YAML Control Details

Diese Seite ist die Referenz aller YAML-Kontrolldateien des WAF Frameworks. Die YAML-Dateien enthalten maschinenlesbare Checks, die vom WAF Checker Tool direkt gegen Terraform-Code ausgeführt werden können.

Säule 1 · Security – WAF-SEC

Control ID	Titel	Severity	Provider	Kategorie
WAF-SEC-010	Identity & Access Management Baseline	🔴 Critical	AWS, Azure, GCP, StackIT, OVH, Hetzner	IAM
WAF-SEC-020	Least Privilege & RBAC Enforcement	🔴 Critical	AWS, Azure, GCP, StackIT, OVH, Hetzner	IAM
WAF-SEC-030	Encryption at Rest with CMK	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Encryption
WAF-SEC-040	Encryption in Transit – TLS Enforcement	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Encryption
WAF-SEC-050	Network Segmentation & Security Group Hardening	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Network Security
WAF-SEC-060	Secrets Management – No Hardcoded Credentials	🔴 Critical	AWS, Azure, GCP, StackIT, OVH, Hetzner	Secrets
WAF-SEC-070	Vulnerability & Patch Management	🟡 Medium	AWS, Azure, GCP, StackIT, OVH, Hetzner	Vulnerability Management
WAF-SEC-080	Security Monitoring & Threat Detection	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Monitoring
WAF-SEC-090	Policy-as-Code & Compliance Automation	🟡 Medium	AWS, Azure, GCP, StackIT, OVH, Hetzner	Compliance
WAF-SEC-100	Incident Response Readiness	🟡 Medium	AWS, Azure, GCP, StackIT, OVH, Hetzner	Incident Response
WAF-SEC-110	Supply Chain Security & SBOM	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Supply Chain
WAF-SEC-120	Container & Runtime Security	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Container Security
WAF-SEC-130	Data Classification & Sensitive Data Protection	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Data Protection

Control ID

Titel

Severity

Provider

Kategorie

WAF-SEC-010

Identity & Access Management Baseline

🔴 Critical

AWS, Azure, GCP, StackIT, OVH, Hetzner

IAM

WAF-SEC-020

Least Privilege & RBAC Enforcement

🔴 Critical

AWS, Azure, GCP, StackIT, OVH, Hetzner

IAM

WAF-SEC-030

Encryption at Rest with CMK

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Encryption

WAF-SEC-040

Encryption in Transit – TLS Enforcement

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Encryption

WAF-SEC-050

Network Segmentation & Security Group Hardening

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Network Security

WAF-SEC-060

Secrets Management – No Hardcoded Credentials

🔴 Critical

AWS, Azure, GCP, StackIT, OVH, Hetzner

Secrets

WAF-SEC-070

Vulnerability & Patch Management

🟡 Medium

AWS, Azure, GCP, StackIT, OVH, Hetzner

Vulnerability Management

WAF-SEC-080

Security Monitoring & Threat Detection

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Monitoring

WAF-SEC-090

Policy-as-Code & Compliance Automation

🟡 Medium

AWS, Azure, GCP, StackIT, OVH, Hetzner

Compliance

WAF-SEC-100

Incident Response Readiness

🟡 Medium

AWS, Azure, GCP, StackIT, OVH, Hetzner

Incident Response

WAF-SEC-110

Supply Chain Security & SBOM

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Supply Chain

WAF-SEC-120

Container & Runtime Security

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Container Security

WAF-SEC-130

Data Classification & Sensitive Data Protection

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Data Protection

Säule 2 · Cost Optimization – WAF-COST

Control ID	Titel	Severity	Provider	Kategorie
WAF-COST-010	Cost Allocation Tagging Enforced	🟠 High	AWS, Azure, GCP	Cost Allocation
WAF-COST-020	Cost Budgets & Alerting Configured	🟠 High	AWS, Azure, GCP	Budget Control
WAF-COST-030	Resource Rightsizing & Idle Detection	🟡 Medium	AWS, Azure, GCP	Resource Optimization
WAF-COST-040	Storage & Retention Lifecycle Defined	🟠 High	AWS, Azure, GCP	Retention Management
WAF-COST-050	Cost Impact Assessment in ADRs	🟠 High	Any (Governance)	Architectural Cost Debt
WAF-COST-060	FinOps Review Cadence	🟡 Medium	Any (Governance)	FinOps Governance
WAF-COST-070	Observability & Logging Cost Tiers	🟡 Medium	AWS, Azure, GCP	Observability Cost
WAF-COST-080	Commitment & Reserved Capacity Planning	🟡 Medium	AWS, Azure, GCP	Cost Optimization
WAF-COST-090	Data Transfer & Egress Cost Management	🟠 High	AWS, Azure, GCP	Data Transfer
WAF-COST-100	Architectural Cost Debt Register & Quarterly Review	🟡 Medium	Any (Governance)	Architectural Cost Debt

Control ID

Titel

Severity

Provider

Kategorie

WAF-COST-010

Cost Allocation Tagging Enforced

🟠 High

AWS, Azure, GCP

Cost Allocation

WAF-COST-020

Cost Budgets & Alerting Configured

🟠 High

AWS, Azure, GCP

Budget Control

WAF-COST-030

Resource Rightsizing & Idle Detection

🟡 Medium

AWS, Azure, GCP

Resource Optimization

WAF-COST-040

Storage & Retention Lifecycle Defined

🟠 High

AWS, Azure, GCP

Retention Management

WAF-COST-050

Cost Impact Assessment in ADRs

🟠 High

Any (Governance)

Architectural Cost Debt

WAF-COST-060

FinOps Review Cadence

🟡 Medium

Any (Governance)

FinOps Governance

WAF-COST-070

Observability & Logging Cost Tiers

🟡 Medium

AWS, Azure, GCP

Observability Cost

WAF-COST-080

Commitment & Reserved Capacity Planning

🟡 Medium

AWS, Azure, GCP

Cost Optimization

WAF-COST-090

Data Transfer & Egress Cost Management

🟠 High

AWS, Azure, GCP

Data Transfer

WAF-COST-100

Architectural Cost Debt Register & Quarterly Review

🟡 Medium

Any (Governance)

Architectural Cost Debt

Säule 3 · Operational Excellence – WAF-OPS

Control ID	Titel	Severity	Provider	Kategorie
WAF-OPS-010	CI/CD Pipeline Defined & Automated	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	CI/CD
WAF-OPS-020	Infrastructure as Code Enforced	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	IaC
WAF-OPS-030	Observability Stack Configured	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Observability
WAF-OPS-040	Alerting on Symptoms, Not Causes	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Alerting
WAF-OPS-050	Change Management & Deployment Risk Assessment	🟡 Medium	AWS, Azure, GCP, StackIT, OVH, Hetzner	Change Management
WAF-OPS-060	Runbook & Operational Documentation Coverage	🟡 Medium	Any (Governance)	Documentation
WAF-OPS-070	Post-Incident Review Process	🟡 Medium	Any (Governance)	Incident Response
WAF-OPS-080	Feature Flag & Safe Deployment Patterns	🟡 Medium	AWS, Azure, GCP, StackIT, OVH, Hetzner	Deployment
WAF-OPS-090	Configuration Drift Detection & Remediation	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Drift Detection
WAF-OPS-100	Operational Debt Register & Review	🟡 Medium	Any (Governance)	Operational Debt

Control ID

Titel

Severity

Provider

Kategorie

WAF-OPS-010

CI/CD Pipeline Defined & Automated

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

CI/CD

WAF-OPS-020

Infrastructure as Code Enforced

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

IaC

WAF-OPS-030

Observability Stack Configured

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Observability

WAF-OPS-040

Alerting on Symptoms, Not Causes

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Alerting

WAF-OPS-050

Change Management & Deployment Risk Assessment

🟡 Medium

AWS, Azure, GCP, StackIT, OVH, Hetzner

Change Management

WAF-OPS-060

Runbook & Operational Documentation Coverage

🟡 Medium

Any (Governance)

Documentation

WAF-OPS-070

Post-Incident Review Process

🟡 Medium

Any (Governance)

Incident Response

WAF-OPS-080

Feature Flag & Safe Deployment Patterns

🟡 Medium

AWS, Azure, GCP, StackIT, OVH, Hetzner

Deployment

WAF-OPS-090

Configuration Drift Detection & Remediation

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Drift Detection

WAF-OPS-100

Operational Debt Register & Review

🟡 Medium

Any (Governance)

Operational Debt

Säule 4 · Reliability – WAF-REL

Control ID	Titel	Severity	Provider	Kategorie
WAF-REL-010	SLO & SLA Definition Documented	🔴 Critical	AWS, Azure, GCP, StackIT, OVH, Hetzner	SLO
WAF-REL-020	Health Checks & Readiness Probes Configured	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Health Checks
WAF-REL-030	Multi-AZ High Availability Deployment	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	High Availability
WAF-REL-040	Backup & Recovery Validation	🔴 Critical	AWS, Azure, GCP, StackIT, OVH, Hetzner	Backup
WAF-REL-050	Circuit Breaker & Timeout Configuration	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Resilience
WAF-REL-060	Incident Response & Runbook Readiness	🟠 High	Any (Governance)	Incident Response
WAF-REL-070	Disaster Recovery Testing	🟠 High	Any (Governance)	DR
WAF-REL-080	Dependency & Upstream Resilience Management	🟡 Medium	Any (Governance)	Dependencies
WAF-REL-090	Chaos Engineering & Fault Injection	🟡 Medium	Any (Governance)	Chaos
WAF-REL-100	Reliability Debt Register & Quarterly Review	🟡 Medium	Any (Governance)	Reliability Debt

Control ID

Titel

Severity

Provider

Kategorie

WAF-REL-010

SLO & SLA Definition Documented

🔴 Critical

AWS, Azure, GCP, StackIT, OVH, Hetzner

SLO

WAF-REL-020

Health Checks & Readiness Probes Configured

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Health Checks

WAF-REL-030

Multi-AZ High Availability Deployment

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

High Availability

WAF-REL-040

Backup & Recovery Validation

🔴 Critical

AWS, Azure, GCP, StackIT, OVH, Hetzner

Backup

WAF-REL-050

Circuit Breaker & Timeout Configuration

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Resilience

WAF-REL-060

Incident Response & Runbook Readiness

🟠 High

Any (Governance)

Incident Response

WAF-REL-070

Disaster Recovery Testing

🟠 High

Any (Governance)

WAF-REL-080

Dependency & Upstream Resilience Management

🟡 Medium

Any (Governance)

Dependencies

WAF-REL-090

Chaos Engineering & Fault Injection

🟡 Medium

Any (Governance)

Chaos

WAF-REL-100

Reliability Debt Register & Quarterly Review

🟡 Medium

Any (Governance)

Reliability Debt

Säule 5 · Performance Efficiency – WAF-PERF

Control ID	Titel	Severity	Provider	Kategorie
WAF-PERF-010	Compute Instance Type & Sizing Validated	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Compute
WAF-PERF-020	Auto-Scaling Configured & Tested	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Auto-Scaling
WAF-PERF-030	Caching Strategy Defined & Implemented	🟡 Medium	AWS, Azure, GCP, StackIT, OVH, Hetzner	Caching
WAF-PERF-040	Database Performance Baseline & Index Strategy	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Database
WAF-PERF-050	Performance Monitoring & SLO Definition	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Monitoring
WAF-PERF-060	Load & Stress Testing in CI/CD Pipeline	🟡 Medium	Any (Governance)	Testing
WAF-PERF-070	Network Latency & Topology Optimization	🟡 Medium	AWS, Azure, GCP, StackIT, OVH, Hetzner	Network
WAF-PERF-080	Serverless & Managed Services for Variable Load	🟡 Low	AWS, Azure, GCP, StackIT, OVH, Hetzner	Serverless
WAF-PERF-090	Storage I/O Performance & Throughput Optimization	🟡 Medium	AWS, Azure, GCP, StackIT, OVH, Hetzner	Storage
WAF-PERF-100	Performance Debt Register & Quarterly Review	🟡 Medium	Any (Governance)	Performance Debt

Control ID

Titel

Severity

Provider

Kategorie

WAF-PERF-010

Compute Instance Type & Sizing Validated

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Compute

WAF-PERF-020

Auto-Scaling Configured & Tested

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Auto-Scaling

WAF-PERF-030

Caching Strategy Defined & Implemented

🟡 Medium

AWS, Azure, GCP, StackIT, OVH, Hetzner

Caching

WAF-PERF-040

Database Performance Baseline & Index Strategy

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Database

WAF-PERF-050

Performance Monitoring & SLO Definition

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Monitoring

WAF-PERF-060

Load & Stress Testing in CI/CD Pipeline

🟡 Medium

Any (Governance)

Testing

WAF-PERF-070

Network Latency & Topology Optimization

🟡 Medium

AWS, Azure, GCP, StackIT, OVH, Hetzner

Network

WAF-PERF-080

Serverless & Managed Services for Variable Load

🟡 Low

AWS, Azure, GCP, StackIT, OVH, Hetzner

Serverless

WAF-PERF-090

Storage I/O Performance & Throughput Optimization

🟡 Medium

AWS, Azure, GCP, StackIT, OVH, Hetzner

Storage

WAF-PERF-100

Performance Debt Register & Quarterly Review

🟡 Medium

Any (Governance)

Performance Debt

Säule 6 · Sustainability – WAF-SUS

Control ID	Titel	Severity	Provider	Kategorie
WAF-SUS-010	Carbon Footprint Measurement & Reporting	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Carbon
WAF-SUS-020	Energy-Efficient Compute Selection	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Compute
WAF-SUS-030	Green Region & Carbon-Aware Workload Placement	🟡 Medium	AWS, Azure, GCP, StackIT, OVH, Hetzner	Regions
WAF-SUS-040	Idle & Underutilized Resource Elimination	🟠 High	AWS, Azure, GCP, StackIT, OVH, Hetzner	Efficiency
WAF-SUS-050	Storage Lifecycle & Data Minimization	🟡 Medium	AWS, Azure, GCP, StackIT, OVH, Hetzner	Storage
WAF-SUS-060	Workload Scheduling & Time-Shifting	🟡 Low	Any (Governance)	Scheduling
WAF-SUS-070	Sustainable Software Design Standards	🟡 Medium	Any (Governance)	Software
WAF-SUS-080	Network & Data Transfer Efficiency	🟡 Medium	AWS, Azure, GCP, StackIT, OVH, Hetzner	Network
WAF-SUS-090	ESG Reporting & Compliance Automation	🟡 Medium	Any (Governance)	Compliance
WAF-SUS-100	Sustainability Debt Register & Quarterly Review	🟡 Low	Any (Governance)	Sustainability Debt

Control ID

Titel

Severity

Provider

Kategorie

WAF-SUS-010

Carbon Footprint Measurement & Reporting

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Carbon

WAF-SUS-020

Energy-Efficient Compute Selection

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Compute

WAF-SUS-030

Green Region & Carbon-Aware Workload Placement

🟡 Medium

AWS, Azure, GCP, StackIT, OVH, Hetzner

Regions

WAF-SUS-040

Idle & Underutilized Resource Elimination

🟠 High

AWS, Azure, GCP, StackIT, OVH, Hetzner

Efficiency

WAF-SUS-050

Storage Lifecycle & Data Minimization

🟡 Medium

AWS, Azure, GCP, StackIT, OVH, Hetzner

Storage

WAF-SUS-060

Workload Scheduling & Time-Shifting

🟡 Low

Any (Governance)

Scheduling

WAF-SUS-070

Sustainable Software Design Standards

🟡 Medium

Any (Governance)

Software

WAF-SUS-080

Network & Data Transfer Efficiency

🟡 Medium

AWS, Azure, GCP, StackIT, OVH, Hetzner

Network

WAF-SUS-090

ESG Reporting & Compliance Automation

🟡 Medium

Any (Governance)

Compliance

WAF-SUS-100

Sustainability Debt Register & Quarterly Review

🟡 Low

Any (Governance)

Sustainability Debt

Säule 7 · Sovereign – WAF-SOV

Control ID	Titel	Severity	Provider	Checks
WAF-SOV-010	Data Residency Policy Defined	🟠 High	AWS, Azure, GCP	4
WAF-SOV-020	Region Pinning Enforced (IaC)	🔴 Critical	AWS, Azure, GCP	5
WAF-SOV-030	Backup Location & Retention Controlled	🟠 High	AWS, Azure	6
WAF-SOV-040	Logging & Telemetry Residency Controlled	🟠 High	AWS	5
WAF-SOV-050	Key Ownership & Management Defined	🔴 Critical	AWS, Azure	6
WAF-SOV-060	Privileged Access Controlled (Separation of Duties)	🔴 Critical	AWS	4
WAF-SOV-070	Break-Glass Process & Logging	🟠 High	AWS	5
WAF-SOV-080	Dependency & Subprocessor Inventory	🟡 Medium	Any	4
WAF-SOV-090	Controlled Egress & Data Exfiltration Guardrails	🟠 High	AWS, Azure	5
WAF-SOV-100	Exit Plan & Portability Tested	🟡 Medium	AWS, Any	5

Control ID

Titel

Severity

Provider

Checks

WAF-SOV-010

Data Residency Policy Defined

🟠 High

AWS, Azure, GCP

WAF-SOV-020

Region Pinning Enforced (IaC)

🔴 Critical

AWS, Azure, GCP

WAF-SOV-030

Backup Location & Retention Controlled

🟠 High

AWS, Azure

WAF-SOV-040

Logging & Telemetry Residency Controlled

🟠 High

AWS

WAF-SOV-050

Key Ownership & Management Defined

🔴 Critical

AWS, Azure

WAF-SOV-060

Privileged Access Controlled (Separation of Duties)

🔴 Critical

AWS

WAF-SOV-070

Break-Glass Process & Logging

🟠 High

AWS

WAF-SOV-080

Dependency & Subprocessor Inventory

🟡 Medium

Any

WAF-SOV-090

Controlled Egress & Data Exfiltration Guardrails

🟠 High

AWS, Azure

WAF-SOV-100

Exit Plan & Portability Tested

🟡 Medium

AWS, Any

WAF-COST – Details

WAF-COST-010 – Cost Allocation Tagging Enforced

Datei: controls/WAF-COST-010.yml | Narrative: WAF-COST-010

Checks prüfen: Pflicht-Tags (cost-center, owner, environment, workload) auf Compute-, Storage- und Datenbankressourcen für AWS, Azure und GCP. CI-Gate blockiert Ressourcen ohne vollständiges Tagging.

WAF-COST-020 – Cost Budgets & Alerting Configured

Datei: controls/WAF-COST-020.yml | Narrative: WAF-COST-020

Checks prüfen: aws_budgets_budget mit Alert-Threshold (80 %, 100 %); azurerm_consumption_budget_resource_group; google_billing_budget pro Billing Account. Kein Environment ohne definiertes Budget.

WAF-COST-030 – Resource Rightsizing & Idle Detection

Datei: controls/WAF-COST-030.yml | Narrative: WAF-COST-030

Checks prüfen: Compute-Ressourcen tragen rightsizing-reviewed-Tag mit Datum; kein persistentes Deployment ohne Rightsizing-Dokumentation. Ergänzende Automatisierung via AWS Compute Optimizer / Azure Advisor.

WAF-COST-040 – Storage & Retention Lifecycle Defined

Datei: controls/WAF-COST-040.yml | Narrative: WAF-COST-040

Checks prüfen: S3-Buckets müssen lifecycle_rule definiert haben; CloudWatch Log Groups retention_in_days muss gesetzt und > 0 sein; Azure Storage Lifecycle Policy; GCP Bucket Lifecycle Rules. Keine Infinite-Retention ohne explizite Compliance-Begründung.

WAF-COST-050 – Cost Impact Assessment in ADRs

Datei: controls/WAF-COST-050.yml | Narrative: WAF-COST-050

Governance-Control (prozessual). Checks prüfen: ADR-Dateien im Repository enthalten eine cost-impact-Sektion mit TCO-Schätzung, Lock-in-Score (1–5), Datentransfer-Kosten, Ops-Aufwand und Exit-Kosten. Fehlende Cost-Sektion = Verletzung (Architektonische Kostenschuld).

WAF-COST-060 – FinOps Review Cadence

Datei: controls/WAF-COST-060.yml | Narrative: WAF-COST-060

Governance-Control. Checks prüfen: Monatlicher Engineering-Review und quartalsweiser Architecture-Board-Review sind dokumentiert (Meeting-Notes im Repository); Action Items mit Owner und Due Date nachverfolgt.

WAF-COST-070 – Observability & Logging Cost Tiers

Datei: controls/WAF-COST-070.yml | Narrative: WAF-COST-070

Checks prüfen: CloudWatch Log Groups retention_in_days ≤ 365 für operative Logs (kein Infinite); Tiering-Tag log-tier (hot/warm/cold/archive) vorhanden; kein DEBUG-Level in Production ohne explizite Sampling-Rate.

WAF-COST-080 – Commitment & Reserved Capacity Planning

Datei: controls/WAF-COST-080.yml | Narrative: WAF-COST-080

Checks prüfen: Baseline-Compute-Instanzen (persistenter Workload) tragen Tag capacity-commitment mit Wert reserved oder savings-plan. On-Demand-Only-Deployments ohne Commitment-Tag werden als Optimierungskandidat markiert.

WAF-COST-090 – Data Transfer & Egress Cost Management

Datei: controls/WAF-COST-090.yml | Narrative: WAF-COST-090

Checks prüfen: VPC Endpoint für S3 in AWS-VPCs vorhanden; keine direkten Internet-Gateway-Routen für interne Compute-Ressourcen; CDN-Ressource (aws_cloudfront_distribution / Azure CDN / google_compute_backend_bucket) für public-facing Storage konfiguriert.

WAF-COST-100 – Architectural Cost Debt Register & Quarterly Review

Datei: controls/WAF-COST-100.yml | Narrative: WAF-COST-100

Governance-Control. Checks prüfen: Datei cost-debt-register.yml im Repository vorhanden; jeder Eintrag enthält owner, annual_impact_eur, status und resolution_date; Quarterly-Review-Eintrag für das aktuelle Quartal mit Architecture-Board-Sign-off vorhanden.

WAF-SOV – Details

Check-Operator Referenz

Die YAML-Controls nutzen folgende op-Werte in Assertions:

Operator Bedeutung

Operator	Bedeutung
`attribute_exists`	Das Attribut existiert (nicht null/unset)
`not_empty`	Das Attribut ist nicht leer (kein leerer String)
`equals`	Wert entspricht genau dem `expected`-Wert
`not_equals`	Wert entspricht nicht dem `expected`-Wert
`in`	Wert ist in der erlaubten Liste enthalten
`not_in`	Wert ist nicht in der verbotenen Liste enthalten
`is_true`	Boolescher Wert ist `true`
`is_false`	Boolescher Wert ist `false`
`greater_than`	Numerischer Wert ist größer als `expected`
`greater_than_or_equal`	Numerischer Wert ist größer oder gleich `expected`
`less_than_or_equal`	Numerischer Wert ist kleiner oder gleich `expected`
`not_matches`	Wert entspricht nicht dem regulären Ausdruck in `pattern`
`matches`	Wert entspricht dem regulären Ausdruck in `pattern`
`key_exists`	Dictionary/Map enthält den Schlüssel `key`
`block_exists`	Ein Block dieses Typs existiert
`has_associated_resource`	Es existiert eine andere Resource, die dieses Objekt referenziert
`json_not_contains_pattern`	JSON-String enthält kein Pattern (Regex-basiert)

attribute_exists

Das Attribut existiert (nicht null/unset)

not_empty

Das Attribut ist nicht leer (kein leerer String)

equals

Wert entspricht genau dem expected-Wert

not_equals

Wert entspricht nicht dem expected-Wert

in

Wert ist in der erlaubten Liste enthalten

not_in

Wert ist nicht in der verbotenen Liste enthalten

is_true

Boolescher Wert ist true

is_false

Boolescher Wert ist false

greater_than

Numerischer Wert ist größer als expected

greater_than_or_equal

Numerischer Wert ist größer oder gleich expected

less_than_or_equal

Numerischer Wert ist kleiner oder gleich expected

not_matches

Wert entspricht nicht dem regulären Ausdruck in pattern

matches

Wert entspricht dem regulären Ausdruck in pattern

key_exists

Dictionary/Map enthält den Schlüssel key

block_exists

Ein Block dieses Typs existiert

has_associated_resource

Es existiert eine andere Resource, die dieses Objekt referenziert

json_not_contains_pattern

JSON-String enthält kein Pattern (Regex-basiert)

WAF-SOV-010 – Data Residency Policy Defined

Datei: controls/WAF-SOV-010.yml

Checks prüfen: Data-Residency-Tagging auf Ressourcen; explizite Region/Location-Attribute in Provider-Blöcken für AWS, Azure und GCP.

WAF-SOV-020 – Region Pinning Enforced (IaC)

Datei: controls/WAF-SOV-020.yml

Checks prüfen: Explizite Region in Provider-Blöcken; Validation-Blöcke in Region/Location-Variablen; keine hardkodierten non-sovereign Regionen.

WAF-SOV-030 – Backup Location & Retention Controlled

Datei: controls/WAF-SOV-030.yml

Checks prüfen: RDS/Aurora backup_retention_period >= 7; DynamoDB PITR aktiviert; Backup Vault in genehmigter Region; S3 Versioning für Backup-Buckets.

WAF-SOV-040 – Logging & Telemetry Residency Controlled

Datei: controls/WAF-SOV-040.yml

Checks prüfen: CloudTrail multi-region mit Log-File-Validation; CloudWatch Log Group Retention nicht 0 und >= 30 Tage; VPC Flow Logs für alle VPCs; CloudWatch-Integration.

WAF-SOV-050 – Key Ownership & Management Defined

Datei: controls/WAF-SOV-050.yml

Checks prüfen: KMS Key Rotation aktiviert; Deletion Window >= 14 Tage; S3 nutzt aws:kms (nicht AES256); EBS und RDS Storage verschlüsselt; Azure Key Vault mit Purge Protection.

WAF-SOV-060 – Privileged Access Controlled (Separation of Duties)

Datei: controls/WAF-SOV-060.yml

Checks prüfen: Keine IAM-Policy mit Action:* und Resource:* kombiniert; kein AdministratorAccess an normale Rollen; IAM Passwort-Policy konfiguriert; keine langlebigen Access Keys.

WAF-SOV-070 – Break-Glass Process & Logging

Datei: controls/WAF-SOV-070.yml

Checks prüfen: CloudTrail multi-region, log-validation, global events; CloudTrail S3 nicht öffentlich; CloudWatch Alarm für Root-Account-Aktivität; Alarm für IAM-Policy-Änderungen.

WAF-SOV-080 – Dependency & Subprocessor Inventory

Datei: controls/WAF-SOV-080.yml

Checks prüfen: Alle required_providers mit Version Constraint; required_version gesetzt; Module-Versionen gepinnt; keine unapproved Git-Module.

WAF-SOV-090 – Controlled Egress & Data Exfiltration Guardrails

Datei: controls/WAF-SOV-090.yml

Checks prüfen: Security Groups ohne 0.0.0.0/0 Egress; VPC Endpoint für S3 vorhanden; VPC Flow Logs aktiviert; Network ACL keine offene Egress; Azure NSG kein offener Outbound.

WAF-SOV-100 – Exit Plan & Portability Tested

Datei: controls/WAF-SOV-100.yml

Checks prüfen: S3 Buckets mit Lifecycle Policy; S3 Versioning aktiviert; Data-Resources mit portability-class Tag; High-Lock-In Services mit exit-strategy Tag; RDS Deletion Protection.