Controls (WAF-PERF)

Severity: High | Category: Compute Sizing | Automatable: High

Intent: Instance types must be chosen based on measured utilization data, not intuition or fear of under-provisioning.

Requirement: All compute resources MUST use current instance generations. Sizing decisions MUST be backed by measured CPU/memory baselines. Over- and under-provisioned resources MUST be reviewed quarterly.

Terraform Checks (excerpt):

Evidence:

Best Practice: Compute Sizing & Instance Selection →

Severity: High | Category: Auto-Scaling | Automatable: High

Intent: Static capacity is the wrong model for variable load. Auto-scaling must not only be configured, but validated under load.

Requirement: All stateless production workloads MUST have auto-scaling configured. Scaling metrics MUST be based on application behavior. Scaling configuration MUST be validated through load tests.

Terraform Checks (excerpt):

Evidence:

Best Practice: Configure Auto-Scaling →

Severity: Medium | Category: Caching | Automatable: Medium

Intent: Caching without a strategy creates inconsistency. Caching without measurement creates false confidence.

Requirement: A documented caching strategy MUST exist for all read-heavy workloads. Distributed cache MUST be used for session data and high-frequency lookups. CDN MUST be configured for all public static content.

Terraform Checks (excerpt):

Evidence:

Best Practice: Implement Caching Strategy →

Severity: High | Category: Database Performance | Automatable: High

Intent: Missing indexes are the most common cause of database performance problems. Slow query logs are the most important diagnostic tool.

Requirement: Performance Insights MUST be active on all production databases. Slow query logging MUST be enabled and reviewed monthly. An index strategy MUST be documented for all high-frequency queries.

Terraform Checks (excerpt):

Evidence:

Best Practice: Optimize Database Performance →

Severity: High | Category: Observability | Automatable: Medium–High

Intent: Without SLOs there is no objective criterion for "good enough". Without error budgets there is no objective criterion for "stop, we need to stabilize".

Requirement: All production services MUST have SLOs with P95/P99 latency targets, error rate, and availability. SLIs MUST be continuously instrumented and measured. SLO burn rate alerting MUST be configured.

Terraform Checks (excerpt):

Evidence:

Best Practice: Performance Observability & SLOs →

Severity: Medium | Category: Load Testing | Automatable: Medium

Intent: Every untested scaling configuration is an untested safety net. Performance regressions must be taken as seriously as functional bugs.

Requirement: Load tests MUST be automatically executed as a deployment gate in the CI/CD pipeline. Acceptance criteria MUST be defined before the load test. Performance regressions (>10% P99 increase) MUST be automatically detected.

Terraform Checks (excerpt):

Evidence:

Best Practice: Load & Stress Testing →

Severity: Medium | Category: Network Performance | Automatable: Medium

Intent: Network latency is cumulative. Every cross-AZ hop, every internet round-trip to a cloud service, every CDN miss adds to the user response time.

Requirement: CDN MUST be configured for all public static and cacheable content. VPC endpoints MUST be used for all cloud service API access from private subnets. Cross-AZ traffic in latency-sensitive paths MUST be minimized.

Terraform Checks (excerpt):

Evidence:

Best Practice: Optimize Network Performance →

Severity: Low | Category: Compute Architecture | Automatable: Medium

Intent: Serverless architectures are often the most cost-efficient and performant solution for variable load – but only when correctly configured.

Requirement: Variable load workloads SHOULD be evaluated for serverless suitability. Lambda/functions MUST have explicitly configured memory, timeout, and concurrency. Cold start mitigation MUST be evaluated for latency-sensitive functions.

Terraform Checks (excerpt):

Evidence:

Best Practice: Auto-Scaling & Serverless →

Severity: Medium | Category: Storage Performance | Automatable: High

Intent: Storage I/O is the most commonly invisible bottleneck. gp2 burst exhaustion and wrong disk type are frequent causes of unexplained latency spikes.

Requirement: All new EBS volumes MUST use gp3 instead of gp2. Storage type MUST match the workload (Premium SSD for databases, HDD for archives). IOPS and throughput MUST be explicitly configured. Storage I/O alerts MUST be configured.

Terraform Checks (excerpt):

Evidence:

Severity: Medium | Category: Performance Governance | Automatable: Low

Intent: Undocumented performance debt accumulates unnoticed. Documented performance debt can be prioritized and reduced.

Requirement: A performance debt register MUST be maintained with ID, description, impact, owner, and priority. Quarterly reviews MUST take place. Every performance incident MUST create a register entry.

Terraform Checks (excerpt):

Evidence: