Wombat

WAF-COST-060 – FinOps Review Cadence

Säule: Cost | Schweregrad: Mittel | Kategorie: Cost Governance | Automatisierbar: High

Beschreibung

Monthly engineering-level FinOps reviews MUST take place for all production workloads. Quarterly Architecture Board reviews covering cost debt and strategic cost decisions MUST occur. Review outputs (action items with owner and due date) MUST be documented in writing and accessible in the team’s task tracking system. Reviews are mandatory, not optional – absence of reviews is a control failure.

Begründung

Risiko Beschreibung

Risk

Uncontrolled cloud spend erodes budget and project viability.

Risk

High lock-in or debt decisions are made without financial impact visibility.

Anforderungen

  • Monthly engineering-level FinOps reviews MUST take place for all production workloads.

  • Quarterly Architecture Board reviews covering cost debt and strategic cost decisions MUST occur.

  • Review outputs (action items with owner and due date) MUST be documented in writing and accessible in the team’s task tracking system.

Implementierungsleitfaden

  1. Document the requirement in a version-controlled policy or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

Reifegrade

Level Name Kriterien

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-cost-060.tf.any.finops-review-tag-current

Engine: terraform | Provider: any | Automated: Ja

Workload resources should have current 'last-finops-review' tag

Workload infrastructure resources should carry a 'last-finops-review' tag with the date (YYYY-MM-DD) of the last FinOps review. A stale review tag (> 45 days old) indicates the review cadence is not being maintained. This tag is a lightweight operational proof of an active review process.

Scope: resource — aws_instance, aws_eks_cluster, aws_rds_cluster, azurerm_kubernetes_cluster, azurerm_virtual_machine_scale_set, google_container_cluster, stackit_project, ovh_cloud_project, hcloud_server

Assertions: * tags key exists — Resource is missing 'last-finops-review' tag. Monthly FinOps reviews required.

Remediation: After each monthly FinOps review, update the 'last-finops-review' tag on workload resources to the current date. This can be automated in CI as part of the review process. Value format: YYYY-MM-DD.

Compliant
resource "aws_eks_cluster" "main" {
  name     = "payment-service-prod"
  role_arn = aws_iam_role.eks.arn

  tags = merge(module.mandatory_tags.tags, {
    last-finops-review   = "2025-03-01"
    rightsizing-reviewed = "2025-03-01"
  })

  version = "1.29"
}
Non-Compliant
resource "aws_eks_cluster" "main" {
  name     = "payment-service-prod"
  role_arn = aws_iam_role.eks.arn
  # Missing last-finops-review tag – no evidence of review process
}

waf-cost-060.config.any.cost-governance

Engine: config | Provider: any | Automated: Ja

Cost Debt Register file must exist in repository

A version-controlled policy document must exist at docs/cost/waf-cost-060-cost-governance.md and document the provider-agnostic implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/cost/waf-cost-060-cost-governance.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/cost/waf-cost-060-cost-governance.md must contain a normative requirement statement.

Remediation: Create or update docs/cost/waf-cost-060-cost-governance.md. State the requirement, how it is implemented for provider-agnostic, the review cadence, and the owner.

Compliant
docs/cost/waf-cost-060-cost-governance.md:
- The provider-agnostic implementation of WAF-COST-060 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).
Non-Compliant
# `docs/cost/waf-cost-060-cost-governance.md` is missing or does not contain a normative requirement.
# WAF-COST-060 violation: provider-agnostic control is not documented

waf-cost-060.config.azurerm.finops-review-cadence

Engine: config | Provider: azurerm | Automated: Ja

Azure-specific FinOps review cadence policy must exist

A version-controlled policy document must exist at docs/cost/waf-cost-060-azure-finops-review-cadence.md and document how Azure production workloads receive monthly engineering-level FinOps reviews and quarterly Architecture Board cost debt reviews.

Scope: file — docs/cost/waf-cost-060-azure-finops-review-cadence.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/cost/waf-cost-060-azure-finops-review-cadence.md must contain a normative requirement statement.

Remediation: Create or update docs/cost/waf-cost-060-azure-finops-review-cadence.md. Define monthly review schedule, attendees, required outputs (action items with owner and due date), and quarterly Architecture Board review entry.

Compliant
docs/cost/waf-cost-060-azure-finops-review-cadence.md:
- Azure workloads MUST be reviewed monthly by the engineering team.
- Architecture Board reviews cost debt quarterly.
- Action items have owner and due date recorded in the task tracker.
Non-Compliant
# `docs/cost/waf-cost-060-azure-finops-review-cadence.md` is missing or does not contain a normative requirement.
# WAF-COST-060 violation: Azure FinOps review cadence is not documented

waf-cost-060.config.google.finops-review-cadence

Engine: config | Provider: google | Automated: Ja

GCP-specific FinOps review cadence policy must exist

A version-controlled policy document must exist at docs/cost/waf-cost-060-gcp-finops-review-cadence.md and document how GCP production workloads receive monthly engineering-level FinOps reviews and quarterly Architecture Board cost debt reviews.

Scope: file — docs/cost/waf-cost-060-gcp-finops-review-cadence.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/cost/waf-cost-060-gcp-finops-review-cadence.md must contain a normative requirement statement.

Remediation: Create or update docs/cost/waf-cost-060-gcp-finops-review-cadence.md. Define monthly review schedule, attendees, required outputs (action items with owner and due date), and quarterly Architecture Board review entry.

Compliant
docs/cost/waf-cost-060-gcp-finops-review-cadence.md:
- GCP workloads MUST be reviewed monthly by the engineering team.
- Architecture Board reviews cost debt quarterly.
- Action items have owner and due date recorded in the task tracker.
Non-Compliant
# `docs/cost/waf-cost-060-gcp-finops-review-cadence.md` is missing or does not contain a normative requirement.
# WAF-COST-060 violation: GCP FinOps review cadence is not documented

waf-cost-060.tf.stackit.finops-review-tag

Engine: terraform | Provider: stackit | Automated: Ja

STACKIT resources must carry a current FinOps review tag

STACKIT resources must carry a current FinOps review tag. This check validates the Terraform configuration uses the expected resource and attribute.

Scope: resource — stackit_server, stackit_ske_cluster, stackit_ske_node_pool, stackit_object_storage_bucket

Assertions: * labels.finops-review key exists — STACKIT resource is missing the 'finops-review' label.

Remediation: Review the Terraform configuration for the listed resource types and ensure the required attribute or tag is present. See the control narrative for provider-specific guidance.

Compliant
# Example resource meets the requirement.
resource "stackit_server" "example" {
  # required attribute/tag/label present
}
Non-Compliant
# Example resource does not meet the requirement.
resource "stackit_server" "example" {
  # Missing required attribute/tag/label
}

waf-cost-060.tf.ovh.finops-review-tag

Engine: terraform | Provider: ovh | Automated: Ja

OVHcloud resources must carry a current FinOps review tag

OVHcloud resources must carry a current FinOps review tag. This check validates the Terraform configuration uses the expected resource and attribute.

Scope: resource — ovh_cloud_project_instance, ovh_vps, ovh_dedicated_server, ovh_cloud_project_kube, ovh_cloud_project_kube_nodepool

Assertions: * tags.finops-review key exists — OVHcloud resource is missing the 'finops-review' tag.

Remediation: Review the Terraform configuration for the listed resource types and ensure the required attribute or tag is present. See the control narrative for provider-specific guidance.

Compliant
# Example resource meets the requirement.
resource "ovh_cloud_project_instance" "example" {
  # required attribute/tag/label present
}
Non-Compliant
# Example resource does not meet the requirement.
resource "ovh_cloud_project_instance" "example" {
  # Missing required attribute/tag/label
}

waf-cost-060.tf.hcloud.finops-review-tag

Engine: terraform | Provider: hcloud | Automated: Ja

Hetzner Cloud resources must carry a current FinOps review tag

Hetzner Cloud resources must carry a current FinOps review tag. This check validates the Terraform configuration uses the expected resource and attribute.

Scope: resource — hcloud_server, hcloud_volume, hcloud_load_balancer

Assertions: * labels.finops-review key exists — Hetzner Cloud resource is missing the 'finops-review' label.

Remediation: Review the Terraform configuration for the listed resource types and ensure the required attribute or tag is present. See the control narrative for provider-specific guidance.

Compliant
# Example resource meets the requirement.
resource "hcloud_server" "example" {
  # required attribute/tag/label present
}
Non-Compliant
# Example resource does not meet the requirement.
resource "hcloud_server" "example" {
  # Missing required attribute/tag/label
}

Evidenz

Art Erforderlich Beschreibung

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Verwandte Controls

Framework Controls

FinOps Foundation

* Operate Phase – Review Cadence and Continuous Improvement * FinOps Principles – Teams Need Timely and Accurate Data