Wombat

WAF-COST-050 – Cost Impact Assessment in Architecture Decision Records

Säule: Cost | Schweregrad: Hoch | Kategorie: Cost Governance | Automatisierbar: High

Beschreibung

Every Architecture Decision Record (ADR) covering infrastructure changes MUST include a structured Cost Impact Assessment section. The assessment MUST cover: TCO estimate (EUR/year), lock-in risk score (1-5), data transfer cost estimate, operational effort (FTE/year), exit cost estimate, and 3-year NPV. ADRs with lock-in risk score >= 4 require Architecture Board approval before implementation. This control is the primary prevention mechanism for Architectural Cost Debt.

Begründung

Risiko Beschreibung

Risk

Architecture decisions without cost consideration lead to lock-in and unaccountable spending.

Risk

Missing lock-in assessment complicates future contract negotiations and cloud migration.

Anforderungen

  • Every Architecture Decision Record (ADR) covering infrastructure changes MUST include a structured Cost Impact Assessment section.

  • The assessment MUST cover: TCO estimate (EUR/year), lock-in risk score (1-5), data transfer cost estimate, operational effort (FTE/year), exit cost estimate, and 3-year NPV.

Implementierungsleitfaden

  1. Document the requirement in a version-controlled policy or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

Reifegrade

Level Name Kriterien

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-cost-050.tf.any.high-lockin-resource-tagged

Engine: terraform | Provider: any | Automated: Ja

High lock-in resources must be tagged with lock-in risk score

Resources from services with inherently high vendor lock-in (proprietary streaming, proprietary database services, complex managed services) should be tagged with 'lock-in-risk' to document that the lock-in was consciously evaluated. This check validates that the tag exists on known high-lock-in resource types.

Scope: resource — aws_kinesis_stream, aws_kinesis_firehose_delivery_stream, aws_redshift_cluster, aws_neptune_cluster, aws_msk_cluster, azurerm_service_bus_namespace, azurerm_eventhub_namespace, azurerm_synapse_workspace, google_spanner_instance, google_bigquery_dataset, stackit_opensearch_instance, stackit_redis_instance, stackit_mysql_instance, ovh_dedicated_server, hcloud_server

Assertions: * tags key exists — High lock-in resource must have 'lock-in-risk' tag (value: 1-5) documenting conscious evaluation.

Remediation: Add 'lock-in-risk' tag (value: 1-5) to document that vendor lock-in was consciously evaluated. Tag value 4 or 5 requires an ADR with Architecture Board approval. See docs/adr/ for the ADR template with Cost Impact Assessment section.

Compliant
resource "aws_kinesis_stream" "events" {
  name        = "payment-events"
  shard_count = 4

  tags = merge(module.mandatory_tags.tags, {
    lock-in-risk = "4"  # High lock-in; ADR-0042 documents cost impact assessment
    adr-reference = "ADR-0042"
  })
}
Non-Compliant
resource "aws_kinesis_stream" "events" {
  name        = "payment-events"
  shard_count = 4
  tags = {
    cost-center = "data-team"
    # Missing lock-in-risk tag – no evidence of lock-in evaluation
  }
}

waf-cost-050.config.any.cost-governance

Engine: config | Provider: any | Automated: Ja

ADR documents must include Cost Impact Assessment section

A version-controlled policy document must exist at docs/cost/waf-cost-050-cost-governance.md and document the provider-agnostic implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/cost/waf-cost-050-cost-governance.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/cost/waf-cost-050-cost-governance.md must contain a normative requirement statement.

Remediation: Create or update docs/cost/waf-cost-050-cost-governance.md. State the requirement, how it is implemented for provider-agnostic, the review cadence, and the owner.

Compliant
docs/cost/waf-cost-050-cost-governance.md:
- The provider-agnostic implementation of WAF-COST-050 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).
Non-Compliant
# `docs/cost/waf-cost-050-cost-governance.md` is missing or does not contain a normative requirement.
# WAF-COST-050 violation: provider-agnostic control is not documented

waf-cost-050.config.azurerm.cost-impact-assessment

Engine: config | Provider: azurerm | Automated: Ja

Azure-specific Cost Impact Assessment policy must exist

A version-controlled policy document must exist at docs/cost/waf-cost-050-azure-cost-impact-assessment.md and document how Azure-specific ADRs implement the Cost Impact Assessment requirement.

Scope: file — docs/cost/waf-cost-050-azure-cost-impact-assessment.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/cost/waf-cost-050-azure-cost-impact-assessment.md must contain a normative requirement statement.

Remediation: Create or update docs/cost/waf-cost-050-azure-cost-impact-assessment.md. Include TCO estimate (EUR/year), lock-in risk score (1-5), data transfer cost estimate, operational effort (FTE/year), exit cost estimate, and 3-year NPV. Lock-in risk >= 4 requires Architecture Board approval.

Compliant
docs/cost/waf-cost-050-azure-cost-impact-assessment.md:
- Azure ADRs MUST include Cost Impact Assessment section.
- Lock-in risk >= 4 requires Architecture Board approval.
- Owner and review cadence are documented.
Non-Compliant
# `docs/cost/waf-cost-050-azure-cost-impact-assessment.md` is missing or does not contain a normative requirement.
# WAF-COST-050 violation: Azure Cost Impact Assessment policy is not documented

waf-cost-050.config.google.cost-impact-assessment

Engine: config | Provider: google | Automated: Ja

GCP-specific Cost Impact Assessment policy must exist

A version-controlled policy document must exist at docs/cost/waf-cost-050-gcp-cost-impact-assessment.md and document how GCP-specific ADRs implement the Cost Impact Assessment requirement.

Scope: file — docs/cost/waf-cost-050-gcp-cost-impact-assessment.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/cost/waf-cost-050-gcp-cost-impact-assessment.md must contain a normative requirement statement.

Remediation: Create or update docs/cost/waf-cost-050-gcp-cost-impact-assessment.md. Include TCO estimate (EUR/year), lock-in risk score (1-5), data transfer cost estimate, operational effort (FTE/year), exit cost estimate, and 3-year NPV. Lock-in risk >= 4 requires Architecture Board approval.

Compliant
docs/cost/waf-cost-050-gcp-cost-impact-assessment.md:
- GCP ADRs MUST include Cost Impact Assessment section.
- Lock-in risk >= 4 requires Architecture Board approval.
- Owner and review cadence are documented.
Non-Compliant
# `docs/cost/waf-cost-050-gcp-cost-impact-assessment.md` is missing or does not contain a normative requirement.
# WAF-COST-050 violation: GCP Cost Impact Assessment policy is not documented

waf-cost-050.tf.stackit.cost-impact-assessment

Engine: terraform | Provider: stackit | Automated: Ja

Every Architecture Decision Record (ADR) covering infrastructure changes…​ for stackit

Every Architecture Decision Record (ADR) covering infrastructure changes…​ must be documented in IaC via a cost-impact-assessment tag/label on stackit_project. This validates the control is tracked as code.

Scope: resource — stackit_project

Assertions: * labels key exists — stackit_project is missing the cost-impact-assessment tag/label.

Remediation: Add a cost-impact-assessment tag/label to the stackit_project resource to show the stackit implementation of WAF-COST-050 is tracked in IaC.

Compliant
resource "stackit_project" "example" {
  labels = {
    cost-impact-assessment = "true"
  }
}
Non-Compliant
resource "stackit_project" "example" {
  # Missing cost-impact-assessment labels
}

waf-cost-050.tf.ovh.cost-impact-assessment

Engine: terraform | Provider: ovh | Automated: Ja

Every Architecture Decision Record (ADR) covering infrastructure changes…​ for ovh

Every Architecture Decision Record (ADR) covering infrastructure changes…​ must be documented in IaC via a cost-impact-assessment tag/label on ovh_cloud_project. This validates the control is tracked as code.

Scope: resource — ovh_cloud_project

Assertions: * tags key exists — ovh_cloud_project is missing the cost-impact-assessment tag/label.

Remediation: Add a cost-impact-assessment tag/label to the ovh_cloud_project resource to show the ovh implementation of WAF-COST-050 is tracked in IaC.

Compliant
resource "ovh_cloud_project" "example" {
  tags = {
    cost-impact-assessment = "true"
  }
}
Non-Compliant
resource "ovh_cloud_project" "example" {
  # Missing cost-impact-assessment tags
}

waf-cost-050.tf.hcloud.cost-impact-assessment

Engine: terraform | Provider: hcloud | Automated: Ja

Every Architecture Decision Record (ADR) covering infrastructure changes…​ for hcloud

Every Architecture Decision Record (ADR) covering infrastructure changes…​ must be documented in IaC via a cost-impact-assessment tag/label on hcloud_server. This validates the control is tracked as code.

Scope: resource — hcloud_server

Assertions: * labels key exists — hcloud_server is missing the cost-impact-assessment tag/label.

Remediation: Add a cost-impact-assessment tag/label to the hcloud_server resource to show the hcloud implementation of WAF-COST-050 is tracked in IaC.

Compliant
resource "hcloud_server" "example" {
  labels = {
    cost-impact-assessment = "true"
  }
}
Non-Compliant
resource "hcloud_server" "example" {
  # Missing cost-impact-assessment labels
}

Evidenz

Art Erforderlich Beschreibung

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Verwandte Controls

Framework Controls

FinOps Foundation

* Operate Phase – Architecture and Cost Governance * FinOps Principles – Everyone Takes Ownership of Their Cloud Usage