Wombat

WAF-PERF-010 – Compute Instance Type & Sizing Validated

Säule: Efficiancy | Schweregrad: Hoch | Kategorie: Container Security | Automatisierbar: High

Beschreibung

All compute resources (virtual machines, container workloads, managed compute services) MUST be sized based on measured workload requirements and validated performance baselines. Instance type selection MUST be documented in architecture records or sizing sheets. Oversized resources (utilization < 20% sustained) and undersized resources (sustained CPU/memory > 80% for non-autoscaling workloads) MUST be flagged and reviewed on a quarterly basis.

Begründung

Risiko Beschreibung

Risk

Outdated or wrongly sized compute instances waste cost and miss performance targets.

Risk

Missing SKU reviews lead to resources that are neither efficient nor resilient.

Anforderungen

  • All compute resources (virtual machines, container workloads, managed compute services) MUST be sized based on measured workload requirements and validated performance baselines.

  • Instance type selection MUST be documented in architecture records or sizing sheets.

  • Oversized resources (utilization < 20% sustained) and undersized resources (sustained CPU/memory > 80% for non-autoscaling workloads) MUST be flagged and reviewed on a quarterly basis.

Implementierungsleitfaden

  1. Document the requirement in a version-controlled policy or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Reifegrade

Level Name Kriterien

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-perf-010.tf.aws.ec2-current-generation

Engine: terraform | Provider: aws | Automated: Ja

AWS EC2 instances must use current-generation instance types

EC2 instances must not use previous-generation instance types (t2, m4, c4, r4, i2, d2, etc.). Current-generation instance types provide significantly better price-performance. All instances must be documented with a sizing rationale.

Scope: resource — aws_instance, aws_launch_template, aws_launch_configuration

Assertions: * instance_type not matches pattern ^(t2|m4|c4|r4|i2|d2|hs1|m3|c3|cr1|cc2|g2|hi1)\\..* — Instance is using a previous-generation type. Migrate to t3/t4g, m5/m6i, c5/c6i, or r5/r6i. * instance_type attribute exists — Instance type must be explicitly declared; no default allowed.

Remediation: Replace previous-generation instance types with current-generation equivalents. t2.* → t3.* or t4g.; m4. → m6i.; c4. → c6i.; r4. → r6i.*. Run AWS Compute Optimizer to get right-sizing recommendations before migrating.

Compliant
resource "aws_instance" "app" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.medium"  # Current-generation, validated with Compute Optimizer
  tags = {
    sizing-reviewed = "2026-01-15"
    workload        = "payment-api"
  }
}
Non-Compliant
resource "aws_instance" "app" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t2.medium"  # Previous-generation – WAF-PERF-010 violation
}

waf-perf-010.tf.azurerm.vm-sizing-documented

Engine: terraform | Provider: azurerm | Automated: Ja

Azure VMs must use current-generation sizes and have sizing metadata

Azure virtual machines must not use deprecated or previous-generation VM sizes. Sizing metadata must be present as tags on the resource.

Scope: resource — azurerm_linux_virtual_machine, azurerm_windows_virtual_machine, azurerm_virtual_machine_scale_set

Assertions: * size not matches pattern ^Standard_(A|D1$|D2$|D3$|D4$|DS1$|DS2$|DS3$|DS4$)$ — VM is using a deprecated or previous-generation size. Upgrade to Dv5 or Ev5 series. * tags key exists — VM must have a 'sizing-reviewed' tag with the date of the last sizing review.

Remediation: Replace deprecated VM sizes with current-generation equivalents (Dv5, Ev5, Bsv2, Dsv5). Use Azure Advisor recommendations for right-sizing guidance. Add a 'sizing-reviewed' tag with the review date.

Compliant
resource "azurerm_linux_virtual_machine" "app" {
  name                = "vm-payment-api"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  size                = "Standard_D2s_v5"
  tags = {
    sizing-reviewed = "2026-01-15"
    workload        = "payment-api"
  }
}
Non-Compliant
resource "azurerm_linux_virtual_machine" "app" {
  name                = "vm-payment-api"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  size                = "Standard_D2"  # Deprecated size – WAF-PERF-010 violation
}

waf-perf-010.tf.google.gce-machine-type-validated

Engine: terraform | Provider: google | Automated: Ja

GCP Compute Engine instances must use N2 or C2 series machine types

GCP VM instances must not use first-generation N1 machine types for production workloads. N2, N2D, C2, E2, or C3 series offer better performance and price-performance ratios.

Scope: resource — google_compute_instance, google_compute_instance_template

Assertions: * machine_type not matches pattern ^n1-(standard|highmem|highcpu)-.* — GCP instance uses N1 machine type. Migrate to N2, N2D, C2, or E2 series for better performance.

Remediation: Replace N1 machine types with current-generation equivalents. n1-standard-* → n2-standard-; n1-highmem- → n2-highmem-; n1-highcpu- → c2-standard-*. Use GCP Recommender for right-sizing analysis.

Compliant
resource "google_compute_instance" "app" {
  name         = "payment-api"
  machine_type = "n2-standard-2"
  zone         = "europe-west3-a"
  boot_disk {
    initialize_params { image = "debian-cloud/debian-11" }
  }
}
Non-Compliant
resource "google_compute_instance" "app" {
  name         = "payment-api"
  machine_type = "n1-standard-2"  # N1 series – WAF-PERF-010 violation
  zone         = "europe-west3-a"
}

waf-perf-010.tf.stackit.performance-slo-defined

Engine: terraform | Provider: stackit | Automated: Ja

All compute resources (virtual machines, container workloads, managed…​ for stackit

All compute resources (virtual machines, container workloads, managed…​ must be documented in IaC via a performance-slo-defined tag/label on stackit_project. This validates the control is tracked as code.

Scope: resource — stackit_project

Assertions: * labels key exists — stackit_project is missing the performance-slo-defined tag/label.

Remediation: Add a performance-slo-defined tag/label to the stackit_project resource to show the stackit implementation of WAF-PERF-010 is tracked in IaC.

Compliant
resource "stackit_project" "example" {
  labels = {
    performance-slo-defined = "true"
  }
}
Non-Compliant
resource "stackit_project" "example" {
  # Missing performance-slo-defined labels
}

waf-perf-010.tf.ovh.performance-slo-defined

Engine: terraform | Provider: ovh | Automated: Ja

All compute resources (virtual machines, container workloads, managed…​ for ovh

All compute resources (virtual machines, container workloads, managed…​ must be documented in IaC via a performance-slo-defined tag/label on ovh_cloud_project. This validates the control is tracked as code.

Scope: resource — ovh_cloud_project

Assertions: * tags key exists — ovh_cloud_project is missing the performance-slo-defined tag/label.

Remediation: Add a performance-slo-defined tag/label to the ovh_cloud_project resource to show the ovh implementation of WAF-PERF-010 is tracked in IaC.

Compliant
resource "ovh_cloud_project" "example" {
  tags = {
    performance-slo-defined = "true"
  }
}
Non-Compliant
resource "ovh_cloud_project" "example" {
  # Missing performance-slo-defined tags
}

waf-perf-010.tf.hcloud.performance-slo-defined

Engine: terraform | Provider: hcloud | Automated: Ja

All compute resources (virtual machines, container workloads, managed…​ for hcloud

All compute resources (virtual machines, container workloads, managed…​ must be documented in IaC via a performance-slo-defined tag/label on hcloud_server. This validates the control is tracked as code.

Scope: resource — hcloud_server

Assertions: * labels key exists — hcloud_server is missing the performance-slo-defined tag/label.

Remediation: Add a performance-slo-defined tag/label to the hcloud_server resource to show the hcloud implementation of WAF-PERF-010 is tracked in IaC.

Compliant
resource "hcloud_server" "example" {
  labels = {
    performance-slo-defined = "true"
  }
}
Non-Compliant
resource "hcloud_server" "example" {
  # Missing performance-slo-defined labels
}

Evidenz

Art Erforderlich Beschreibung

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Verwandte Controls

Framework Controls

ISO/IEC 25010

* Performance Efficiency – Time Behavior * Performance Efficiency – Resource Utilization * Performance Efficiency – Capacity