Control-Schema Referenz

id:          # string  – eindeutige Control-ID (WAF-SOV-010)
title:       # string  – kurzer, aktiver Titel ("Data Residency Policy Defined")
pillar:      # string  – Pillar-Name (sovereign | cost | security | reliability | operations | architecture | governance)
status:      # string  – active | deprecated | draft
severity:    # string  – critical | high | medium | low
category:    # string  – Kategorisierung innerhalb des Pillars (z.B. "data-residency", "cost-allocation")
type:        # list    – [governance, configuration, automation, process, architecture]
tags:        # list    – freie Tags für Suche und Filterung

description: # >       – Was dieses Control fordert (normativ, z.B. "MUST carry tags")
rationale:   # >       – Warum dieses Control existiert (Risikobegründung)
threat:      # list    – Konkrete Bedrohungen bei Nicht-Einhaltung

regulatory_mapping:    # list – Zuordnung zu Compliance-Rahmenwerken (siehe unten)
implementation_guidance: # list – Konkrete Umsetzungsschritte (Checkliste)
maturity_levels:       # map  – 5 Reifegradebenen (level_1 bis level_5)
evidence:              # map  – required + optional Evidenzarten

checks:      # list    – Automatisierte und manuelle Prüfschritte (siehe unten)
references:  # map     – Links zu Narrative-Seiten und verwandten Controls

regulatory_mapping:
  - framework: "GDPR"
    controls:
      - "Art. 44 – General principle for transfers"
      - "Art. 46 – Transfers subject to appropriate safeguards"
  - framework: "BSI C5:2020"
    controls:
      - "OPS-04 – Data management"
  - framework: "ISO 27001:2022"
    controls:
      - "A.5.12 – Classification of information"
  - framework: "EUCS (ENISA)"
    controls:
      - "DSP-01 – Data classification"
  - framework: "GAIA-X"
    controls:
      - "Sovereign Cloud – Data location requirements"

maturity_levels:
  level_1:
    description: "Ad hoc – keine strukturierten Controls"
    criteria:
      - "Erste messbare Bedingung auf Level 1"
  level_2:
    description: "Standardisiert – manuell umgesetzt"
    criteria:
      - "..."
  level_3:
    description: "Integriert – automatisiert und in CI geprüft"
    criteria:
      - "..."
  level_4:
    description: "Souverän – vollständig auditierbar"
    criteria:
      - "..."
  level_5:
    description: "Optimiert – kontinuierliche Verbesserung"
    criteria:
      - "..."

evidence:
  required:
    - kind: "governance"
      description: "Policy-Dokument, version-controlled."
    - kind: "iac"
      description: "Terraform-Konfiguration, die die Anforderung umsetzt."
  optional:
    - kind: "architecture"
      description: "Architekturdiagramm mit Datenflüssen."
    - kind: "process"
      description: "Protokoll des letzten Reviews."
    - kind: "config"
      description: "Export aus Cloud-Konsole oder Inventory-Tool."

checks:
  - id: "waf-sov-010.tf.aws.provider-region-explicit"   # eindeutige Check-ID
    engine: "terraform"                                  # terraform | manual | api
    provider: "aws"                                      # aws | azurerm | google | any
    automated: true                                      # true | false
    severity: "critical"                                 # critical | high | medium | low
    title: "AWS provider must have 'region' explicitly set"
    description: >
      Kurze Beschreibung, was dieser Check prüft und warum.
    scope:
      block_type: "provider"                             # resource | provider | variable | terraform | module
      provider_name: "aws"                               # nur bei block_type: provider
      resource_types:                                    # nur bei block_type: resource
        - "aws_s3_bucket"
    assertions:
      - attribute: "region"
        op: "attribute_exists"
        message: "AWS provider block is missing explicit 'region' attribute."
    on_fail: "violation"
    remediation: >
      Set 'region' explicitly in all AWS provider blocks.
    example:
      compliant: |
        provider "aws" {
          region = var.aws_region
        }
      non_compliant: |
        provider "aws" {
          # No region set
        }

assertions:
  - attribute: "tags"            # Attributpfad (dot-notation für verschachtelte Werte)
    op: "key_exists"             # Operator (siehe Tabelle unten)
    key: "cost-center"           # für key_exists
    expected: "COST"             # für equals, not_equals, in, not_in, greater_than_or_equal, less_than_or_equal
    pattern: "^eu-"              # für matches, not_matches (Regex)
    fallback_attribute: "region" # für attribute_exists_or_fallback
    message: "Resource is missing the mandatory 'cost-center' tag."

references:
  narrative: "modules/pillar-sovereign/pages/controls.adoc#WAF-SOV-010"
  best_practice: "modules/pillar-sovereign/pages/best-practices/bp-data-residency.adoc"
  related_controls:
    - "WAF-SOV-020"
    - "WAF-SOV-030"

id: WAF-COST-010
title: "Cost Allocation Tagging Enforced"
pillar: "cost"
status: "active"
severity: "high"
category: "cost-allocation"
type: ['governance', 'configuration']
tags: ['tagging', 'cost-allocation', 'finops']

description: >
  All cloud resources MUST carry mandatory cost allocation tags:
  cost-center, owner, environment, and workload.

rationale: >
  Without consistent tagging, cloud costs cannot be allocated to workloads or teams.
  Manual tagging is unreliable; IaC-enforced tags are the only sustainable approach.

threat:
  - "Unallocated cloud spend making workload cost ownership impossible"
  - "Budget overruns not attributable to specific teams"

regulatory_mapping:
  - framework: "FinOps Foundation"
    controls:
      - "Inform Phase – Cost Allocation and Showback"

implementation_guidance:
  - "Define a mandatory tag taxonomy: cost-center, owner, environment, workload."
  - "Use a shared Terraform module to output the complete tag map."
  - "Enforce tagging in CI/CD with wafpass --fail-on critical."

maturity_levels:
  level_1:
    description: "Ad-hoc tagging, no standard taxonomy"
    criteria:
      - "Some resources are tagged but no consistent taxonomy exists"
  level_2:
    description: "Taxonomy documented, manual tagging"
    criteria:
      - "Mandatory tag taxonomy is documented and version-controlled"
  level_3:
    description: "IaC-enforced with CI gate"
    criteria:
      - "Shared mandatory-tags module is used by all IaC deployments"
      - "CI pipeline checks tag compliance on every PR"
  level_4:
    description: "Automated remediation and chargeback"
    criteria:
      - "Automated remediation tags untagged resources within 24 hours"
  level_5:
    description: "Full cost allocation with automated attribution"
    criteria:
      - "100% cost allocation to workloads and teams"

evidence:
  required:
    - kind: "governance"
      description: "Tag taxonomy document (version-controlled)."
    - kind: "iac"
      description: "Shared mandatory-tags Terraform module."
  optional:
    - kind: "process"
      description: "Monthly tagging compliance report."

checks:
  - id: "waf-cost-010.tf.aws.compute-mandatory-tags"
    engine: "terraform"
    provider: "aws"
    automated: true
    severity: "high"
    title: "AWS resources must have all mandatory cost allocation tags"
    description: >
      Compute and data resources must carry cost-center, owner, environment, and workload tags.
    scope:
      block_type: "resource"
      resource_types:
        - "aws_instance"
        - "aws_s3_bucket"
        - "aws_lambda_function"
    assertions:
      - attribute: "tags"
        op: "key_exists"
        key: "cost-center"
        message: "Resource is missing the mandatory 'cost-center' tag."
      - attribute: "tags"
        op: "key_exists"
        key: "owner"
        message: "Resource is missing the mandatory 'owner' tag."
      - attribute: "tags"
        op: "key_exists"
        key: "environment"
        message: "Resource is missing the mandatory 'environment' tag."
      - attribute: "tags"
        op: "key_exists"
        key: "workload"
        message: "Resource is missing the mandatory 'workload' tag."
    on_fail: "violation"
    remediation: >
      Use the shared mandatory-tags module. Set tags = module.tags.tags on every resource.
    example:
      compliant: |
        resource "aws_instance" "app" {
          ami           = data.aws_ami.ubuntu.id
          instance_type = "t3.medium"
          tags = {
            cost-center = "fintech-platform"
            owner       = "payments-team"
            environment = "production"
            workload    = "payment-service"
          }
        }
      non_compliant: |
        resource "aws_instance" "app" {
          ami           = data.aws_ami.ubuntu.id
          instance_type = "t3.medium"
          tags = {
            Name = "payment-app"
            # Missing: cost-center, owner, environment, workload
          }
        }

references:
  narrative: "modules/pillar-cost/pages/controls.adoc#WAF-COST-010"
  best_practice: "modules/pillar-cost/pages/best-practices/bp-tagging.adoc"
  related_controls:
    - "WAF-COST-020"
    - "WAF-COST-030"