Wombat

WAF-COST-030 – Resource Rightsizing & Idle Detection

Säule: Cost | Schweregrad: Mittel | Kategorie: Container Security | Automatisierbar: High

Beschreibung

All persistent compute resources (EC2 instances, VMs, RDS instances, Kubernetes node groups) MUST carry a 'rightsizing-reviewed' tag with the date of the last review (ISO 8601, YYYY-MM-DD). Reviews must be performed at least every 90 days. Resources tagged with a review date older than 90 days are considered non-compliant. Idle detection must be configured for all compute workloads (CPU utilization < 5% over 7 days triggers an alert).

Begründung

Risiko Beschreibung

Risk

Unreviewed compute resources permanently lead to over-provisioning and cloud waste.

Risk

Missing rightsizing evidence complicates FinOps reviews and budget accountability.

Anforderungen

  • All persistent compute resources (EC2 instances, VMs, RDS instances, Kubernetes node groups) MUST carry a 'rightsizing-reviewed' tag with the date of the last review (ISO 8601, YYYY-MM-DD).

  • Reviews must be performed at least every 90 days.

  • Idle detection must be configured for all compute workloads (CPU utilization < 5% over 7 days triggers an alert).

Implementierungsleitfaden

  1. Document the requirement in a version-controlled policy or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Reifegrade

Level Name Kriterien

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-cost-030.tf.aws.ec2-rightsizing-tag-required

Engine: terraform | Provider: aws | Automated: Ja

EC2 instances must have 'rightsizing-reviewed' tag

All EC2 instances must carry a 'rightsizing-reviewed' tag with the date (YYYY-MM-DD) of the last rightsizing review. This tag proves active resource management and enables automated detection of resources that have not been reviewed within 90 days.

Scope: resource — aws_instance, aws_launch_template

Assertions: * tags key exists — EC2 instance is missing the 'rightsizing-reviewed' tag. All compute resources must be actively reviewed.

Remediation: Add 'rightsizing-reviewed' tag to all EC2 instances and launch templates. Value format: YYYY-MM-DD (ISO 8601 date of last review). Example: rightsizing-reviewed = "2025-03-01" Schedule the next review within 90 days.

Compliant
resource "aws_instance" "app" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.medium"
  tags = merge(module.mandatory_tags.tags, {
    rightsizing-reviewed = "2025-03-01"
    rightsizing-result   = "no-change"
    capacity-commitment  = "on-demand"
  })
}
Non-Compliant
resource "aws_instance" "app" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.medium"
  tags = {
    cost-center = "fintech-platform"
    owner       = "payments-team"
    environment = "production"
    workload    = "payment-service"
    # Missing: rightsizing-reviewed – WAF-COST-030 violation
  }
}

waf-cost-030.tf.azurerm.vm-rightsizing-tag

Engine: terraform | Provider: azurerm | Automated: Ja

Azure VMs must have 'rightsizing-reviewed' tag

All Azure Virtual Machines must carry a 'rightsizing-reviewed' tag with the ISO 8601 date of the last rightsizing review, proving active management of compute costs.

Scope: resource — azurerm_virtual_machine, azurerm_linux_virtual_machine, azurerm_windows_virtual_machine, azurerm_kubernetes_cluster

Assertions: * tags key exists — Azure VM is missing 'rightsizing-reviewed' tag.

Remediation: Add 'rightsizing-reviewed' tag to all Azure compute resources. Use Azure Advisor recommendations to inform the rightsizing review.

Compliant
resource "azurerm_linux_virtual_machine" "app" {
  name                = "vm-payment-app-prod"
  resource_group_name = azurerm_resource_group.main.name
  location            = var.location
  size                = "Standard_D2s_v3"
  tags = merge(local.mandatory_tags, {
    "rightsizing-reviewed" = "2025-03-01"
    "rightsizing-result"   = "no-change"
  })
}
Non-Compliant
resource "azurerm_linux_virtual_machine" "app" {
  name                = "vm-payment-app-prod"
  resource_group_name = azurerm_resource_group.main.name
  location            = var.location
  size                = "Standard_D8s_v3"  # May be oversized; no review proof
  # Missing: rightsizing-reviewed tag
}

waf-cost-030.tf.google.compute-rightsizing-tag

Engine: terraform | Provider: google | Automated: Ja

GCP compute instances must have 'rightsizing-reviewed' label

All GCP Compute Engine instances and GKE node pools must carry a 'rightsizing-reviewed' label with the ISO 8601 date of the last rightsizing review, proving active management of compute costs.

Scope: resource — google_compute_instance, google_container_node_pool

Assertions: * labels key exists — GCP compute instance is missing 'rightsizing-reviewed' label.

Remediation: Add 'rightsizing-reviewed' label to all google_compute_instance and google_container_node_pool resources. Value format: YYYY-MM-DD. Use GCP Recommender rightsizing insights to inform the review.

Compliant
resource "google_compute_instance" "app" {
  name         = "vm-payment-app-prod"
  machine_type = "e2-medium"
  zone         = var.zone

  labels = merge(module.mandatory_tags.labels, {
    rightsizing-reviewed = "2025-03-01"
    rightsizing-result   = "no-change"
  })
}
Non-Compliant
resource "google_compute_instance" "app" {
  name         = "vm-payment-app-prod"
  machine_type = "e2-standard-8"  # May be oversized; no review proof
  # Missing: rightsizing-reviewed label
}

waf-cost-030.tf.stackit.server-rightsizing-tag

Engine: terraform | Provider: stackit | Automated: Ja

STACKIT compute resources must have a rightsizing-reviewed tag or label

STACKIT compute resources must have a rightsizing-reviewed tag or label. This check validates the Terraform configuration uses the expected resource and attribute.

Scope: resource — stackit_server, stackit_ske_cluster, stackit_ske_node_pool

Assertions: * labels key exists — STACKIT compute resource is missing the 'rightsizing-reviewed' label.

Remediation: Review the Terraform configuration for the listed resource types and ensure the required attribute or tag is present. See the control narrative for provider-specific guidance.

Compliant
# Example resource meets the requirement.
resource "stackit_server" "example" {
  # required attribute/tag/label present
}
Non-Compliant
# Example resource does not meet the requirement.
resource "stackit_server" "example" {
  # Missing required attribute/tag/label
}

waf-cost-030.tf.ovh.instance-rightsizing-tag

Engine: terraform | Provider: ovh | Automated: Ja

OVHcloud compute resources must have a rightsizing-reviewed tag

OVHcloud compute resources must have a rightsizing-reviewed tag. This check validates the Terraform configuration uses the expected resource and attribute.

Scope: resource — ovh_cloud_project_instance, ovh_vps, ovh_dedicated_server, ovh_cloud_project_kube, ovh_cloud_project_kube_nodepool

Assertions: * tags key exists — OVHcloud compute resource is missing the 'rightsizing-reviewed' tag.

Remediation: Review the Terraform configuration for the listed resource types and ensure the required attribute or tag is present. See the control narrative for provider-specific guidance.

Compliant
# Example resource meets the requirement.
resource "ovh_cloud_project_instance" "example" {
  # required attribute/tag/label present
}
Non-Compliant
# Example resource does not meet the requirement.
resource "ovh_cloud_project_instance" "example" {
  # Missing required attribute/tag/label
}

waf-cost-030.tf.hcloud.server-rightsizing-label

Engine: terraform | Provider: hcloud | Automated: Ja

Hetzner Cloud compute resources must have a rightsizing-reviewed label

Hetzner Cloud compute resources must have a rightsizing-reviewed label. This check validates the Terraform configuration uses the expected resource and attribute.

Scope: resource — hcloud_server

Assertions: * labels key exists — Hetzner Cloud server is missing the 'rightsizing-reviewed' label.

Remediation: Review the Terraform configuration for the listed resource types and ensure the required attribute or tag is present. See the control narrative for provider-specific guidance.

Compliant
# Example resource meets the requirement.
resource "hcloud_server" "example" {
  # required attribute/tag/label present
}
Non-Compliant
# Example resource does not meet the requirement.
resource "hcloud_server" "example" {
  # Missing required attribute/tag/label
}

Evidenz

Art Erforderlich Beschreibung

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Verwandte Controls

Framework Controls

FinOps Foundation

* Optimize Phase – Rightsizing and Resource Optimization * Operate Phase – Continuous Resource Review