Wombat

WAF-COST-100 – Architectural Cost Debt Register & Quarterly Review

Säule: Cost | Schweregrad: Mittel | Kategorie: Cost Governance | Automatisierbar: High

Beschreibung

A structured Cost Debt Register MUST exist as a version-controlled file in the repository. Each entry MUST document: unique ID, title, description, owner (team), estimated annual impact (EUR), detection date, target resolution date, status (monitoring/paydown/accepted), and either a paydown plan or a documented acceptance rationale. A quarterly Architecture Board review entry covering cost debt status MUST exist for the current quarter. This control governs the ongoing management of Architectural Cost Debt.

Begründung

Risiko Beschreibung

Risk

Uncontrolled cloud spend erodes budget and project viability.

Risk

High lock-in or debt decisions are made without financial impact visibility.

Anforderungen

  • A structured Cost Debt Register MUST exist as a version-controlled file in the repository.

  • Each entry MUST document: unique ID, title, description, owner (team), estimated annual impact (EUR), detection date, target resolution date, status (monitoring/paydown/accepted), and either a paydown plan or a documented acceptance rationale.

  • A quarterly Architecture Board review entry covering cost debt status MUST exist for the current quarter.

Implementierungsleitfaden

  1. Document the requirement in a version-controlled policy or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

Reifegrade

Level Name Kriterien

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-cost-100.config.any.cost-governance

Engine: config | Provider: any | Automated: Ja

Cost Debt Register file must exist in repository

A version-controlled policy document must exist at docs/cost/waf-cost-100-cost-governance.md and document the provider-agnostic implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/cost/waf-cost-100-cost-governance.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/cost/waf-cost-100-cost-governance.md must contain a normative requirement statement.

Remediation: Create or update docs/cost/waf-cost-100-cost-governance.md. State the requirement, how it is implemented for provider-agnostic, the review cadence, and the owner.

Compliant
docs/cost/waf-cost-100-cost-governance.md:
- The provider-agnostic implementation of WAF-COST-100 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).
Non-Compliant
# `docs/cost/waf-cost-100-cost-governance.md` is missing or does not contain a normative requirement.
# WAF-COST-100 violation: provider-agnostic control is not documented

waf-cost-100.config.azurerm.cost-debt-register

Engine: config | Provider: azurerm | Automated: Ja

Azure-specific Cost Debt Register must exist

A version-controlled register must exist at docs/cost/waf-cost-100-azure-cost-debt-register.md documenting Azure-specific cost debt items with ID, title, description, owner, estimated annual impact, detection date, target resolution date, status, and paydown plan or acceptance rationale.

Scope: file — docs/cost/waf-cost-100-azure-cost-debt-register.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/cost/waf-cost-100-azure-cost-debt-register.md must contain a normative requirement statement.

Remediation: Create or update docs/cost/waf-cost-100-azure-cost-debt-register.md. Record each Azure cost debt item, its owner, financial impact, target date, and paydown/acceptance rationale. Add a quarterly Architecture Board review entry for the current quarter.

Compliant
docs/cost/waf-cost-100-azure-cost-debt-register.md:
- Azure cost debt items have unique IDs, owners, and target resolution dates.
- Quarterly Architecture Board review entry exists for the current quarter.
- Status is monitoring, paydown, or accepted with rationale.
Non-Compliant
# `docs/cost/waf-cost-100-azure-cost-debt-register.md` is missing or does not contain a normative requirement.
# WAF-COST-100 violation: Azure Cost Debt Register is not documented

waf-cost-100.config.google.cost-debt-register

Engine: config | Provider: google | Automated: Ja

GCP-specific Cost Debt Register must exist

A version-controlled register must exist at docs/cost/waf-cost-100-gcp-cost-debt-register.md documenting GCP-specific cost debt items with ID, title, description, owner, estimated annual impact, detection date, target resolution date, status, and paydown plan or acceptance rationale.

Scope: file — docs/cost/waf-cost-100-gcp-cost-debt-register.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/cost/waf-cost-100-gcp-cost-debt-register.md must contain a normative requirement statement.

Remediation: Create or update docs/cost/waf-cost-100-gcp-cost-debt-register.md. Record each GCP cost debt item, its owner, financial impact, target date, and paydown/acceptance rationale. Add a quarterly Architecture Board review entry for the current quarter.

Compliant
docs/cost/waf-cost-100-gcp-cost-debt-register.md:
- GCP cost debt items have unique IDs, owners, and target resolution dates.
- Quarterly Architecture Board review entry exists for the current quarter.
- Status is monitoring, paydown, or accepted with rationale.
Non-Compliant
# `docs/cost/waf-cost-100-gcp-cost-debt-register.md` is missing or does not contain a normative requirement.
# WAF-COST-100 violation: GCP Cost Debt Register is not documented

waf-cost-100.config.any.quarterly-review-entry

Engine: config | Provider: any | Automated: Ja

Quarterly Architecture Board review entry must exist for current quarter

A version-controlled policy document must exist at docs/cost/waf-cost-100-cost-governance.md and document the provider-agnostic implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/cost/waf-cost-100-cost-governance.md

Assertions: * content matches pattern (?i)MUST|SHALL|required|mandatory|enforced|documented — Policy file docs/cost/waf-cost-100-cost-governance.md must contain a normative requirement statement.

Remediation: Create or update docs/cost/waf-cost-100-cost-governance.md. State the requirement, how it is implemented for provider-agnostic, the review cadence, and the owner.

Compliant
docs/cost/waf-cost-100-cost-governance.md:
- The provider-agnostic implementation of WAF-COST-100 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).
Non-Compliant
# `docs/cost/waf-cost-100-cost-governance.md` is missing or does not contain a normative requirement.
# WAF-COST-100 violation: provider-agnostic control is not documented

Evidenz

Art Erforderlich Beschreibung

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Verwandte Controls

Framework Controls

FinOps Foundation

* Operate Phase – Cost Governance and Accountability * FinOps Principles – A FinOps Practice is About More Than Saving Money