YAML Control Details

File: controls/WAF-SEC-010.yml

Checks verify: root account secured with MFA, IAM password policy, IMDSv2 for EC2, no long-lived access keys.

File: controls/WAF-SEC-020.yml

Checks verify: no Action: * with Resource: * policies, no AdministratorAccess for application roles, permission boundaries configured.

File: controls/WAF-SEC-030.yml

Checks verify: S3 uses aws:kms (CMK, not AES256), EBS volumes encrypted, RDS storage encrypted, KMS key rotation enabled.

File: controls/WAF-SEC-040.yml

Checks verify: ALB enforces HTTPS with TLS 1.2+, CloudFront minimum protocol TLSv1.2, API Gateway with TLS, RDS connections with TLS.

File: controls/WAF-SEC-050.yml

Checks verify: no security group with port 22/3389 open to 0.0.0.0/0, no unrestricted ingress rules, RDS not publicly accessible, VPC flow logs enabled.

File: controls/WAF-SEC-060.yml

Checks verify: no plaintext passwords in defaults, ECS task definitions use secrets not environment, Secrets Manager rotation configured, no private keys in Terraform.

File: controls/WAF-SEC-070.yml

Checks verify: ECR scan-on-push enabled, ECR image tag immutability, Inspector enabled (optional).

File: controls/WAF-SEC-080.yml

Checks verify: GuardDuty enabled, CloudTrail multi-region with log validation, CloudTrail S3 not public, alarms for root login and IAM changes.

File: controls/WAF-SEC-090.yml

Checks verify: required Terraform version pinned, required provider versions pinned.

File: controls/WAF-SEC-100.yml

Checks verify: Config recorder enabled, S3 access logging enabled, CloudTrail multi-region enabled.

File: controls/WAF-SEC-110.yml

Checks verify: lockfile present, SBOM generation in CI, image signing step (Cosign).

File: controls/WAF-SEC-120.yml

Checks verify: ECS task definitions without privileged mode, non-root user, read-only root filesystem.

File: controls/WAF-SEC-130.yml

Checks verify: DataClassification tag on storage resources, CMK encryption for confidential/restricted resources, Macie enabled.

File: controls/WAF-COST-010.yml

Checks verify: mandatory tags (cost-center, owner, environment, workload) on compute, storage, and database resources. CI gate blocks resources without complete tagging.

File: controls/WAF-COST-020.yml

Checks verify: aws_budgets_budget with alert thresholds (80%, 100%); azurerm_consumption_budget_resource_group; google_billing_budget per billing account.

File: controls/WAF-COST-030.yml

Checks verify: compute resources carry rightsizing-reviewed tag with date; no persistent deployment without rightsizing documentation.

File: controls/WAF-COST-040.yml

Checks verify: S3 buckets have lifecycle_rule; CloudWatch Log Groups retention_in_days set and > 0; Azure Storage Lifecycle Policy; GCP Bucket Lifecycle Rules.

File: controls/WAF-COST-050.yml

Governance control (procedural). Checks verify: ADR files contain a cost-impact section with TCO estimate, lock-in score (1–5), data transfer costs, operational effort, and exit costs.

File: controls/WAF-COST-060.yml

Governance control. Checks verify: monthly engineering review and quarterly architecture board review documented with action items tracked.

File: controls/WAF-COST-070.yml

Checks verify: CloudWatch Log Groups retention_in_days ⇐ 365 for operational logs (no infinite); tiering tag log-tier (hot/warm/cold/archive) present; no DEBUG level in production without explicit sampling rate.

File: controls/WAF-COST-080.yml

Checks verify: baseline compute instances carry capacity-commitment tag with reserved or savings-plan. On-demand-only deployments flagged as optimization candidates.

File: controls/WAF-COST-090.yml

Checks verify: VPC Endpoint for S3 present in AWS VPCs; no direct internet gateway routes for internal compute resources; CDN configured for public-facing storage.

File: controls/WAF-COST-100.yml

Governance control. Checks verify: cost-debt-register.yml present with owner, annual_impact_eur, status, resolution_date; quarterly review entry with architecture board sign-off.

File: controls/WAF-OPS-010.yml

Checks verify: pipeline definitions stored in version control; all deployments automated; branch protection enabled; approval gates configured.

File: controls/WAF-OPS-020.yml

Checks verify: all production infrastructure defined as IaC; manual changes restricted via IAM/SCP; remote state backend with locking; all IaC changes through pull request review.

File: controls/WAF-OPS-030.yml

Checks verify: services emit structured JSON logs with trace ID; distributed tracing configured; RED metrics exported; log retention >= 30 days.

File: controls/WAF-OPS-040.yml

Checks verify: alerts based on symptom metrics (error rate, latency, availability); every paging alert has runbook URL; SLOs defined for critical services.

File: controls/WAF-OPS-050.yml

Checks verify: change categories defined; high-risk changes require multi-person approval; deployment freeze policies configured; change records linked to artifacts.

File: controls/WAF-OPS-060.yml

Checks verify: all paging alerts linked to runbooks; runbooks versioned and reviewed quarterly; runbook coverage >= 90% for critical services.

File: controls/WAF-OPS-070.yml

Checks verify: SEV-1/P1 incidents and SLO violations trigger postmortem; postmortems blameless with action items tracked; completed within 5 business days.

File: controls/WAF-OPS-080.yml

Checks verify: production deployments use Canary, Blue/Green, or Feature Flags; rollback possible in < 5 minutes; new features deployed behind feature flags.

File: controls/WAF-OPS-090.yml

Checks verify: automatic drift detection runs at least daily; drift alerts within 1 hour; emergency console changes transferred to IaC within 24 hours.

File: controls/WAF-OPS-100.yml

Checks verify: Operational Debt Register stored in version control; every entry has severity, toil hours, owner, target date; quarterly review with minutes.

File: controls/WAF-REL-010.yml

Checks verify: SLO document versioned; error budget calculated; burn rate alerts configured; quarterly review evidenced.

File: controls/WAF-REL-020.yml

Checks verify: ALB target group health check configured; Azure LB probe with request_path; GCP compute health check with HTTP path.

File: controls/WAF-REL-030.yml

Checks verify: RDS multi_az = true; ASG with min >= 2 and multi-AZ subnets; Azure DB with ZoneRedundant HA; Cloud SQL REGIONAL availability.

File: controls/WAF-REL-040.yml

Checks verify: RDS backup_retention_period >= 7, deletion_protection = true; S3 versioning = Enabled; Azure DB backup configuration; Cloud SQL backup + PITR enabled.

File: controls/WAF-REL-050.yml

Checks verify: ALB idle_timeout explicitly set; Azure App Gateway request_timeout; Cloud Run timeout_seconds configured.

File: controls/WAF-REL-060.yml

Checks verify: CloudWatch alarms with alarm_actions and ok_actions; Azure Monitor action group with recipients; GCP alert policy with notification channels.

File: controls/WAF-REL-070.yml

Checks verify: Route 53 health check failover; Azure Traffic Manager failover; GCP DNS with TTL ⇐ 60s.

File: controls/WAF-REL-080.yml

Checks verify: VPC endpoints for AWS API isolation; Azure private endpoints; GCP private_ip_google_access enabled.

File: controls/WAF-REL-090.yml

Checks verify: AWS FIS with stop condition; Azure Chaos Studio experiment; GCP URL map with fault injection policy.

File: controls/WAF-REL-100.yml

Checks verify: AWS Config conformance pack; Azure policy assignment for reliability; GCP org policy for reliability constraints.

File: controls/WAF-PERF-010.yml

Checks verify: no previous-generation instance types (t2, m4, c4); Azure VMs with current size; GCP N2/C2 instead of N1.

File: controls/WAF-PERF-020.yml

Checks verify: ASG min >= 1, max >= 2, health check configured; Azure Monitor Autoscale Settings; GCP autoscaler with policy.

File: controls/WAF-PERF-030.yml

Checks verify: ElastiCache with automatic failover; Azure Redis Premium SKU; GCP Memorystore with HA tier.

File: controls/WAF-PERF-040.yml

Checks verify: RDS Performance Insights enabled; Azure SQL Query Insights; GCP Cloud SQL Query Insights enabled.

File: controls/WAF-PERF-050.yml

Checks verify: P99 latency alarm with actions; Application Insights with retention >= 30 days; Monitoring uptime check with alert policy.

File: controls/WAF-PERF-060.yml

Checks verify: CodePipeline with performance test stage; Azure DevOps pipeline with perf gate; Cloud Build trigger with performance steps.

File: controls/WAF-PERF-070.yml

Checks verify: Gateway VPC endpoint for S3; Azure CDN or Front Door; Cloud CDN enabled.

File: controls/WAF-PERF-080.yml

Checks verify: Lambda with explicit memory, timeout, reserved concurrency; Azure Premium or Dedicated plan; Cloud Run min instances > 0.

File: controls/WAF-PERF-090.yml

Checks verify: EBS gp3 volume type with explicit IOPS and throughput; Azure Premium_LRS for databases; GCP pd-ssd or pd-balanced.

File: controls/WAF-PERF-100.yml

Checks verify: AWS Config with performance governance rules; Azure Policy with performance initiatives; GCP SCC notification for performance findings.

File: controls/WAF-SUS-010.yml

Checks verify: Cloud provider carbon footprint tools activated; emission data linked to workload tags; retained for ESG reporting.

File: controls/WAF-SUS-020.yml

Checks verify: ARM64/Graviton instances preferred; Lambda functions use arm64; no previous-generation instance families.

File: controls/WAF-SUS-030.yml

Checks verify: region selection considers carbon intensity; sustainable aspects documented; batch workloads evaluate green regions.

File: controls/WAF-SUS-040.yml

Checks verify: compute resources monitored for utilization; resources with < 5% CPU for 14+ days flagged; non-production scheduled shutdown policies.

File: controls/WAF-SUS-050.yml

Checks verify: S3, EBS, Azure Blob, GCS lifecycle policies; data transitioned to cold tiers; log data retention limits; temporary data expiration dates.

File: controls/WAF-SUS-060.yml

Checks verify: batch workloads scheduled for off-peak hours; flexible time windows activated; carbon intensity APIs integrated.

File: controls/WAF-SUS-070.yml

Checks verify: software designed with energy efficiency as quality attribute; ADRs include energy efficiency considerations; SCI measured for critical workloads.

File: controls/WAF-SUS-080.yml

Checks verify: CDN for user-facing static content; HTTP compression enabled; VPC endpoints for AWS service communication.

File: controls/WAF-SUS-090.yml

Checks verify: documented processes for collecting cloud IT emissions; export at least quarterly; CSRD targets documented and tracked.

File: controls/WAF-SUS-100.yml

Checks verify: sustainability debt register with ID, description, impact, owner, priority; quarterly reviews with minutes.

File: controls/WAF-SOV-010.yml

Checks verify: data residency tagging on resources; explicit region/location attributes in provider blocks.

File: controls/WAF-SOV-020.yml

Checks verify: explicit region in provider blocks; validation blocks in region/location variables; no hardcoded non-sovereign regions.

File: controls/WAF-SOV-030.yml

Checks verify: RDS/Aurora backup_retention_period >= 7; DynamoDB PITR enabled; backup vault in approved region; S3 versioning for backup buckets.

File: controls/WAF-SOV-040.yml

Checks verify: CloudTrail multi-region with log file validation; CloudWatch Log Group retention not 0 and >= 30 days; VPC Flow Logs enabled.

File: controls/WAF-SOV-050.yml

Checks verify: KMS key rotation enabled; deletion window >= 14 days; S3 uses aws:kms (not AES256); EBS and RDS storage encrypted; Azure Key Vault with purge protection.

File: controls/WAF-SOV-060.yml

Checks verify: no IAM policy combining Action:* and Resource:*; no AdministratorAccess on regular roles; IAM password policy configured; no long-lived access keys.

File: controls/WAF-SOV-070.yml

Checks verify: CloudTrail multi-region, log validation, global events; CloudTrail S3 not public; CloudWatch alarm for root account activity; alarm for IAM policy changes.

File: controls/WAF-SOV-080.yml

Checks verify: all required_providers with version constraint; required_version set; module versions pinned; no unapproved Git modules.

File: controls/WAF-SOV-090.yml

Checks verify: security groups without 0.0.0.0/0 egress; VPC Endpoint for S3 present; VPC Flow Logs enabled; network ACL no open egress; Azure NSG no open outbound.

File: controls/WAF-SOV-100.yml

Checks verify: S3 buckets with lifecycle policy; S3 versioning enabled; data resources with portability-class tag; high lock-in services with exit-strategy tag; RDS deletion protection.