresflex_user"],"units":1,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/databases/postgresql-flex/basics/architecture-of-postgresql-flex/; stackitcloud/docs.stackit.cloud, products/databases/postgresql-flex/basics/architecture-of-postgresql-flex.txt","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/postgres-flex/v3/postgres-flex.json:2050-2332; stackitcloud/stackit-api-specifications, services/postgres-flex/v3/postgres-flex.json:3554; stackitcloud/stackit-api-specifications, services/postgres-flex/v3/postgres-flex.json:4744","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_postgresflex_database","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_postgresflex_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_postgresflex_user","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_postgresflex_database","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_postgresflex_instance","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_postgresflex_user","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: resource_schemas.stackit_postgresflex_instance (acl, flavor, replicas deprecated: true)","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"devtools.build-resource-sharing","ref":"capability:devtools.build-resource-sharing","description":"Sharing of build projects and reports with other accounts by resource policy.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"devtools.cloud-ide","ref":"capability:devtools.cloud-ide","description":"A cloud development environment or browser IDE service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"devtools.code-review-automation","ref":"capability:devtools.code-review-automation","description":"Automated code review of pull requests.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"devtools.container-registry","ref":"capability:devtools.container-registry","description":"A managed container image registry (STACKIT Container Registry: its API manages artifactories, each the STACKIT record of a Harbor project (CreateArtifactory takes claim=true to adopt an existing one, registry_v1.json:560), and lists replication adapters). Source counterparts: Amazon ECR, Azure Container Registry, Google Artifact Registry (Docker repositories) and the legacy Container Registry. The pinned provider has no resource type for it (checked against the pinned provider schema: no registry, container or artifactory resource), so a registry is set up through the portal or the API.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/developer-platform/container-registry/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/registry/v1/registry.json:454","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability. STACKIT offers this service. A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT drafts no Terraform for it; it writes STACKIT API steps as scripts for part of it, and the rest needs extra implementation."},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"devtools.git","ref":"capability:devtools.git","description":"A managed STACKIT Git instance (stackit_git: name, ACL, flavor; the instance URL, version and consumed disk and object storage are computed). Source counterparts: a hosted repository service with access restrictions (GitHub, Azure DevOps, Cloud Source Repositories); the repositories and users inside the instance are not Terraform resources.","unit_services":["a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD"],"provided_by":["stackit_git"],"units":3,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/developer-platform/git/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/git/v1beta/git.json:968-1313","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,BETA","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_git","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","BETA"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_git","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"BETA","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 (resource_schemas.stackit_git.block.description)","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":3},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.enable_beta_resources","freshness":"FRESH"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: resource_schemas.stackit_git block description","freshness":"FRESH"},{"kind":"PUBLIC_ISSUE","source":"https://github.com/stackitcloud/terraform-provider-stackit/issues/1633","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"devtools.git-external-integration","ref":"capability:devtools.git-external-integration","description":"Objects of a managed Git service beyond the instance: a connection to an external Git host, a repository link or pull mirror, and an event subscription (rule, topic or chat target). STACKIT Git (stackit_git) models the instance only; its management API has instances, authentications, runner and users and no repository, mirror or connection endpoint. Source counterparts: AWS CodeConnections/CodeStar connections, repository links and notification rules.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"devtools.git-repository-resource","ref":"capability:devtools.git-repository-resource","description":"Repositories of the managed Git service as a management-API or Terraform resource (stackit_git creates the instance only).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.client-certificate-verification","ref":"capability:edge.client-certificate-verification","description":"Verification of client certificates (mutual TLS) against a trust store at the CDN or the Application Load Balancer.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.compute","ref":"capability:edge.compute","description":"Code and key-value data executed or read at the CDN edge (edge functions, connection functions, key-value stores).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.field-level-encryption","ref":"capability:edge.field-level-encryption","description":"Encryption of single request fields at the edge with a public key.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.multi-tenant-distribution","ref":"capability:edge.multi-tenant-distribution","description":"A CDN distribution that is a shared template filled in per tenant (domains, certificate request, parameters) behind a connection group.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.private-origin","ref":"capability:edge.private-origin","description":"A CDN path to an origin inside a private network (VPC origin).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.realtime-log-stream","ref":"capability:edge.realtime-log-stream","description":"A configurable stream of selected, sampled viewer-request log fields to a data stream.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.response-header-policy","ref":"capability:edge.response-header-policy","description":"Adding, overriding or removing response headers (CORS, security headers) at the CDN edge.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.signed-urls","ref":"capability:edge.signed-urls","description":"Signed URLs, signed cookies and the key groups and public keys that verify them.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.staged-rollout","ref":"capability:edge.staged-rollout","description":"A CDN staging distribution that receives a share of the production traffic before a change is promoted.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"edge.static-anycast-addresses","ref":"capability:edge.static-anycast-addresses","description":"Dedicated static anycast IP addresses for a CDN.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"end-user.app-streaming","ref":"capability:end-user.app-streaming","description":"Desktop or application streaming to end users (AWS AppStream 2.0, WorkSpaces, Azure Virtual Desktop).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"end-user.secure-browser","ref":"capability:end-user.secure-browser","description":"A remote isolated browser with clipboard, transfer and redaction controls.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"end-user.virtual-desktop","ref":"capability:end-user.virtual-desktop","description":"Managed virtual desktops (desktop as a service) with directories, IP access groups and pools.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"file-storage.object-view","ref":"capability:file-storage.object-view","description":"S3 API view of a file system.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"file-transfer.as2","ref":"capability:file-transfer.as2","description":"Managed AS2 messaging and outbound partner connectors.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"file-transfer.managed-sftp","ref":"capability:file-transfer.managed-sftp","description":"Managed SFTP, FTPS and FTP endpoint with managed users.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"file-transfer.web-portal","ref":"capability:file-transfer.web-portal","description":"Browser interface to files in storage for end users.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"file-transfer.workflow","ref":"capability:file-transfer.workflow","description":"Post-upload processing workflow of a file-transfer endpoint.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"game.server-hosting","ref":"capability:game.server-hosting","description":"Hosting of game servers with session placement, matchmaking, fleets and Spot capacity.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"gaming.game-server-hosting","ref":"capability:gaming.game-server-hosting","description":"Dedicated game server hosting with fleets, placement queues and Spot capacity.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"geo.location-services","ref":"capability:geo.location-services","description":"Managed maps, geocoding, routing, device tracking and geofencing.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.application-metadata","ref":"capability:governance.application-metadata","description":"An application registry with structured (nested) metadata attached to applications.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.application-registry","ref":"capability:governance.application-registry","description":"A registry of applications with attribute groups and associated resources.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.architecture-review","ref":"capability:governance.architecture-review","description":"A tool that reviews workloads against question catalogues (lenses) and produces improvement plans and recommendations.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.audit-evidence","ref":"capability:governance.audit-evidence","description":"Collection of audit evidence against compliance frameworks, with assessments.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.commitment-plans","ref":"capability:governance.commitment-plans","description":"A subscription to a pricing plan or savings plan applied to resources.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.config-recorder","ref":"capability:governance.config-recorder","description":"A configuration recorder / resource configuration history.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.dynamic-grouping","ref":"capability:governance.dynamic-grouping","description":"Dynamic resource groups / self-service product catalogs.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.generic-resource-proxy","ref":"capability:governance.generic-resource-proxy","description":"A generic resource proxy and an extension-type registry for infrastructure templates.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.landing-zone","ref":"capability:governance.landing-zone","description":"A managed landing zone with guardrails and baselines (STACKIT offers the Landing Zone Accelerator framework, not a managed service).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.launch-constraints","ref":"capability:governance.launch-constraints","description":"Launch constraints on catalogue products: notification topics, parameter rules, stack set deployment and update control.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.license-tracking","ref":"capability:governance.license-tracking","description":"Counting of licence use with limits that block launches above the count.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.multi-account-deployment","ref":"capability:governance.multi-account-deployment","description":"Fan-out of one template to many accounts and regions with an operation preference.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.policy-engine","ref":"capability:governance.policy-engine","description":"A policy engine for resource configuration (guardrails, compliance evaluation).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.product-catalog","ref":"capability:governance.product-catalog","description":"A self-service product catalog (portfolios, products, versions, launches).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.resilience-assessment","ref":"capability:governance.resilience-assessment","description":"A managed assessment of application resilience against recovery time and recovery point policies with recommendations.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.resource-search","ref":"capability:governance.resource-search","description":"Tag- and type-based queries and cross-region search over the resources of an account.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.resource-sharing","ref":"capability:governance.resource-sharing","description":"Sharing of resources and permissions with other accounts (STACKIT has Network Area for the projects of one organisation, and role assignments).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.service-catalog","ref":"capability:governance.service-catalog","description":"A self-service product catalogue with portfolios, constraints, shares and provisioned products.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"governance.tag-policy","ref":"capability:governance.tag-policy","description":"A managed catalogue of allowed tag keys and values offered at provisioning.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"healthcare.agent-domain","ref":"capability:healthcare.agent-domain","description":"The HealthAgent service domain for healthcare providers.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"hybrid-storage.gateway","ref":"capability:hybrid-storage.gateway","description":"On-premises storage gateway appliance with local cache (file, volume).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"identity.access-brokering","ref":"capability:identity.access-brokering","description":"Brokered access of identity-provider users and groups to roles in other accounts or projects (Identity Center Account Access).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"identity.application-authorization-policy-store","ref":"capability:identity.application-authorization-policy-store","description":"A managed application-authorization policy store (Cedar policies, schema and an is-authorized API).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"identity.end-user-idp","ref":"capability:identity.end-user-idp","description":"A managed identity service for application end users (CIAM).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"identity.managed-directory","ref":"capability:identity.managed-directory","description":"A managed directory service (Active Directory compatible or LDAP) with domain controllers and trusts.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"identity.role-assignment","ref":"capability:identity.role-assignment","description":"Granting a role to a subject on a resource (stackit_authorization_{organization,folder,project}_role_assignment) and to a service account on a service account (stackit_authorization_service_account_role_assignment, the \"Act-As\" permission), and the project custom roles a role assignment can name. Source counterparts: the permission policies attached to an aws_iam_role (managed policy attachments, inline policies) and the trust of one principal in another (who may assume the role).","unit_services":["STACKIT service account"],"provided_by":["stackit_authorization_folder_role_assignment","stackit_authorization_organization_role_assignment","stackit_authorization_project_custom_role","stackit_authorization_project_role_assignment","stackit_authorization_service_account_role_assignment"],"units":4,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/platform/access-and-identity/roles-permissions/roles-permissions/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/authorization/v2/authorization.json:807-840","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,EXPERIMENTAL","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_authorization_folder_role_assignment","facts":["RESOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"iam"},{"type":"stackit_authorization_organization_role_assignment","facts":["RESOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"iam"},{"type":"stackit_authorization_project_custom_role","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_authorization_project_role_assignment","facts":["RESOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"iam"},{"type":"stackit_authorization_service_account_role_assignment","facts":["RESOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"iam"}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_folder_role_assignment","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_organization_role_assignment","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_project_custom_role","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_project_role_assignment","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_authorization_service_account_role_assignment","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"EXPERIMENTAL","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 (resource_schemas.stackit_authorization_project_role_assignment.block.description, ..._folder_..., ..._organization_..., ..._service_account_role_assignment.block.description)","freshness":"UNKNOWN"}]},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":1}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.experiments","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"identity.secretsmanager-role-binding","ref":"capability:identity.secretsmanager-role-binding","description":"Granting a role to a subject on a Secrets Manager instance or on one of its secret groups (stackit_secretsmanager_instance_role_binding_v1, stackit_secretsmanager_secret_group_role_binding_v1; experimental feature iam). Source counterparts: a resource policy on an aws_secretsmanager_secret, an access policy of an azurerm_key_vault, an IAM binding of a google_secret_manager_secret. Documentation of these two resources and of the roles they accept: unverified (the Secrets Manager pages of docs.stackit.cloud, searched 2026-10-11, describe instance users and the project-level roles but name neither resource).","unit_services":[],"provided_by":["stackit_secretsmanager_instance_role_binding_v1","stackit_secretsmanager_secret_group_role_binding_v1"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/secrets-manager/v1alpha/secrets-manager.json:361-1171","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,EXPERIMENTAL","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_secretsmanager_instance_role_binding_v1","facts":["RESOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"iam"},{"type":"stackit_secretsmanager_secret_group_role_binding_v1","facts":["RESOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"iam"}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_secretsmanager_instance_role_binding_v1","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_secretsmanager_secret_group_role_binding_v1","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"EXPERIMENTAL","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 (resource_schemas.stackit_secretsmanager_instance_role_binding_v1.block.description, resource_schemas.stackit_secretsmanager_secret_group_role_binding_v1.block.description)","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.experiments","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"identity.server-service-account","ref":"capability:identity.server-service-account","description":"The service account a server runs as (stackit_service_account, stackit_server_service_account_attach; STACKIT IaaS API v2 and the service-account API): creating the account, attaching it to a server, how many a server takes, and how code on the server gets a token for it (metadata service). Source counterparts: aws_iam_instance_profile / iam_instance_profile, azurerm managed identity of a virtual machine, google_compute_instance.service_account.","unit_services":["STACKIT service account"],"provided_by":["stackit_server_service_account_attach","stackit_service_account"],"units":4,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/compute-engine/server/how-tos/attaching-service-account-to-servers/","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"WRITE_SUPPORTED","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"STACKIT IaaS API v2 specification (path /v2/projects/{projectId}/regions/{region}/servers/{serverId}/service-accounts/{serviceAccountMail})","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-09","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_server_service_account_attach","facts":["RESOURCE_AVAILABLE"]},{"type":"stackit_service_account","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_server_service_account_attach","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_service_account","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":1}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","state":"ASSESSED","value":"RECORDED","basis":"Probes of the live target and evidence of the capability as a whole. A probe is an observation of one exact variant, not of the capability. A disagreement between sources is listed as a conflict of the row.","counts":[{"key":"PROBES","count":11},{"key":"EVIDENCE_ITEMS","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-11-06","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-11-06","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-09","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-09","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-09","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-09","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-10","freshness":"UNKNOWN"}]}]},{"capability_id":"identity.service-account-key","ref":"capability:identity.service-account-key","description":"A key of a STACKIT service account for the key flow (stackit_service_account_key). Source counterpart: the long-lived access key or the credentials a workload of an AWS role is given when it cannot use federation.","unit_services":[],"provided_by":["stackit_service_account_key"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/platform/access-and-identity/service-accounts/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/service-account/v2/service-account.json:1680-1740","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_service_account_key","facts":["RESOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_service_account_key","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"identity.workload-identity-federation","ref":"capability:identity.workload-identity-federation","description":"A STACKIT service account that trusts tokens of an external OIDC issuer (stackit_service_account_federated_identity_provider: issuer URL and assertions). Source counterparts: the Federated principal of an aws_iam_role trust policy (an EKS service-account issuer for IRSA, GitHub Actions, another web identity provider) and aws_iam_openid_connect_provider.","unit_services":[],"provided_by":["stackit_service_account_federated_identity_provider"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/platform/access-and-identity/service-accounts/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/service-account/v2/service-account.json:1168-1230","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_service_account_federated_identity_provider","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_service_account_federated_identity_provider","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":1}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"integration.event-bus","ref":"capability:integration.event-bus","description":"An event bus with SaaS event sources and routing rules (the STACKIT PubSub API v1beta has topics and subscriptions; no provider resource and no SaaS sources).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"integration.managed-api-gateway","ref":"capability:integration.managed-api-gateway","description":"A managed API gateway / API management (routes, auth, quotas, throttling, developer portal).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"integration.saas-audit-ingestion","ref":"capability:integration.saas-audit-ingestion","description":"Connectors that pull the audit logs of SaaS applications and normalise them.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"integration.saas-data-connector","ref":"capability:integration.saas-data-connector","description":"Scheduled data pulls from a SaaS source into a store.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.analytics","ref":"capability:iot.analytics","description":"Managed flow that ingests device messages into a channel, transforms them in a pipeline, stores them in a data store and produces datasets.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.device-defender","ref":"capability:iot.device-defender","description":"Audit of device certificates, device policies and role aliases, custom device metrics, behaviour profiles and automatic mitigation actions.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.device-management","ref":"capability:iot.device-management","description":"A device registry with credentials, policies, fleet provisioning, remote jobs and behaviour monitoring.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.device-management-and-rules","ref":"capability:iot.device-management-and-rules","description":"IoT device registry, shadows, fleet indexing, device certificates and a rules engine over device messages.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.device-remote-access","ref":"capability:iot.device-remote-access","description":"A time-limited tunnel from an operator to a service on a single device behind a firewall.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.device-software-deployment","ref":"capability:iot.device-software-deployment","description":"Delivery of software components (recipes, artifacts, Lambda-derived components) to customer-owned devices with rollout and failure policies, and over-the-air file streams.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.device-testing-and-fleet-view","ref":"capability:iot.device-testing-and-fleet-view","description":"Device test suites against an IoT endpoint and a fleet monitoring application.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.digital-twin","ref":"capability:iot.digital-twin","description":"A digital twin service with workspaces, 3D scenes and entity sync jobs.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.event-detection","ref":"capability:iot.event-detection","description":"Evaluation of device messages against state machines (detector models) and threshold alarms, with actions.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.industrial-asset-data","ref":"capability:iot.industrial-asset-data","description":"Industrial asset models, assets, datasets, tasks, pipelines and access policies over device data.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.industrial-data","ref":"capability:iot.industrial-data","description":"Industrial asset data ingestion, modelling and dashboards.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.rules-engine","ref":"capability:iot.rules-engine","description":"SQL routing of device messages to other services.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.vehicle-data-collection","ref":"capability:iot.vehicle-data-collection","description":"Collection of vehicle signals by conditions with spooling, signal catalogs, model manifests and campaigns.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"iot.wireless-network-server","ref":"capability:iot.wireless-network-server","description":"A managed LoRaWAN (and Sidewalk) network server with device and gateway registry, profiles, firmware updates over the air and traces.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"kubernetes.external-oidc","ref":"capability:kubernetes.external-oidc","description":"An external OIDC identity provider accepted by the Kubernetes API of a managed cluster.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"kubernetes.managed-platform-components","ref":"capability:kubernetes.managed-platform-components","description":"Managed platform components of a Kubernetes cluster that the provider runs outside it (Argo CD, controllers).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"kubernetes.serverless-nodes","ref":"capability:kubernetes.serverless-nodes","description":"Serverless (per-pod, nodeless) capacity in a managed Kubernetes cluster.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"licensing.license-issuing","ref":"capability:licensing.license-issuing","description":"Issuing licenses with entitlements to beneficiaries and tracking license usage.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"mainframe.runtime","ref":"capability:mainframe.runtime","description":"A managed runtime for migrated mainframe applications on a vendor engine.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.ad-insertion","ref":"capability:media.ad-insertion","description":"Server-side ad insertion, linear channel assembly and ad prefetch.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.file-transcoding","ref":"capability:media.file-transcoding","description":"Managed file-based video transcoding with presets and queues.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.live-encoding","ref":"capability:media.live-encoding","description":"Live video encoding clusters, multiplexes and alarm and event templates for media resources.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.live-streaming","ref":"capability:media.live-streaming","description":"Managed live video ingest and delivery, with chat rooms.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.live-video-encoding","ref":"capability:media.live-video-encoding","description":"Managed live video encoding, ingest and multiplexing.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.packaging-origin","ref":"capability:media.packaging-origin","description":"Just-in-time packaging of video to HLS, DASH, CMAF and Smooth Streaming with DRM, start-over and CDN authorization.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.real-time-analytics","ref":"capability:media.real-time-analytics","description":"Real-time analysis of live audio and video streams.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.transcoding","ref":"capability:media.transcoding","description":"Managed media transcoding with presets and pipelines.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.transcoding-packaging","ref":"capability:media.transcoding-packaging","description":"Managed video transcoding queues and packaging channels.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.video-inference","ref":"capability:media.video-inference","description":"AI processing of video: clipping, cropping and subtitling with custom dictionaries (AWS Elemental Inference).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"media.video-transport","ref":"capability:media.video-transport","description":"Reliable live video transport between sites with bridges, gateways and a media router.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.customer-engagement","ref":"capability:messaging.customer-engagement","description":"A customer-engagement platform with segments, campaigns and journeys.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.email-contact-lists","ref":"capability:messaging.email-contact-lists","description":"Recipient lists with topic subscriptions managed by the e-mail service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.email-dedicated-ips","ref":"capability:messaging.email-dedicated-ips","description":"Dedicated sending IP addresses and pools for an e-mail service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.email-deliverability-insights","ref":"capability:messaging.email-deliverability-insights","description":"A deliverability dashboard and optimised delivery for an e-mail service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.email-multi-region","ref":"capability:messaging.email-multi-region","description":"A multi-region sending endpoint with failover between regions.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.email-tenants","ref":"capability:messaging.email-tenants","description":"Per-tenant isolation of sending reputation and settings in an e-mail service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.event-notifications","ref":"capability:messaging.event-notifications","description":"A service that routes platform and service events to e-mail, chat and mobile channels with per-configuration batching.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.inbound-mail","ref":"capability:messaging.inbound-mail","description":"Receiving incoming email (an inbound SMTP endpoint with rules: AWS SES receipt rules, a mail relay).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.mail-receiving","ref":"capability:messaging.mail-receiving","description":"Receiving and processing of incoming e-mail (inbound SMTP with rules, filters and storage).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.mail-templates-and-events","ref":"capability:messaging.mail-templates-and-events","description":"Stored e-mail templates, configuration sets and delivery event feeds of the outbound mail service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.mailbox-hosting","ref":"capability:messaging.mailbox-hosting","description":"Hosted mailboxes for users (nearest target: Workspace by STACKIT, ordered through sales, no API or provider resource described).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.mailbox-platform","ref":"capability:messaging.mailbox-platform","description":"A managed mailbox platform (organization, domains, groups, mailboxes) with an API.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.managed-activemq","ref":"capability:messaging.managed-activemq","description":"A managed ActiveMQ broker with Spring XML configuration.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.managed-kafka","ref":"capability:messaging.managed-kafka","description":"A managed Apache Kafka (topics, partitions, consumer groups, ACLs). STACKIT offers no such service (product index and the pinned provider schema, read 2026-11-04). STACKIT Intake (Public Preview since 2025-12-04) speaks the Kafka protocol to producers but is an ingestion-only sink into Iceberg tables of a Dremio catalog, JSON messages only: \"you cannot consume data from it\" (https://docs.stackit.cloud/products/data-and-ai/intake/faq/), so it does not provide this capability.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.managed-kafka-connect","ref":"capability:messaging.managed-kafka-connect","description":"Managed Kafka and Kafka Connect workers.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.mqtt-broker","ref":"capability:messaging.mqtt-broker","description":"An MQTT broker for devices, as the rabbitmq_mqtt plugin of a RabbitMQ instance (no device registry, certificates or rules engine).","unit_services":["STACKIT RabbitMQ"],"provided_by":["stackit_rabbitmq_instance"],"units":1,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_rabbitmq_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_rabbitmq_instance","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.pubsub","ref":"capability:messaging.pubsub","description":"A managed publish/subscribe service (STACKIT PubSub: topics, publishers, subscriptions, subscribers). Source counterparts: SNS, SQS, Google Pub/Sub, Service Bus topics. No docs.stackit.cloud product page for it was found (searched 2026-10-17; the Messaging index lists MailOut and RabbitMQ). The pinned provider has no resource type for it. It has no message-schema setting.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/pubsub/v1beta/pubsub.json:516","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability. Whether STACKIT offers this service is not established. A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT drafts no Terraform for it; it writes STACKIT API steps as scripts for part of it, and the rest needs extra implementation."},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"PREVIEW","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/pubsub/v1beta/pubsub.json:516","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.push-notifications","ref":"capability:messaging.push-notifications","description":"A push notification gateway for mobile platforms.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.rabbitmq-credential","ref":"capability:messaging.rabbitmq-credential","description":"A credential (user name, password and connection URIs) of a STACKIT RabbitMQ instance (stackit_rabbitmq_credential); the instance itself is listed under messaging.mqtt-broker. Among the sources the AWS rules map to it: aws_mq_broker; a source password is never carried by the draft.","unit_services":["STACKIT RabbitMQ"],"provided_by":["stackit_rabbitmq_credential"],"units":1,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/rabbitmq/v2/rabbitmq.json:1379","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_rabbitmq_credential","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_rabbitmq_credential","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.schema-registry","ref":"capability:messaging.schema-registry","description":"Validation of published messages against a registered schema (Pub/Sub schemas, a schema registry).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.secure-team-messaging","ref":"capability:messaging.secure-team-messaging","description":"An end-to-end encrypted staff messaging and collaboration service with retention and administrative controls.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.sms-and-voice","ref":"capability:messaging.sms-and-voice","description":"SMS and voice messaging with leased origination numbers, pools and sender ids.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"messaging.sms-and-whatsapp","ref":"capability:messaging.sms-and-whatsapp","description":"Sending text messages and WhatsApp messages to end users.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ml.anomaly-detection","ref":"capability:ml.anomaly-detection","description":"Managed anomaly detection on equipment sensor data, metrics and images.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ml.data-labeling","ref":"capability:ml.data-labeling","description":"A managed data-labeling or human-review service with workforce and task templates.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ml.edge-device-fleet","ref":"capability:ml.edge-device-fleet","description":"A device registry and fleet service that delivers models to edge devices.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ml.experiment-lineage","ref":"capability:ml.experiment-lineage","description":"Terraform-managed experiment-tracking entities and a lineage graph of actions, artifacts and contexts.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"ml.model-hub","ref":"capability:ml.model-hub","description":"A curated model hub or catalogue that a customer can maintain for its users.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.application-load-balancer","ref":"capability:network.application-load-balancer","description":"A STACKIT Application Load Balancer (layer 7) with its listeners, target pools and rules (stackit_application_load_balancer), and the TLS certificates its HTTPS listeners use (stackit_alb_certificate). Among the sources the AWS rules map to it: aws_lb and aws_acm_certificate.","unit_services":[],"provided_by":["stackit_alb_certificate","stackit_application_load_balancer"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/network/load-balancing-and-content-delivery/application-load-balancer/basics/basic-concepts-alb/; stackitcloud/docs.stackit.cloud, products/network/load-balancing-and-content-delivery/application-load-balancer/basics/basic-concepts-alb.txt","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/alb/v2/alb.json:1587-1783; stackitcloud/stackit-api-specifications, services/certificates/v2/certificates.json:343","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_alb_certificate","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_application_load_balancer","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_alb_certificate","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_application_load_balancer","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":2},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-09-30 (Findings Q2, Q2b, Q3)","freshness":"FRESH"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-09-30 (Findings Q1, Q1b)","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.application-networking","ref":"capability:network.application-networking","description":"Application networking: a service network, service directory, resource gateway and resource configuration with request-level authorisation.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.ddos-protection","ref":"capability:network.ddos-protection","description":"A DDoS protection service with a response team that acts on the account.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.dedicated-connection","ref":"capability:network.dedicated-connection","description":"A dedicated customer connection (cross connect, interconnect to a partner network).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.dynamic-route-exchange","ref":"capability:network.dynamic-route-exchange","description":"Dynamic route exchange with virtual appliances (a managed BGP speaker that installs learned routes in route tables).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.failover-routing-control","ref":"capability:network.failover-routing-control","description":"Routing controls with safety rules that move traffic between replicas.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.global-accelerator","ref":"capability:network.global-accelerator","description":"A global accelerator with static anycast addresses, regional endpoint groups, traffic dials and cross-account endpoint sharing.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.http-https-redirect","ref":"capability:network.http-https-redirect","description":"A load balancer setting that redirects HTTP requests to HTTPS.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.interface","ref":"capability:network.interface","description":"Network interfaces and their attachment to servers (stackit_network_interface, stackit_server_network_interface_attach; STACKIT IaaS API v2): the interface that carries a private address in one network, the security groups attached to it by id, NIC security, allowed addresses, IPv4 only, the attachment that takes effect after a reboot. Source counterparts: aws_network_interface / aws_network_interface_attachment, azurerm_network_interface, the network_interface block of google_compute_instance.","unit_services":[],"provided_by":["stackit_network_interface","stackit_server_network_interface_attach"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/network/core-networking/network-interfaces/how-tos/create-and-manage-network-interfaces/","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08 (Phase B)","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"WRITE_SUPPORTED","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"STACKIT IaaS API v2 specification (paths .../networks/{networkId}/nics, .../nics/{nicId} and .../servers/{serverId}/nics/{nicId})","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_network_interface","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_server_network_interface_attach","facts":["RESOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_network_interface","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_server_network_interface_attach","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":4}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","state":"ASSESSED","value":"RECORDED","basis":"Probes of the live target and evidence of the capability as a whole. A probe is an observation of one exact variant, not of the capability. A disagreement between sources is listed as a conflict of the row.","counts":[{"key":"PROBES","count":2},{"key":"EVIDENCE_ITEMS","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"}]}]},{"capability_id":"network.interface-security-default","ref":"capability:network.interface-security-default","services":["iaas"],"unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}],"conflicts":[{"origin":"EVIDENCE_CONFLICT","id":"network.interface-security-default","disposition":"MANUAL_REVIEW","legs":[{"source_kind":"service_api","state":"SUPPORTED","source":"STACKIT IaaS API v2 specification components.schemas.NIC.nicSecurity and CreateNicPayload.nicSecurity: \"default\": true, so a network interface created without nicSecurity has security (its security groups apply). NICSecurity: \"If this is set to false, then no security groups will apply to this network interface.\"","checked":"2026-10-08"},{"source_kind":"official_doc","state":"UNSUPPORTED","source":"https://docs.stackit.cloud/products/network/core-networking/network-interfaces/how-tos/create-and-manage-network-interfaces/ (\"the optional flag `--nic-security` enables you to turn network interface security on. Per default it is disabled.\"), read 2026-10-08 through a page-summarising fetch tool. The sentence is about the CLI flag, not the API, so the two may both be true (the CLI would then send an explicit false); the page does not say. Probe 11: the page sentence is not true of STACKIT CLI 0.73.0 (its own help says \"--nic-security ... (default true)\", and `network-interface create` without the flag stored nicSecurity true), so the page is the outlier, not the specification.","checked":"2026-10-08"},{"source_kind":"observed_provider_schema","state":"NOT_STATED","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_network_interface.block.attributes.security: optional, computed bool without a stated default; the provider (mirror tag v0.116.0, networkinterface/resource.go:643) sends nothing when it is unset, so the API default decides. Probe 11 (provider 0.118.0): a network interface written without security was stored and read back with nicSecurity true (state security = true). The attribute is the same in the 0.119.0 schema (re-read 2026-10-10) the 0.120.0 schema (re-read 2026-10-16) and the 0.121.0 schema (re-read 2026-11-02).","checked":"2026-11-02"}]}]},{"capability_id":"network.internet-facing-dns-resolver","ref":"capability:network.internet-facing-dns-resolver","description":"An internet-facing, anycast DNS resolver with DNS filtering for clients outside the cloud.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.ipam-discovery-and-byoip","ref":"capability:network.ipam-discovery-and-byoip","description":"Bring-your-own-IP and IP address management (IPAM) discovery.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.ipv6-networks","ref":"capability:network.ipv6-networks","description":"IPv6 inside a STACKIT network.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.lb-http-redirect","ref":"capability:network.lb-http-redirect","description":"An HTTP to HTTPS redirect setting on the application load balancer.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.lb-ip-block-lists","ref":"capability:network.lb-ip-block-lists","description":"A named list of IPv4 CIDR ranges whose sources an Application Load Balancer denies (STACKIT Load Balancer IP Lists, referenced by ipBlockListName in the ALB options). It is a block list of the load balancer, not a condition set of the WAF, and it takes IPv4 only. The pinned provider has no resource type for the list and no attribute that references it (stackit_application_load_balancer).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/network/load-balancing-and-content-delivery/application-load-balancer/basics/features-alb/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/lb-ip-lists/v1alpha/lb-ip-lists.json:237","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability. STACKIT offers this service (preview). A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT drafts no Terraform for it; it writes STACKIT API steps as scripts for part of it, and the rest needs extra implementation."},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"PREVIEW","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/lb-ip-lists/v1alpha/lb-ip-lists.json:237","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.managed-certificates","ref":"capability:network.managed-certificates","description":"Certificates issued, validated and renewed by the platform for a customer domain.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.modernisation-proxy","ref":"capability:network.modernisation-proxy","description":"A managed strangler-fig proxy that moves traffic from a legacy application to new services route by route.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.network","ref":"capability:network.network","description":"Networks of a project and the network area they sit in (stackit_network, stackit_network_area, stackit_network_area_region; STACKIT IaaS API v2): IPv4 prefix and prefix length, gateway, nameservers, DHCP, routed or isolated, the routing table assignment, the VPC attributes, the area's address ranges and prefix length bounds. Source counterparts: aws_vpc / aws_subnet, azurerm_virtual_network / azurerm_subnet, google_compute_network / google_compute_subnetwork. The VPC container, the VPC network range and the VPC routing table stay on network.vpc-container.","unit_services":[],"provided_by":["stackit_network","stackit_network_area","stackit_network_area_region"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/network/core-networking/virtual-network/basics/concepts/","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"WRITE_SUPPORTED","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"STACKIT IaaS API v2 specification (paths /v2/projects/{projectId}/regions/{region}/networks and .../networks/{networkId}, /v2/organizations/{organizationId}/network-areas and .../regions/{region} (+ network-ranges))","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_network","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_network_area","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_network_area_region","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_network","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_network_area","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_network_area_region","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":4}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":2},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-09-24","freshness":"FRESH"},{"kind":"PUBLIC_ISSUE","source":"https://github.com/stackitcloud/terraform-provider-stackit/issues/1751","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","state":"ASSESSED","value":"RECORDED","basis":"Probes of the live target and evidence of the capability as a whole. A probe is an observation of one exact variant, not of the capability. A disagreement between sources is listed as a conflict of the row.","counts":[{"key":"PROBES","count":4},{"key":"EVIDENCE_ITEMS","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-09-24","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"}]}]},{"capability_id":"network.private-link","ref":"capability:network.private-link","description":"Private endpoints / private link to managed services.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.private-zone-global-resolution","ref":"capability:network.private-zone-global-resolution","description":"Resolution of the records of a private DNS zone for clients anywhere through a global resolver.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.public-ip-and-egress","ref":"capability:network.public-ip-and-egress","description":"Public IP addresses and the implicit outbound path of a routed network (stackit_public_ip, stackit_public_ip_associate; STACKIT IaaS API v2): what replaces an AWS elastic IP, internet gateway and NAT gateway (a public IP attached to a network interface, and the SNAT address of the routed networks that servers without a public IP share), what is implicit, the IPv4 limit and the open questions. Source counterparts: aws_eip / aws_eip_association / aws_internet_gateway / aws_nat_gateway, azurerm_public_ip / azurerm_nat_gateway, google_compute_address / google_compute_router_nat.","unit_services":[],"provided_by":["stackit_public_ip","stackit_public_ip_associate"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/network/core-networking/public-ip-address/basics/concepts/","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08 (Phase B)","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"WRITE_SUPPORTED","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"STACKIT IaaS API v2 specification (paths /v2/projects/{projectId}/regions/{region}/public-ips and .../servers/{serverId}/public-ips/{publicIpId})","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_public_ip","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_public_ip_associate","facts":["RESOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_public_ip","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_public_ip_associate","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":2}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":2},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: resource_schemas.stackit_public_ip_associate block description","freshness":"FRESH"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: resource_schemas.stackit_public_ip attribute network_interface_id","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","state":"ASSESSED","value":"RECORDED","basis":"Probes of the live target and evidence of the capability as a whole. A probe is an observation of one exact variant, not of the capability. A disagreement between sources is listed as a conflict of the row.","counts":[{"key":"PROBES","count":3},{"key":"EVIDENCE_ITEMS","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-10","freshness":"UNKNOWN"}]}]},{"capability_id":"network.routing","ref":"capability:network.routing","description":"Static and dynamic routes of a STACKIT network (STACKIT IaaS API v2 for network areas, v2alpha1 for VPCs): what a route is (destination CIDR, next hop of type ipv4, ipv6, internet or blackhole), the network-area routing tables the routes live in, the VPC static route behind an experiment and an entitlement. Source counterparts: aws_route_table / aws_route, azurerm_route_table / azurerm_route, google_compute_route. The row records what the cited sources establish and names, as probe-needed constraints, what they leave open; per-network routing table assignment is recorded on network.network.","unit_services":[],"provided_by":["stackit_network_area_route","stackit_routing_table","stackit_routing_table_route","stackit_vpc_routing_table_static_route"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"PARTIAL","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/network/core-networking/network-area/basics/routing-tables/","freshness":"UNKNOWN"},{"kind":"TARGET_OFFICIAL_DOC","source":"stackitcloud/professional-service, examples/vpn-full-tunnel-central-egress/README.md:262-263","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"PARTIAL","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"STACKIT IaaS API v2 specification (paths .../network-areas/{areaId}/regions/{region}/routes, .../routes/{routeId}, .../routing-tables, .../routing-tables/{routingTableId}/routes and .../routes/{routeId})","freshness":"UNKNOWN"},{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/iaas/v2alpha1/iaas.json:3992","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,EXPERIMENTAL","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_network_area_route","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_routing_table","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"routing-tables"},{"type":"stackit_routing_table_route","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"routing-tables"},{"type":"stackit_vpc_routing_table_static_route","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"vpc"}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_network_area_route","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_routing_table","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_routing_table_route","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_vpc_routing_table_static_route","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":2}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":2},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.experiments","freshness":"FRESH"},{"kind":"PUBLIC_ISSUE","source":"https://github.com/stackitcloud/terraform-provider-stackit/issues/1751","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","state":"ASSESSED","value":"RECORDED","basis":"Probes of the live target and evidence of the capability as a whole. A probe is an observation of one exact variant, not of the capability. A disagreement between sources is listed as a conflict of the row.","counts":[{"key":"PROBES","count":4},{"key":"EVIDENCE_ITEMS","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-10","freshness":"UNKNOWN"}]}]},{"capability_id":"network.rtb-interconnect","ref":"capability:network.rtb-interconnect","description":"A managed low-latency interconnect for real-time bidding traffic with gateways, links and traffic modules (rate limit, no-bid, OpenRTB filter).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.security-group","ref":"capability:network.security-group","description":"Per-project security groups and their allow rules for server network interfaces (stackit_security_group, stackit_security_group_rule; STACKIT IaaS API v2): stateful or stateless, ingress and egress rules on a protocol, port range or ICMP type/code, with an IP range or another security group as the remote. Source counterparts: aws_security_group and its rule resources, azurerm_network_security_group, google_compute_firewall.","unit_services":[],"provided_by":["stackit_security_group","stackit_security_group_rule"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/network/core-networking/security-groups/basics/concepts/","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"WRITE_SUPPORTED","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"STACKIT IaaS API v2 specification (paths /v2/projects/{projectId}/regions/{region}/security-groups, .../security-groups/{securityGroupId}, .../rules)","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_security_group","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_security_group_rule","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_security_group","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_security_group_rule","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":9}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":2},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"FRESH"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","state":"ASSESSED","value":"RECORDED","basis":"Probes of the live target and evidence of the capability as a whole. A probe is an observation of one exact variant, not of the capability. A disagreement between sources is listed as a conflict of the row.","counts":[{"key":"PROBES","count":8},{"key":"EVIDENCE_ITEMS","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-08","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-09","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-09","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-10","freshness":"UNKNOWN"}]}],"conflicts":[{"origin":"CONSTRAINT_FACT","id":"intra-group-implicit-allow-claimed-by-docs","words":"The STACKIT documentation and the live platform disagree on whether traffic inside one security group is allowed by default; the draft follows the observed platform behaviour (an explicit rule is needed)."}]},{"capability_id":"network.service-registry","ref":"capability:network.service-registry","description":"A run-time service registry with registration, health and discovery API.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.virtual-wan","ref":"capability:network.virtual-wan","description":"A managed hub-and-spoke / virtual WAN routing product.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"network.vpc-container","ref":"capability:network.vpc-container","description":"A VPC container (stackit_vpc) above regions, network ranges and routing tables, and stackit_network.vpc_id / ipv4_vpc_network_range_id / ipv6_vpc_network_range_id attaching a network to it (all three are attributes of stackit_network in the pinned provider schema). Maturity: experimental (provider experiment `vpc`, maturity table experimental:vpc), not GA. Entitlement (HYPOTHESIS, not CONFIRMED): the tests on a STACKIT project on 2026-10-07 got 400 \"project not allowed to interact with a VPC\" from stackit_vpc create, so the backend gates it per project; the provider acceptance fixture creates its project with the label `enable-vpc = \"true\"`, but that label being the gate is unproven (the same 400 came again with the label set on the existing project; the record of that test is the evidence, not this note).","unit_services":[],"provided_by":["stackit_vpc","stackit_vpc_network_range","stackit_vpc_region","stackit_vpc_routing_table"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE,EXPERIMENTAL","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_vpc","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"vpc"},{"type":"stackit_vpc_network_range","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"vpc"},{"type":"stackit_vpc_region","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"vpc"},{"type":"stackit_vpc_routing_table","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE","EXPERIMENTAL"],"experiment":"vpc"}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_vpc","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_vpc_network_range","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_vpc_region","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_vpc_routing_table","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"EXPERIMENTAL","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 (resource_schemas.stackit_vpc.block.description, the pinned provider version)","freshness":"UNKNOWN"}]},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":1}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":2},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"FRESH"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.experiments","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","state":"ASSESSED","value":"RECORDED","basis":"Probes of the live target and evidence of the capability as a whole. A probe is an observation of one exact variant, not of the capability. A disagreement between sources is listed as a conflict of the row.","counts":[{"key":"PROBES","count":2},{"key":"EVIDENCE_ITEMS","count":0}],"evidence":[{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"UNKNOWN"},{"kind":"LIVE_TARGET_PROBE","source":"tested on a STACKIT project on 2026-10-07","freshness":"UNKNOWN"}]}]},{"capability_id":"observability.audit-event-ingestion","ref":"capability:observability.audit-event-ingestion","description":"An ingestion endpoint that accepts audit events from partner or custom sources into an event store.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"observability.checks","ref":"capability:observability.checks","description":"Observability checks that probe a URL, a domain, an address or a certificate on a schedule (STACKIT Observability API v1: http, ping, network and certificate checks). Source counterparts: Route 53 health checks and CloudWatch Synthetics canaries that only call a URL. A scripted canary has no counterpart. The pinned provider has no resource type for the checks (stackit_observability_instance and stackit_observability_scrapeconfig are other capabilities).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/observability/v1/observability.json:11702","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability. Whether STACKIT offers this service is not established. A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT does not draft automation for it yet; extra implementation is needed."},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"observability.continuous-profiling","ref":"capability:observability.continuous-profiling","description":"Continuous profiling of running applications.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"observability.log-routing","ref":"capability:observability.log-routing","description":"Account-wide log routing / forwarding / exclusion / data-collection rules.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"observability.logs","ref":"capability:observability.logs","description":"The managed log store of STACKIT (STACKIT Logs, built on Grafana Loki): an instance with a retention in days and an ACL, written by OTLP or Loki clients with an access token. Source counterparts: aws_cloudwatch_log_group (with its log streams, metric filters and subscription filters), azurerm_log_analytics_workspace, google_logging_project_sink destinations.","unit_services":[],"provided_by":["stackit_logs_access_token","stackit_logs_instance"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/logging-and-monitoring/logs/","freshness":"UNKNOWN"},{"kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/logging-and-monitoring/logs/release-notes/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"WRITE_SUPPORTED","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/logs/v1/logs.json:463-557","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_logs_access_token","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_logs_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_logs_access_token","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_logs_instance","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"GA","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/logging-and-monitoring/logs/release-notes/","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 (resource_schemas.stackit_logs_instance.block.description and resource_schemas.stackit_logs_access_token.block.description)","freshness":"UNKNOWN"}]},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":3}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"observability.metrics-and-alerting","ref":"capability:observability.metrics-and-alerting","description":"A STACKIT Observability instance with its metric alert groups (Thanos), log alert groups (Loki), scrape configurations and credentials (stackit_observability_instance, stackit_observability_alertgroup, stackit_observability_logalertgroup, stackit_observability_scrapeconfig, stackit_observability_credential). The provider schema says the service is only available with default_region \"eu01\". Among the sources the AWS rules map to it: aws_cloudwatch_metric_alarm and aws_cloudwatch_dashboard; the managed log store is observability.logs.","unit_services":[],"provided_by":["stackit_observability_alertgroup","stackit_observability_credential","stackit_observability_instance","stackit_observability_logalertgroup","stackit_observability_scrapeconfig"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/observability/v1/observability.json:5296; stackitcloud/stackit-api-specifications, services/observability/v1/observability.json:7245; stackitcloud/stackit-api-specifications, services/observability/v1/observability.json:10619; stackitcloud/stackit-api-specifications, services/observability/v1/observability.json:11983; stackitcloud/stackit-api-specifications, services/observability/v1/observability.json:14826","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_observability_alertgroup","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_observability_credential","facts":["RESOURCE_AVAILABLE"]},{"type":"stackit_observability_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_observability_logalertgroup","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_observability_scrapeconfig","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_observability_alertgroup","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_observability_credential","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_observability_instance","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_observability_logalertgroup","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_observability_scrapeconfig","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: resource_schemas.stackit_ske_cluster extensions.argus","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"observability.operational-work-items","ref":"capability:observability.operational-work-items","description":"A tracked operational work item (incident or ticket) service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"observability.smart-detection","ref":"capability:observability.smart-detection","description":"Managed anomaly / smart detection on telemetry.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.fleet-configuration","ref":"capability:operations.fleet-configuration","description":"Roll-out of a named configuration (patching, host management, backup) to many accounts, organizational units and regions at once.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.fleet-configuration-deployment","ref":"capability:operations.fleet-configuration-deployment","description":"Deployment of configuration definitions (patching, host management) to several accounts, organisational units and regions by one object.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.incident-management","ref":"capability:operations.incident-management","description":"On-call rotations, escalation and incident response plans.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.incident-store","ref":"capability:operations.incident-store","description":"A managed incident record store replicated across regions with customer managed keys.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.on-call-and-escalation","ref":"capability:operations.on-call-and-escalation","description":"On-call schedules, rotations, contacts and escalation plans with acknowledgement and SMS or voice engagement.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.oncall-escalation","ref":"capability:operations.oncall-escalation","description":"On-call contacts, contact channels (e-mail, SMS, voice) and staged escalation plans.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.remote-session-recording","ref":"capability:operations.remote-session-recording","description":"Managed remote-desktop access to servers with recording of the sessions.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.sap-management","ref":"capability:operations.sap-management","description":"A managed service that registers SAP HANA and ABAP applications for application-aware backup and operations.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.self-service-actions","ref":"capability:operations.self-service-actions","description":"Self-service operations (automation documents) that users run on launched products.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.support-chat-integration","ref":"capability:operations.support-chat-integration","description":"Support case notification and handling in a chat tool.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"operations.user-notifications","ref":"capability:operations.user-notifications","description":"A service that notifies people of service events by e-mail, mobile or chat, with organisation-wide assignment.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"optimization.recommendation-and-automation","ref":"capability:optimization.recommendation-and-automation","description":"Resource optimization recommendations with automatic implementation by rule (AWS Compute Optimizer automation).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"organization.delegated-service-admin","ref":"capability:organization.delegated-service-admin","description":"Delegation of a service's administration for the whole organisation to one member account.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"organization.resource-sharing","ref":"capability:organization.resource-sharing","description":"Sharing of individual resources with principals of other accounts or organisations.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"platform.app-config-delivery","ref":"capability:platform.app-config-delivery","description":"Delivery of application configuration and feature flags with validation and gradual rollout.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"platform.configuration-management","ref":"capability:platform.configuration-management","description":"A managed Chef Automate or Puppet Enterprise server (configuration management of servers).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"platform.iac-templating-service","ref":"capability:platform.iac-templating-service","description":"A managed service for infrastructure templates, guided workload deployments and application repositories.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"platform.service-mesh","ref":"capability:platform.service-mesh","description":"A managed service mesh (service-to-service routing, retries, mutual TLS).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"rendering.managed-render-farm","ref":"capability:rendering.managed-render-farm","description":"Managed render management: farms, queues, worker fleets, licence limits and budgets for rendering and compute- intensive batch work (AWS Deadline Cloud).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"resilience.assessment","ref":"capability:resilience.assessment","description":"Assessment of an application against recovery objectives.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"resilience.failover-orchestration","ref":"capability:resilience.failover-orchestration","description":"Orchestrated failover between regions or zones (plans, workflows, zonal shift).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"resilience.fault-injection","ref":"capability:resilience.fault-injection","description":"Managed chaos engineering: fault injection experiments with stop conditions on cloud workloads (AWS FIS).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"runtime.edge-cloud","ref":"capability:runtime.edge-cloud","description":"A STACKIT Edge Cloud instance and the credentials to reach it (stackit_edgecloud_instance, stackit_edgecloud_kubeconfig, stackit_edgecloud_token). The provider says Edge Cloud is in private beta and not generally available. Source counterparts: none established; no rule maps a source resource to Edge Cloud.","unit_services":[],"provided_by":["stackit_edgecloud_instance","stackit_edgecloud_kubeconfig","stackit_edgecloud_token"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/edge/v1beta1/edge.json:427-1271","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,BETA","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_edgecloud_instance","facts":["RESOURCE_AVAILABLE","BETA"]},{"type":"stackit_edgecloud_kubeconfig","facts":["RESOURCE_AVAILABLE","BETA"]},{"type":"stackit_edgecloud_token","facts":["RESOURCE_AVAILABLE","BETA"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_edgecloud_instance","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_edgecloud_kubeconfig","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_edgecloud_token","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"BETA","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 (resource_schemas.stackit_edgecloud_instance.block.description, resource_schemas.stackit_edgecloud_kubeconfig.block.description, resource_schemas.stackit_edgecloud_token.block.description)","freshness":"UNKNOWN"},{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/runtime/edge-cloud/getting-started/authentication/","freshness":"UNKNOWN"}]},{"dimension":"quota","state":"NOT_ASSESSED","basis":"The registry lists evidenced limits for this capability. A list of facts is not a complete description of the quotas, so the dimension stays not assessed.","counts":[{"key":"LIMIT","count":2}]},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":1},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: provider.attributes.enable_beta_resources","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"satellite.ground-segment","ref":"capability:satellite.ground-segment","description":"Antenna time, radio contact scheduling and data delivery for satellites.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"search.resource-inventory","ref":"capability:search.resource-inventory","description":"A cross-resource search index or saved query over the resources of an account, project or organization.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.audit-log","ref":"capability:security.audit-log","description":"The platform-wide record of administrative activity (who called which API in an organisation, folder or project): on by default, 90 days of history in the Portal, readable with the audit-log.reader role, routed onward with the Telemetry Router. It records API calls, not the resulting configuration. No Terraform resource enables or configures it.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/platform/audit-log/","freshness":"UNKNOWN"},{"kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/release-notes/","freshness":"UNKNOWN"}]},{"dimension":"api","stock":true},{"dimension":"terraform","state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability. STACKIT offers this service. A public STACKIT API for it is not established. The pinned Terraform provider has no resource for it. StackToIT does not draft automation for it yet; extra implementation is needed."},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.code-scanning","ref":"capability:security.code-scanning","description":"Scanning of source code repositories (SAST, infrastructure as code, dependencies) and of other clouds.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.code-signing","ref":"capability:security.code-signing","description":"A managed code-signing service with signing profiles, platforms, jobs and revocation.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.code-signing-permissions","ref":"capability:security.code-signing-permissions","description":"Cross-account or cross-identity grants on a code-signing profile.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.data-lake","ref":"capability:security.data-lake","description":"A managed security data lake with OCSF normalisation, subscribers, lifecycle and cross-region replication.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.ddos-protection","ref":"capability:security.ddos-protection","description":"Managed DDoS protection (volumetric and application layer) for load balancers, public IP addresses and DNS, with a response team.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.findings-hub","ref":"capability:security.findings-hub","description":"A hub that aggregates findings of many products with automation rules, saved views and product integrations (STACKIT CSPM covers the STACKIT project only).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.investigation","ref":"capability:security.investigation","description":"An investigation graph over audit, flow and finding data.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.investigation-graph","ref":"capability:security.investigation-graph","description":"Security investigation graph over cloud activity and findings (Amazon Detective).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.kms","ref":"capability:security.kms","description":"The STACKIT Key Management Service: key rings, keys and wrapping keys (stackit_kms_keyring, stackit_kms_key, stackit_kms_wrapping_key). Among the sources the AWS rules map to it: aws_kms_key. The provider notes that keys and key rings are not destroyed at once by a destroy (provider schema description); the default-encryption-key absence of block storage stays recorded under block-storage.default-encryption-key.","unit_services":[],"provided_by":["stackit_kms_key","stackit_kms_keyring","stackit_kms_wrapping_key"],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/kms/v1/kms.json:730; stackitcloud/stackit-api-specifications, services/kms/v1/kms.json:901; stackitcloud/stackit-api-specifications, services/kms/v1/kms.json:1863","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_kms_key","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_kms_keyring","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_kms_wrapping_key","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_kms_key","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_kms_keyring","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_kms_wrapping_key","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","state":"ASSESSED","value":"ESTABLISHED","basis":"Provider and backend behaviours the control plane records for the capability, by status. A reported issue is not a proven platform bug.","counts":[{"key":"REPORTED","count":2},{"key":"PROVEN_PLATFORM_BUG","count":0},{"key":"RESOLVED","count":0},{"key":"BLOCKING_EFFECT","count":0}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: resource_schemas.stackit_kms_key block description","freshness":"FRESH"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0: resource_schemas.stackit_kms_keyring block description","freshness":"FRESH"}]},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.log-lake","ref":"capability:security.log-lake","description":"A managed security data lake that normalises logs (OCSF) from many sources and serves subscribers.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.malware-scanning","ref":"capability:security.malware-scanning","description":"Malware scanning of objects in a storage bucket.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.managed-penetration-testing","ref":"capability:security.managed-penetration-testing","description":"A managed service that runs authorised, AI-driven penetration tests and code reviews against deployed applications.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.multi-party-approval","ref":"capability:security.multi-party-approval","description":"A rule that a sensitive operation needs the approval of several approvers.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.organisation-firewall-policy","ref":"capability:security.organisation-firewall-policy","description":"Organisation-wide enforcement of firewall, WAF and security-group policies across accounts.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.organization-network-policy","ref":"capability:security.organization-network-policy","description":"Central firewall policy management across accounts with reusable application, protocol and resource lists (AWS Firewall Manager).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.payment-hsm","ref":"capability:security.payment-hsm","description":"A payment HSM service with payment key usages and payment operations.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.payment-key-alias","ref":"capability:security.payment-key-alias","description":"A named alias that can be re-pointed at a payment HSM key.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.posture-aggregation","ref":"capability:security.posture-aggregation","description":"Aggregation of security findings across projects, accounts or regions, with insights, automation rules, suppression and alerting.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.posture-management","ref":"capability:security.posture-management","description":"Managed security posture management (assessment of a project against fixed benchmarks): STACKIT Cloud Security Posture Management, a Portal service (generally available since 2026-10-05; enabled in the Portal or through the Service Enablement API) whose documented API reference is labelled v1beta, with no Terraform resource. It shows a project-level dashboard with a scan every 24 hours and offers no alerting. Managed threat detection is not part of it.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","state":"ASSESSED","value":"AVAILABLE","basis":"Service availability of the capability, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/security/cspm/","freshness":"UNKNOWN"},{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/security/cspm/basics/concepts/","freshness":"UNKNOWN"},{"kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/products/security/cspm/release-notes/","freshness":"UNKNOWN"}]},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/products/security/cspm/","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"NOT_ASSESSED","basis":"No Terraform resource type is listed for this capability. STACKIT offers this service (generally available). A public STACKIT API exists for it. The pinned Terraform provider has no resource for it. StackToIT does not draft automation for it yet; extra implementation is needed."},{"dimension":"region","stock":true},{"dimension":"maturity","state":"ASSESSED","value":"GA","basis":"Maturity of the capability, as the registry states it with evidence. The maturity the knowledge base keeps for a unit's target is shown per unit and is another source.","evidence":[{"kind":"TARGET_RELEASE_NOTE","source":"https://docs.stackit.cloud/release-notes/","freshness":"UNKNOWN"}]},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.posture-standards","ref":"capability:security.posture-standards","description":"Choice of compliance standards and control-level parameters or suppression in a posture service.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.posture-ticketing-integration","ref":"capability:security.posture-ticketing-integration","description":"Integration of security posture findings with ticketing systems (Jira Cloud, ServiceNow).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.private-ca","ref":"capability:security.private-ca","description":"A private certificate authority service (issue, revoke, share a CA).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.private-ca-templates","ref":"capability:security.private-ca-templates","description":"Certificate templates of a private certificate authority for directory-joined clients (validity, key, key usage, subject name and enrolment flags).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.secrets-manager","ref":"capability:security.secrets-manager","description":"A STACKIT Secrets Manager instance and its users (stackit_secretsmanager_instance, stackit_secretsmanager_user); the role bindings are identity.secretsmanager-role-binding. The provider schema says the service is only available with default_region \"eu01\". Among the sources the AWS rules map to it: aws_secretsmanager_secret; a secret value is never carried by the draft.","unit_services":["STACKIT Secrets Manager"],"provided_by":["stackit_secretsmanager_instance","stackit_secretsmanager_user"],"units":2,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","state":"ASSESSED","value":"AVAILABLE","basis":"API capability of the service, as the registry states it with evidence.","evidence":[{"kind":"TARGET_API_SPEC","source":"stackitcloud/stackit-api-specifications, services/secrets-manager/v1/secrets-manager.json:481; stackitcloud/stackit-api-specifications, services/secrets-manager/v1/secrets-manager.json:1922","freshness":"UNKNOWN"}]},{"dimension":"terraform","state":"ASSESSED","value":"RESOURCE_AVAILABLE,DATA_SOURCE_AVAILABLE","basis":"Facts derived from the pinned provider schema for the resource types the registry lists; a fact that is not listed is not established, it is not false.","types":[{"type":"stackit_secretsmanager_instance","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_secretsmanager_user","facts":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"evidence":[{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_secretsmanager_instance","freshness":"UNKNOWN"},{"kind":"TARGET_PROVIDER_SCHEMA","source":"STACKIT provider schema 0.121.0 resource_schemas.stackit_secretsmanager_user","freshness":"UNKNOWN"}]},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.sensitive-data-discovery","ref":"capability:security.sensitive-data-discovery","description":"Discovery and classification of sensitive data in object storage.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.siem","ref":"capability:security.siem","description":"A managed SIEM / security analytics product.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.threat-detection","ref":"capability:security.threat-detection","description":"Managed threat detection on logs and traffic (findings, threat intelligence lists, member accounts).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.voice-biometrics","ref":"capability:security.voice-biometrics","description":"Voice authentication of callers by voiceprint with a fraudster watchlist.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.vulnerability-assessment","ref":"capability:security.vulnerability-assessment","description":"Managed vulnerability and benchmark assessment of servers and images.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"security.vulnerability-scanning","ref":"capability:security.vulnerability-scanning","description":"Vulnerability scanning of hosts, functions and images (STACKIT Container Registry scans images with Trivy; no host or function scan).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"storage.bucket-policy","ref":"capability:storage.bucket-policy","description":"A resource policy or resource-based grant on an object storage bucket. STACKIT's management API (object-storage v1 and v2) and the pinned provider have no object for it; its S3 API takes Put Bucket Policy (docs.stackit.cloud object-storage reference supported-operations-on-buckets-and-objects), in a grammar of its own whose principals are credentials groups or * (key bucket_policy of execution-capabilities.yaml), so access by the identity of a compute resource does not exist.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"storage.object-lambda-access-point","ref":"capability:storage.object-lambda-access-point","description":"An Object Lambda access point that transforms objects on read, with its own access policy.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"storage.object-versioning","ref":"capability:storage.object-versioning","description":"Object versioning and public-access rules on a bucket.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"telephony.contact-center","ref":"capability:telephony.contact-center","description":"A cloud contact centre with telephony, queues, routing and agents.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"telephony.programmable-voice","ref":"capability:telephony.programmable-voice","description":"Programmable voice applications, SIP rules, speaker verification and call records.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"telephony.sip-trunking","ref":"capability:telephony.sip-trunking","description":"SIP trunking to the public telephone network with inbound and outbound settings.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"testing.device-farm","ref":"capability:testing.device-farm","description":"Real-device testing of mobile and web applications.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"testing.fault-injection","ref":"capability:testing.fault-injection","description":"A fault-injection service for controlled failure experiments.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"tls.acme-endpoint","ref":"capability:tls.acme-endpoint","description":"An ACME endpoint with domain prevalidation and external account binding.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"tls.certificate-expiry-events","ref":"capability:tls.certificate-expiry-events","description":"Platform events before a certificate expires.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"waf.captcha-and-challenge","ref":"capability:waf.captcha-and-challenge","description":"CAPTCHA, challenge and client token services of a WAF.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"waf.custom-conditions-and-reusable-sets","ref":"capability:waf.custom-conditions-and-reusable-sets","description":"Reusable, named condition sets and custom conditions in the CDN WAF and the load balancer WAF.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"waf.geographic-conditions","ref":"capability:waf.geographic-conditions","description":"Geographic (country) conditions in the load balancer WAF.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"waf.rate-limiting","ref":"capability:waf.rate-limiting","description":"Rate-based rules in a WAF.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"web.hosting-and-build","ref":"capability:web.hosting-and-build","description":"Managed build and hosting of web applications from a repository (static and server-side rendered).","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]},{"capability_id":"workflow.orchestration","ref":"capability:workflow.orchestration","description":"A managed workflow / low-code integration / step orchestration engine.","unit_services":[],"provided_by":[],"units":0,"cells":[{"dimension":"functional_parity","stock":true},{"dimension":"service","stock":true},{"dimension":"api","stock":true},{"dimension":"terraform","stock":true},{"dimension":"region","stock":true},{"dimension":"maturity","stock":true},{"dimension":"quota","stock":true},{"dimension":"lifecycle","stock":true},{"dimension":"operability","stock":true},{"dimension":"security","stock":true},{"dimension":"support","stock":true},{"dimension":"evidence","stock":true}]}],"units":{"with_target":15,"without_target":1,"matched":13,"partial":1,"capability_unlinked":1,"no_catalogue_row":0,"not_applicable":0,"by_presence":[{"presence":"KNOWN_PRESENT","with_target":10,"without_target":1,"matched":9,"partial":0,"capability_unlinked":1,"no_catalogue_row":0,"not_applicable":0},{"presence":"CONDITIONAL","with_target":5,"without_target":0,"matched":4,"partial":1,"capability_unlinked":0,"no_catalogue_row":0,"not_applicable":0},{"presence":"KNOWN_ABSENT","with_target":0,"without_target":0,"matched":0,"partial":0,"capability_unlinked":0,"no_catalogue_row":0,"not_applicable":0}]},"uncovered_resource_types":[{"type":"stackit_objectstorage_bucket","units":2,"standing":"RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED","functional_parity":"NOT_ASSESSED","basis":"The pinned STACKIT provider has this resource; StackToIT's capability metadata for it is incomplete.","terraform":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_objectstorage_credential","units":1,"standing":"RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED","functional_parity":"NOT_ASSESSED","basis":"The pinned STACKIT provider has this resource; StackToIT's capability metadata for it is incomplete.","terraform":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]},{"type":"stackit_objectstorage_credentials_group","units":1,"standing":"RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED","functional_parity":"NOT_ASSESSED","basis":"The pinned STACKIT provider has this resource; StackToIT's capability metadata for it is incomplete.","terraform":["RESOURCE_AVAILABLE","DATA_SOURCE_AVAILABLE"]}],"api_only_gaps":{"catalogued_not_generated":4,"rows":[{"capability":"compute.image-share","aws_source":["aws_ami_launch_permission"],"operation":"iaas_v2 SetImageShare","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has the source type aws_ami_launch_permission."}},{"capability":"compute.run-command","aws_source":["aws_ssm_document","aws_ssm_association","aws_ssm_maintenance_window_task","awscc_ssm_document","awscc_ssm_association","awscc_ssm_maintenance_window_task"],"operation":"run-command_v2 CreateCommand","step_state":"GENERATOR_AVAILABLE","step_words":"generated, not yet tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has one of the source types aws_ssm_document, aws_ssm_association, aws_ssm_maintenance_window_task, awscc_ssm_document, awscc_ssm_association, awscc_ssm_maintenance_window_task."}},{"capability":"compute.snapshot","aws_source":["aws_ebs_snapshot","google_compute_instant_snapshot","google_compute_region_instant_snapshot"],"operation":"iaas_v2 CreateSnapshot","step_state":"GENERATOR_AVAILABLE","step_words":"generated, not yet tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has one of the source types aws_ebs_snapshot, google_compute_instant_snapshot, google_compute_region_instant_snapshot."}},{"capability":"containers.container-app","aws_source":["aws_apprunner_service","awscc_apprunner_service","aws_lightsail_container_service_deployment_version"],"operation":"sca_v1alpha CreateApplication","step_state":"GENERATOR_AVAILABLE","step_words":"generated, not yet tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has one of the source types aws_apprunner_service, awscc_apprunner_service, aws_lightsail_container_service_deployment_version."}},{"capability":"database.postgresql.deletion-protection","aws_source":["aws_db_instance","aws_rds_cluster","awscc_rds_db_instance","awscc_rds_db_cluster","google_sql_database_instance"],"operation":"postgres-flex_v3 UpdateInstanceProtection","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":1,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: the 1 unit of its source types that exist (google_sql_database_instance.postgres) asks for no deletion protection (deletion_protection is not set to true), so no step is needed."}},{"capability":"database.sqlserver.deletion-protection","aws_source":["aws_db_instance","awscc_rds_db_instance","google_sql_database_instance"],"operation":"sqlserverflex_v3 UpdateInstanceProtection","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":1,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: the 1 unit of its source types that exist (google_sql_database_instance.postgres) is drafted onto another STACKIT service than the one this requirement is for (stackit_sqlserverflex_instance), so no step of it is needed."}},{"capability":"function.container-image","aws_source":["aws_lambda_function","awscc_lambda_function"],"operation":"sca_v1alpha CreateApplication","step_state":"GENERATOR_AVAILABLE","step_words":"generated, not yet tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has one of the source types aws_lambda_function, awscc_lambda_function."}},{"capability":"function.http","aws_source":["aws_lambda_function","awscc_lambda_function","aws_lambda_function_url","aws_lambda_alias","aws_lambda_layer_version","aws_lambda_permission"],"operation":"functions_v1alpha CreateFunction","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has one of the source types aws_lambda_function, awscc_lambda_function, aws_lambda_function_url, aws_lambda_alias, aws_lambda_layer_version, aws_lambda_permission."}},{"capability":"identity.secret","aws_source":["aws_secretsmanager_secret","aws_ssm_parameter","awscc_secretsmanager_secret","google_secret_manager_secret","google_secret_manager_regional_secret"],"operation":"secretsmanager-vault WriteSecret","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":2,"conditional":0,"known_absent":0},"estate":{"state":"STEPS","steps":{"terraform":0,"stackit_api":2,"manual":0,"refused":0},"units":["google_secret_manager_secret.django_admin_password","google_secret_manager_secret.django_settings"],"words":"2 STACKIT API steps, in this run's execution plan."}},{"capability":"network.lb-block-list","aws_source":["aws_wafv2_ip_set","awscc_wafv2_ip_set"],"operation":"lb-ip-lists_v1alpha UploadIPList","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has one of the source types aws_wafv2_ip_set, awscc_wafv2_ip_set."}},{"capability":"network.security-group.default-egress-rules","aws_source":["aws_subnet"],"operation":"iaas_v2 DeleteSecurityGroupRule","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has the source type aws_subnet."}},{"capability":"objectstorage.bucket.cors","aws_source":["aws_s3_bucket_cors_configuration","google_storage_bucket"],"operation":"s3 PutBucketCors","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":1,"conditional":0,"known_absent":0},"estate":{"state":"NAMED_NO_STEP","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":["google_storage_bucket.media"],"words":"1 unit of its source types exist or are decided at plan time (google_storage_bucket.media), and the execution plan holds no step of this requirement: a unit gets the step only when its source sets what the call carries. For these units the plan holds 1 OpenTofu step, 13 manual steps, 1 refused step."}},{"capability":"objectstorage.bucket.lifecycle","aws_source":["aws_s3_bucket_lifecycle_configuration","aws_s3control_bucket_lifecycle_configuration","google_storage_bucket"],"operation":"s3 PutBucketLifecycleConfiguration","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":1,"conditional":0,"known_absent":0},"estate":{"state":"NAMED_NO_STEP","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":["google_storage_bucket.media"],"words":"1 unit of its source types exist or are decided at plan time (google_storage_bucket.media), and the execution plan holds no step of this requirement: a unit gets the step only when its source sets what the call carries. For these units the plan holds 1 OpenTofu step, 13 manual steps, 1 refused step."}},{"capability":"objectstorage.bucket.policy","aws_source":["aws_s3_bucket_policy","google_storage_bucket"],"operation":"s3 PutBucketPolicy","step_state":"GENERATOR_AVAILABLE","step_words":"generated, not yet tested offline","units":{"known_present":1,"conditional":0,"known_absent":0},"estate":{"state":"NAMED_NO_STEP","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":["google_storage_bucket.media"],"words":"1 unit of its source types exist or are decided at plan time (google_storage_bucket.media), and the execution plan holds no step of this requirement: a unit gets the step only when its source sets what the call carries. For these units the plan holds 1 OpenTofu step, 13 manual steps, 1 refused step."}},{"capability":"objectstorage.bucket.tagging","aws_source":["aws_s3_bucket"],"operation":"s3 PutBucketTagging","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has the source type aws_s3_bucket."}},{"capability":"objectstorage.bucket.versioning","aws_source":["aws_s3_bucket_versioning","google_storage_bucket"],"operation":"s3 PutBucketVersioning","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":1,"conditional":0,"known_absent":0},"estate":{"state":"NAMED_NO_STEP","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":["google_storage_bucket.media"],"words":"1 unit of its source types exist or are decided at plan time (google_storage_bucket.media), and the execution plan holds no step of this requirement: a unit gets the step only when its source sets what the call carries. For these units the plan holds 1 OpenTofu step, 13 manual steps, 1 refused step."}},{"capability":"observability.cdn-log-sink","aws_source":["aws_cloudfront_realtime_log_config"],"operation":"cdn_v1 PatchDistribution","step_state":"GENERATOR_AVAILABLE","step_words":"generated, not yet tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has the source type aws_cloudfront_realtime_log_config."}},{"capability":"platform.git-runner","aws_source":["google_cloudbuild_worker_pool"],"operation":"git_v1beta CreateRunner","step_state":"GENERATOR_AVAILABLE","step_words":"generated, not yet tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has the source type google_cloudbuild_worker_pool."}},{"capability":"platform.service-enablement","aws_source":[],"operation":"service-enablement_v2 EnableServiceRegional","step_state":"GENERATOR_AVAILABLE","step_words":"generated, not yet tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has one of the source types ."}},{"capability":"pubsub.queue","aws_source":["aws_sqs_queue"],"operation":"pubsub_v1beta create-topic","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has the source type aws_sqs_queue."}},{"capability":"pubsub.subscription","aws_source":["aws_sns_topic_subscription","google_pubsub_subscription"],"operation":"pubsub_v1beta create-subscription","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has one of the source types aws_sns_topic_subscription, google_pubsub_subscription."}},{"capability":"pubsub.subscription.subscriber-grant","aws_source":["google_pubsub_subscription_iam_member","google_pubsub_subscription_iam_binding"],"operation":"pubsub_v1beta grant-subscription-subscriber-access","step_state":"GENERATOR_AVAILABLE","step_words":"generated, not yet tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has one of the source types google_pubsub_subscription_iam_member, google_pubsub_subscription_iam_binding."}},{"capability":"pubsub.topic","aws_source":["aws_sns_topic","google_pubsub_topic"],"operation":"pubsub_v1beta create-topic","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":1,"conditional":0,"known_absent":0},"estate":{"state":"STEPS","steps":{"terraform":0,"stackit_api":0,"manual":1,"refused":0},"units":["google_pubsub_topic.faux"],"words":"1 manual step, in this run's execution plan."}},{"capability":"pubsub.topic.publisher-grant","aws_source":["google_pubsub_topic_iam_member","google_pubsub_topic_iam_binding"],"operation":"pubsub_v1beta grant-topic-publisher-access","step_state":"GENERATOR_AVAILABLE","step_words":"generated, not yet tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has one of the source types google_pubsub_topic_iam_member, google_pubsub_topic_iam_binding."}},{"capability":"registry.git-repository","aws_source":["aws_codecommit_repository","awscc_codecommit_repository"],"operation":"stackit-git-forgejo CreateOrgRepo","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has one of the source types aws_codecommit_repository, awscc_codecommit_repository."}},{"capability":"registry.repository","aws_source":["aws_ecr_repository","awscc_ecr_repository","aws_ecr_pull_through_cache_rule","google_artifact_registry_repository","google_container_registry"],"operation":"registry_v1 CreateArtifactory","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has one of the source types aws_ecr_repository, awscc_ecr_repository, aws_ecr_pull_through_cache_rule, google_artifact_registry_repository, google_container_registry."}},{"capability":"workflows.airflow","aws_source":["aws_mwaa_environment"],"operation":"workflows_v1alpha CreateInstance","step_state":"OFFLINE_TESTED","step_words":"generated, tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has the source type aws_mwaa_environment."}},{"capability":"workflows.composer","aws_source":["google_composer_environment"],"operation":"workflows_v1alpha CreateInstance","step_state":"GENERATOR_AVAILABLE","step_words":"generated, not yet tested offline","units":{"known_present":0,"conditional":0,"known_absent":0},"estate":{"state":"NOT_USED","steps":{"terraform":0,"stackit_api":0,"manual":0,"refused":0},"units":[],"words":"Not used by any unit of this estate: no unit has the source type google_composer_environment."}}]}},"evidence_index":{"limits":["A unit id is its Terraform address: renaming a resource in the source is a new unit. Continuity of a unit across a rename is not built (a semantic fingerprint is a later item).","An id names an object and holds no run: the same estate gives the same ids in every run. The JSON pointer into a file of the report is valid for the run named in header.run.","A line is given only for a block of the draft that parses as HCL. A block the draft writes as a comment has a file and no line, and a block the report could not place has neither.","A hop that reads UNSUPPORTED is not produced by this build; one that reads NOT_AVAILABLE is produced by this build and made nothing in this run. Neither is a finding of no risk."],"counts":{"units":16,"units_with_targets":11,"targets":10,"edges":13,"unowned_targets":0},"families":[{"family":"GCP_IDENTITY","units":4,"trace_producer":false,"traced_units":0,"hops":[{"hop":"source","states":[{"state":"ESTABLISHED","units":4}]},{"hop":"intent","states":[{"state":"NOT_AVAILABLE","units":4}]},{"hop":"plan","states":[{"state":"OPEN","units":4}]},{"hop":"hcl","states":[{"state":"ESTABLISHED","units":4}]},{"hop":"validation","states":[{"state":"ESTABLISHED","units":4}]}]},{"family":"LEGACY_GENERATOR","units":12,"trace_producer":true,"traced_units":7,"hops":[{"hop":"source","states":[{"state":"ESTABLISHED","units":12}]},{"hop":"intent","states":[{"state":"UNSUPPORTED","units":12}]},{"hop":"plan","states":[{"state":"UNSUPPORTED","units":12}]},{"hop":"hcl","states":[{"state":"ESTABLISHED","units":7},{"state":"NONE","units":5}]},{"hop":"validation","states":[{"state":"UNSUPPORTED","units":12}]}]}],"targets":{"rows_total":10,"by_block":{"HCL_BLOCK":10},"by_origin":{"LEGACY_GENERATOR":10}},"checks":[{"id":"check:GLOBAL_RESOURCE_UNIQUENESS","state":"PASS","checked":55,"file":"manifest.json","pointer":"/verification/0"},{"id":"check:NO_UNPLANNED_RESOURCE","state":"PASS","checked":10,"file":"manifest.json","pointer":"/verification/1"},{"id":"check:NO_UNPLANNED_REFERENCE","state":"PASS","checked":9,"file":"manifest.json","pointer":"/verification/2"},{"id":"check:NO_UNRESOLVED_REQUIRED_FIELD","state":"PASS","checked":28,"file":"manifest.json","pointer":"/verification/3"},{"id":"check:NO_SECURITY_WIDENING","state":"PASS","checked":0,"file":"manifest.json","pointer":"/verification/4"},{"id":"check:ALL_OUTPUTS_SAME_RUN","state":"PASS","checked":48,"file":"manifest.json","pointer":"/verification/5"},{"id":"check:VARIABLE_IDENTITY_PRESERVED","state":"PASS","checked":0,"file":"manifest.json","pointer":"/verification/6"},{"id":"check:NO_ORPHAN_MANUAL_ACTION","state":"PASS","checked":4,"file":"manifest.json","pointer":"/verification/7"},{"id":"check:SOURCE_PROVIDER_MATCHES_SCHEMA_OR_IS_UNVERIFIED","state":"PASS","checked":16,"file":"manifest.json","pointer":"/verification/8"},{"id":"check:APPLICATION_READY_IMPLIES_REQUIRED_ENV_SECRETS_DEPENDENCIES","state":"PASS","checked":0,"file":"manifest.json","pointer":"/verification/9"},{"id":"check:ALL_EMITTED_TARGET_TYPES_CLASSIFIED","state":"PASS","checked":10,"file":"manifest.json","pointer":"/verification/10"},{"id":"check:ALL_UNACCOUNTED_PROPERTIES_EXPLICIT","state":"PASS","checked":69,"file":"manifest.json","pointer":"/verification/11"},{"id":"check:SOURCE_COMPLETENESS","state":"PARTIAL","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/0"},{"id":"check:DRAFT_GENERATION","state":"GENERATED","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/1"},{"id":"check:STACKTOIT_DRAFT_CHECKS","state":"PASSED","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/2"},{"id":"check:GLOBAL_INVARIANTS","state":"PASSED","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/3"},{"id":"check:TOFU_STATIC_VALIDATION","state":"PASSED","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/4"},{"id":"check:OUTPUT_SCHEMA_VALIDATION","state":"PASSED","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/5"},{"id":"check:STACKIT_PLAN","state":"NOT_RUN","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/6"},{"id":"check:ARCHITECT_APPROVAL","state":"NOT_PROVIDED","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/7"},{"id":"check:SEMANTIC_EQUIVALENCE","state":"NOT_ASSESSED","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/8"},{"id":"check:SAFE_TO_APPLY","state":"NOT_ASSERTED","checked":0,"file":"workspace.json","pointer":"/validation_matrix/rows/9"}]},"finding_groups":{"counts":{"findings":41,"in_groups":31,"singletons":10,"groups":7},"groups":[{"id":"findinggroup:cloudbuild-source-event:4b662b9b8f2b","check_id":"cloudbuild-source-event","severity":"info","message":"This trigger starts its builds on a Pub/Sub message. The replacement workflow lists the events that start it in its own on: section; the pages of STACKIT read describe pipelines that run whenever changes are pushed to a repository, so a pull request, a schedule or a manual start is verified by a person against the Forgejo Actions reference.","evidence":["https://docs.stackit.cloud/products/developer-platform/git/basics/stackit-pipelines/"],"records":3,"units":["google_cloudbuild_trigger.activategcb","google_cloudbuild_trigger.init","google_cloudbuild_trigger.placeholder"]},{"id":"findinggroup:linked-dependency-unread:8bcb492ae42c","check_id":"linked-dependency-unread","severity":"warning","message":"This unit names google_firebase_hosting_site.client (google_firebase_hosting_site), whose own decision the target does not carry (it is REDESIGN), and the semantic contract of google_cloudbuild_trigger does not read google_firebase_hosting_site, so what the reference becomes is not assessed.","records":2,"units":["google_cloudbuild_trigger.init","google_cloudbuild_trigger.placeholder"]},{"id":"findinggroup:run-min-zero:5a8464db9c9c","check_id":"run-min-zero","severity":"info","message":"The service can scale to zero; on SKE at least one replica runs unless an autoscaler with scale-to-zero (KEDA/Knative) is installed.","records":2,"units":["google_cloud_run_v2_job.migrate","google_cloud_run_v2_service.server"]},{"id":"findinggroup:run-unsupported-volume:c6a1d4c8671b","check_id":"run-unsupported-volume","severity":"warning","message":"A container mounts a Cloud SQL connection, a Cloud Storage bucket (through Cloud Storage FUSE) or an NFS share. The draft writes no volume for these and holds the pods until a person decides: connect to the migrated database or object store over the network instead of the mount, or mount a share or a volume of the cluster yourself.","evidence":["https://registry.terraform.io/providers/hashicorp/google/8.4.0/docs/resources/cloud_run_v2_service"],"records":2,"units":["google_cloud_run_v2_job.migrate","google_cloud_run_v2_service.server"]},{"id":"findinggroup:sa-account-id-not-visible:8622d2e15078","check_id":"sa-account-id-not-visible","severity":"info","message":"The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact","evidence":["https://registry.terraform.io/providers/stackitcloud/stackit/0.116.0/docs/resources/service_account"],"records":4,"units":["google_service_account.automation","google_service_account.client","google_service_account.init","google_service_account.server"]},{"id":"findinggroup:secret-iam-access:a19fe5290842","check_id":"secret-iam-access","severity":"warning","message":"The secret has grants for individual principals. Access on STACKIT Secrets Manager is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for the whole secrets engine of its instance, with no scope to one secret or path. Narrower access exists only as role bindings on the instance or on a secret group (a named list of secrets) in the alpha API of the service, and the pinned provider offers them as resources of its experimental IAM feature (stackit_secretsmanager_instance_role_binding_v1 and stackit_secretsmanager_secret_group_role_binding_v1), which its documentation says may change or be removed; the specification does not list the roles a secret group accepts. A grant of one Google principal on one secret therefore cannot be carried one to one: decide per principal whether it gets a user of the whole instance, a role binding on a secret group of the secrets it may read, or a separate Secrets Manager instance.","evidence":["https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/secrets-manager/v1/secrets-manager.json","https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/secrets-manager/v1alpha/secrets-manager.json","https://registry.terraform.io/providers/stackitcloud/stackit/0.121.0/docs/resources/secretsmanager_instance_role_binding_v1","https://registry.terraform.io/providers/stackitcloud/stackit/0.121.0/docs/resources/secretsmanager_secret_group_role_binding_v1","https://registry.terraform.io/providers/stackitcloud/stackit/0.121.0/docs/resources/secretsmanager_user"],"records":2,"units":["google_secret_manager_secret.django_admin_password","google_secret_manager_secret.django_settings"]},{"id":"findinggroup:source-provider-unverified:8a82df957e8e","check_id":"source-provider-unverified","severity":"warning","message":"no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint \"\u003e= 6, \u003c 8\" excludes it (pinned 8.4.0) (stated once for the whole estate, with the units it covers and the rest of the words)","records":16,"units":["google_cloud_run_v2_job.migrate","google_cloud_run_v2_service.server","google_cloudbuild_trigger.activategcb","google_cloudbuild_trigger.init","google_cloudbuild_trigger.placeholder","google_firebase_hosting_site.client","google_firebase_project.default","google_pubsub_topic.faux","google_secret_manager_secret.django_admin_password","google_secret_manager_secret.django_settings","google_service_account.automation","google_service_account.client","google_service_account.init","google_service_account.server","google_sql_database_instance.postgres","google_storage_bucket.media"]}]},"diagrams":[{"scope":{"kind":"estate"},"node_count":16,"edge_count":29,"nodes":[{"unit":"google_firebase_project.default","type":"google_firebase_project","class":"MANUAL_REVIEW","confidence":"LOW","no_target":true,"not_carried":null,"tier":"other","critical_open":1,"conditional":false},{"unit":"google_pubsub_topic.faux","type":"google_pubsub_topic","class":"REPLATFORM","confidence":"MEDIUM","service":"STACKIT RabbitMQ","no_target":false,"not_carried":1,"tier":"compute","critical_open":1,"conditional":false},{"unit":"google_service_account.automation","type":"google_service_account","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account","no_target":false,"not_carried":2,"tier":"support","critical_open":2,"conditional":false},{"unit":"google_service_account.client","type":"google_service_account","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account","no_target":false,"not_carried":2,"tier":"support","critical_open":2,"conditional":false},{"unit":"google_service_account.server","type":"google_service_account","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account","no_target":false,"not_carried":2,"tier":"support","critical_open":2,"conditional":false},{"unit":"google_sql_database_instance.postgres","type":"google_sql_database_instance","class":"REPLATFORM","confidence":"MEDIUM","service":"STACKIT PostgreSQL Flex","no_target":false,"not_carried":6,"tier":"data","critical_open":6,"conditional":false},{"unit":"google_secret_manager_secret.django_admin_password","type":"google_secret_manager_secret","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Secrets Manager","no_target":false,"not_carried":5,"tier":"support","critical_open":3,"conditional":false},{"unit":"google_storage_bucket.media","type":"google_storage_bucket","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Object Storage","no_target":false,"not_carried":6,"tier":"data","critical_open":7,"conditional":false},{"unit":"google_secret_manager_secret.django_settings","type":"google_secret_manager_secret","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Secrets Manager","no_target":false,"not_carried":5,"tier":"support","critical_open":3,"conditional":false},{"unit":"google_cloud_run_v2_job.migrate","type":"google_cloud_run_v2_job","class":"CONTAINERIZE","confidence":"MEDIUM","service":"Kubernetes Job/CronJob on SKE","no_target":false,"not_carried":3,"tier":"compute","critical_open":11,"conditional":false},{"unit":"google_cloud_run_v2_service.server","type":"google_cloud_run_v2_service","class":"CONTAINERIZE","confidence":"MEDIUM","service":"SKE workload (or Cloud Foundry Docker app)","no_target":false,"not_carried":6,"tier":"compute","critical_open":12,"conditional":false},{"unit":"google_cloudbuild_trigger.activategcb","type":"google_cloudbuild_trigger","class":"REDESIGN","confidence":"MEDIUM","service":"a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD","no_target":false,"not_carried":null,"tier":"compute","critical_open":6,"conditional":true},{"unit":"google_cloudbuild_trigger.init","type":"google_cloudbuild_trigger","class":"REDESIGN","confidence":"LOW","service":"a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD","no_target":false,"not_carried":null,"tier":"compute","critical_open":6,"conditional":true},{"unit":"google_cloudbuild_trigger.placeholder","type":"google_cloudbuild_trigger","class":"REDESIGN","confidence":"LOW","service":"a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD","no_target":false,"not_carried":null,"tier":"compute","critical_open":6,"conditional":true},{"unit":"google_firebase_hosting_site.client","type":"google_firebase_hosting_site","class":"REDESIGN","confidence":"LOW","service":"STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain","no_target":false,"not_carried":null,"tier":"network","critical_open":2,"conditional":true},{"unit":"google_service_account.init","type":"google_service_account","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account","no_target":false,"not_carried":2,"tier":"support","critical_open":2,"conditional":true}],"edges":[{"from":"google_cloud_run_v2_job.migrate","to":"google_secret_manager_secret.django_settings"},{"from":"google_cloud_run_v2_job.migrate","to":"google_service_account.automation"},{"from":"google_cloud_run_v2_job.migrate","to":"google_sql_database_instance.postgres"},{"from":"google_cloud_run_v2_service.server","to":"google_secret_manager_secret.django_settings"},{"from":"google_cloud_run_v2_service.server","to":"google_service_account.server"},{"from":"google_cloud_run_v2_service.server","to":"google_sql_database_instance.postgres"},{"from":"google_cloudbuild_trigger.activategcb","to":"google_pubsub_topic.faux"},{"from":"google_cloudbuild_trigger.activategcb","to":"google_service_account.init"},{"from":"google_cloudbuild_trigger.init","to":"google_cloud_run_v2_job.migrate"},{"from":"google_cloudbuild_trigger.init","to":"google_cloud_run_v2_service.server"},{"from":"google_cloudbuild_trigger.init","to":"google_firebase_hosting_site.client"},{"from":"google_cloudbuild_trigger.init","to":"google_pubsub_topic.faux"},{"from":"google_cloudbuild_trigger.init","to":"google_secret_manager_secret.django_admin_password"},{"from":"google_cloudbuild_trigger.init","to":"google_secret_manager_secret.django_settings"},{"from":"google_cloudbuild_trigger.init","to":"google_service_account.automation"},{"from":"google_cloudbuild_trigger.init","to":"google_service_account.client"},{"from":"google_cloudbuild_trigger.init","to":"google_service_account.init"},{"from":"google_cloudbuild_trigger.init","to":"google_sql_database_instance.postgres"},{"from":"google_cloudbuild_trigger.placeholder","to":"google_firebase_hosting_site.client"},{"from":"google_cloudbuild_trigger.placeholder","to":"google_pubsub_topic.faux"},{"from":"google_cloudbuild_trigger.placeholder","to":"google_service_account.init"},{"from":"google_firebase_hosting_site.client","to":"google_firebase_project.default"},{"from":"google_secret_manager_secret.django_admin_password","to":"google_service_account.automation"},{"from":"google_secret_manager_secret.django_settings","to":"google_service_account.automation"},{"from":"google_secret_manager_secret.django_settings","to":"google_service_account.server"},{"from":"google_secret_manager_secret.django_settings","to":"google_sql_database_instance.postgres"},{"from":"google_secret_manager_secret.django_settings","to":"google_storage_bucket.media"},{"from":"google_storage_bucket.media","to":"google_service_account.automation"},{"from":"google_storage_bucket.media","to":"google_service_account.server"}]},{"scope":{"kind":"proposed_group","id":"migrate"},"node_count":3,"edge_count":2,"nodes":[{"unit":"google_service_account.automation","type":"google_service_account","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account","no_target":false,"not_carried":2,"tier":"support","critical_open":2,"conditional":false},{"unit":"google_secret_manager_secret.django_admin_password","type":"google_secret_manager_secret","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT Secrets Manager","no_target":false,"not_carried":5,"tier":"support","critical_open":3,"conditional":false},{"unit":"google_cloud_run_v2_job.migrate","type":"google_cloud_run_v2_job","class":"CONTAINERIZE","confidence":"MEDIUM","service":"Kubernetes Job/CronJob on SKE","no_target":false,"not_carried":3,"tier":"compute","critical_open":11,"conditional":false}],"edges":[{"from":"google_cloud_run_v2_job.migrate","to":"google_service_account.automation"},{"from":"google_secret_manager_secret.django_admin_password","to":"google_service_account.automation"}]},{"scope":{"kind":"proposed_group","id":"server"},"node_count":2,"edge_count":1,"nodes":[{"unit":"google_service_account.server","type":"google_service_account","class":"RECONFIGURE","confidence":"MEDIUM","service":"STACKIT service account","no_target":false,"not_carried":2,"tier":"support","critical_open":2,"conditional":false},{"unit":"google_cloud_run_v2_service.server","type":"google_cloud_run_v2_service","class":"CONTAINERIZE","confidence":"MEDIUM","service":"SKE workload (or Cloud Foundry Docker app)","no_target":false,"not_carried":6,"tier":"compute","critical_open":12,"conditional":false}],"edges":[{"from":"google_cloud_run_v2_service.server","to":"google_service_account.server"}]}],"target_architecture":{"drawing":{"scope":{"kind":"generated_target"},"node_count":3,"edge_count":1,"nodes":[{"unit":"stackit_objectstorage_bucket.media","type":"stackit_objectstorage_bucket","class":"","confidence":"","service":"from storage bucket media","no_target":false,"not_carried":null,"tier":"data","critical_open":0,"conditional":false},{"unit":"stackit_postgresflex_instance.postgres","type":"stackit_postgresflex_instance","class":"","confidence":"","service":"from sql database instance postgres","no_target":false,"not_carried":null,"tier":"data","critical_open":0,"conditional":false},{"unit":"stackit_ske_cluster.containers","type":"stackit_ske_cluster","class":"","confidence":"","service":"from 2 source units","no_target":false,"not_carried":null,"tier":"compute","critical_open":0,"conditional":false}],"edges":[{"from":"stackit_ske_cluster.containers","to":"stackit_postgresflex_instance.postgres","unknown":true}]},"source_units":4,"by_kind":[{"name":"server","count":1},{"name":"data-store","count":2}],"not_drawn":[{"name":"stackit_rabbitmq_instance","count":1},{"name":"stackit_secretsmanager_instance","count":1},{"name":"stackit_secretsmanager_user","count":1},{"name":"stackit_service_account","count":4}],"unknown_edges":[{"from":"stackit_ske_cluster.containers","to":"stackit_postgresflex_instance.postgres","why":"google_cloud_run_v2_job.migrate refers to google_sql_database_instance.postgres (template.template.volumes.cloud_sql_instance.instances) in the source; the draft writes no reference between stackit_ske_cluster.containers and stackit_postgresflex_instance.postgres; what decides it: stackit_postgresflex_instance has a network block with an access list and a scope but no network ID of a project network (provider schema 0.120.0); network.acl and network.access_scope (PUBLIC or SNA) is its access control, so who reaches it is decided by var.postgres_allowed_cidrs, which the draft leaves without a default, which is to name the addresses the workload connects from: the pods of a drafted cluster connect from its egress_address_ranges (a computed attribute: \"The outgoing network ranges (in CIDR notation) of traffic originating from workload on the cluster.\", provider schema 0.120.0)"}],"mappings":[{"kind":"MANY_TO_ONE","units":["google_cloud_run_v2_job.migrate","google_cloud_run_v2_service.server"],"resources":["stackit_ske_cluster.containers"]}],"mermaid_views":[{"path":"architecture/network-security.mmd","text":"%% FOR REVIEW — generated by StackToIT Assess. Architect review required before any decision.\n%% What this view is: the network and security picture of the migration, drawn from the plans of the draft (security group rules, attachments, routing) and from the assessment (the references the source configuration makes). One box per source unit: its address, its source type, the STACKIT service the assessment proposes and, when a plan drafts resources from it, their addresses.\n%% Arrows: a thin arrow is a reference the source configuration makes (its label is the attribute that holds it); a thick arrow is a path a rule, a route or a listener permits (direction, protocol, ports); a dashed arrow is UNKNOWN (its label says why the sources do not settle it). Nothing here is observed traffic or a verified connection, and a connection no source states is not drawn.\n%% Google Cloud: a load balancer is its forwarding rule and its backend service, with the target proxy and the URL map as the label of the arrow between them. A firewall rule is the box of the rule; a thin arrow from an instance, a group manager or a cluster to it is the selection the source states by network tag or service account (\"selected by target_tags web\"), and the arrow says whether the draft attaches the rule's security group to that unit. A thick arrow from a range to the rule is a rule the draft drafts; a deny rule is an orange arrow, because STACKIT security groups only allow. What faces the internet is read from the load balancing scheme, the external IP of a network interface, the ingress setting and invoker of a Cloud Run service or Function, the endpoint of a GKE cluster and the public address of a Cloud SQL instance.\n%% Only GCP units of a network role are drawn. architecture/dependencies.mmd holds every unit.\nflowchart LR\n  n_google_cloud_run_v2_job_migrate[\"google_cloud_run_v2_job.migrate\u003cbr/\u003e\u003csmall\u003egoogle_cloud_run_v2_job → Kubernetes Job/CronJob on SKE\u003c/small\u003e\u003cbr/\u003e\u003csmall\u003elocation us-central1\u003c/small\u003e\"]:::unit\n  n_google_cloud_run_v2_service_server[\"google_cloud_run_v2_service.server\u003cbr/\u003e\u003csmall\u003egoogle_cloud_run_v2_service → SKE workload (or Cloud Foundry Docker app)\u003c/small\u003e\u003cbr/\u003e\u003csmall\u003elocation us-central1\u003c/small\u003e\"]:::unit\n  n_google_sql_database_instance_postgres[\"google_sql_database_instance.postgres\u003cbr/\u003e\u003csmall\u003egoogle_sql_database_instance → STACKIT PostgreSQL Flex\u003c/small\u003e\u003cbr/\u003e\u003csmall\u003ePOSTGRES_14, region us-central1, db-custom-2-4096\u003c/small\u003e\"]:::unit\n  n_internet[\"internet\"]:::internet\n  n_google_cloud_run_v2_job_migrate --\u003e|\"template.template.volumes.cloud_sql_instance.instances\"| n_google_sql_database_instance_postgres\n  n_google_cloud_run_v2_service_server --\u003e|\"template.volumes.cloud_sql_instance.instances\"| n_google_sql_database_instance_postgres\n  n_internet --\u003e|\"the URL is reachable from the internet (ingress is not set, and by default the service accepts all traffic) but needs an authenticated caller: no IAM member of the source gives allUsers the invoker role (a binding or policy outside the scan could)\"| n_google_cloud_run_v2_service_server\n  n_internet --\u003e|\"public IPv4 address (ipv4_enabled is not set and its default is true); no authorized network, so only the Cloud SQL connectors reach it\"| n_google_sql_database_instance_postgres\n  classDef unit fill:#e1e5f5,stroke:#4b5ba6\n  classDef synthetic fill:#f3f3f3,stroke:#566663\n  classDef unknown fill:#f3f3f3,stroke:#566663,stroke-dasharray:4 3\n  classDef manual fill:#f6e7cf,stroke:#a8650c\n  classDef internet fill:#f8deda,stroke:#b1261b\n","drawing":{"scope":"network_security","nodes":[{"key":"google_cloud_run_v2_job.migrate","title":"google_cloud_run_v2_job.migrate","lines":["google_cloud_run_v2_job → Kubernetes Job/CronJob on SKE","location us-central1"],"kind":"unit","tier":"compute"},{"key":"google_cloud_run_v2_service.server","title":"google_cloud_run_v2_service.server","lines":["google_cloud_run_v2_service → SKE workload (or Cloud Foundry Docker app)","location us-central1"],"kind":"unit","tier":"compute"},{"key":"google_sql_database_instance.postgres","title":"google_sql_database_instance.postgres","lines":["google_sql_database_instance → STACKIT PostgreSQL Flex","POSTGRES_14, region us-central1, db-custom-2-4096"],"kind":"unit","tier":"data"},{"key":"internet","title":"internet","kind":"internet","tier":"network"}],"edges":[{"from":"google_cloud_run_v2_job.migrate","to":"google_sql_database_instance.postgres","kind":"source","label":"template.template.volumes.cloud_sql_instance.instances"},{"from":"google_cloud_run_v2_service.server","to":"google_sql_database_instance.postgres","kind":"source","label":"template.volumes.cloud_sql_instance.instances"},{"from":"internet","to":"google_cloud_run_v2_service.server","kind":"source","label":"the URL is reachable from the internet (ingress is not set, and by default the service accepts all traffic) but needs an authenticated caller: no IAM member of the source gives allUsers the invoker role (a binding or policy outside the scan could)"},{"from":"internet","to":"google_sql_database_instance.postgres","kind":"source","label":"public IPv4 address (ipv4_enabled is not set and its default is true); no authorized network, so only the Cloud SQL connectors reach it"}]}},{"path":"architecture/data-flows.mmd","text":"%% FOR REVIEW — generated by StackToIT Assess. Architect review required before any decision.\n%% What this view is: the data flows between the clients, load balancers, applications, databases, object storage and registries of the estate, drawn from the forwarding rules and backend services of the source, the ingress settings of its serverless units, the firewall rules of the VPC and the references the source configuration makes. Each flow says its protocol and port where the source states them, whether it is public or private, and the migration effect (the class the assessment gives the unit it ends in). What the source does not state is written unknown.\n%% The flows are the paths a forwarding rule, a backend service or a firewall rule permits, not observed traffic. A load balancer is drawn as its forwarding rule (the clients, the protocol of its target proxy, its ports) and its backend service (the protocol and the named port it speaks to the instance groups, network endpoint groups and buckets behind it); the proxy and the URL map are the label of the arrow between them. A firewall rule is drawn between the clients and the instances it selects by network tag or service account, thick only when the draft attaches the rule's security group to the unit it filters, else dashed and saying what the draft does not do. A thin arrow is a reference from an application to a unit it uses, whose protocol and port the source does not state; a dashed arrow is UNKNOWN. A deny rule is no flow: the network and security view draws it.\n%% Only GCP units are drawn. architecture/dependencies.mmd holds every unit and the dependencies among them.\n%% 2 managed service units that no flow touches are not drawn and not counted toward the 120 units above which this view is cut into partitions: google_pubsub_topic.faux, google_secret_manager_secret.django_admin_password. architecture/dependencies.mmd holds every unit.\n%% A label that ends in \"full reason at the end of this file\" is cut at the end of a clause: the lines \"Full reason of arrow N\" at the end of this file, and the key of the drawn view, carry the whole reason.\nflowchart LR\n  n_clients_public[\"clients\u003cbr/\u003einternet\"]:::internet\n  n_google_cloud_run_v2_job_migrate[\"google_cloud_run_v2_job.migrate\u003cbr/\u003e\u003csmall\u003egoogle_cloud_run_v2_job → Kubernetes Job/CronJob on SKE\u003c/small\u003e\u003cbr/\u003e\u003csmall\u003elocation us-central1\u003c/small\u003e\"]:::unit\n  n_google_cloud_run_v2_service_server[\"google_cloud_run_v2_service.server\u003cbr/\u003e\u003csmall\u003egoogle_cloud_run_v2_service → SKE workload (or Cloud Foundry Docker app)\u003c/small\u003e\u003cbr/\u003e\u003csmall\u003elocation us-central1\u003c/small\u003e\"]:::unit\n  n_google_secret_manager_secret_django_settings[\"google_secret_manager_secret.django_settings\u003cbr/\u003e\u003csmall\u003egoogle_secret_manager_secret → STACKIT Secrets Manager\u003c/small\u003e\"]:::unit\n  n_google_sql_database_instance_postgres[\"google_sql_database_instance.postgres\u003cbr/\u003e\u003csmall\u003egoogle_sql_database_instance → STACKIT PostgreSQL Flex\u003c/small\u003e\u003cbr/\u003e\u003csmall\u003ePOSTGRES_14, region us-central1, db-custom-2-4096\u003c/small\u003e\"]:::unit\n  n_google_storage_bucket_media[\"google_storage_bucket.media\u003cbr/\u003e\u003csmall\u003egoogle_storage_bucket → STACKIT Object Storage\u003c/small\u003e\u003cbr/\u003e\u003csmall\u003elocation us-central1, REGIONAL\u003c/small\u003e\"]:::unit\n  n_clients_public --\u003e|\"the URL is reachable from the internet (ingress is not set, and by default the service accepts all traffic) but needs an authenticated caller: no IAM member of the source gives allUsers the invoker role (a binding or policy outside the scan could) … (full reason at the end of this file and in the key of the drawn view)\"| n_google_cloud_run_v2_service_server\n  n_clients_public --\u003e|\"public IPv4 address (ipv4_enabled is not set and its default is true); no authorized network, so only the Cloud SQL connectors reach it; effect: REPLATFORM\"| n_google_sql_database_instance_postgres\n  n_google_cloud_run_v2_job_migrate --\u003e|\"uses (template.template.containers.env.value_source.secret_key_ref.secret): protocol and port unknown, public or private unknown; effect: RECONFIGURE\"| n_google_secret_manager_secret_django_settings\n  n_google_cloud_run_v2_job_migrate --\u003e|\"uses (template.template.volumes.cloud_sql_instance.instances): protocol and port unknown, public or private unknown; effect: REPLATFORM\"| n_google_sql_database_instance_postgres\n  n_google_cloud_run_v2_service_server --\u003e|\"uses (template.containers.env.value_source.secret_key_ref.secret): protocol and port unknown, public or private unknown; effect: RECONFIGURE\"| n_google_secret_manager_secret_django_settings\n  n_google_cloud_run_v2_service_server --\u003e|\"uses (template.volumes.cloud_sql_instance.instances): protocol and port unknown, public or private unknown; effect: REPLATFORM\"| n_google_sql_database_instance_postgres\n  classDef unit fill:#e1e5f5,stroke:#4b5ba6\n  classDef synthetic fill:#f3f3f3,stroke:#566663\n  classDef unknown fill:#f3f3f3,stroke:#566663,stroke-dasharray:4 3\n  classDef manual fill:#f6e7cf,stroke:#a8650c\n  classDef internet fill:#f8deda,stroke:#b1261b\n%% Full reason of arrow 1 (clients:public → google_cloud_run_v2_service.server): the URL is reachable from the internet (ingress is not set, and by default the service accepts all traffic) but needs an authenticated caller: no IAM member of the source gives allUsers the invoker role (a binding or policy outside the scan could); effect: CONTAINERIZE\n","drawing":{"scope":"data_flows","nodes":[{"key":"clients:public","title":"clients","lines":["internet"],"kind":"internet","tier":"network"},{"key":"google_cloud_run_v2_job.migrate","title":"google_cloud_run_v2_job.migrate","lines":["google_cloud_run_v2_job → Kubernetes Job/CronJob on SKE","location us-central1"],"kind":"unit","tier":"compute"},{"key":"google_cloud_run_v2_service.server","title":"google_cloud_run_v2_service.server","lines":["google_cloud_run_v2_service → SKE workload (or Cloud Foundry Docker app)","location us-central1"],"kind":"unit","tier":"compute"},{"key":"google_secret_manager_secret.django_settings","title":"google_secret_manager_secret.django_settings","lines":["google_secret_manager_secret → STACKIT Secrets Manager"],"kind":"unit","tier":"data"},{"key":"google_sql_database_instance.postgres","title":"google_sql_database_instance.postgres","lines":["google_sql_database_instance → STACKIT PostgreSQL Flex","POSTGRES_14, region us-central1, db-custom-2-4096"],"kind":"unit","tier":"data"},{"key":"google_storage_bucket.media","title":"google_storage_bucket.media","lines":["google_storage_bucket → STACKIT Object Storage","location us-central1, REGIONAL"],"kind":"unit","tier":"data"}],"edges":[{"from":"clients:public","to":"google_cloud_run_v2_service.server","kind":"source","label":"the URL is reachable from the internet (ingress is not set, and by default the service accepts all traffic) but needs an authenticated caller: no IAM member of the source gives allUsers the invoker role (a binding or policy outside the scan could); effect: CONTAINERIZE"},{"from":"clients:public","to":"google_sql_database_instance.postgres","kind":"source","label":"public IPv4 address (ipv4_enabled is not set and its default is true); no authorized network, so only the Cloud SQL connectors reach it; effect: REPLATFORM"},{"from":"google_cloud_run_v2_job.migrate","to":"google_secret_manager_secret.django_settings","kind":"source","label":"uses (template.template.containers.env.value_source.secret_key_ref.secret): protocol and port unknown, public or private unknown; effect: RECONFIGURE"},{"from":"google_cloud_run_v2_job.migrate","to":"google_sql_database_instance.postgres","kind":"source","label":"uses (template.template.volumes.cloud_sql_instance.instances): protocol and port unknown, public or private unknown; effect: REPLATFORM"},{"from":"google_cloud_run_v2_service.server","to":"google_secret_manager_secret.django_settings","kind":"source","label":"uses (template.containers.env.value_source.secret_key_ref.secret): protocol and port unknown, public or private unknown; effect: RECONFIGURE"},{"from":"google_cloud_run_v2_service.server","to":"google_sql_database_instance.postgres","kind":"source","label":"uses (template.volumes.cloud_sql_instance.instances): protocol and port unknown, public or private unknown; effect: REPLATFORM"}]}}]},"lenses":[{"id":"executive","label":"Executive","sections":["overview","decisions","applications","target-fit","security-assurance","sovereignty","cost","migration","work-board","operations","evidence","architecture","engineering"],"hidden":["architecture","engineering"],"note":"Executive lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside."},{"id":"architect","label":"Architect","sections":["overview","architecture","applications","decisions","target-fit","migration","work-board","operations","security-assurance","sovereignty","evidence","cost","engineering"],"hidden":["cost"],"note":"Architect lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside."},{"id":"platform","label":"Platform","sections":["overview","architecture","target-fit","operations","security-assurance","decisions","applications","migration","work-board","evidence","sovereignty","cost","engineering"],"hidden":["cost"],"note":"Platform lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside."},{"id":"security","label":"Security","sections":["overview","security-assurance","decisions","sovereignty","target-fit","architecture","evidence","applications","operations","migration","work-board","cost","engineering"],"hidden":["cost","migration"],"note":"Security lens: the sections are in the order this reader usually wants, and Costs and Migration Plan are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside."},{"id":"application-owner","label":"Application owner","sections":["overview","applications","decisions","architecture","target-fit","operations","migration","work-board","evidence","security-assurance","sovereignty","cost","engineering"],"hidden":["engineering"],"note":"Application owner lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside."},{"id":"programme","label":"Programme","sections":["overview","applications","decisions","migration","work-board","operations","target-fit","architecture","evidence","security-assurance","sovereignty","cost","engineering"],"hidden":["engineering"],"note":"Programme lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside."},{"id":"finops","label":"FinOps","sections":["overview","cost","applications","target-fit","decisions","operations","security-assurance","migration","work-board","sovereignty","evidence","architecture","engineering"],"hidden":["architecture","engineering"],"note":"FinOps lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside."},{"id":"engineering","label":"Engineering","sections":["overview","engineering","architecture","evidence","decisions","target-fit","operations","applications","security-assurance","migration","work-board","sovereignty","cost"],"hidden":["cost"],"note":"Engineering lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside."}],"workload_readiness":{"statement":"Terraform generated is not workload ready: 0 of 11 units carry open workload items","units":11,"units_not_measured":5,"units_applicable":2,"units_with_open_workload_items":0,"units_needing_input":0,"units_decision_required":0,"units_blocking":0,"units_without_evidence":2,"dimensions":[{"id":"bootstrap_configuration","name":"Bootstrap configuration","asks":"How is the workload installed on this unit?","not_assessed_reason":"StackToIT cannot see how the workload is installed: no provisioner block, user data or startup script was observed on the unit."},{"id":"source_artifacts","name":"Source artifacts","asks":"Which files do the unit's attributes or its bootstrap read that the scan did not find?","not_assessed_reason":"No file the unit depends on was listed as missing, unreadable or unresolved; that does not establish that the scripts and templates are the right ones."},{"id":"target_preconditions","name":"Target preconditions","asks":"What must exist on STACKIT before a resource of the draft works?","not_assessed_reason":"No plan manual action of the kind target precondition names the unit in this build."},{"id":"cutover","name":"Cutover","asks":"What must be true before the cutover?","not_assessed_reason":"This build reads the cutover from two things only: the DNS endpoint reading (a record whose address the draft re-binds to a generated resource carries the cutover requirement; an A or AAAA record whose address is not bound to one needs evidence) and the manual actions of the plan that are due before the cutover. A unit none of them names is not assessed, which is not ready."},{"id":"day2_operations","name":"Day 2 operations","asks":"What do the plans ask after the move?","not_assessed_reason":"No plan manual action due on day 2 or for optimisation names the unit in this build."}],"counts":[{"dimension":"bootstrap_configuration","states":[{"key":"DECISION_REQUIRED","count":0},{"key":"EVIDENCE_REQUIRED","count":0},{"key":"READY_WITH_ACTIONS","count":0},{"key":"NOT_ASSESSED","count":2},{"key":"NOT_APPLICABLE","count":9}]},{"dimension":"source_artifacts","states":[{"key":"DECISION_REQUIRED","count":0},{"key":"EVIDENCE_REQUIRED","count":0},{"key":"READY_WITH_ACTIONS","count":0},{"key":"NOT_ASSESSED","count":2},{"key":"NOT_APPLICABLE","count":9}]},{"dimension":"target_preconditions","states":[{"key":"DECISION_REQUIRED","count":0},{"key":"EVIDENCE_REQUIRED","count":0},{"key":"READY_WITH_ACTIONS","count":0},{"key":"NOT_ASSESSED","count":2},{"key":"NOT_APPLICABLE","count":9}]},{"dimension":"cutover","states":[{"key":"DECISION_REQUIRED","count":0},{"key":"EVIDENCE_REQUIRED","count":0},{"key":"READY_WITH_ACTIONS","count":0},{"key":"NOT_ASSESSED","count":2},{"key":"NOT_APPLICABLE","count":9}]},{"dimension":"day2_operations","states":[{"key":"DECISION_REQUIRED","count":0},{"key":"EVIDENCE_REQUIRED","count":0},{"key":"READY_WITH_ACTIONS","count":0},{"key":"NOT_ASSESSED","count":2},{"key":"NOT_APPLICABLE","count":9}]}],"not_assessed_dimensions":[{"id":"iam","name":"IAM","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"wif","name":"WIF","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"audit_logs","name":"Audit logs","state":"NOT_ASSESSED","reason":"the draft creates and configures no audit log: the record of administrative activity is a platform fact, not something the draft made. STACKIT Audit Log (capability registry security.audit-log): The platform-wide record of administrative activity (who called which API in an organisation, folder or project): on by default, 90 days of history in the Portal, readable with the audit-log.reader role, routed onward with the Telemetry Router. It records API calls, not the resulting configuration. No Terraform resource enables or configures it. The Telemetry Router takes the Audit Logs of STACKIT products only; the link that makes the router receive the project's audit events is not drafted, a person sets it up; the legacy Audit Log API was decommissioned on 2026-06-02, and the Telemetry Router is the way to take the log out."},{"id":"application_logs","name":"Application logs","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"metrics","name":"Metrics","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"traces","name":"Traces","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"alerts","name":"Alerts","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"backup","name":"Backup","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"restore","name":"Restore","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"dr","name":"DR","state":"NOT_ASSESSED","reason":"this build states nothing about it; business recovery objectives (RTO, RPO) are not provided to this build"},{"id":"patching","name":"Patching","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"upgrade_lifecycle","name":"Upgrade lifecycle","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"support","name":"Support","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"quota_monitoring","name":"Quota monitoring","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"incident_handling","name":"Incident handling","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"capacity","name":"Capacity","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"cost_allocation","name":"Cost allocation","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"security_posture","name":"Security posture","state":"NOT_ASSESSED","reason":"the draft does not enable it and the provider has no resource for it: CSPM is a platform fact, not something the draft made. STACKIT Cloud Security Posture Management (capability registry security.posture-management): Managed security posture management (assessment of a project against fixed benchmarks): STACKIT Cloud Security Posture Management, a Portal service (generally available since 2026-10-05; enabled in the Portal or through the Service Enablement API) whose documented API reference is labelled v1beta, with no Terraform resource. It shows a project-level dashboard with a scan every 24 hours and offers no alerting. Managed threat detection is not part of it. It scans against BSI C5, ISO 27000 and the STACKIT standard. Where the estate has Security Command Center settings they are not carried: a person enables CSPM and maps the controls."},{"id":"secrets","name":"Secrets","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"},{"id":"runbook_ownership","name":"Runbook ownership","state":"NOT_ASSESSED","reason":"this build states nothing about it; the estate-level blocks (assurance, support) are not a per-workload measure"}],"limits":["A generated Terraform resource does not mark these ready: no dimension is ready in this build, and a unit without evidence is not assessed, never ready.","A state is read from a typed fact of the assessment or of a plan (an open critical semantic, an observed bootstrap, a source artifact the scan did not find, a manual action with its kind and phase); nothing is inferred from a resource name.","A compute unit is a unit of the catalogue category compute; every other unit applies to a dimension only where a typed fact concerns it.","The cutover requirement is read for the DNS records of this build only (the re-bound address of a public IP address, or an address record with no endpoint binding) and for the manual actions of the plan due before the cutover; the cutover of any other endpoint (load balancer, certificate, allow-list) is not read by this build. StackToIT applies no cutover and the requirement does not change a unit's class, confidence or eligibility."]},"support_suitability":{"source":"STACKIT support plans (https://docs.stackit.cloud/support/plans/)","as_of":"2026-11-07","options":[{"id":"essential","name":"Essential Support","includes":["Free of charge and available to all STACKIT customers by default.","Ideal for development and test environments that host non-critical cloud workloads.","Service hours 10/5 for service requests, incidents and business-critical incidents.","Reaction time 15 minutes for all support cases; response time for business-critical incidents 4 hours; no response time targeted for service requests and other incidents (N/A)."],"service_hours":{"service_requests":"10/5","incidents":"10/5","critical_incidents":"10/5"},"evidence_kind":"TARGET_OFFICIAL_DOC","evidence_document":"https://docs.stackit.cloud/support/plans/","evidence_date":"2026-07-20","verified_at":"2026-10-08","recheck_after":"2027-01-06","caveats":["The page states that, for Essential Support, these times are targeted on a best-effort basis, are not binding, and that exceeding them does not entitle the customer to penalties or financial compensation.","The page refers to sections A.5 and A.6 of the service description document for more information; that document was not read."],"freshness":"FRESH"},{"id":"advanced","name":"Advanced Support","includes":["Designed for customers with cloud workloads that run in production and host business-critical services.","Booked on a per-project basis; can be cancelled monthly.","Service hours 10/5 for service requests and incidents; 24/7 for business-critical incidents.","Reaction time 15 minutes for all support cases; response time 8 hours for service requests, 4 hours for incidents, 1 hour for business-critical incidents."],"service_hours":{"service_requests":"10/5","incidents":"10/5","critical_incidents":"24/7"},"evidence_kind":"TARGET_OFFICIAL_DOC","evidence_document":"https://docs.stackit.cloud/support/plans/","evidence_date":"2026-07-20","verified_at":"2026-10-08","recheck_after":"2027-01-06","supporting":[{"kind":"TARGET_OFFICIAL_DOC","document":"https://stackit.com/en/support/advanced-support","verified_at":"2026-10-08","detail":"Product page (sales page: evidence that the plan is offered). Its footnote: \"24/7 support refers exclusively to the response time for business-critical issues within the scope of STACKIT Advanced Support.\" Business-critical issues: 1 hour (24/7); incidents within 4 hours during business hours, Monday through Friday, 8:00-18:00."}],"caveats":["24/7 applies to business-critical incidents only; other incidents and service requests are handled in 10/5 hours.","The documents read do not say whether the stated times are contractual (SLA, penalties); the Advanced Support contract terms (Vertragsbedingungen) were not read."],"freshness":"FRESH"},{"id":"ultimate","name":"Ultimate Support","includes":["High-end support plan for enterprise customers who require immediate assistance for their most critical cloud workloads.","Includes specialized consulting and training.","Service hours 10/5 for service requests; 24/7 for incidents and for business-critical incidents.","Reaction time 15 minutes for all support cases; response time 4 hours for service requests, 2 hours for incidents, 30 minutes for business-critical incidents."],"service_hours":{"service_requests":"10/5","incidents":"24/7","critical_incidents":"24/7"},"evidence_kind":"TARGET_OFFICIAL_DOC","evidence_document":"https://docs.stackit.cloud/support/plans/","evidence_date":"2026-07-20","verified_at":"2026-10-08","recheck_after":"2027-01-06","supporting":[{"kind":"TARGET_OFFICIAL_DOC","document":"https://stackit.com/en/support/ultimate-support","verified_at":"2026-10-08","detail":"Product page (sales page: evidence that the features are offered). Lists 24/7 escalation management (an escalation manager can be activated 30 minutes after a business-critical ticket is opened), training and consulting, a dedicated number and service reports."}],"caveats":["The documents read do not say whether the stated times are contractual (SLA, penalties); the Ultimate Support contract terms were not read."],"freshness":"FRESH"}],"entries":[{"subject":{"kind":"ESTATE"},"state":"NOT_ASSESSED","available_support_options":["Essential Support","Advanced Support","Ultimate Support"],"support_gap":"UNKNOWN","reason":"No criticality stated; pass --applications to state criticality and explicit support requirements","evidence":[{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/support/plans/","detail":"Essential Support: plan comparison table; the document states \"Last updated on 2026-07-20\"","freshness":{"retrieved_at":"2026-10-08","checked_at":"2026-10-08","recheck_after":"2027-01-06"}},{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/support/plans/","detail":"Advanced Support: plan comparison table; the document states \"Last updated on 2026-07-20\"","freshness":{"retrieved_at":"2026-10-08","checked_at":"2026-10-08","recheck_after":"2027-01-06"}},{"kind":"TARGET_OFFICIAL_DOC","source":"https://stackit.com/en/support/advanced-support","detail":"Advanced Support: Product page (sales page: evidence that the plan is offered). Its footnote: \"24/7 support refers exclusively to the response time for business-critical issues within the scope of STACKIT Advanced Support.\" Business-critical issues: 1 hour (24/7); incidents within 4 hours during business hours, Monday through Friday, 8:00-18:00.","freshness":{"retrieved_at":"2026-10-08","checked_at":"2026-10-08","recheck_after":"2027-01-06"}},{"kind":"TARGET_OFFICIAL_DOC","source":"https://docs.stackit.cloud/support/plans/","detail":"Ultimate Support: plan comparison table; the document states \"Last updated on 2026-07-20\"","freshness":{"retrieved_at":"2026-10-08","checked_at":"2026-10-08","recheck_after":"2027-01-06"}},{"kind":"TARGET_OFFICIAL_DOC","source":"https://stackit.com/en/support/ultimate-support","detail":"Ultimate Support: Product page (sales page: evidence that the features are offered). Lists 24/7 escalation management (an escalation manager can be activated 30 minutes after a business-critical ticket is opened), training and consulting, a dedicated number and service reports.","freshness":{"retrieved_at":"2026-10-08","checked_at":"2026-10-08","recheck_after":"2027-01-06"}}]}]},"assurance":{"sources":["STACKIT certificates and attestations by service (the certificates page stackit.com/en/why-stackit/benefits/certificates and the documents it links; each row names its document)","STACKIT certificates and attestations of the provider organisation and its facilities (the certificates page stackit.com/en/why-stackit/benefits/certificates and the documents it links; each row names its document)"],"as_of":"2026-11-07","recheck_days":90,"disclaimer":"Provider evidence describes the provider's own controls and attestations. It is not a statement about the workload and does not make a workload compliant with any framework; the customer's own controls and an external review decide that.","frameworks":["BSI C5","GDPR","ISAE 3000 (SOC 2)","ISAE 3402","ISO 22301","ISO/IEC 20000-1","ISO/IEC 27001","ISO/IEC 27017","ISO/IEC 27018","TISAX"],"requested_frameworks":[],"services":["STACKIT Object Storage","STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain","STACKIT PostgreSQL Flex","STACKIT RabbitMQ","STACKIT Secrets Manager","STACKIT service account"],"other_targets":["Kubernetes Job/CronJob on SKE","SKE workload (or Cloud Foundry Docker app)","a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD"],"cells":[{"service":"STACKIT Object Storage","framework":"BSI C5","requested":false,"state":"CUSTOMER_CONTROL_REQUIRED","reason":"the evidence covers the provider's side at most; the customer's own controls for this framework are still required and are not assessed here","provider_evidence":true,"organisation_only":false,"evidence_rows":[1]},{"service":"STACKIT Object Storage","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT Object Storage","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT Object Storage","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT Object Storage","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT Object Storage","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT Object Storage","framework":"ISO/IEC 27001","requested":false,"state":"PROVIDER_EVIDENCE_PRESENT","reason":"current evidence about the provider's own controls is present; nothing is concluded about the workload","provider_evidence":true,"organisation_only":false,"evidence_rows":[10]},{"service":"STACKIT Object Storage","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT Object Storage","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT Object Storage","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[13]},{"service":"STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain","framework":"BSI C5","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for BSI C5; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[0]},{"service":"STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[13]},{"service":"STACKIT PostgreSQL Flex","framework":"BSI C5","requested":false,"state":"CUSTOMER_CONTROL_REQUIRED","reason":"the evidence covers the provider's side at most; the customer's own controls for this framework are still required and are not assessed here","provider_evidence":true,"organisation_only":false,"evidence_rows":[2]},{"service":"STACKIT PostgreSQL Flex","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT PostgreSQL Flex","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT PostgreSQL Flex","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT PostgreSQL Flex","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT PostgreSQL Flex","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT PostgreSQL Flex","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT PostgreSQL Flex","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT PostgreSQL Flex","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT PostgreSQL Flex","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[13]},{"service":"STACKIT RabbitMQ","framework":"BSI C5","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for BSI C5; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[0]},{"service":"STACKIT RabbitMQ","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT RabbitMQ","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT RabbitMQ","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT RabbitMQ","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT RabbitMQ","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT RabbitMQ","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT RabbitMQ","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT RabbitMQ","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT RabbitMQ","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[13]},{"service":"STACKIT Secrets Manager","framework":"BSI C5","requested":false,"state":"CUSTOMER_CONTROL_REQUIRED","reason":"the evidence covers the provider's side at most; the customer's own controls for this framework are still required and are not assessed here","provider_evidence":true,"organisation_only":false,"evidence_rows":[3]},{"service":"STACKIT Secrets Manager","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT Secrets Manager","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT Secrets Manager","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT Secrets Manager","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT Secrets Manager","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT Secrets Manager","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT Secrets Manager","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT Secrets Manager","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT Secrets Manager","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[13]},{"service":"STACKIT service account","framework":"BSI C5","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for BSI C5; its document does not name STACKIT service account, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[0]},{"service":"STACKIT service account","framework":"GDPR","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for GDPR; its document does not name STACKIT service account, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[4]},{"service":"STACKIT service account","framework":"ISAE 3000 (SOC 2)","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT service account, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[5]},{"service":"STACKIT service account","framework":"ISAE 3402","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT service account, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[6]},{"service":"STACKIT service account","framework":"ISO 22301","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO 22301; its document does not name STACKIT service account, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[7]},{"service":"STACKIT service account","framework":"ISO/IEC 20000-1","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT service account, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[8]},{"service":"STACKIT service account","framework":"ISO/IEC 27001","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT service account, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[9]},{"service":"STACKIT service account","framework":"ISO/IEC 27017","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT service account, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[11]},{"service":"STACKIT service account","framework":"ISO/IEC 27018","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT service account, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[12]},{"service":"STACKIT service account","framework":"TISAX","requested":false,"state":"EXTERNAL_REVIEW_REQUIRED","reason":"only organisation-level evidence exists for TISAX; its document does not name STACKIT service account, so whether it covers this service has to be read from the document","provider_evidence":false,"organisation_only":true,"evidence_rows":[13]}],"evidence":[{"framework":"BSI C5","claim":"STACKIT states that its infrastructure is certified according to C5 Type 2 of the BSI","scope":"Statement on the STACKIT certificates page: the report covers the products listed there (the certificates page of STACKIT, stackit.com/en/why-stackit/benefits/certificates) and all basic and additional criteria. The attestation report was not opened. The STACKIT C5 page says a C5 certificate is valid for one year as a rule; no page opened names a date for STACKIT's own attestation, an auditor or an audit period. Press release of 2024-08-21 (opened): C5 Type 1 for the infrastructure stack at the end of 2023, type 2 effectiveness audit confirmed in 2024, appropriateness tested for STACKIT IaaS (Compute Engine, Network \u0026 Security, Block Storage, Object Storage).","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/why-stackit/benefits/certificates","verified_at":"2026-10-08","validity_stated":false},{"framework":"BSI C5","claim":"STACKIT states that its infrastructure is certified according to C5 Type 2 and that the report covers this product and all basic and additional criteria","scope":"Product listed under \"C5 certified cloud products\" on the STACKIT certificates page; C5 Type 2 as that page states it. The attestation report itself was not opened. The page names no audit period, no auditor, no region and no end of validity.","service":"STACKIT Object Storage","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/why-stackit/benefits/certificates","verified_at":"2026-10-08","validity_stated":false},{"framework":"BSI C5","claim":"STACKIT states that its infrastructure is certified according to C5 Type 2 and that the report covers this product and all basic and additional criteria","scope":"Product listed under \"C5 certified cloud products\" on the STACKIT certificates page; C5 Type 2 as that page states it. The attestation report itself was not opened. The page names no audit period, no auditor, no region and no end of validity.","service":"STACKIT PostgreSQL Flex","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/why-stackit/benefits/certificates","verified_at":"2026-10-08","validity_stated":false},{"framework":"BSI C5","claim":"STACKIT states that its infrastructure is certified according to C5 Type 2 and that the report covers this product and all basic and additional criteria","scope":"Product listed under \"C5 certified cloud products\" on the STACKIT certificates page; C5 Type 2 as that page states it. The attestation report itself was not opened. The page names no audit period, no auditor, no region and no end of validity.","service":"STACKIT Secrets Manager","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/why-stackit/benefits/certificates","verified_at":"2026-10-08","validity_stated":false},{"framework":"GDPR","claim":"STACKIT states that the development of its cloud takes place in Germany, that its servers and data centers are located in Germany and Austria, and that its cloud operates in accordance with European data protection standards","scope":"Statement on the STACKIT certificates page (provider-side text, not an attestation or a certificate). It is a statement about where and how the provider operates; the customer's own obligations toward personal data stay with the customer. The page names no region id and no attestation document.","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/why-stackit/benefits/certificates","verified_at":"2026-10-08","validity_stated":false},{"framework":"ISAE 3000 (SOC 2)","claim":"STACKIT states that its infrastructure holds an ISAE 3000 (SOC 2) certification in addition to C5","scope":"Statement on the STACKIT certificates page. The report was not opened and the page states no type, no audit period, no auditor and no end of validity. The Schwarz Digits press release of 2024-01-23 (opened) says ISAE 3000 (SOC 2) and ISAE 3402 were issued as type 1 at that time; whether a type 2 exists now is not stated on any page opened. Which products the report covers is not separately stated.","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/why-stackit/benefits/certificates","verified_at":"2026-10-08","validity_stated":false},{"framework":"ISAE 3402","claim":"STACKIT states that its infrastructure holds an ISAE 3402 certificate in addition to C5","scope":"Statement on the STACKIT certificates page. The report was not opened and the page states no type, no audit period, no auditor and no end of validity. The Schwarz Digits press release of 2024-01-23 (opened) says it was issued as type 1 at that time. Which products the report covers is not separately stated.","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/why-stackit/benefits/certificates","verified_at":"2026-10-08","validity_stated":false},{"framework":"ISO 22301","claim":"TÜV Rheinland Cert GmbH certified that the requirements of ISO 22301:2019 are met by Schwarz Digits Cloud GmbH \u0026 Co. KG, certificate registration number 01 195 2500863, initial certification 2026","scope":"Holder Schwarz Digits Cloud GmbH \u0026 Co. KG, Bad Friedrichshall (not STACKIT GmbH \u0026 Co. KG). Scope as the certificate words it (German): Cloud Infrastruktur- und Plattform-Services (IaaS und PaaS) sowie Colocation in Form der Bereitstellung von Rechenzentrums- oder Rackspace. Business continuity management system of the provider; the certificate lists no products and no locations.","control":"PROVIDER","status":"CURRENT","document":"https://stackit.com/en/asset/download/61434/file/ISO22301.pdf?version=2","evidence_date":"2026-08-28","valid_until":"2029-08-26","verified_at":"2026-10-08","validity_stated":true},{"framework":"ISO/IEC 20000-1","claim":"TÜV SÜD Management Service GmbH certified that the requirements of ISO/IEC 20000-1:2018 are met by Schwarz Digits KG, certificate registration number 12 410 60762 TMS","scope":"Holder Schwarz Digits KG, Neckarsulm. IT service management system; scope as the certificate words it (German): Betrieb der IT-Infrastruktur, Server- und Netzwerkadministration, Datenspeicherung, Rechenzentrums- sowie Colocation Services (STACKIT Colocation, Housing), mit den Rechenzentren in Deutschland und Österreich für interne und externe Kunden; sites per the annex: Neckarsulm, Ellhofen, Weinsberg (two), Heilbronn and Ostermiething (Austria).","control":"PROVIDER","status":"CURRENT","document":"https://stackit.com/en/asset/download/40661/file/240206_STACKIT_Zertifikat_ISO-20000-1_DE_ug%2520%25281%2529.pdf?version=4","evidence_date":"2024-01-18","valid_until":"2027-01-17","verified_at":"2026-10-08","validity_stated":true},{"framework":"ISO/IEC 27001","claim":"TÜV Rheinland Cert GmbH certified that the requirements of ISO/IEC 27001:2022 are met by STACKIT GmbH \u0026 Co. KG, certificate registration number 01 153 2500863","scope":"Holder STACKIT GmbH \u0026 Co. KG, Neckarsulm. Scope as the certificate words it: cloud infrastructure and platform services (IaaS and PaaS) as well as colocation in the form of providing data center or rack space. Statement of Applicability version 22 of 2025-11-28. The certificate lists no products and no locations.","control":"PROVIDER","status":"CURRENT","document":"https://stackit.com/en/asset/download/50680/file/ISO%253AIEC%252027001_2022_EN.pdf?version=2","evidence_date":"2026-02-09","valid_until":"2029-02-08","verified_at":"2026-10-08","validity_stated":true},{"framework":"ISO/IEC 27001","claim":"The Federal Office for Information Security (BSI) issued certificate BSI-IGZ-0691-2025, an ISO 27001 certificate on the basis of IT-Grundschutz, for the provision and operation of the STACKIT IaaS cloud services of STACKIT GmbH \u0026 Co. KG","scope":"The certificate names the IaaS and PaaS cloud services STACKIT Compute Engine, STACKIT Network \u0026 Security, STACKIT Block Storage and STACKIT Objekt Storage (S3) and all processes, applications, systems, networks and locations of STACKIT GmbH \u0026 Co. KG necessary for them; this product is STACKIT Objekt Storage (S3) in the certificate. It is valid only for that object and together with the full certification report (not opened), under the condition that the annual surveillance audits from 2025-04-30 are completed with a positive result. The certificate states that it is no general recommendation of the object by the BSI and contains no warranty. It names no region.","service":"STACKIT Object Storage","control":"PROVIDER","status":"CURRENT","document":"https://stackit.com/en/asset/download/41727/file/BSI-IGZ-0691-2025-STACKIT-05-2025.pdf?version=2","evidence_date":"2025-04-30","valid_until":"2028-04-29","verified_at":"2026-10-08","validity_stated":true},{"framework":"ISO/IEC 27017","claim":"The ISO/IEC 27001:2022 certificate of STACKIT GmbH \u0026 Co. KG states a Statement of Applicability with the additional measures for ISO/IEC 27017:2015","scope":"The additional measures of ISO/IEC 27017:2015 are part of the Statement of Applicability (version 22 of 2025-11-28) of the ISO/IEC 27001:2022 certificate 01 153 2500863; the certificate is not a separate ISO/IEC 27017 certificate. The STACKIT certificates page words it as a certification according to ISO/IEC 27017.","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/asset/download/50680/file/ISO%253AIEC%252027001_2022_EN.pdf?version=2","evidence_date":"2026-02-09","valid_until":"2029-02-08","verified_at":"2026-10-08","validity_stated":true},{"framework":"ISO/IEC 27018","claim":"The ISO/IEC 27001:2022 certificate of STACKIT GmbH \u0026 Co. KG states a Statement of Applicability with the additional measures for ISO/IEC 27018:2019","scope":"The additional measures of ISO/IEC 27018:2019 are part of the Statement of Applicability (version 22 of 2025-11-28) of the ISO/IEC 27001:2022 certificate 01 153 2500863; the certificate is not a separate ISO/IEC 27018 certificate. The STACKIT certificates page words it as a certification according to ISO/IEC 27018 (personal data in the cloud).","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/asset/download/50680/file/ISO%253AIEC%252027001_2022_EN.pdf?version=2","evidence_date":"2026-02-09","valid_until":"2029-02-08","verified_at":"2026-10-08","validity_stated":true},{"framework":"TISAX","claim":"STACKIT states a successful TISAX assessment, Level 3, for the automotive industry","scope":"Statement on the STACKIT certificates page with assessment ID ATA163-1 and scope ID SH938N; the result is published in the ENX portal, which was not opened. The page names no assessment date, no end of validity and no products.","control":"SHARED","status":"CURRENT","document":"https://stackit.com/en/why-stackit/benefits/certificates","verified_at":"2026-10-08","validity_stated":false}]},"verification":{"invariants":[{"id":"GLOBAL_RESOURCE_UNIQUENESS","status":"PASS","checked":55,"detail":"55 addressable blocks in the final files and 0 resources of the plans, every address once"},{"id":"NO_UNPLANNED_RESOURCE","status":"PASS","checked":10,"detail":"10 resource blocks: 0 resources of a plan, 10 written by a registered legacy generator, none unplanned","listed":["legacy.data-services: 2 resource(s) written by a registered legacy generator","legacy.identity: 4 resource(s) written by a registered legacy generator","legacy.kubernetes: 1 resource(s) written by a registered legacy generator","legacy.secrets-and-keys: 2 resource(s) written by a registered legacy generator","legacy.storage: 1 resource(s) written by a registered legacy generator"]},{"id":"NO_UNPLANNED_REFERENCE","status":"PASS","checked":9,"detail":"9 references between resources: every one is written, and the references of plan resources are stated by their plan (legacy to legacy: 9)","listed":["legacy to legacy: 9"]},{"id":"NO_UNRESOLVED_REQUIRED_FIELD","status":"PASS","checked":28,"detail":"28 required arguments of the resources written: every one is written (a value, a reference or a declared variable) or declared as a target gap"},{"id":"NO_SECURITY_WIDENING","status":"PASS","checked":0,"detail":"0 grant-defining attributes of the rules and routes written, each equal to the plan, none added (files against the plan; whether the plan carries everything the source allows is said by the unit findings and the NOT CARRIED lines, not by this check)"},{"id":"ALL_OUTPUTS_SAME_RUN","status":"PASS","checked":48,"detail":"48 artefacts carry the run id that manifest.json carries","listed":["assurance/compliance-evidence.csv: carries no run id by design, bound to the run by its sha256 in the manifest","assurance/equivalence-ledger.csv: carries no run id by design, bound to the run by its sha256 in the manifest","assurance/evidence-ledger.csv: carries no run id by design, bound to the run by its sha256 in the manifest","engineering/not-carried-summary.csv: carries no run id by design, bound to the run by its sha256 in the manifest","engineering/not-carried.csv: carries no run id by design, bound to the run by its sha256 in the manifest","engineering/review-edges.csv: carries no run id by design, bound to the run by its sha256 in the manifest","engineering/review.csv: carries no run id by design, bound to the run by its sha256 in the manifest","financial/mapping.csv: carries no run id by design, bound to the run by its sha256 in the manifest","financial/priced-resources.csv: carries no run id by design, bound to the run by its sha256 in the manifest","migration/actions.csv: carries no run id by design, bound to the run by its sha256 in the manifest","migration/application-chain.csv: carries no run id by design, bound to the run by its sha256 in the manifest","migration/applications.csv: carries no run id by design, bound to the run by its sha256 in the manifest","migration/data-movement.csv: carries no run id by design, bound to the run by its sha256 in the manifest","migration/decisions.csv: carries no run id by design, bound to the run by its sha256 in the manifest","migration/source-target.csv: carries no run id by design, bound to the run by its sha256 in the manifest","migration/waves.csv: carries no run id by design, bound to the run by its sha256 in the manifest","migration/work-board.csv: carries no run id by design, bound to the run by its sha256 in the manifest"]},{"id":"VARIABLE_IDENTITY_PRESERVED","status":"PASS","checked":0,"detail":"0 variable references are exactly the variable the plan states, and the 0 variables read are declared as the plan declares them (type and description)"},{"id":"NO_ORPHAN_MANUAL_ACTION","status":"PASS","checked":4,"detail":"4 manual actions and decisions, each naming a unit of the assessment"},{"id":"SOURCE_PROVIDER_MATCHES_SCHEMA_OR_IS_UNVERIFIED","status":"PASS","checked":16,"detail":"16 units of a source provider: 0 verified against a compatibility record, 16 explicitly not verified through a root record, 0 stated by their provider row"},{"id":"APPLICATION_READY_IMPLIES_REQUIRED_ENV_SECRETS_DEPENDENCIES","status":"PASS","checked":0,"detail":"the draft holds no application compatibility contract (no container service is drafted as Kubernetes manifests), so no workload is stated ready"},{"id":"ALL_EMITTED_TARGET_TYPES_CLASSIFIED","status":"PASS","checked":10,"detail":"10 resource and data blocks of 7 type(s) in the final files, every STACKIT type classified by the target catalogue","listed":["resource stackit_objectstorage_bucket (1 block): RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED"]},{"id":"ALL_UNACCOUNTED_PROPERTIES_EXPLICIT","status":"PASS","checked":69,"detail":"69 meaningful properties of 11 generated units each end as accounted by a contract, consumed, a wired reference, a placement decision or named NOT CARRIED; none is UNACCOUNTED"}],"product_invariants":[{"id":"ALL_MANUAL_STEPS_ACTIONABLE_OR_MARKED_UNASSIGNED","status":"PASS","checked":64,"detail":"64 manual steps, each with an owner role, a success condition and a phase"}]},"validation_matrix":{"scope":"What has been established about this draft, row by row, and what has not. Nothing here approves the draft, asserts that it is equivalent to the source, or says it is safe to apply.","rows":[{"id":"SOURCE_COMPLETENESS","name":"Source completeness","state":"PARTIAL","detail":"source status RUNTIME_TOPOLOGY_PARTIAL","scope":"how much of the source configuration StackToIT read; not whether what it read is correct","evidence":{"file":"assessment.json","pointer":"/summary/source_status"}},{"id":"DRAFT_GENERATION","name":"Draft generation","state":"GENERATED","detail":"the draft is in terraform/","scope":"whether a STACKIT draft was written for this run","evidence":{"file":"manifest.json","pointer":"/draft"}},{"id":"STACKTOIT_DRAFT_CHECKS","name":"StackToIT draft checks","state":"PASSED","detail":"20 checks, none found a violation","scope":"StackToIT's own checks of the plan and the rendered text of the families it writes from a plan; not what OpenTofu or STACKIT would say","evidence":{"file":"workspace.json","pointer":"/units"}},{"id":"GLOBAL_INVARIANTS","name":"Global invariants","state":"PASSED","detail":"12 of 12 invariants PASS; vacuous, they checked nothing: NO_SECURITY_WIDENING, VARIABLE_IDENTITY_PRESERVED, APPLICATION_READY_IMPLIES_REQUIRED_ENV_SECRETS_DEPENDENCIES","scope":"eight consistency checks over the files of the draft and the plans, ALL_OUTPUTS_SAME_RUN among them, and one product check that no meaningful source property is left without a stated fate (ALL_UNACCOUNTED_PROPERTIES_EXPLICIT); not a check of target behaviour","evidence":{"file":"manifest.json","pointer":"/verification"}},{"id":"TOFU_STATIC_VALIDATION","name":"OpenTofu validation","state":"PASSED","detail":"tofu init -backend=false and tofu validate accepted the draft; tofu 1.13.1","scope":"static validation of the draft against the pinned provider schema — not target behaviour, not approval","evidence":{"file":"manifest.json","pointer":"/validation/tofu_validate"}},{"id":"OUTPUT_SCHEMA_VALIDATION","name":"Output schema validation","state":"PASSED","detail":"verified at publish: every JSON file that has a schema is validated against it (see run_verification in manifest.json)","scope":"the machine-readable output files that have a schema, against the schemas recorded in manifest.json","evidence":{"file":"manifest.json","pointer":"/run_verification"}},{"id":"STACKIT_PLAN","name":"STACKIT plan","state":"NOT_RUN","detail":"this build runs no plan against a STACKIT project","scope":"a plan of the draft against a live STACKIT project: whether the provider accepts the values and what it would create"},{"id":"ARCHITECT_APPROVAL","name":"Architect approval","state":"NOT_PROVIDED","detail":"no review decision is recorded for this run","scope":"a named architect's decision on the draft; StackToIT records none"},{"id":"SEMANTIC_EQUIVALENCE","name":"Semantic equivalence","state":"NOT_ASSESSED","detail":"this build has no measure for it","scope":"whether the target behaves like the source; StackToIT assesses units and settings one by one and makes no statement about the whole"},{"id":"SAFE_TO_APPLY","name":"Safe to apply","state":"NOT_ASSERTED","detail":"StackToIT never asserts it","scope":"whether the draft can be applied to a live project without harm; StackToIT never asserts this"}],"tofu_validate":{"state":"PASSED","tool_version":"1.13.1","scope":"static validation of the draft against the pinned provider schema — not target behaviour, not approval"}},"run_summary":{"package_state":"PARTIALLY_EXECUTABLE","package_kpi":{"generated_automatically":10,"generated_with_decisions":0,"manual_carry_over":57,"unsupported":2,"steps":78,"terraform_steps":10,"automated_now":"10 of the 12 automated steps (OpenTofu or a script) are free of decisions and manual prerequisites (2 require a design decision) · 0 can run as written · 10 of those 10 wait for a value (project_id, containers_machine_type, containers_nodes_max, containers_nodes_min and 7 more) · stages of 12 automated steps: 12 in the draft, 10 free of decisions and manual prerequisites, 0 rest on no default to confirm, no opt-in to answer and no value to supply, 0 are approved (every decision and default confirmed in the decisions file, and no value left to supply)","runnable":{"automated_steps":12,"free_of_decisions_and_prerequisites":10,"runs_as_written":0,"need_values":10,"variables":11,"project_id":true},"terms":{"automated_steps":12,"can_generate":12,"free_of_decisions_and_prerequisites":10,"runs_as_written":0,"ready_for_migration":0,"approved":0,"waiting_for_value":10},"stages":"stages of 12 automated steps: 12 in the draft, 10 free of decisions and manual prerequisites, 0 rest on no default to confirm, no opt-in to answer and no value to supply, 0 are approved (every decision and default confirmed in the decisions file, and no value left to supply)","figures":[{"n":10,"words":"of the 12 automated steps (OpenTofu or a script) are free of decisions and manual prerequisites","state":"FREE_OF_DECISIONS_AND_PREREQUISITES"},{"n":2,"words":"require a design decision","tone":"attention","of":"of the 12 automated steps","state":"REQUIRES_DESIGN_DECISION"},{"n":0,"words":"can run as written","of":"of the 12 automated steps","state":"RUN_AS_WRITTEN"},{"n":10,"words":"of those 10 wait for a value","tone":"attention","names":"project_id, containers_machine_type, containers_nodes_max, containers_nodes_min and 7 more"},{"n":0,"words":"are approved","of":"of the 12 automated steps"}],"api_steps":2,"api_steps_waiting":2,"api_steps_opt_in":2,"design_inputs":0,"manual_migration_work_steps":55,"lifecycle_steps":2,"review_steps":14,"review_settings":37,"stuck_steps":0,"refused_steps":2,"not_taken_steps":0,"alternative_method_steps":7,"source_units_api":0,"hybrid_units":2},"ladder_counts":[{"rung":4,"generated":0,"proposed":1,"manual":0,"refused":0,"no_step":0},{"rung":5,"generated":0,"proposed":3,"written":10,"part_refused":1,"manual":0,"refused":0,"no_step":0,"capability_proposals":4},{"rung":6,"generated":0,"proposed":0,"manual":0,"refused":1,"no_step":0}],"inputs":{"open_requests":27,"blocking_draft":7,"preferences_not_applied":4},"run_id":"6f8f72b2-1c34-4cfc-8483-344c41245364","run_publication":"COMPLETE","source_status":"RUNTIME_TOPOLOGY_PARTIAL","source":{"units":11,"conditional":5,"switched_off":0,"resources":37,"files":18,"conditional_by_state":{"present_on_defaults":5,"disabled_on_defaults_but_overridable":0,"runtime_data_unknown":0,"variable_unknown":0,"undecided_other_cause":0}},"critical_semantics":{"total":62,"resolved":12,"open":50,"units_without_contract":0,"carried_open":1,"conditional_open":22,"conditional_units":5},"review":{"register":"BUILT","register_decisions":43,"plan_read":true,"plan_decisions":13,"plan_decision_states":{"pending":13,"accepted_awaiting_verification":0,"rejected":0,"stale":0},"manual_actions":0,"units_with_open_plan_items":11,"units_with_open_records":16,"by_source":[{"source":"PLAN_DECISION","records":5,"open_items":13,"accepted_items":0,"units":11,"conditional":0,"open_records":5,"open_units":11,"open_default_records":1},{"source":"CRITICAL_SEMANTIC","records":36,"open_items":72,"accepted_items":0,"units":16,"conditional":22,"open_records":36,"open_units":16,"open_confirm_only_items":1},{"source":"MANUAL_ACTION","records":0,"open_items":0,"accepted_items":0,"units":0,"conditional":0},{"source":"PLAN_STATEMENT","records":2,"open_items":4,"accepted_items":0,"units":4,"conditional":0,"open_records":2,"open_units":4}]},"draft":{"state":"GENERATED","considered":16,"generated":11,"no_resource":0,"proposed":4,"left_for_architect":1,"variables":13},"checks":{"invariants_total":12,"invariants_passed":12,"invariants_failed":0,"invariants_pending":0,"invariants_vacuous":3,"draft_checks":20,"draft_checks_failed":0},"tofu_validate":{"state":"PASSED","tool_version":"1.13.1","scope":"static validation of the draft against the pinned provider schema — not target behaviour, not approval"},"architect_approval":"NOT_PROVIDED","semantic_equivalence":"NOT_ASSESSED","safe_to_apply":"NOT_ASSERTED","next":[{"code":"REVIEW_CRITICAL_SEMANTICS","text":"Review the 71 open critical settings: a person decides each (index.html, Decisions page; assurance/critical-semantics.json, critical_semantic_resolution.open). 22 of them belong to units that exist only if a plan-time input holds (critical_semantic_resolution.conditional_open). 1 more is carried by the draft already: confirm only."},{"code":"REVIEW_PLAN_ITEMS","text":"Review the 4 open plan decisions and 0 manual actions of the draft (index.html, Architecture, Deployment prerequisites). Confirm the 1 default the draft carries out (index.html, Decisions page): no step waits for the answer, a person confirms each or changes it."},{"code":"REVIEW_DRAFT","text":"Review the draft in terraform/: nothing in it is approved, and an architect has to review it before any use."},{"code":"OPEN_WORKSPACE","text":"Open index.html in a browser for the unit-by-unit view (offline, nothing is loaded)."}],"four_terms":{"can_generate":{"units":11,"of_units":16,"steps_in_draft":12,"of_automated_steps":12},"runnable":{"runs_as_written":0,"free_of_decisions_and_prerequisites":10,"of_automated_steps":12,"waiting_for_value":10},"ready_for_migration":{"ready":false,"state":"PARTIALLY_EXECUTABLE","state_words":"Partially executable migration package"},"approved":{"steps":0,"of_automated_steps":12,"waiting_for_value":10,"package":false}},"mappings":{"units":11,"production_eligible":0,"by_maturity":[{"key":"not stated","count":11}],"automation_known":true,"automation_not_automatable":11,"not_automatable_reasons":[{"key":"a provider the build cannot check","count":11},{"key":"a critical value the draft states only as a placement","count":3},{"key":"a target resource the provider marks experimental","count":3},{"key":"a unit left to an architect","count":3},{"key":"a critical setting STACKIT does not support","count":1},{"key":"a decision whose every option is work a person does by hand","count":1}]}},"equivalence_ledger":{"grain":"UNIT_SEMANTIC_AND_PROPERTY_LISTS","rows_total":201,"by_disposition":{"LEDGER":3,"NOT_APPLICABLE":1,"NOT_CARRIED":40,"OPEN":4,"PRESERVED":2,"REVIEW":139,"TRANSFORMED":10,"UNSUPPORTED":2},"by_proof_kind":{"CASE":72,"CHECK":10,"DRAFT_LEDGER":3,"NOT_PROVEN_UNVERIFIED_CHECK":2,"NOT_PROVEN_VARIABLE_DEFAULT":1,"NOT_RECORDED":113},"by_vocabulary":{"v1":201},"omitted_not_stated":504,"limits":["Grain: one row per source unit and semantic of the assessment that the source states or may state (UNIT_SEMANTIC), plus one row per source unit and property for each of three lists the assessment names: properties the draft does not carry, properties no semantic accounts for, and critical properties still open (UNIT_PROPERTY). A property named by more than one list has one row per list. A row for every source property is not possible yet: the assessment does not record which properties a generator reads.","Vocabulary v1: the disposition column prints the words the contracts and the property accounting use today. LEDGER means the contract hands the semantic to the semantic ledger of the draft; PRESERVED and TRANSFORMED appear only where the contract result or the draft's plan ledger states them.","intent_id, target_capability and target_resource are stated only for a semantic that a family written from a plan (security groups, routing tables) carries through the plan's own ledger; for every other row they are not recorded.","target_effective_behavior is NOT_ASSESSED on every row: the behaviour of the target is evidenced per field of a plan resource (units[].behavior_evidence), and a semantic is not a field.","residual_risk, required_action and decision_id are stated only for a critical semantic that is open; they are the sentences and the record that the Decisions section already shows, quoted whole. A sentence that names a record internal to the product is not quoted, and its column is not recorded.","invalidated_by names the inputs of the whole run (manifest.json invalidation) that, when they change, invalidate the row; no row has an invalidation of its own.","evidence_refs name rows of evidence_ledger. Evidence that names a record internal to the product is not listed, and evidence that states no check date and no date to check it again is listed UNDATED, never CURRENT.","504 semantics of the contracts that the source does not state (it observed no) are not listed: the source has nothing there to carry. The kernel claims of assessment.json count them the same way (absent_claims)."]},"evidence_ledger":{"rows_total":72,"by_state":{"CURRENT":10,"STALE":0,"UNDATED":62},"by_kind":{"OFFICIAL_DOCUMENTED":24,"PROVIDER_DOCUMENT":5,"PUBLIC_ISSUE":4,"SOURCE_CODE_VERIFIED":1,"SOURCE_OFFICIAL_DOC":10,"TARGET_API_SPEC":7,"TARGET_OFFICIAL_DOC":21}},"data_movement":{"state":"DECISION_REQUIRED","statement":"StackToIT never moves data. 2 stateful source units are listed here: a person must choose a data-movement mechanism for each. The execution plan takes a method for 1 of them (the only method open, or the one an answered decision took; migration/data-movement-plan.json), and this file names no mechanism class for any (the mechanism is UNKNOWN).","units":{"rows_total":2,"by_state":{"DECISION_REQUIRED":2},"by_source_type":{"google_sql_database_instance":1,"google_storage_bucket":1}},"limits":["The size of the data, its change rate, the duration of a transfer, the transfer rate and the downtime are never stated: the source does not state them and this build has no way to measure them. A provisioned capacity quoted beside a unit is the size of what was provisioned, not the size of the data.","No mechanism is chosen and nothing is executed: StackToIT is out of scope for actual data movement, and a mechanism class is a recommendation a person makes from the size, the downtime tolerated and the consistency the application needs.","A unit is listed when its catalogue kind holds data of its own (a database, a cache, a search domain, a warehouse, a block volume, a file share, an object store). A Kubernetes storage class that provisions volumes, a persistent volume and a persistent volume claim are listed too: the volumes behind a class, and the data on any volume, are in the source cloud and not in the Terraform, so a class is a row of what is not known, never a statement that the cluster holds data. A queue or topic service, and a system installed on a server's disk, are not read as stateful and are not listed. A message broker and a container registry repository are not listed: this build has no definitions export and no image-move steps for the ones of this source's cloud.","The data class, RPO and downtime tolerance are the customer's, from the applications file, word for word; without one, or for a unit outside an application, they are NOT_PROVIDED and no default is assumed."]},"resilience":{"requirement":{"state":"BUSINESS_REQUIREMENT_NOT_PROVIDED","statement":"No RTO or RPO was stated (BUSINESS_REQUIREMENT_NOT_PROVIDED): no architecture is called resilient against it, and no value is assumed.","applications":[]},"units":{"rows_total":2,"by_state":{"EVIDENCE_REQUIRED":2},"by_source_type":{"google_sql_database_instance":1,"google_storage_bucket":1}},"limits":["No unit is called resilient and no resilience intent is chosen: the intent of every unit is UNKNOWN until a person decides it from a stated requirement and the facts of the source.","No RTO or RPO is defaulted or inferred from a resource name; the requirement is what the applications file states, word for word, or it is not provided.","The zone facts of the source are read by the AWS and the Google Cloud placement adapters; for every other source they are NOT_ASSESSED, which does not mean that the source states none.","The availability zones and metro placement of the STACKIT target are NOT_ASSESSED: this build holds no evidence for them, so nothing here compares the source with the target.","A unit is listed when it holds state or states a failure-domain, replication or backup fact; a unit that states none and holds no data is not looked at, and the network a unit stands in (a subnet, a route table, a security group) is not a unit with an intent of its own: 14 of the 16 units present in the source are not listed here, and the block says nothing about them."]},"identity_transition":{"workloads":[{"source_unit":"google_cloud_run_v2_job.migrate","source_type":"google_cloud_run_v2_job","bindings":[{"id":"google_cloud_run_v2_job.migrate#template[0].template[0].service_account","purpose":"RUNTIME","principal_kind":"SERVICE_ACCOUNT","binding_state":"KNOWN"}],"static_credential_state":"NOT_ASSESSED","federation":[],"target_attachment":"OPEN","wif":"NOT_ASSESSED","state":"DECISION_REQUIRED","detail":"The identity plan states the attachment of this workload and writes none: whether STACKIT accepts the role assignments an attached account needs is not established. The plan holds manual actions or open decisions for it; they are listed as items. Privilege delta, break-glass access and human identity are not assessed.","derived_from":["assessment.json#/units/9/result"],"items":["action:stackitsa:facts:google_cloud_run_v2_job.migrate:google_cloud_run_v2_job.migrate#template[0].template[0].service_account"]},{"source_unit":"google_cloud_run_v2_service.server","source_type":"google_cloud_run_v2_service","bindings":[{"id":"google_cloud_run_v2_service.server#template[0].service_account","purpose":"RUNTIME","principal_kind":"SERVICE_ACCOUNT","binding_state":"KNOWN"}],"static_credential_state":"NOT_ASSESSED","federation":[],"target_attachment":"OPEN","wif":"NOT_ASSESSED","state":"DECISION_REQUIRED","detail":"The identity plan states the attachment of this workload and writes none: whether STACKIT accepts the role assignments an attached account needs is not established. The plan holds manual actions or open decisions for it; they are listed as items. Privilege delta, break-glass access and human identity are not assessed.","derived_from":["assessment.json#/units/10/result"],"items":["action:stackitsa:facts:google_cloud_run_v2_service.server:google_cloud_run_v2_service.server#template[0].service_account"]}],"limits":["Workload identity federation is not assessed as an option for any workload. A row states an OIDC issuer where the source names one, as a fact of the source, and never that federation can replace a key.","A static credential is named only where the knowledge base reads a machine user with access keys on the unit. A scan that finds no key cannot say a workload has none, so the absence of a credential is never written.","Privilege delta, break-glass access and human identity are not assessed for any row.","A workload that names no identity in the source has no row, and a run whose draft held no identity intents lists only the units that are an identity themselves.","The block states what the identity plan holds open. It does not attach, grant or federate anything."]},"sovereignty":{"requirement":{"state":"NOT_PROVIDED","statement":"No sovereignty requirement was provided: no applications file gives a tier or constraints. It is not inferred from the location of the company or of the provider.","applications":[]},"dimensions":[{"id":"DATA_LOCATION","name":"Data location","state":"EVIDENCE_REQUIRED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"NOT_ASSESSED","text":"The location of the source resources is not read: this build computes no region or zone placement for the source."},"proposed_target_state":{"state":"STATED","text":"The capability catalogue lists the STACKIT services of the draft as available in: eu01, eu02. That a service is available in a region is a fact about the service. Region assumed for pricing: eu01 (default; no input chose a region). The catalogue lists the service of 4 units there, but no input or profile has chosen the region, so no resource is tied to it."},"delta":{"state":"NOT_ASSESSED","text":"No source location is established, so no change of location is stated."},"evidence":["workspace.json#/assurance/evidence/4"],"unknowns":["The provider's own statement on data location is a statement of the provider with control shared: STACKIT states that the development of its cloud takes place in Germany, that its servers and data centers are located in Germany and Austria, and that its cloud operates in accordance with European data protection standards. It names no region id, so it does not tie any resource of the draft to a region.","Where backups, logs and replicas are stored is the subject of the backup chain and the telemetry chain."],"actions":[]},{"id":"JURISDICTION","name":"Jurisdiction chain","state":"NOT_ASSESSED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"NOT_ASSESSED","text":"The jurisdiction chain (the legal seat of the provider, of its owners and of its operators, and the legal reach over them) is not assessed. It is not a fact of the Terraform source or of the draft, and legal conclusions stay external."},"proposed_target_state":{"state":"NOT_ASSESSED","text":"No target state is stated: the source state is not established."},"delta":{"state":"NOT_ASSESSED","text":"No change is stated."},"evidence":[],"unknowns":["Which legal order applies to the provider, to its parent organisations and to its operators is a question for counsel, not for this build."],"actions":[]},{"id":"OPERATOR_ACCESS","name":"Operator access","state":"NOT_ASSESSED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"NOT_ASSESSED","text":"Who at the provider or at an operator can reach the resources and the data, and under which conditions, is not assessed. It is not a fact of the Terraform source or of the draft."},"proposed_target_state":{"state":"NOT_ASSESSED","text":"No target state is stated: the source state is not established."},"delta":{"state":"NOT_ASSESSED","text":"No change is stated."},"evidence":[],"unknowns":["The access model of the provider's staff and subcontractors is not a fact of the Terraform source."],"actions":[]},{"id":"KEY_CONTROL","name":"Key control","state":"NOT_ASSESSED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"NOT_ASSESSED","text":"No unit's contract observes a customer-managed key or an encrypted volume. That is a reading of the contracts this build holds, not a finding that no key is used."},"proposed_target_state":{"state":"NOT_ASSESSED","text":"No target state is stated: the source state is not established."},"delta":{"state":"NOT_ASSESSED","text":"Whether key ownership changes is not established: the key of the source and the key of the target are not compared."},"evidence":[],"unknowns":["Who holds the keys of the data the source stores is not established."],"actions":[]},{"id":"IDENTITY_CHAIN","name":"Identity chain","state":"DECISION_REQUIRED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"STATED","text":"The source names identities for its workloads or states them as units: google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server."},"proposed_target_state":{"state":"STATED","text":"The draft attaches a STACKIT service account to a server only where the identity plan attaches it exactly; every other attachment is stated as open. Where the draft writes a project role assignment (for a Google Cloud service account or the IAM binding of a member it turns into service accounts or members), the role it grants is a variable the architect chooses, because a Google Cloud permission is not translated into a STACKIT role: the draft derives no role from the source."},"delta":{"state":"NOT_ASSESSED","text":"Whether the identity dependency changes is not established: the privilege delta and the external identity provider are not assessed."},"evidence":["workspace.json#/identity_transition/workloads/0","workspace.json#/identity_transition/workloads/1"],"unknowns":["Whether an external identity provider is a dependency of the sign-in of people is not assessed.","The privilege delta between the source identities and the target roles is not assessed."],"actions":["action:stackitsa:facts:google_cloud_run_v2_job.migrate:google_cloud_run_v2_job.migrate#template[0].template[0].service_account","action:stackitsa:facts:google_cloud_run_v2_service.server:google_cloud_run_v2_service.server#template[0].service_account"]},{"id":"TELEMETRY_CHAIN","name":"Telemetry chain","state":"NOT_ASSESSED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"NOT_ASSESSED","text":"No log sink of the source is read in this run. That is not a finding that no telemetry leaves the estate."},"proposed_target_state":{"state":"NOT_ASSESSED","text":"No log source plan was produced in this run, so no target state is stated."},"delta":{"state":"NOT_ASSESSED","text":"Whether the destination of the telemetry changes is not established."},"evidence":[],"unknowns":["Where metrics, traces and agent telemetry go is not read by this build."],"actions":[]},{"id":"BACKUP_CHAIN","name":"Backup chain","state":"EVIDENCE_REQUIRED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"STATED","text":"The contracts of the source observe a backup, retention or geo-replication setting on: google_storage_bucket.media."},"proposed_target_state":{"state":"NOT_ASSESSED","text":"Where the backups of the target are stored and who operates the destination is not stated by the draft or by this build."},"delta":{"state":"NOT_ASSESSED","text":"Whether the destination of the backups changes is not established."},"evidence":["assessment.json#/units/7/result/semantics/items/4"],"unknowns":["The destination of the backups and replicas, and the jurisdiction of that destination, are not assessed."],"actions":[]},{"id":"SUPPLY_CHAIN","name":"Supply chain","state":"OBSERVED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"STATED","text":"The source records these Terraform providers, required by its configuration or locked in its lock file: google, google-beta, http, random, time."},"proposed_target_state":{"state":"STATED","text":"The draft is written for the STACKIT provider 0.121.0."},"delta":{"state":"NOT_ASSESSED","text":"Whether the supply chain of the estate changes is not established."},"evidence":["workspace.json#/header/source_snapshot/providers/0","workspace.json#/header/source_snapshot/providers/1","workspace.json#/header/source_snapshot/providers/2","workspace.json#/header/source_snapshot/providers/3","workspace.json#/header/source_snapshot/providers/4"],"unknowns":["The registries and the build chain of the providers, and the provenance of the modules the source calls, are not assessed."],"actions":[]},{"id":"THIRD_PARTY_PROCESSING","name":"Third-party processing","state":"EVIDENCE_REQUIRED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"STATED","text":"The source depends on providers or resource types the knowledge base holds no schema of: provider http, provider random, provider time."},"proposed_target_state":{"state":"NOT_ASSESSED","text":"The draft names no STACKIT counterpart for these dependencies."},"delta":{"state":"NOT_ASSESSED","text":"Whether a third party processes the data after the move is not established."},"evidence":["workspace.json#/header/source_snapshot/providers/2","workspace.json#/header/source_snapshot/providers/3","workspace.json#/header/source_snapshot/providers/4"],"unknowns":["What data a third-party provider or service handles is not read from the Terraform source."],"actions":[]},{"id":"OPEN_INTERFACES","name":"Open interfaces","state":"NOT_ASSESSED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"NOT_ASSESSED","text":"Whether the interfaces the source depends on are open standards and whether the target keeps them is not assessed."},"proposed_target_state":{"state":"NOT_ASSESSED","text":"No target state is stated: the source state is not established."},"delta":{"state":"NOT_ASSESSED","text":"No change is stated."},"evidence":[],"unknowns":["Which of the interfaces the source uses are proprietary is not read."],"actions":[]},{"id":"DATA_PORTABILITY","name":"Data portability","state":"NOT_ASSESSED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"NOT_ASSESSED","text":"Whether the data can be exported in a documented format, and by which path, is not assessed."},"proposed_target_state":{"state":"NOT_ASSESSED","text":"No target state is stated: the source state is not established."},"delta":{"state":"NOT_ASSESSED","text":"No change is stated."},"evidence":[],"unknowns":["How the data of each stateful unit leaves its service is not read."],"actions":[]},{"id":"APPLICATION_COUPLING","name":"Application coupling","state":"NOT_ASSESSED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"NOT_ASSESSED","text":"The coupling of application code to the interfaces of the source (SDKs, proprietary protocols) is not assessed: the application code is not scanned."},"proposed_target_state":{"state":"NOT_ASSESSED","text":"No target state is stated: the source state is not established."},"delta":{"state":"NOT_ASSESSED","text":"No change is stated."},"evidence":[],"unknowns":["Which SDKs and protocols the application code uses is not read."],"actions":[]},{"id":"EXITABILITY","name":"Exitability","state":"OBSERVED","requirement":{"provenance":"NOT_PROVIDED"},"observed_source_state":{"state":"NOT_ASSESSED","text":"The interface, data format, code coupling, replacement complexity, extraction path and alternatives of the source's dependencies are not assessed."},"proposed_target_state":{"state":"STATED","text":"The draft is provider-specific Terraform for the STACKIT provider; that is the only exit fact stated, and it is listed per dependency in the exitability entries."},"delta":{"state":"NOT_ASSESSED","text":"No change of exit cost is stated: no cost, no duration and no complexity is estimated."},"evidence":[],"unknowns":["Every field of the exitability model but the Terraform coupling is not assessed, so no exit path is proven and none is ruled out."],"actions":[]}],"limits":["Legal conclusions remain external. The block provides technical evidence and gaps and does not certify legal compliance.","Sovereignty is not residency: a region of a service is a fact about the service, never a statement about the sovereignty of a workload.","There is no score, no percentage and no count in this block, and no dimension is compared with a requirement in this build.","Jurisdiction, operator access, open interfaces, data portability and application coupling are not assessed, and every field of the exitability model but the Terraform coupling is not assessed.","Dependencies are the units the knowledge base maps to a STACKIT service, the source providers the knowledge base holds no schema of and the source types it does not know. A dependency the draft introduces without a source unit is not listed, and a unit with no STACKIT resource is not listed as removed."]},"sovereignty_rows":{"dependencies":{"rows_total":13,"by_change":{"REPLACED":10,"RETAINED":3},"by_target_service":{"Kubernetes Job/CronJob on SKE":1,"SKE workload (or Cloud Foundry Docker app)":1,"STACKIT Object Storage":1,"STACKIT PostgreSQL Flex":1,"STACKIT RabbitMQ":1,"STACKIT Secrets Manager":2,"STACKIT service account":3,"none":3}},"exitability":{"rows_total":10,"by_state":{"PROVIDER_SPECIFIC":10},"by_target_service":{"Kubernetes Job/CronJob on SKE":1,"SKE workload (or Cloud Foundry Docker app)":1,"STACKIT Object Storage":1,"STACKIT PostgreSQL Flex":1,"STACKIT RabbitMQ":1,"STACKIT Secrets Manager":2,"STACKIT service account":3}}},"price_snapshot":{"statement":"These are list prices only: no quantity is read and no total is built from them here; the quantities, amounts and totals of the priced families are in financial/cost-model.json, which computes a usage or an egress only where the assumption file states it. This block names the snapshot of the public STACKIT price list the run cites and, for each drafted resource of a kind the price rules list, the list price of the one SKU a tested rule joins it to, or why it has none.","source_url":"https://pim.api.stackit.cloud/v2/skus?pageSize=100\u0026language=en","retrieved_at":"2026-10-26T18:27:45Z","sha256":"94244fec5b573614dcff15f79238ce4a0e60cf197768be287e45092d7e1e61ca","currency":"EUR","price_basis":"net list price","licence_note":"reuse terms not found (U1)","sku_count":1134,"region":"eu01","coverage":{"resources":5,"priced":3,"unpriced":0,"not_assessed":2},"other_drafted_resources":5,"unowned_resources":0,"limits":["A list price is the price of one unit of one SKU. It is not a cost: this block reads no quantity and builds no total; the quantities, amounts and totals of the priced families are in financial/cost-model.json.","A resource is joined to a SKU only where the draft itself names the machine type, performance class or flavor; where the draft leaves that to a person (a variable), no SKU is named and the resource is NOT_ASSESSED.","Prices are net list prices of the public STACKIT price list: excluding taxes, with no contract discount, no savings plan and no other currency. A SKU that is not in the public list, a deprecated SKU and the metro variant of a SKU are never used as a price.","Egress and traffic, support plans, the container registry and every resource of a kind the price rules do not list have no row: nothing is stated about their cost.","Only the region eu01 is looked at: it is the region of the knowledge-base catalogue the draft takes its flavors from.","The row of a volume is the per-hour fee of its performance class; the capacity fee of the disk is a separate SKU that depends on the size, and is a line of the cost model, not a row here."]},"cost_model":{"statement":"An initial infrastructure cost estimate under explicit assumptions (the scenario and the assumption file this model names), not a bill: list prices (net, no discount, no Spot, no savings plan, no private price) times quantities the source or the assumption file states. A total is FULL only when every line of its scope is priced; a line that cannot be priced says why and is never filled in, and an unknown quantity is neither 0 nor 1. A savings percentage is given only for the same scope, in one currency (or with an exchange rate that names its source and date), with every line of both sides priced. No usage, traffic, request or egress cost is computed unless the assumption file states the use of one month: a line priced on a stated use is an assumption and says so, and without it the line has its price and no amount. No support, licence, operations or migration labour cost is computed. The one one-off item the model states is what both estates cost while they run side by side during the cutover (parallel_run_months of the assumption file): it is stated apart and is in no total, comparison or saving.","file":"financial/cost-model.json","scenario":{"id":"STANDARD_730H","label":"the labelled standard month of 730 hours, the same on both sides","hours":"730"},"price_sources":[{"side":"SOURCE","provider":"gcp","status":"NOT_AVAILABLE","reason":"the price cache holds no Google Cloud PubSub catalog for global: its lines cannot be priced (run `stacktoit prices refresh --provider gcp --region global --offer PubSub`, with your API key in STACKTOIT_GCP_BILLING_API_KEY)","region":"global","price_basis":"net list price (On-Demand), catalog PubSub","offer":"PubSub","gap":"NOT_IN_CACHE","rungs_tried":[{"rung":"PRICE_CACHE","result":"MISSING","words":"the cache at the default location holds no record of it (the cache was last filled 2026-11-02)"},{"rung":"RELEASE_SNAPSHOT","result":"NOT_IMPLEMENTED","words":"none in this build"},{"rung":"AUTO_FETCH","result":"UNAVAILABLE","words":"no program to fetch with: stacktoit-prices was not found next to this binary or on PATH"}]},{"side":"SOURCE","provider":"gcp","status":"NOT_AVAILABLE","reason":"the price cache holds no Google Cloud SecretManager catalog for global: its lines cannot be priced (run `stacktoit prices refresh --provider gcp --region global --offer SecretManager`, with your API key in STACKTOIT_GCP_BILLING_API_KEY)","region":"global","price_basis":"net list price (On-Demand), catalog SecretManager","offer":"SecretManager","gap":"NOT_IN_CACHE","rungs_tried":[{"rung":"PRICE_CACHE","result":"MISSING","words":"the cache at the default location holds no record of it (the cache was last filled 2026-11-02)"},{"rung":"RELEASE_SNAPSHOT","result":"NOT_IMPLEMENTED","words":"none in this build"},{"rung":"AUTO_FETCH","result":"UNAVAILABLE","words":"no program to fetch with: stacktoit-prices was not found next to this binary or on PATH"}]},{"side":"TARGET","provider":"stackit","status":"USED","retrieved_at":"2026-10-26T18:27:45Z","sha256":"94244fec5b573614dcff15f79238ce4a0e60cf197768be287e45092d7e1e61ca","currency":"EUR","price_basis":"net list price","price_rung":"PRICE_CACHE"}],"assumptions":{},"line_counts":{"total":22,"source":14,"target":8,"by_state":{"AMBIGUOUS":1,"PRICED":2,"PRICE_NOT_FOUND":9,"PRICE_SOURCE_ABSENT":5,"QUANTITY_UNKNOWN":1,"TARGET_NOT_CHOSEN":4}},"totals":[{"scope":"estate","side":"SOURCE","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":14,"unpriced_by_state":{"PRICE_NOT_FOUND":9,"PRICE_SOURCE_ABSENT":5},"coverage":7},{"scope":"estate","side":"TARGET","scenario":"STANDARD_730H","currency":"EUR","state":"PARTIAL","min":"164.67","max":"164.67","priced_lines":2,"unpriced_lines":6,"unpriced_by_state":{"AMBIGUOUS":1,"QUANTITY_UNKNOWN":1,"TARGET_NOT_CHOSEN":4},"coverage":7,"target_only_lines":1,"target_only_min":"72.70","target_only_max":"72.70"},{"scope":"service","key":"containers","side":"TARGET","scenario":"STANDARD_730H","currency":"EUR","state":"PARTIAL","min":"72.70","max":"72.70","priced_lines":1,"unpriced_lines":1,"unpriced_by_state":{"TARGET_NOT_CHOSEN":1},"coverage":2,"target_only_lines":1,"target_only_min":"72.70","target_only_max":"72.70"},{"scope":"service","key":"database","side":"SOURCE","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":3,"unpriced_by_state":{"PRICE_NOT_FOUND":3},"coverage":1},{"scope":"service","key":"database","side":"TARGET","scenario":"STANDARD_730H","currency":"EUR","state":"PARTIAL","min":"91.97","max":"91.97","priced_lines":1,"unpriced_lines":2,"unpriced_by_state":{"TARGET_NOT_CHOSEN":2},"coverage":1},{"scope":"service","key":"messaging","side":"SOURCE","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":1,"unpriced_by_state":{"PRICE_SOURCE_ABSENT":1},"coverage":1},{"scope":"service","key":"messaging","side":"TARGET","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":1,"unpriced_by_state":{"TARGET_NOT_CHOSEN":1},"coverage":1},{"scope":"service","key":"object_storage","side":"SOURCE","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":1,"unpriced_by_state":{"PRICE_NOT_FOUND":1},"coverage":1},{"scope":"service","key":"platform","side":"TARGET","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":1,"unpriced_by_state":{"AMBIGUOUS":1},"coverage":2},{"scope":"service","key":"secrets","side":"SOURCE","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":4,"unpriced_by_state":{"PRICE_SOURCE_ABSENT":4},"coverage":2},{"scope":"service","key":"serverless","side":"SOURCE","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":5,"unpriced_by_state":{"PRICE_NOT_FOUND":5},"coverage":2},{"scope":"service","key":"storage","side":"TARGET","scenario":"STANDARD_730H","state":"NONE","priced_lines":0,"unpriced_lines":1,"unpriced_by_state":{"QUANTITY_UNKNOWN":1},"coverage":1}],"comparisons":[{"scope":"estate","scenario":"STANDARD_730H","comparability":"TARGET_ONLY","source_state":"NONE","target_state":"PARTIAL","reason":"TARGET_ONLY: the source has no priced component","outside":[{"side":"TARGET","part":"TARGET_ONLY","lines":1,"amount":{"currency":"EUR","min":"72.70","max":"72.70"}}]},{"scope":"service","key":"containers","scenario":"STANDARD_730H","comparability":"TARGET_ONLY","target_state":"PARTIAL","reason":"TARGET_ONLY: there is no source total","outside":[{"side":"TARGET","part":"TARGET_ONLY","lines":1,"amount":{"currency":"EUR","min":"72.70","max":"72.70"}}]},{"scope":"service","key":"database","scenario":"STANDARD_730H","comparability":"TARGET_ONLY","source_state":"NONE","target_state":"PARTIAL","reason":"TARGET_ONLY: the source has no priced component"},{"scope":"service","key":"messaging","scenario":"STANDARD_730H","comparability":"COMPARABLE","source_state":"NONE","target_state":"NONE","reason":"NONE: neither side has a priced component"},{"scope":"service","key":"object_storage","scenario":"STANDARD_730H","comparability":"SOURCE_ONLY","source_state":"NONE","reason":"SOURCE_ONLY: there is no target total"},{"scope":"service","key":"platform","scenario":"STANDARD_730H","comparability":"TARGET_ONLY","target_state":"NONE","reason":"TARGET_ONLY: there is no source total"},{"scope":"service","key":"secrets","scenario":"STANDARD_730H","comparability":"SOURCE_ONLY","source_state":"NONE","reason":"SOURCE_ONLY: there is no target total"},{"scope":"service","key":"serverless","scenario":"STANDARD_730H","comparability":"SOURCE_ONLY","source_state":"NONE","reason":"SOURCE_ONLY: there is no target total"},{"scope":"service","key":"storage","scenario":"STANDARD_730H","comparability":"TARGET_ONLY","target_state":"NONE","reason":"TARGET_ONLY: there is no source total"}],"modelled":{"resources":3,"source_resources":33},"parallel_run":{"statement":"Both estates run while the migration is cut over. These are the monthly list-price subtotals of the priced lines of each side, each in the currency of its own side (no exchange rate is applied), so they are a lower bound: a line without a price is not in them. The cost of both estates running is a one-off cost of the migration: it is in no total, no comparison and no saving, and it is not the difference between the two estates.","sides":[{"side":"SOURCE","state":"NONE","priced_lines":0,"unpriced_lines":14},{"side":"TARGET","state":"PARTIAL","currency":"EUR","per_month_min":"164.67","per_month_max":"164.67","priced_lines":2,"unpriced_lines":6}]},"coverage":{"billable":{"source_resources":33,"with_price_rule":7,"no_charge_of_its_own":13,"out_of_model":13,"out_of_model_types":[{"type":"google_cloudbuild_trigger","resources":3},{"type":"google_secret_manager_secret_iam_binding","resources":2},{"type":"google_storage_bucket_iam_member","resources":2},{"type":"google_cloud_run_service_iam_policy","resources":1},{"type":"google_firebase_hosting_site","resources":1},{"type":"google_firebase_project","resources":1},{"type":"google_project_service","resources":1},{"type":"google_sql_database","resources":1},{"type":"google_sql_user","resources":1}]},"price":{"lines":22,"found":2,"not_found":20,"not_found_by_state":{"AMBIGUOUS":1,"PRICE_NOT_FOUND":9,"PRICE_SOURCE_ABSENT":5,"QUANTITY_UNKNOWN":1,"TARGET_NOT_CHOSEN":4},"not_found_by_diagnostic":{"AMBIGUOUS":1,"CACHE_MISSING":5,"TARGET_NOT_CHOSEN":4,"USAGE_NOT_STATED":1},"by_side":{"SOURCE":{"lines":14,"found":0},"TARGET":{"lines":8,"found":2}}},"usage":{"priced_lines":2,"quantity_known":2,"quantity_assumed":0,"quantity_unknown":0}},"unpriced_causes":[{"diagnostic":"CACHE_MISSING","lines":5,"families":[{"family":"google_secret_manager_secret","lines":4},{"family":"google_pubsub_topic","lines":1}],"next_action":"fill the price cache once, online: `stacktoit prices refresh` (the commands for each missing price family are in the price source statement); the assessment itself stays offline."},{"diagnostic":"TARGET_NOT_CHOSEN","lines":4,"families":[{"family":"PostgreSQL Flex","lines":2},{"family":"RabbitMQ","lines":1},{"family":"SKE","lines":1}],"next_action":"state the choice in the assumption file (--assumptions FILE) or as the answer cost.target_choice of the inputs file (--inputs FILE): variable target_choice, with the subject and an example value that each line names, or answer the request that changes the draft; the line is then priced on your value and says so. A refresh does not help."},{"diagnostic":"AMBIGUOUS","lines":1,"families":[{"family":"Secrets Manager","lines":1}],"next_action":"each line says what chooses between the prices: state it where the line names the variable (os, tenancy, licence), in the assumption file or as the answer cost.\u003cvariable\u003e of the inputs file; where the vendor defines no choice (a tier of a service) the line stays unpriced until it does. A refresh does not help."},{"diagnostic":"USAGE_NOT_STATED","lines":1,"families":[{"family":"Object Storage","lines":1}],"next_action":"state the use of one month in the assumption file (--assumptions FILE) or as the answer cost.\u003cvariable\u003e of the inputs file (--inputs FILE), in the variable and unit the line names (data_transfer, usage_quantity, volume_size, log_ingestion; assumptions-template.yaml lists them); the line is then priced on your figure and says so. A line that names none (the storage of a broker, the I/O requests of an Aurora cluster) has no input for it in this build. Without a figure the line has its price and no amount, and is in no total."}],"notes":["google_secret_manager_secret_version.django_admin_password: a secret version has no line of its own: the versions of the secret are the use stated on the secret's line","google_secret_manager_secret_version.django_settings: a secret version has no line of its own: the versions of the secret are the use stated on the secret's line","the switched-off proposed modules of the draft (8) are outside this estimate: nothing of them runs until a person switches them on and gives them their values, and their size is one of those values","no application totals: the run was given no applications file (--applications), so no unit belongs to an application"],"limits":["Only EC2 instances (aws_instance), EBS volumes (aws_ebs_volume and the root and block devices of an instance), RDS for PostgreSQL instances (aws_db_instance: instance hours, allocated storage, provisioned iops, gp3 throughput), Amazon Aurora (aws_rds_cluster_instance: the instance hours; aws_rds_cluster: the consumed storage and the I/O requests with their price and no quantity) the network families (aws_nat_gateway, aws_lb, aws_eip and the public address an instance asks for, aws_route53_zone, aws_internet_gateway: see the line on the network families below) and the managed-service families (aws_ecs_service on Fargate, aws_mq_broker, aws_elasticache_replication_group and aws_elasticache_cluster, aws_opensearch_domain, aws_dynamodb_table: see the line on them below), the control plane of an Amazon EKS cluster (aws_eks_cluster), the nodes of its managed node groups (aws_eks_node_group) and the storage of S3 buckets and EFS file systems (aws_s3_bucket, aws_efs_file_system: see the line on them below) have lines on the source side, and only STACKIT servers (each with its boot volume), volumes, PostgreSQL Flex instances (flavor, storage class, storage capacity), public IPs, load balancers, DNS zones, RabbitMQ, Valkey, OpenSearch and MariaDB instances (their plan), MongoDB Flex instances (their flavor), SKE clusters (the cluster hour and each node pool), KMS keys, Secrets Manager and Logs instances on the target side; the other drafted resources have a line that says they have no quantity rule, and every other source resource has no line and is listed in the out-of-model group.","The network families have a line on each side, never a total over a partial set. NAT gateway: the hour of a zonal public NAT gateway is priced and the data it processes has the per-GB price and no quantity; the STACKIT price list holds no SKU for a NAT gateway or for outbound address translation, so its target line is PRICE_NOT_FOUND (a service the list does not price is not free). Load balancer: the hour of an Application or Network Load Balancer is priced and its capacity units have the price and no quantity; the target line is the hour of the plan (plan_id; a Network Load Balancer that states none is read as the default p10 the provider documents). Public IPv4 address: the hour of an Elastic IP, and of the address an instance asks for with associate_public_ip_address = true (not an address its subnet or launch template decides), against the hour of a stackit_public_ip. DNS: the month of a hosted zone (the first tier of the Route 53 price; the tier is the account's) and its queries (no quantity); the STACKIT list prices a zone by the number of records it may hold, which the draft does not state, so its target line is AMBIGUOUS. Data transfer out: the per-GB price of the first tier (every tier is named on the line) on the line of the internet gateway and no quantity; the STACKIT list holds no SKU for it, so its target line is PRICE_NOT_FOUND. A quantity that is a measurement of use (GB, capacity unit hours, queries) is never in a Terraform source and is never made up: such a line has its price and no amount. The prices are the On-Demand rows of the AmazonEC2 (NAT gateway, load balancers), AmazonVPC (public IPv4), AWSDataTransfer and AmazonRoute53 offers of the price cache, which `stacktoit prices refresh --provider aws --region R` fetches (`--offer` names one); a line whose offer the cache does not hold names the offer and the command.","The managed-service families are priced from the On-Demand rows of the AmazonECS (Fargate vCPU and GB hours: the cpu and memory of the task definition times the desired count, which is never taken as zero when it is not stated), AmazonMQ (broker hour by engine, instance type and deployment mode; its storage has the price and no quantity), AmazonElastiCache (node hour by engine and node type times the nodes of a replication group), AmazonES (data and dedicated master node hours, EBS GB-month) and AmazonDynamoDB (provisioned read and write capacity unit hours when the table states them, at the rate beyond the free first tier, which is the whole account's; request units and storage have the price and no quantity) offers, which `stacktoit prices refresh --provider aws --region R` fetches (`--offer` names one); Fargate Spot, ECS on EC2 capacity, Windows tasks, global datastores and non-standard table classes are out of the model. The control plane of an Amazon EKS cluster is the cluster hour of the AmazonEKS offer (the standard-support hour: a cluster of a Kubernetes version past standard support is billed the extended-support hour in addition, which is not in the line, and the line says so; a local cluster on AWS Outposts and a Provisioned Control Plane tier are out of the model; the management fee of EKS Auto Mode is said, not computed). A managed node group costs nothing of its own (Amazon EKS User Guide, Managed node groups): its line is the EC2 hour of the first of its instance_types, or of its launch template, or the t3.medium Amazon EKS uses when none is stated, times its desired_size, with the operating system, tenancy and purchasing option rules of an instance (a Spot or Windows node group is not priced as On-Demand Linux) and the EBS volumes its launch template maps as lines of their own; the root volume of the nodes is not in it. The storage of an S3 bucket (S3 Standard, tiered by the size stored in a month) and of an EFS file system (Standard, or One Zone when availability_zone_name is stated) has its price and no quantity, because the data held is a measurement of use that no Terraform source states: the line names the entry of the assumption file that would price it (variable volume_size, unit GB), and the other storage classes, the requests, the transfer and the throughput are not in it. On the target side a RabbitMQ, Valkey (Key Value Store), OpenSearch or MariaDB instance is the hour of the SKU of its plan_name (the SKU is named by the plan, INFERRED from the names of the list, and its nodes and disk are checked against the list's attributes); a plan the draft leaves to a person is TARGET_NOT_CHOSEN. An SKE cluster is the cluster hour, and each node pool it states is a line of its own: the server flavor hours of its machine_type (the join of a server) times its nodes, the range between its minimum and its maximum when they differ, an unknown quantity with the price when the draft states either as a variable, and TARGET_NOT_CHOSEN when the machine type is a variable; the boot volume of each node is not in the line, and the machines of a pool are never set against the source lines of the nodes of an EKS node group (a unit of its own) or of an ECS cluster's capacity, so a pool is a target-only line (see below); the cluster hour of an SKE cluster stands against the control plane hour of an EKS cluster, but a unit whose item holds a target-only pool is not computed, so no saving is stated over it. A MongoDB Flex instance is the hour of the SKU MongoDB-Flex-\u003ccpu\u003e.\u003cram\u003e-\u003cSingle|Replica|Sharded\u003e of its flavor.cpu, flavor.ram and options.type (INFERRED from the names of the list, and checked against the SKU's own attributes; the rate of a Replica SKU is read as that of the whole instance with its nodes); a flavor a person sets is TARGET_NOT_CHOSEN, a flavor the list has no SKU of is PRICE_NOT_FOUND, its storage and backups are not computed, and because this build prices no DocumentDB cluster on the source side its line is target only (see below). A software KMS key version and a GB of log ingestion have their list price and no quantity; Secrets Manager is AMBIGUOUS between its tiers (the number of secret versions). A priced target line of a family whose source side has no line for the unit (an SKE cluster and its node pools, a MariaDB instance, a MongoDB Flex instance, a RabbitMQ plan against a source with no priced broker) is target only: it is counted in the STACKIT total, listed apart with its amount (target_only on the line and target_only_lines, target_only_min and target_only_max on the total), and kept out of every comparison and every saving, because no source amount stands against it; each comparison states the lines and the amount it leaves out, on both sides.","The instance hours and the allocated storage of an RDS for PostgreSQL instance are priced from the AmazonRDS offer of the price cache (On-Demand list prices, Single-AZ or Multi-AZ as the source states; `stacktoit prices refresh --provider aws` fetches it with the AmazonEC2 offer); its provisioned IOPS (io1, io2, gp3) and the provisioned throughput of gp3 storage come from the same offer, gp3 only above the performance its allocated storage includes (a baseline of 12,000 IOPS and 500 MiB/s from 400 GiB, nothing more can be provisioned below it: Amazon RDS User Guide, DB instance storage); without that offer the lines are PRICE_SOURCE_ABSENT and the instance is never in the computed subtotal. An Aurora instance (engine aurora-mysql or aurora-postgresql) is the instance hour of its engine, its instance class and the storage configuration of its cluster, from the same offer (rules version 3 of its narrowing): Aurora Standard when the cluster states no storage_type (the provider's documented default), Aurora I/O-Optimized for storage_type = \"aurora-iopt1\", and both prices open (AMBIGUOUS) when the source does not state it as a fact or the instance's cluster is not a resource of the source; the cluster's consumed storage (a GB-month) and, on Standard, its I/O requests are measurements of use and have their price and no quantity. An Aurora Serverless v2 instance (db.serverless), an instance of a Multi-AZ DB cluster, backup storage beyond the free allocation, Global Database and the Data API are not computed. An offer narrowed before the Aurora rows were kept answers PRICE_SOURCE_ABSENT with the refresh command on each Aurora line. A PostgreSQL Flex Replica flavor is priced once per instance: the list gives its SKU 3 nodes and a higher rate than the Single SKU (1.6 to 2.0 times it, never 3 times), and the rate is read as that of the whole instance (evidence class INFERRED from the price list; each such line says so); how much of its storage is billed (once or per node) the list does not say, so its storage lines have the SKU and no quantity.","The PostgreSQL Flex storage class premium-perf\u003cn\u003e-stackit is priced as the SKU \"Block Storage for PostgreSQL Premium-Performance \u003cn\u003e\" per disk and its capacity as \"Block Storage for PostgreSQL Premium-Capacity\" per GB (evidence class INFERRED from the names of the price list; each such line says so). For a replica flavor the list gives the storage per node and does not say whether the booked size is billed once or for each node, so its disks and gigabytes are the range between the two readings. The IOPS and throughput shown for the class in the technical mapping are the attributes maxIOPerSec and maxTroughInMB of that performance SKU in the price list (the catalogue states none for a PostgreSQL Flex class); whether the class covers what the source provisions is a comparison of those figures, not a statement that the two perform alike.","The lines fall into three groups: the computed subtotal (only the source units every line of which is priced on both sides, so both subtotals cover the same units), the lines whose price is known and whose quantity is not (the quantity that is needed is named), and what is not computed (a unit of a type out of the model, a unit with no line on one side, or a line without a price), listed by resource and never zero.","Source prices are the On-Demand list prices of the AWS offer file in the price cache (USD, net, region of the resource); Spot, Reserved, Savings Plans, Dedicated Host, capacity reservation and private prices are never used. The operating system and licence come from the assumption file: the source does not state them.","The offer file bills an EBS volume per GB-month; this build reads it as GiB-month, the unit a volume is sized in: the Amazon EBS pricing page states \"on this page, GB = 1024^3 bytes\" (OFFICIAL_DOCUMENTED for that page; applying it to the offer file's unit is INFERRED). The IOPS and throughput of a gp3 volume are priced only above the baseline included in the price of its storage (3,000 IOPS, 125 MiB/s: Amazon EBS User Guide, OFFICIAL_DOCUMENTED), per volume; io2 IOPS are priced in tiers whose edges the offer file carries in descriptions only, and are not priced.","Target prices are the net EUR list prices of the public STACKIT price list in the price cache (region eu01). A machine type or performance class the draft leaves to a person is TARGET_NOT_CHOSEN; the metro variant of a SKU is never substituted.","The target capacity price of a volume is the capacity SKU of its performance class's tier (evidence class INFERRED from the structure of the price list).","One month is the 730 hours of the scenario; a per-month rate is applied as the file gives it. Snapshots, backups, support plans and every other cost of usage, traffic or requests that this build has no line for are not computed.","A saving is compared only for the same source units on both sides and in one currency (an exchange rate from the assumption file, with its source and date, converts one side).","Google Cloud source lines are priced from the On-Demand list prices of the Cloud Billing Catalog API in the price cache (USD, net, the region of the resource; `stacktoit prices refresh --provider gcp --region R`, with your own API key in STACKTOIT_GCP_BILLING_API_KEY, fetches them; `--offer` names one catalog). The catalog has no machine-type or disk-type field: each line joins its SKU by the words of the SKU's description and needs exactly one SKU to fit (a join INFERRED from the descriptions, said on each line); no fit is PRICE_NOT_FOUND and more than one is AMBIGUOUS, never a pick.","What the Google Cloud model prices: google_compute_instance and google_compute_instance_from_template (a predefined or custom machine type as its vCPU hours and its memory hours, a shared-core type as its instance hour; the GPUs, the Local SSD, the boot disk with its Hyperdisk or extreme-disk IOPS and throughput; the external address an access_config asks for), google_compute_instance_group_manager and google_compute_region_instance_group_manager (the instances of the one instance template the group names, between the bounds of the autoscaler that targets it, else target_size), google_compute_disk and google_compute_region_disk, google_compute_address (external), google_sql_database_instance (PostgreSQL, MySQL and SQL Server: vCPUs, memory, storage and, for SQL Server, the edition licence; Enterprise Plus, shared-core and legacy named tiers), google_container_cluster and google_container_node_pool, google_redis_instance, google_storage_bucket (also dual-region), google_compute_router_nat, google_dns_managed_zone, google_pubsub_topic, and the serverless, data, security, network and data-processing services: Cloud Run services and jobs, Cloud Functions, BigQuery, Spanner, Bigtable, Firestore, Filestore, Secret Manager, Cloud KMS, Cloud Logging, Cloud Tasks, Cloud Scheduler, Artifact Registry, Dataproc, Dataflow, Composer, load balancer forwarding rules, Cloud Armor, VPN tunnels and Interconnect (the coverage file of this run lists each line). Every other Google Cloud resource has no line and is listed in the out-of-model group.","A machine series whose memory per vCPU this build does not read from the documentation, a Cloud SQL tier of another series, a Spanner or Firestore multi-region, a custom dual-region bucket and a Composer 1 environment are out of the model or KEY_NOT_READ with the reason on the line; a forwarding rule is priced as an additional rule, without the minimum charge that covers the first rules of a project. Spot, preemptible, sole-tenant, flex-start and reservation-bound capacity is never priced as On-Demand. A premium operating system image (Windows Server, SQL Server, Red Hat or SUSE Enterprise Linux, Ubuntu Pro) gets a licence line that names the licence and is PRICE_NOT_FOUND, so the instance is never in a computed subtotal without its licence fee; an image the source does not state is read as one with no licence fee and the line says so (an ASSUMPTION).","No discount is applied: the sustained-use discount of the N1, N2, N2D and C2 families, committed-use discounts, the free tier of the billing account (one zonal or Autopilot GKE cluster, the first gigabytes of Pub/Sub) and negotiated prices are not in a list price. A quantity that is a measurement of use (the data a bucket holds, the data a NAT gateway or a topic moves, the VMs a NAT gateway serves, the requests and the instance time of a Cloud Run service or function, the bytes a BigQuery query scans, the operations of a key, a secret or a database, the log volume, the worker hours of a Dataflow job) is never in a Terraform source: such a line has its price and no quantity, until the assumption file states the use. A node count of a regional GKE cluster that lists no node_locations is not known (the zones GKE chooses are not in the source), so its nodes are not priced."]},"migration_execution":{"verdict":"PARTIALLY_EXECUTABLE","verdict_words":"Partially executable migration package","steps_now":"10 of the 12 automated steps (OpenTofu or a script) are free of decisions and manual prerequisites (2 require a design decision) · 0 can run as written · 10 of those 10 wait for a value (project_id, containers_machine_type, containers_nodes_max, containers_nodes_min and 7 more); a person can start 29 of the 64 manual steps now (10 wait for a manual prerequisite, 3 wait for an automated step, 22 require a design decision); 2 steps of the plan are permanently unsupported (refused).","meaning":"Some steps cannot be carried out as the plan stands, whatever is decided. Execution completeness: COMPLETE (each of the 64 manual steps states what it is, why, who carries it out and when it is done, and the input it needs where it depends on one).","migration_ready":"Migration-ready: NO — 72 critical settings of 16 source resources have manual or refused steps open (65 manual, 2 refused, 5 with no step); 26 steps of the plan cannot be carried out now (24 wait only for a decision, 2 are refused).","steps":78,"terraform":10,"stackit_api":2,"manual":64,"refused":2,"free_of_decisions":52,"runs_as_written":0,"after_manual":10,"awaiting_value":10,"waiting":24,"stuck":0,"decisions":[{"id":"DEC-GEN-CONVERT-API-OPT-IN","steps":5},{"id":"DEC-GEN-CONVERT-DATA-MOVEMENT","steps":13},{"id":"DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE","steps":4},{"id":"DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING","steps":1},{"id":"DEC-GEN-CONVERT-SOURCE-REGION-MAPPING","steps":1}],"unrecorded":0,"draft":{"blocks":10,"without_step":0,"complete":true},"work_packages":[{"id":"WP-01","title":"Set up the identities and access (prepare)","owner":"Identity Architect","steps":4,"resources":4,"decisions":[],"unrecorded":0,"state":"FREE_OF_DECISIONS","state_words":"a person can start it now"},{"id":"WP-02","title":"Decide and set the critical settings (security)","owner":"Identity Architect","steps":6,"resources":6,"decisions":[],"unrecorded":0,"state":"FREE_OF_DECISIONS","state_words":"steps to answer: a person answers them, no change is made"},{"id":"WP-03","title":"Decide and set the critical settings (security)","owner":"Security Architect","steps":2,"resources":2,"decisions":[],"unrecorded":0,"state":"FREE_OF_DECISIONS","state_words":"steps to answer: a person answers them, no change is made"},{"id":"WP-04","title":"Secrets migration user retire (security)","owner":"Security Architect","steps":1,"resources":2,"decisions":["DEC-GEN-CONVERT-API-OPT-IN"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions"},{"id":"WP-05","title":"Secrets read back (security)","owner":"Security Architect","steps":1,"resources":2,"decisions":["DEC-GEN-CONVERT-API-OPT-IN"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions"},{"id":"WP-06","title":"Decide and set the critical settings (data services)","owner":"Identity Architect","steps":2,"resources":2,"decisions":[],"unrecorded":0,"state":"FREE_OF_DECISIONS","state_words":"steps to answer: a person answers them, no change is made"},{"id":"WP-07","title":"Decide and set the critical settings (data services)","owner":"Network Architect","steps":1,"resources":1,"decisions":[],"unrecorded":0,"state":"FREE_OF_DECISIONS","state_words":"steps to answer: a person answers them, no change is made"},{"id":"WP-08","title":"Decide and set the critical settings (data services)","owner":"Platform Architect","steps":4,"resources":4,"decisions":["DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING","DEC-GEN-CONVERT-SOURCE-REGION-MAPPING"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions (2 of 4 manual steps)"},{"id":"WP-09","title":"Decide and set the critical settings (data services)","owner":"Security Architect","steps":1,"resources":1,"decisions":[],"unrecorded":0,"state":"FREE_OF_DECISIONS","state_words":"steps to answer: a person answers them, no change is made"},{"id":"WP-10","title":"Decide and set the critical settings (data services)","owner":"Storage Architect","steps":1,"resources":1,"decisions":[],"unrecorded":0,"state":"FREE_OF_DECISIONS","state_words":"steps to answer: a person answers them, no change is made"},{"id":"WP-11","title":"Decide on the switched-off modules that hold a STACKIT alternative of what has no equal (data services)","owner":"Network Architect","steps":1,"resources":1,"decisions":["DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions"},{"id":"WP-12","title":"Move the data and the objects to the target","owner":"Data Architect","steps":8,"resources":2,"decisions":["DEC-GEN-CONVERT-DATA-MOVEMENT"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions (2 of 8 manual steps)"},{"id":"WP-13","title":"Decide and set the critical settings (platform services)","owner":"Identity Architect","steps":2,"resources":2,"decisions":[],"unrecorded":0,"state":"FREE_OF_DECISIONS","state_words":"steps to answer: a person answers them, no change is made"},{"id":"WP-14","title":"Decide and set the critical settings (platform services)","owner":"Network Architect","steps":2,"resources":2,"decisions":[],"unrecorded":0,"state":"FREE_OF_DECISIONS","state_words":"steps to answer: a person answers them, no change is made"},{"id":"WP-15","title":"Decide and set the critical settings (platform services)","owner":"Platform Architect","steps":3,"resources":3,"decisions":[],"unrecorded":0,"state":"FREE_OF_DECISIONS","state_words":"steps to answer: a person answers them, no change is made"},{"id":"WP-16","title":"Decide and set the critical settings (platform services)","owner":"Security Architect","steps":2,"resources":2,"decisions":[],"unrecorded":0,"state":"FREE_OF_DECISIONS","state_words":"steps to answer: a person answers them, no change is made"},{"id":"WP-17","title":"Carry by hand what the STACKIT service for pubsub topic does not take from the draft (platform services)","owner":"Platform Architect","steps":1,"resources":1,"decisions":["DEC-GEN-CONVERT-API-OPT-IN"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions"},{"id":"WP-18","title":"Cluster access (platform services)","owner":"Platform Architect","steps":1,"resources":2,"decisions":[],"unrecorded":0,"state":"FREE_OF_DECISIONS","state_words":"a person can start it after the automated step it comes after has run"},{"id":"WP-19","title":"Messaging topology (platform services)","owner":"Platform Engineer","steps":1,"resources":1,"decisions":[],"unrecorded":0,"state":"FREE_OF_DECISIONS","state_words":"a person can start it now"},{"id":"WP-20","title":"Decide on the switched-off modules that hold a STACKIT alternative of what has no equal (workloads)","owner":"Platform Architect","steps":3,"resources":3,"decisions":["DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions"},{"id":"WP-21","title":"Kubernetes apply (workloads)","owner":"Platform Architect","steps":2,"resources":2,"decisions":[],"unrecorded":0,"state":"FREE_OF_DECISIONS","state_words":"a person can start after WP-18 is done"},{"id":"WP-22","title":"Move the data and the objects to the target","owner":"Data Architect","steps":8,"resources":2,"decisions":["DEC-GEN-CONVERT-DATA-MOVEMENT"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions (6 of 8 manual steps)"},{"id":"WP-23","title":"Move the data and the objects to the target","owner":"Migration Owner","steps":4,"resources":2,"decisions":["DEC-GEN-CONVERT-DATA-MOVEMENT"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions (3 of 4 manual steps)"},{"id":"WP-24","title":"Retire the source resources","owner":"Data Architect","steps":3,"resources":2,"decisions":["DEC-GEN-CONVERT-DATA-MOVEMENT"],"unrecorded":0,"state":"BLOCKED_BY_DECISION","state_words":"waits for decisions (2 of 3 manual steps)"}],"stackit_api_states":[{"state":"OFFLINE_TESTED","words":"generated, tested offline","steps":2}],"stackit_api_steps":[{"step":"API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password","label":"API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password","call":"secrets-manager-vault WriteSecret","capability":"identity.secret","state":"OFFLINE_TESTED","words":"generated, tested offline","meaning":"A test of StackToIT ran a script of this call under a real shell against a local stub that answers as the API is documented to; it was not run against the live STACKIT API."},{"step":"API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings","label":"API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings","call":"secrets-manager-vault WriteSecret","capability":"identity.secret","state":"OFFLINE_TESTED","words":"generated, tested offline","meaning":"A test of StackToIT ran a script of this call under a real shell against a local stub that answers as the API is documented to; it was not run against the live STACKIT API."}],"progress_split":{"steps":78,"decide":24,"now":5,"waiting":47,"awaiting_value":10,"refused":2},"open_fields":[{"step":"MAN/data/google_storage_bucket.media/preflight","subject":"google_storage_bucket.media","shape":"OFS-a3e0790aa9e3"},{"step":"MAN/data/google_sql_database_instance.postgres/preflight","subject":"google_sql_database_instance.postgres","shape":"OFS-a3e0790aa9e3"}],"open_field_shapes":[{"id":"OFS-a3e0790aa9e3","fields":[{"field":"copy volume","kind":"DATA_MOVE","owner":"Data Architect","required":true,"closes_when":"the measured amount and the date of the measurement are recorded","words":"copy volume: UNKNOWN — supplied by Data Architect (the amount of data of {subject} to copy: the used space measured on the source; the provisioned capacity of the source is not the amount of data; closed when the measured amount and the date of the measurement are recorded)"},{"field":"change rate","kind":"DATA_MOVE","owner":"Data Architect","required":true,"closes_when":"the rate measured over a representative period is recorded, with the time a final pass needs at that rate","words":"change rate: UNKNOWN — supplied by Data Architect (how much data the writers of {subject} change per hour; closed when the rate measured over a representative period is recorded, with the time a final pass needs at that rate)"},{"field":"write-freeze window","kind":"DATA_MOVE","owner":"Data Architect","required":true,"closes_when":"the owner of the application agrees the start and the end of the window and it is recorded","words":"write-freeze window: UNKNOWN — supplied by Data Architect (the window in which the writers of {subject} stop for the final pass; closed when the owner of the application agrees the start and the end of the window and it is recorded)"},{"field":"last sync","kind":"DATA_MOVE","owner":"Data Architect","required":true,"closes_when":"the time of the final pass and the result of its checks are recorded","words":"last sync: UNKNOWN — supplied by Data Architect (the time the final pass ends and its checks hold; closed when the time of the final pass and the result of its checks are recorded)"},{"field":"return point","kind":"DATA_MOVE","owner":"Data Architect","required":true,"closes_when":"the return point is recorded with its time and how it is restored","words":"return point: UNKNOWN — supplied by Data Architect (the state of {subject} the migration returns to on a rollback: the source as it was at the write freeze, or a named snapshot or backup; closed when the return point is recorded with its time and how it is restored)"},{"field":"consistency check","kind":"CONSISTENCY","owner":"Data Architect","required":true,"closes_when":"the method is agreed and its result after the final pass is recorded","words":"consistency check: UNKNOWN — supplied by Data Architect (how the copy of {subject} is shown complete and unchanged after the final pass: the used space and a checksum of the data (of the files, or the row counts of the tables) agree with the source; closed when the method is agreed and its result after the final pass is recorded)"},{"field":"validation on the target","kind":"VALIDATION","owner":"Migration Owner","required":true,"closes_when":"the test passes on the target and its result is recorded","words":"validation on the target: UNKNOWN — supplied by Migration Owner (the test the application that uses {subject} passes on STACKIT with the copied data before the cutover, agreed with the owner of the application; closed when the test passes on the target and its result is recorded)"},{"field":"source retention","kind":"ROLLBACK","owner":"Migration Owner","required":true,"closes_when":"the date until which {subject} is kept is recorded","words":"source retention: UNKNOWN — supplied by Migration Owner ({subject} is not retired until the owner decides to retire it; how long it and its final backup are kept after that is the owner's; closed when the date until which {subject} is kept is recorded)"},{"field":"rollback trigger","kind":"ROLLBACK","owner":"Migration Owner","required":true,"closes_when":"the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover","words":"rollback trigger: UNKNOWN — supplied by Migration Owner (the owner's decision to go back; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)"},{"field":"data written to the target","kind":"ROLLBACK","owner":"Data Architect","required":true,"closes_when":"the choice is recorded before the cutover","words":"data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in Google Cloud: it is copied back to {subject} before Google Cloud serves again, or accepted as lost; closed when the choice is recorded before the cutover)"}]}]},"machine_files":[{"path":"assessment.json","description":"The full assessment: every unit, finding and count, machine-readable. Every number in this workspace is read from it.","present":true},{"path":"engineering/architect-report.md","description":"The assessment in words: the run status and its checks, and for each unit the class, the confidence and the STACKIT target proposed.","present":true},{"path":"engineering/analysis-details.md","description":"The working behind engineering/architect-report.md: the relations and combinations the engine evaluated for the decisions that depend on them. Nothing here is a second decision.","present":true},{"path":"architecture/dependencies.mmd","description":"The source and the target architecture as a diagram in Mermaid text, for tools that draw it. The Architecture section of this page draws the same units itself.","present":true},{"path":"migration/technical-sequencing.md","description":"A draft order of work: waves computed from the dependencies between units. A starting point for the architect's plan, not a schedule.","present":true},{"path":"engineering/review.csv","description":"One row per unit for spreadsheet review.","present":true},{"path":"engineering/review-edges.csv","description":"One row per dependency between units, for the architect to confirm, correct or complete.","present":true},{"path":"workspace.json","description":"The compact model the pages show, machine-readable. No page embeds it: the pages are complete without it, and a tool reads the model from this file.","present":true},{"path":"index.html","description":"The front page: the header, the navigation and the Overview. The other sections are the pages in pages/.","present":true},{"path":"pages/applications.html","description":"The Applications section as a page of its own, with the same header and navigation. Which application each unit belongs to, and each application's migration strategy.","present":true},{"path":"pages/architecture.html","description":"The Architecture section as a page of its own, with the same header and navigation. The units of the estate and what the assessment decided for each.","present":true},{"path":"pages/decisions.html","description":"The Decisions section as a page of its own, with the same header and navigation. The decisions people must take, aggregated, with their options, owners and deadlines.","present":true},{"path":"pages/target-fit.html","description":"The Target Fit section as a page of its own, with the same header and navigation. How well each STACKIT target fits: service, interface, Terraform, region, maturity, quota, lifecycle, operability, support and security.","present":true},{"path":"pages/migration.html","description":"The Migration Plan section as a page of its own, with the same header and navigation. Waves, prerequisites, data movement and the order of work.","present":true},{"path":"pages/security-assurance.html","description":"The Security \u0026 Resilience section as a page of its own, with the same header and navigation. What has been proven about security and resilience, what has not, and what needs evidence from outside; the resilience of each unit, where this run assesses it, is on the Operations page.","present":true},{"path":"pages/sovereignty.html","description":"The Sovereignty section as a page of its own, with the same header and navigation. Dependencies, jurisdiction, data placement, key control and exit paths, source against target.","present":true},{"path":"pages/operations.html","description":"The Operations section as a page of its own, with the same header and navigation. Whether the target can be run: identity, audit, observability, backup, restore, support and lifecycle.","present":true},{"path":"pages/cost.html","description":"The Costs section as a page of its own, with the same header and navigation. Priced and unpriced coverage, and the inputs a cost estimate needs.","present":true},{"path":"pages/evidence.html","description":"The Evidence section as a page of its own, with the same header and navigation. The counts, versions and sources behind every statement in this workspace.","present":true},{"path":"pages/engineering.html","description":"The Engineering Evidence section as a page of its own, with the same header and navigation. The machine-readable files and the Terraform draft.","present":true},{"path":"pages/work-board.html","description":"The Work Board section as a page of its own, with the same header and navigation. Every job of the migration in one list, in four queues: who does it, what it waits for, what closes it and which file it carries out.","present":true},{"path":"decisions.json","description":"The decision register, machine-readable, with a template of the decisions file to fill in.","present":true},{"path":"migration/decisions.csv","description":"The decision records as rows for a spreadsheet.","present":true},{"path":"executive/decisions.md","description":"The decision records in words.","present":true},{"path":"executive/brief.md","description":"The five-minute answer as a document: the run summary, what holds the estate back, what people must decide, the shape of the target and what has and has not been established. It restates numbers this file holds and scores nothing.","present":true},{"path":"migration/applications.csv","description":"One row per application of the applications file you gave, with the values as you wrote them (a value you did not write is marked not provided), and one row per unit claimed by several applications. Header only without an applications file.","present":true},{"path":"migration/waves.csv","description":"The dependency order of the units, one row per unit: the wave, WITHHELD when a part of the source was not read in full, or REFUSED for a unit the partial draft refuses for a missing input (in no wave). An order of work, not a schedule.","present":true},{"path":"migration/actions.csv","description":"The register of what a person has to do, decide or establish before the draft is deployed, one typed row per item: gaps in the reading of the source, critical semantics left open, open decisions and manual actions of the plans, workload items that wait for evidence, and validation rows not yet established. Every member of decisions.json is a row; each row names the decision record that holds it. It lists what is open and decides nothing.","present":true},{"path":"migration/work-board.csv","description":"The Work Board as a sheet: one row per job of the migration, in one of four queues (provide information, approve a design, perform migration work, verify), with its owner, priority, what it waits for, what closes it, its evidence, the files it carries out and the steps of the execution plan it holds. Every step of the plan is in exactly one job, or listed as not taken; pages/work-board.html shows the same jobs. The rows are in board order (queue by queue); the order to work in is the order of migration/work-items.json and the Start here list of the page. Header only when the run wrote no execution plan.","present":true},{"path":"migration/work-items.json","description":"The jobs of the Work Board as data, with the run they belong to: each job's id, kind, queue, owner, state, what it waits for, what closes it, its files and steps and, for a decision, its options and how each is carried out, and the one order in which the report names the jobs (the first job, then the jobs that can start, then the others). It is the file the guided work command reads; it states no state or priority of its own, and a job it lists is not done.","present":true},{"path":"migration/source-target.csv","description":"Each source unit beside its STACKIT target, one row per unit (the standing column says what the knowledge base and the run state of the unit's target; the drafted and manual counts of the console and of the draft's README partition what the draft did, and are another count): the target service and its resources (the knowledge base's candidate resource types), the resource types the draft really writes for the unit (drafted_resources: empty when it writes none, marked not assessed when no draft was read), or in words that there is no target, that the unit is refused or that the source switches it off, and how many of its settings are kept (PRESERVED), changed (TRANSFORMED), accepted (ACCEPTED_*) or still to do (everything else, including anything not known). Counted from the rows of assurance/equivalence-ledger.csv; a unit with no ledger row has four zeros, which says nothing was counted, not that nothing is left to do. Header only when the Workspace holds no counts.","present":true},{"path":"migration/application-chain.csv","description":"The drill-down from each application of the customer's file and each group the run suggested (PROPOSED: a reading of the source, not confirmed by anyone), one row per member unit: the Google Cloud resource, the STACKIT target in the words of migration/source-target.csv, the ids of the decisions that still ask something about the unit, the steps of the execution plan that carry it with the number an answer leaves not taken, the Kubernetes manifest objects that tie to it by an exact literal match, and what the code scan says of the application. A run that read no plan or built no register marks those cells as not assessed, which is not an empty list. Header only when the Workspace holds none.","present":true},{"path":"migration/prerequisites.md","description":"For each unit, the open decisions and manual actions that stand between its draft and its deployment, as its plan states them.","present":true},{"path":"migration/data-movement.csv","description":"One row per stateful source unit (a database, a cache, a volume, a file share, an object store): its source and target service, the data class, RPO and downtime tolerance you stated (or marked not provided), the provisioned capacity the source states (not the size of the data) and the cutover dependency. The mechanism of every unit is UNKNOWN: StackToIT never moves data.","present":true},{"path":"migration/data-movement.md","description":"The same units in words, with what the source and the plans do and do not state about each. No size, change rate, duration, transfer rate or downtime is ever stated, and no mechanism is chosen.","present":true},{"path":"migration/data-movement.json","description":"The data_movement block of workspace.json with every stateful source unit (the facets, the unknowns, the provisioned capacity and where each fact is read from), as a file of its own, with the run it belongs to. workspace.json carries the tally of the units.","present":true},{"path":"architecture/current.mmd","description":"The units of the estate and the dependencies among them as a Mermaid flowchart, with the units of each application drawn together.","present":true},{"path":"architecture/target.mmd","description":"The same units with the STACKIT service proposed for each, its class and confidence, as a Mermaid flowchart.","present":true},{"path":"architecture/delta.mmd","description":"The same units with what the move changes for each: its class, whether it has a target, and how many properties the draft names as not carried.","present":true},{"path":"architecture/current.svg","description":"The drawing of the source architecture of the Architecture section, as a file of its own, without the links of the page.","present":true},{"path":"architecture/target.svg","description":"The drawing of the proposed STACKIT target of the Architecture section, as a file of its own.","present":true},{"path":"architecture/delta.svg","description":"The drawing of what the move changes, as a file of its own.","present":true},{"path":"assurance/safety.md","description":"What has and has not been established about the draft, row by row, with the global invariants. It approves nothing and asserts neither equivalence nor that the draft is safe to apply.","present":true},{"path":"assurance/source-compatibility.md","description":"How much of the source was read, the source providers the assessment saw and the source types the knowledge base does not know.","present":true},{"path":"assurance/target-readiness.md","description":"How the STACKIT targets of the units stand in the capability catalogue and in the pinned provider (maturity, lifecycle), and the readiness dimensions.","present":true},{"path":"assurance/operational-readiness.md","description":"The workload readiness of the units (installation, source artifacts, target preconditions, cutover, day 2) and the support options STACKIT evidences. Terraform generated is not workload ready.","present":true},{"path":"assurance/compliance-evidence.md","description":"For each STACKIT service of the draft and each framework in scope, the state of the provider's own evidence. It says nothing about the compliance of your workload.","present":true},{"path":"assurance/compliance-evidence.csv","description":"The cells of compliance-evidence.md as rows for a spreadsheet.","present":true},{"path":"assurance/equivalence-ledger.csv","description":"The equivalence ledger: one row per unit and semantic of the assessment that the source states (workspace.json counts those it does not state), and one row per unit and property for the properties the draft does not carry, no semantic accounts for or that are critical and still open. Each row says how the source states the value, what proves the disposition, where the draft carries it and what stays open. Dispositions are the words the assessment uses today; PRESERVED appears only where the assessment or the draft's plan states it.","present":true},{"path":"assurance/evidence-ledger.csv","description":"The evidence the ledger and the other blocks cite, one row per document, with what it backs, the date it was checked, the date after which it is to be checked again and its state. Evidence that states no such dates is UNDATED, never CURRENT.","present":true},{"path":"assurance/critical-semantics.json","description":"The open critical semantics, one row per unit and semantic, with the disposition the contract result gives, the cause code, the sentences that say why the semantic is open and what would close it, the instances of a repeated unit and the alarm card where there is one. These are the rows the decision records name as their members; workspace.json carries the tally of them, with the run it belongs to.","present":true},{"path":"assurance/resilience.md","description":"The RTO and RPO you stated (or that none was stated) and, for each unit that holds state or states a zone, replication or backup fact, what the source states. No unit is called resilient and no intent is chosen.","present":true},{"path":"assurance/resilience.json","description":"The resilience block of workspace.json with every unit that states a failure-domain, replication or backup fact or holds state (the quoted source facts, the state and where each fact is read from), as a file of its own, with the run it belongs to. workspace.json carries the tally of the units.","present":true},{"path":"assurance/identity-transition.md","description":"For each unit that runs as an identity or is one: the identities the source names, the static credential the knowledge base reads, the federation facts, the attachment the identity plan holds and its state. It makes no claim that federation is an option; privilege delta, break-glass access and human identity are not assessed.","present":true},{"path":"assurance/sovereignty.md","description":"The sovereignty requirement (not provided unless your applications file states one), the dimensions of sovereignty with what the source shows and what the target is proposed to be, the dependencies and the exitability. Sovereignty is not residency; it holds no score and certifies no legal compliance.","present":true},{"path":"assurance/sovereignty.json","description":"The sovereignty block of workspace.json as a file of its own, with the run it belongs to.","present":true},{"path":"financial/price-snapshot.json","description":"The price_snapshot block of workspace.json as a file of its own, with the run it belongs to: which snapshot of the public STACKIT price list this run cites (source, retrieval date, sha256, currency, net list price) and how many of the drafted resources it priced. It holds list prices only: no quantity is read, no total is built, and no usage and no egress is computed.","present":true},{"path":"financial/cost-model.json","description":"The cost model of the run, line by line: for each component of the source (its servers and disks) and of the STACKIT target (servers and volumes) its quantity (a value, a range or unknown, and where it comes from), its price record or the reason there is none, its pricing state and its amount; then the totals of the estate and of each service for each side (full, partial or none), the comparison of source and target with the reason a saving is or is not given, the price sources (the local price cache) and the assumptions the figures rest on. An estimate under one labelled scenario, not a bill.","present":true},{"path":"financial/priced-resources.csv","description":"One row for each line of the cost model (financial/cost-model.json), source and target: the quantity with its provenance, the price record (SKU, rate, unit, the date it is valid from, the snapshot it comes from) or the state and the reason there is none, and the amount of a priced line. An empty amount is a line that is not priced, never a zero.","present":true},{"path":"financial/mapping.csv","description":"The technical mapping beside the prices: for each server, boot disk, disk and database whose source and target are both in the computed group of the cost model, what each side states about vCPU, memory, CPU model, disk capacity, IOPS, throughput and high availability. The source side is read from the attributes of the source resource, the target side from the catalogue snapshot of the region; a fact a side does not state is the words not stated. A machine type is one of the types of the catalogue with at least the vCPUs and memory of the source (a burstable source may be offered shared types); a storage class is the one the draft names (the customer's answer or the variable's default), shown with the catalogue's own IOPS and throughput. The table states sizes; it is not a statement about the performance of the target against the source (no benchmark was run, and a CPU model that a side does not state is shown as not stated). The last six columns add, for a disk, the fee of the selected performance class (the cost model's own amount) with the assumption behind the class, whether the class covers the IOPS and throughput of the source volume, and the smaller classes of the catalogue that still cover them with their fee and change (an alternative with the same or better figures than the source; not a recommendation), and, for a server, whether the flavor is with or without CPU overprovisioning (the documentation's terms, by the overcommit the catalogue states) and what STACKIT states of its lifecycle (a deprecated type says so, with the sentence of the documentation). The size match columns state the comparison of a server's machine type with the source instance and of a database's PostgreSQL Flex flavor with the database instance of the source (vCPUs, memory and the kind, single node or replica set, against its high-availability setting) as proven, to review, not met or unknown, with the sentence that says what was compared; a basis names a size only where the size match is proven.","present":true},{"path":"financial/cost-coverage.md","description":"What the cost model covers: the price sources it looked at, the lines by pricing state for each side, the totals with their state (full, partial or none), the comparison of source and target and why a saving is or is not given, the assumptions, and what the list prices of the STACKIT snapshot cover, with what is known of the terms of reuse of the price data.","present":true},{"path":"engineering/not-carried.csv","description":"One row per property the draft names as not carried: the unit, the node and the property, what the assessment states about it (the class and closure of the critical-property gate, the draft's own reason, the contract semantic that reads it, what closes that semantic while it is open) and the place of the node in the source. A cell the assessment states nothing for is empty.","present":true},{"path":"engineering/not-carried-summary.csv","description":"The units for which the draft names properties as not carried, with how many, and the units that have no count (their draft block was not accounted, or they need no resource of their own).","present":true},{"path":"engineering/evidence-index.json","description":"The reverse table of the evidence index: one entry per block of the draft, with the units it comes from, whether it is an HCL block, a comment or not placed, and its file and line, with the hop table and the checks over the draft. workspace.json carries the tally of the entries and, on each unit, the forward hops; this file is the mirror of them, with the run it belongs to.","present":true},{"path":"engineering/trace/","description":"The full comment of each block of the Terraform draft that has one: the draft keeps a one-paragraph comment above the block (where it comes from, why its values are what they are, what is not carried, which decision is open) and a `# trace: TR-...` line, and the section of this folder that line names holds the whole comment the generators wrote, unabridged: the rule and knowledge-base stamp, the references with their digests, the evidence of each chosen value and the reason of each attribute that is not written. One file for each file of the draft that has such a block, named after it with the extension .md, one section for each block under an anchor that is its trace id; the blocks are linked to their file by `trace_file` and their anchor `trace_id` in engineering/evidence-index.json. This run wrote 6 files with 10 sections.","present":true},{"path":"engineering/trace-index.csv","description":"One row per block with a trace: the trace id, the block, the draft file, the source units, the lines of the comment as the generators wrote it and the lines the draft keeps, and the pointer of the block (the trace file and the anchor of its section).","present":true,"bytes":1804},{"path":"terraform/","description":"The STACKIT Terraform draft: architect review is required before any use. Present only when the run produced it.","present":true},{"path":"terraform/README.md","description":"How to read the draft: what was generated, what is left to a person, and how to check it with OpenTofu.","present":true,"bytes":22234},{"path":"terraform/data.tf","description":"The STACKIT resources the draft writes for one area of the target (data).","present":true,"bytes":2824},{"path":"terraform/handover/bucket-media/data-copy.md","description":"A file of the STACKIT Terraform draft.","present":true,"bytes":18011},{"path":"terraform/handover/cluster-access/kubeconfig.md","description":"A file of the STACKIT Terraform draft.","present":true,"bytes":5326},{"path":"terraform/handover/database-postgres/data-move.md","description":"A file of the STACKIT Terraform draft.","present":true,"bytes":46051},{"path":"terraform/identity.tf","description":"The STACKIT resources the draft writes for one area of the target (identity).","present":true,"bytes":10383},{"path":"terraform/kubernetes.tf","description":"The STACKIT resources the draft writes for one area of the target (kubernetes).","present":true,"bytes":3549},{"path":"terraform/kubernetes/migrate/manifests.yaml","description":"A file of the STACKIT Terraform draft.","present":true,"bytes":5894},{"path":"terraform/kubernetes/server/manifests.yaml","description":"A file of the STACKIT Terraform draft.","present":true,"bytes":11017},{"path":"terraform/messaging.tf","description":"The STACKIT resources the draft writes for one area of the target (messaging).","present":true,"bytes":1052},{"path":"terraform/proposals.tf","description":"The switches of the proposed alternatives: each is off, so a plan of the draft does not hold them.","present":true,"bytes":20819},{"path":"terraform/proposals/proposal_activategcb/main.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":4102},{"path":"terraform/proposals/proposal_activategcb/variables.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":431},{"path":"terraform/proposals/proposal_activategcb/versions.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":231},{"path":"terraform/proposals/proposal_automation/main.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":3117},{"path":"terraform/proposals/proposal_automation/variables.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":429},{"path":"terraform/proposals/proposal_automation/versions.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":231},{"path":"terraform/proposals/proposal_client/main.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":4672},{"path":"terraform/proposals/proposal_client/variables.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":1861},{"path":"terraform/proposals/proposal_client/versions.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":231},{"path":"terraform/proposals/proposal_django_admin_password/main.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":12503},{"path":"terraform/proposals/proposal_django_admin_password/variables.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":4058},{"path":"terraform/proposals/proposal_django_admin_password/versions.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":231},{"path":"terraform/proposals/proposal_django_settings/main.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":12479},{"path":"terraform/proposals/proposal_django_settings/variables.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":4058},{"path":"terraform/proposals/proposal_django_settings/versions.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":231},{"path":"terraform/proposals/proposal_init/main.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":4025},{"path":"terraform/proposals/proposal_init/variables.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":431},{"path":"terraform/proposals/proposal_init/versions.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":231},{"path":"terraform/proposals/proposal_placeholder/main.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":4099},{"path":"terraform/proposals/proposal_placeholder/variables.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":431},{"path":"terraform/proposals/proposal_placeholder/versions.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":231},{"path":"terraform/proposals/proposal_server/main.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":3105},{"path":"terraform/proposals/proposal_server/variables.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":429},{"path":"terraform/proposals/proposal_server/versions.tf","description":"A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.","present":true,"bytes":231},{"path":"terraform/rabbitmq/apply-topology.sh","description":"A file of the STACKIT Terraform draft.","present":true,"bytes":3324},{"path":"terraform/rabbitmq/topology.json","description":"A file of the STACKIT Terraform draft.","present":true,"bytes":219},{"path":"terraform/security.tf","description":"The STACKIT resources the draft writes for one area of the target (security).","present":true,"bytes":6073},{"path":"terraform/storage.tf","description":"The STACKIT resources the draft writes for one area of the target (storage).","present":true,"bytes":1881},{"path":"terraform/terraform.tf","description":"The OpenTofu and provider version requirements of the draft.","present":true,"bytes":700},{"path":"terraform/variables.tf","description":"The input variables of the draft: the values a person fills in.","present":true,"bytes":4286},{"path":"target-plan.json","description":"The canonical TargetPlans the draft was generated from, machine-readable: one plan for each family of the draft that is written from a plan (the security groups of each source cloud, routing, identity, log sources, servers), each with how the draft wrote every resource of it (a resource, a comment only, or a statement about a block another generator writes). The run read it back against the draft before it was published: every resource of a plan is, or is not, a block of the draft as the file says. Present only when the run produced the draft.","present":true},{"path":"execution/","description":"The execution package: execution/README.md is the entry point for carrying the migration out (the verdict for the resources with a typed plan and the draft files it does not cover, what is created, what is not migrated, the decisions, the credentials, the order of the steps, the OpenTofu and API commands, the manual steps, the checks and the rollback); execution/terraform/apply.md, one request file and one script per STACKIT API call under execution/api/, execution/manual/actions.md and execution/verify/checks.md beside it; execution/deploy.sh, the one entry point that carries the steps out in the order of the plan, up to the verification (no argument: a dry run that prints the order; --run: stops at each step that waits, and resumes from review/progress.yaml), with the template of the remote state (execution/backend.tf.template), one example of a pipeline (execution/ci-pipeline.example.yml) and, when a step sits between OpenTofu blocks, the generated roots of the stages before the draft (execution/stages/); a run whose plan holds checks that are commands, or a load balancer in the network of a cluster, also holds the scripts that run those checks and fill the values of the cluster, this entry names them when the run wrote them. A rendering of execution-plan.json and of the facts of the staged draft (the variables, outputs and manifests the scripts read); nothing in it has been run, and a script stops before it calls anything when its step waits for a decision. Present only when the run produced the draft. This run also wrote the scripts execution/deploy.sh, execution/verify/verify.sh.","present":true},{"path":"migration/execution-actions.csv","description":"One row per step of execution-plan.json for a spreadsheet: id, phase, mode, source, target, dependencies, owner, status, file, risks, rollback, whether it is executable and the decisions it waits for. The steps to carry out, not the register of open items (migration/actions.csv). Present only when the run produced the draft.","present":true},{"path":"migration/work-packages.csv","description":"One row per work package of the manual steps of execution-plan.json for a spreadsheet: the steps of one phase, one owner role and one kind of work that one person carries out together, with their number, the resources they touch, the decisions they rest on and wait for, the strictest state among them, their success conditions and the ids of the steps. Every manual step is in exactly one package; execution/README.md lists the same packages. Present only when the run produced the draft.","present":true},{"path":"architecture/network-security.mmd","description":"The network and security view as a Mermaid flowchart, or, in an estate with more than 120 units in it, the partition map of the files under architecture/partitions/ (one box for each partition, the arrows between partitions counted, every unknown edge accounted for). Drawn from the TargetPlans of the draft and the assessment: the internet, public IPs, load balancers, networks, subnets, servers, databases, security groups and their rules, network ACLs and routing. A path the sources do not state is a dashed edge labelled unknown with its reason, never a connection that was not read. Present only when the run produced the draft.","present":true},{"path":"architecture/identity.mmd","description":"The identity view as a Mermaid flowchart (an estate with more principals than a drawing keeps legible gets one sentence that names assurance/identity-transition.md, which lists every identity, instead of a drawing): the Google Cloud principal, the decision the assessment and the plan hold for it, the STACKIT identity it moves to, the role assignment and its scope. A step the typed plan does not hold (the role assignment) is drawn as manual, and a step it leaves open is a dashed edge labelled unknown. Present only when the run produced the draft.","present":true},{"path":"architecture/data-flows.mmd","description":"The data flows as a Mermaid flowchart, or, in an estate with more than 120 units in it, the partition map of the files under architecture/partitions/ (one box for each partition, the arrows between partitions counted, every unknown edge accounted for): clients, load balancers, applications, databases, object storage and registries, with the protocol and port of each flow where the source states them, public or private, and the migration effect on the unit that carries it; what the source does not state is written unknown. The flows are the paths the listeners and security group rules permit, not observed traffic. Present only when the run produced the draft.","present":true},{"path":"architecture/network-security.svg","description":"The network and security view drawn offline: the same boxes and arrows as architecture/network-security.mmd, each arrow numbered, with a key that gives its two ends in the direction of the arrow and its words (protocol, port and direction of a rule; the attribute of a reference). Source links, target links (what a rule, route or listener of the draft permits), links an answer of the inputs file changed and unknowns are drawn apart and named in the legend. A view that is not drawn whole (a partition map above 120 units) is one sentence. Present only when the run produced the draft.","present":true},{"path":"architecture/data-flows.svg","description":"The data flow view drawn offline: the same boxes and arrows as architecture/data-flows.mmd, each flow numbered, with a key that gives its two ends in the direction of the flow, its protocol and port, public or private, and the migration effect. Source links, target links and unknowns are drawn apart and named in the legend. A view that is not drawn whole (a partition map above 120 units) is one sentence. Present only when the run produced the draft.","present":true},{"path":"migration/roadmap.md","description":"The execution plan laid out in ten waves: wave 0 the decisions some step waits for, then the landing zone, network and security, data services, platform, workloads, data migration, cutover, verification and decommission. Each step names what it does, the Google Cloud resource, the mode, what it depends on and whether it is ready, blocked by a decision, not ready or refused. It holds the steps of execution-plan.json only. Present only when the run produced the draft.","present":true},{"path":"migration/landing-zone-requirements.md","description":"What the STACKIT organization and project have to provide before the first apply: organization and project, network area and region, address ranges, routing, DNS, identity, service enablement, quotas to check, API access, Terraform permissions, external dependencies and the customer decisions. Read from the TargetPlans, the execution plan and the assessment; what they do not state is written as unknown and no limit or role name is invented. Present only when the run produced the draft.","present":true},{"path":"engineering/explain-index.json","description":"Where, in this folder's files, the entries and ledger rows of each unit sit, as byte offsets: the explain command (stacktoit explain) reads a unit's chain from it without parsing the whole files. Machine-only: it is not an exchange document and states nothing the files it points into do not state; without it, or when it does not fit the files, explain reads them in full and prints the same answer.","present":true},{"path":"manifest.json","description":"The run's identity (run id, source digest) and the list of the files it published, each with its sha256 and size; its status says whether the run is COMPLETE, PARTIAL or FAILED.","present":true},{"path":"migration/strategies.csv","description":"Not produced in this build: a migration strategy for each application. No run writes this file, and nothing links to it.","present":false,"not_produced":true},{"path":"assurance/preflight.md","description":"Not produced in this build: the preflight checks in words. No run writes this file, and nothing links to it.","present":false,"not_produced":true},{"path":"assurance/terraform-operability.md","description":"Not produced in this build: how the draft is operated with OpenTofu. No run writes this file, and nothing links to it.","present":false,"not_produced":true},{"path":"financial/business-case.md","description":"Not produced in this build: a business case. No run writes this file, and nothing links to it.","present":false,"not_produced":true},{"path":"financial/finops-readiness.md","description":"Not produced in this build: the FinOps readiness. No run writes this file, and nothing links to it.","present":false,"not_produced":true}],"trace_texts":{"TL-0098b008d5a1":"claim: role-bindings = KNOWN, CRITICAL, REVIEW","TL-00a39791a5cf":"block in the draft: stackit_secretsmanager_user.migration","TL-0143a4f3b878":"block in the draft: stackit_postgresflex_instance.{name}","TL-036332d57455":"claim: force-destroy = KNOWN, CRITICAL, UNSUPPORTED","TL-038469fbde1f":"stackit_service_account.{name}: written as an active resource (terraform/identity.tf, lines 36-39); the whole comment of the block is in engineering/trace/identity.md","TL-06755e954f06":"3 left to a person to review","TL-08f76fb5c71a":"knowledge base rule: gcp.secret","TL-0b9ad6d89847":"NOT CARRIED ({subject}): settings.user_labels — labels are metadata and the draft carries none.","TL-0c56d776dcdb":"stackit_secretsmanager_user.migration: written as an active resource (terraform/security.tf, lines 24-29); it also stands for 1 other unit; the whole comment of the block is in engineering/trace/security.md","TL-0dc40386f958":"claim: tc-name = KNOWN, CRITICAL, REVIEW","TL-0e2ee7c8bf70":"stackit_rabbitmq_instance.messaging: written as an active resource (terraform/messaging.tf, lines 8-16); the whole comment of the block is in engineering/trace/messaging.md","TL-1216316511e9":"46 further statements that the source does not make (nothing to carry)","TL-13ce71aece42":"recorded: trace: TR-20eecaf8afaa","TL-14805476ce24":"block in the draft: terraform/storage.tf:11-14","TL-1649b25a7b0f":"knowledge base rule: gcp.pubsub_topic","TL-185c870bf3cc":"6 left to a person to review","TL-18961919f6a2":"claim: user-and-database-settings = KNOWN, CRITICAL, REVIEW","TL-18f44e45a2a6":"block in the draft: terraform/security.tf:24-29","TL-1961a5b14f0a":"block in the draft: terraform/identity.tf:24-27","TL-1baa75712dde":"decision: convert:estate:source_location:SOURCE_REGION_MAPPING","TL-1deb9236882e":"claim: engine = KNOWN, CRITICAL, TRANSFORMED","TL-2504dbf62e2c":"56 further statements that the source does not make (nothing to carry)","TL-2617e179fc00":"3 open decisions of the converter wait for a person: the unit is not ready to deploy until each is decided","TL-27f3a4627dfd":"2 kept as it is","TL-2a141718f446":"trace: TR-d46bac8a52a7","TL-2a26f9d81a54":"recorded: trace: TR-5ca70ac9e6fa","TL-2ac14f61113b":"claim: geo-replication = UNKNOWN, CRITICAL, REVIEW","TL-2b16c070f231":"NOT CARRIED ({subject}): storage_class = REGIONAL — stackit_objectstorage_bucket has a name and object_lock only (pinned provider): the bucket's storage class, Autoclass, hierarchical-namespace and requester-pays settings are not generated.","TL-2e8b6e94ca72":"NOT CARRIED (google_sql_database.database): deletion_policy — stackit_postgresflex_database is deleted directly (pinned provider): ABANDON (keep the Cloud SQL database, drop it from state only) has no counterpart.","TL-2f1101bbfe8f":"block in the draft: stackit_objectstorage_bucket.{name}","TL-2f5f7c1eeb1a":"claim: terraform-destroy-guard-off = KNOWN, CRITICAL, PRESERVED","TL-2fba04c78ffa":"NOT CARRIED (google_storage_bucket_iam_member.automation): member, role = roles/storage.admin — the draft of {subject} does not carry this one member's role on the Cloud Storage bucket. Proposed, switched off until it is decided: proposals/proposal_automation, switch … (full text: engineering/trace/storage.md)","TL-309577fb8601":"NOT CARRIED (google_storage_bucket_iam_member.server): member, role = roles/storage.admin — the draft of {subject} does not carry this one member's role on the Cloud Storage bucket. Proposed, switched off until it is decided: proposals/proposal_server, switch … (full text: engineering/trace/storage.md)","TL-30986cd22262":"recorded: rule line: rule gcp.sql_instance/sql-{name} · KB 0.394.0 · target maturity GA · lifecycle active · evidence internal · review required","TL-32b627c93f61":"source type: google_pubsub_topic","TL-330f53e1c971":"NOT CARRIED (google_secret_manager_secret_iam_binding.{name}): members, role = roles/secretmanager.secretAccessor — the API step API/secrets-manager-vault/WriteSecret/{subject} writes it into the Secrets Manager instance from a document you supply (the … (full text: engineering/trace/security.md)","TL-34f62a617dbd":"claim: secret-values = KNOWN, CRITICAL, TRANSFORMED","TL-3545a21a7bd6":"1 not supported on STACKIT","TL-375c470451cb":"NOT CARRIED ({subject}): replication, secret_id — the API step API/secrets-manager-vault/WriteSecret/{subject} writes it into the Secrets Manager instance from a document you supply (the path is its name when the … (full text: engineering/trace/security.md)","TL-384370564772":"1 open decision of the converter wait for a person: the unit is not ready to deploy until each is decided","TL-3c80bf4c8508":"stackit_postgresflex_instance.{name}: written as an active resource (terraform/data.tf, lines 18-32); the whole comment of the block is in engineering/trace/data.md","TL-3e14ab827c67":"recorded: trace: TR-82b9a11ffa8d","TL-3f8a5f7320ef":"claim: public-access = UNKNOWN, CRITICAL, REVIEW","TL-3fccb67a47a7":"source type: google_sql_database_instance","TL-405c1bd9d17b":"claim: tc-storage-bucket-name = KNOWN, CRITICAL, REVIEW","TL-4650f5c83475":"warning: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint \"\u003e= 6, \u003c 8\" excludes it (pinned 8.4.0) (stated once for the whole estate)","TL-4b050dadf8ee":"NOT CARRIED (google_sql_user.django): password — the source password is not copied: STACKIT generates the user's password (stackit_postgresflex_user.password is computed, pinned provider) — hand the new one to the application.","TL-4b5d26e71960":"decision: convert:google_secret_manager_secret_iam_binding.{name}:proposal:PROPOSED_ALTERNATIVE","TL-4e87d5fb0143":"NOT CARRIED (google_secret_manager_secret_iam_binding.{name}): members, role = roles/secretmanager.secretAccessor — the API step API/secrets-manager-vault/WriteSecret/{subject} writes it into the Secrets Manager instance from a document you … (full text: engineering/trace/security.md)","TL-503d50b7aa7d":"recorded: trace: TR-d46bac8a52a7","TL-555c5bdcead1":"claim: iam-access = KNOWN, CRITICAL, REVIEW","TL-5798af0448aa":"stackit_secretsmanager_instance.migrated_secrets: written as an active resource (terraform/security.tf, lines 16-19); it also stands for 1 other unit; the whole comment of the block is in engineering/trace/security.md","TL-58023aeb183b":"REVIEW: the source disk grows by itself (disk_autoresize is on, the Cloud SQL default), so its disk_size is the size the Terraform file asks for and not necessarily the size of the data today — read the current disk size of the instance before the move and give PostgreSQL Flex at least that much; a … (full text: engineering/trace/data.md)","TL-5aac6219bc47":"trace: TR-4a61e547964d","TL-5c3e9dcd32d3":"claim: region-residency = KNOWN, CRITICAL, REVIEW","TL-5ceb916b409a":"knowledge base case: secret","TL-5e7f92073316":"9 further statements that the source does not make (nothing to carry)","TL-5f75b6165ca2":"recorded: finding: secret-iam-access","TL-60584d093b95":"recorded: trace: TR-03d7fb936653","TL-61ddfceeefef":"NOT CARRIED (google_sql_user.django): deletion_policy — stackit_postgresflex_user is deleted directly (pinned provider): ABANDON (keep the Cloud SQL user, drop it from state only) has no counterpart.","TL-6434d6be105d":"backup_schedule is a default (02:00 daily): the source states no backup start time (Cloud SQL then picks one of its own).","TL-65e6682564ab":"decision: convert:estate:source_project:SOURCE_PROJECT_MAPPING","TL-6c37c393a923":"claim: tcfp-sql-user--name = KNOWN, CRITICAL, REVIEW","TL-6ce259dabf9d":"2 open decisions of the converter wait for a person: the unit is not ready to deploy until each is decided","TL-6fdf2e403494":"trace: TR-97904614ad56","TL-7451f0ddfebd":"claim: secret-settings = KNOWN, CRITICAL, REVIEW","TL-7746014398df":"source type: google_service_account","TL-7a225d66b674":"claim: iam-grant = KNOWN, CRITICAL, REVIEW","TL-7b43413ea2a6":"block in the draft: terraform/identity.tf:36-39","TL-7ec765d9e4dd":"block in the draft: stackit_service_account.{name}","TL-80d5f3ebb51a":"block in the draft: stackit_rabbitmq_instance.messaging","TL-82854da0cb04":"trace: TR-20eecaf8afaa","TL-831e32157956":"60 further statements that the source does not make (nothing to carry)","TL-8360e12ae19c":"NOT CARRIED ({subject}): replication, secret_id — the API step API/secrets-manager-vault/WriteSecret/{subject} writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it … (full text: engineering/trace/security.md)","TL-84300c5fe338":"NOT CARRIED ({subject}): name — the topic becomes an exchange and its subscriptions queues of the shared RabbitMQ instance, created in RabbitMQ by hand (not by this draft): names, delivery, retention and push settings are not generated.","TL-84428ae7503a":"recorded: rule line: rule gcp.service_account/service-account · KB 0.394.0 · target maturity EXPERIMENTAL · lifecycle active · evidence internal · review required","TL-8af2c912ea9b":"1 left to a person to review","TL-8e146c99b99d":"claim: account-name = UNKNOWN, CRITICAL, REVIEW","TL-90d3dbeb2580":"warning: force_destroy lets Terraform delete the bucket together with its objects.","TL-916a67083a18":"trace: TR-82b9a11ffa8d","TL-94cf3b3e974b":"NOT CARRIED (google_secret_manager_secret_version.{name}): secret_data — the API step API/secrets-manager-vault/WriteSecret/{subject} writes it into the Secrets Manager instance from a document you supply (the path is its name when the source … (full text: engineering/trace/security.md)","TL-964869bde1d0":"unit: {subject}","TL-9b1e882cdba7":"NOT CARRIED (google_sql_user.django): name — a user name is not visible statically: create that user with stackit_postgresflex_user.","TL-9b340e19f00f":"1 kept in another form","TL-9b9dd3a28121":"knowledge base case: sql-{name}","TL-9dbb5f8333d6":"PITR on PostgreSQL Flex restores into a new cloned instance; backups are kept 32–90 days.","TL-a291587bece7":"claim: secret-value = KNOWN, CRITICAL, REVIEW","TL-a30957b93362":"claim: tcr-secret-id = KNOWN, CRITICAL, REVIEW","TL-ad58d14c653f":"knowledge base case: service-account","TL-b04b701df7e2":"recorded: rule line: rule gcp.storage_bucket/gcs · KB 0.394.0 · target maturity GA · lifecycle active · evidence internal · review required","TL-b3306b8eabe5":"claim: tcf-sql-database--name = KNOWN, CRITICAL, REVIEW","TL-b33949aaa668":"claim: network-exposure = KNOWN, CRITICAL, LEDGER","TL-b3da39ca70f7":"block in the draft: terraform/data.tf:18-32","TL-b3ee0cbcdc8a":"claim: project-scope = KNOWN, CRITICAL, REVIEW","TL-b433a26e0503":"NOT CARRIED ({subject}): account_id — the account ID is not visible statically, or the account is declared several times: the STACKIT account is named after the source address.","TL-b59da857cf28":"block in the draft: terraform/messaging.tf:8-16","TL-b5f912d83e77":"2 left to a person to review","TL-b657e20901a7":"flavor_id 2.4 = 2 vCPU / 4 GiB, single-node (eu01 catalogue 2026-10-18).","TL-b6eef9695340":"claim: workload-identity = KNOWN, CRITICAL, TRANSFORMED","TL-b72a4bd8bcdb":"decision: convert:google_storage_bucket_iam_member.automation:proposal:PROPOSED_ALTERNATIVE","TL-b7540011238d":"claim: bucket-region = KNOWN, CRITICAL, REVIEW","TL-b7f2b6f96617":"NOT CARRIED ({subject}): display_name = Client Frontend service account — stackit_service_account has no display name, only a name besides project_id (pinned provider).","TL-b801052d81ab":"7 left to a person to review","TL-b9c1a19073a9":"NOT CARRIED ({subject}): display_name = Jump Start App Init SA — stackit_service_account has no display name, only a name besides project_id (pinned provider).","TL-bdcb1a0dfe46":"retention_days: the source backup retention is not visible statically; 32 days is the STACKIT minimum (32–90).","TL-bfebdb5f8d89":"NOT CARRIED ({subject}): force_destroy = true — stackit_objectstorage_bucket has no force-destroy override (pinned provider): deleting a bucket that still holds objects behaves as STACKIT's Object Storage API defines it — empty the bucket (or migrate its objects) before it is … (full text: engineering/trace/storage.md)","TL-bfecd2feb306":"recorded: finding: gcs-force-destroy","TL-c11b2eb48228":"recorded: finding: source-provider-unverified","TL-c4d6b1793833":"decision: convert:google_storage_bucket_iam_member.server:proposal:PROPOSED_ALTERNATIVE","TL-c5abf7427a0e":"source type: google_secret_manager_secret","TL-c72c571f4c97":"knowledge base case: pubsub","TL-c77e25347112":"NOT CARRIED (google_sql_database.database): name — a database name (or the number of databases) is not visible statically: create that database with stackit_postgresflex_database.","TL-c8c470bdcd9f":"decision: convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN","TL-c959b4e71765":"14 further statements that the source does not make (nothing to carry)","TL-ccc248853d64":"knowledge base case: gcs","TL-cfd7a7579712":"recorded: trace: TR-97904614ad56","TL-d371c95a6914":"warning: The secret has grants for individual principals.","TL-d674fb3be129":"knowledge base rule: gcp.storage_bucket","TL-d88062febb16":"decision: convert:{subject}:data:DATA_MOVEMENT","TL-d9a5f7378646":"Grant the permissions of the source policies as STACKIT role assignments (provider experiment \"iam\").","TL-e191a34ed084":"block in the draft: terraform/security.tf:16-19","TL-e2cba8df4bae":"claim: engine-version = KNOWN, CRITICAL, PRESERVED","TL-e307263d6d83":"source type: google_storage_bucket","TL-eb286fde8661":"trace: TR-03d7fb936653","TL-ef2ecd6b642d":"stackit_objectstorage_bucket.{name}: written as an active resource (terraform/storage.tf, lines 11-14); the whole comment of the block is in engineering/trace/storage.md","TL-f10bfd5a8baa":"claim: database-users = UNKNOWN, CRITICAL, REVIEW","TL-f1ec41938106":"1 carried into the draft and listed in the ledger","TL-f35035518166":"block in the draft: stackit_secretsmanager_instance.migrated_secrets","TL-f4a0c3b59d97":"trace: TR-5ca70ac9e6fa","TL-f515dc6cd3d2":"knowledge base rule: gcp.sql_instance","TL-f7d3539d5d56":"stackit_service_account.{name}: written as an active resource (terraform/identity.tf, lines 24-27); the whole comment of the block is in engineering/trace/identity.md","TL-f8cda5a50a4e":"NOT CARRIED (google_secret_manager_secret_version.{name}): secret_data — the API step API/secrets-manager-vault/WriteSecret/{subject} writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as … (full text: engineering/trace/security.md)","TL-f933a6edf2f2":"knowledge base rule: gcp.service_account","TL-fcfcb45fdd01":"Open: how many instances {subject} creates is not visible statically (its count/for_each reads a variable that can be set when the source is planned, so the variable's default is not a fact of the source and is not used); this block drafts one instance — repeat it (count/for_each) for … (full text: engineering/trace/identity.md)","TT-0235368c68f5":"The draft states, for this unit: 2 properties it does not carry, 1 finding. That is what the draft states, not a proof that the block and the source are equivalent.","TT-0a1b0dbee66e":"The engine read 3 statements the source makes about this resource and decided what happens to each; 3 of them are critical settings, 2 of those still open.","TT-157dcc58b082":"The generator that writes this unit's block states, above the block, why its values are what they are. These are the generator's own statements in the draft, not checks of the draft.","TT-1737feb2c87a":"The engine read 4 statements the source makes about this resource and decided what happens to each; 4 of them are critical settings, 3 of those still open.","TT-203b3c44b616":"The draft states, for this unit: 3 properties it does not carry, 2 findings, 2 open decisions of the converter. That is what the draft states, not a proof that the block and the source are equivalent.","TT-438cc76716fb":"The draft states, for this unit: 6 properties it does not carry, 1 finding, 3 open decisions of the converter. That is what the draft states, not a proof that the block and the source are equivalent.","TT-48469437839e":"The block stands for several units, so the generator's explanations of its values are not attributed to this unit; the trace file of the block holds them. These are the generator's own statements in the draft, not checks of the draft.","TT-49f7559eb2a2":"The generator records no explanation of the values of this unit's block and no source attribute for them. These are the generator's own statements in the draft, not checks of the draft.","TT-585f91b2466f":"The engine read 2 statements the source makes about this resource and decided what happens to each; 2 of them are critical settings, 1 of those still open.","TT-58928f2709b6":"The draft states, for this unit: 2 properties it does not carry, 1 finding, 1 open item. That is what the draft states, not a proof that the block and the source are equivalent.","TT-5d552dfb783c":"The draft states, for this unit: 4 properties it does not carry, 2 findings, 3 open decisions of the converter. That is what the draft states, not a proof that the block and the source are equivalent.","TT-959c48ef01bf":"The draft states, for this unit: 1 property it does not carry, 1 finding, 1 open decision of the converter. That is what the draft states, not a proof that the block and the source are equivalent.","TT-9f2cc9376199":"The engine read 7 statements the source makes about this resource and decided what happens to each; 7 of them are critical settings, 7 of those still open.","TT-c5508c270aa7":"The draft holds 2 blocks for this unit, written as active Terraform.","TT-cd1dc4f7b042":"The engine read 11 statements the source makes about this resource and decided what happens to each; 11 of them are critical settings, 7 of those still open.","TT-d130b98cad63":"The draft holds 1 block for this unit, written as active Terraform."}}