Wombat

WAF-PERF-030 – Caching Strategy Defined & Implemented

Säule: Efficiancy | Schweregrad: Mittel | Kategorie: Identity Access | Automatisierbar: High

Beschreibung

All workloads with repeated read patterns or high-latency data sources MUST have a caching strategy defined and implemented. The caching strategy MUST specify cache layers (application, distributed cache, CDN), TTL policies, cache invalidation mechanisms, and cache hit rate targets. CDN caching MUST be configured for all public-facing static and dynamic content. Distributed caching solutions (Redis, Memcached, or equivalents) MUST be used for session data and frequently-accessed read-heavy datasets.

Begründung

Risiko Beschreibung

Risk

Internet-facing resources or open management ports become direct attack vectors.

Risk

Lateral movement is easier when network segmentation and access rules are missing.

Anforderungen

  • All workloads with repeated read patterns or high-latency data sources MUST have a caching strategy defined and implemented.

  • The caching strategy MUST specify cache layers (application, distributed cache, CDN), TTL policies, cache invalidation mechanisms, and cache hit rate targets.

  • CDN caching MUST be configured for all public-facing static and dynamic content.

  • Distributed caching solutions (Redis, Memcached, or equivalents) MUST be used for session data and frequently-accessed read-heavy datasets.

Implementierungsleitfaden

  1. Document the requirement in a version-controlled policy or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Reifegrade

Level Name Kriterien

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-perf-030.tf.aws.elasticache-cluster-configured

Engine: terraform | Provider: aws | Automated: Ja

AWS ElastiCache clusters must be in cluster mode with automatic failover

ElastiCache Redis clusters must have cluster mode or multi-AZ with automatic failover enabled to ensure high availability of the caching layer. Single-node ElastiCache deployments in production are a violation.

Scope: resource — aws_elasticache_replication_group, aws_elasticache_cluster

Assertions: * automatic_failover_enabled is true — ElastiCache replication group must have automatic_failover_enabled = true for production use. * num_cache_clusters greater than or equal 2 — ElastiCache must have at least 2 cache nodes for redundancy. * at_rest_encryption_enabled is true — ElastiCache must have at-rest encryption enabled.

Remediation: Set automatic_failover_enabled = true, num_cache_clusters >= 2, and at_rest_encryption_enabled = true. For Redis, use replication_group resource with at least one replica.

Compliant
resource "aws_elasticache_replication_group" "app" {
  replication_group_id       = "payment-cache"
  description                = "Cache for payment service sessions and lookups"
  node_type                  = "cache.t3.medium"
  num_cache_clusters         = 2
  automatic_failover_enabled = true
  at_rest_encryption_enabled = true
  transit_encryption_enabled = true
  subnet_group_name          = aws_elasticache_subnet_group.main.name
  security_group_ids         = [aws_security_group.cache.id]
}
Non-Compliant
resource "aws_elasticache_cluster" "app" {
  cluster_id        = "payment-cache"
  engine            = "redis"
  node_type         = "cache.t3.micro"
  num_cache_nodes   = 1  # Single node, no failover – WAF-PERF-030 violation
  # No encryption configured
}

waf-perf-030.tf.azurerm.redis-cache-premium

Engine: terraform | Provider: azurerm | Automated: Ja

Azure Cache for Redis must be Premium or Standard tier with persistence

Azure Cache for Redis for production use must be Standard or Premium tier with clustering enabled for large datasets and geo-replication where required.

Scope: resource — azurerm_redis_cache

Assertions: * sku_name in ['Standard', 'Premium'] — Azure Redis Cache must use Standard or Premium SKU for production (not Basic). * enable_non_ssl_port is false — Non-SSL port must be disabled on Azure Redis Cache. * minimum_tls_version equals 1.2 — Azure Redis Cache must enforce TLS 1.2 minimum.

Remediation: Upgrade Redis SKU to Standard or Premium. Disable non-SSL port. Set minimum_tls_version = "1.2". For large datasets enable cluster mode (Premium only).

Compliant
resource "azurerm_redis_cache" "app" {
  name                = "cache-payment-api"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  capacity            = 1
  family              = "C"
  sku_name            = "Standard"
  enable_non_ssl_port = false
  minimum_tls_version = "1.2"
}
Non-Compliant
resource "azurerm_redis_cache" "app" {
  name                = "cache-payment-api"
  capacity            = 0
  family              = "C"
  sku_name            = "Basic"  # Basic tier – no replication – WAF-PERF-030 violation
  enable_non_ssl_port = true     # SSL disabled – security violation
}

waf-perf-030.tf.google.memorystore-redis-ha

Engine: terraform | Provider: google | Automated: Ja

GCP Memorystore for Redis must use STANDARD_HA tier

GCP Memorystore for Redis instances used for production caching must use STANDARD_HA tier to ensure failover and high availability.

Scope: resource — google_redis_instance

Assertions: * tier equals STANDARD_HA — Memorystore Redis must use STANDARD_HA tier for production use. * transit_encryption_mode equals SERVER_AUTHENTICATION — Memorystore Redis must have transit encryption enabled.

Remediation: Set tier = "STANDARD_HA" for production Redis instances. Set transit_encryption_mode = "SERVER_AUTHENTICATION" for encryption in transit.

Compliant
resource "google_redis_instance" "app" {
  name                    = "cache-payment-api"
  tier                    = "STANDARD_HA"
  memory_size_gb          = 4
  region                  = "europe-west3"
  transit_encryption_mode = "SERVER_AUTHENTICATION"
  redis_version           = "REDIS_7_0"
  labels = {
    workload = "payment-api"
  }
}
Non-Compliant
resource "google_redis_instance" "app" {
  name           = "cache-payment-api"
  tier           = "BASIC"  # No failover – WAF-PERF-030 violation
  memory_size_gb = 1
}

waf-perf-030.tf.stackit.scalability-tested

Engine: terraform | Provider: stackit | Automated: Ja

All workloads with repeated read patterns or high-latency data sources for stackit

All workloads with repeated read patterns or high-latency data sources must be documented in IaC via a scalability-tested tag/label on stackit_project. This validates the control is tracked as code.

Scope: resource — stackit_project

Assertions: * labels key exists — stackit_project is missing the scalability-tested tag/label.

Remediation: Add a scalability-tested tag/label to the stackit_project resource to show the stackit implementation of WAF-PERF-030 is tracked in IaC.

Compliant
resource "stackit_project" "example" {
  labels = {
    scalability-tested = "true"
  }
}
Non-Compliant
resource "stackit_project" "example" {
  # Missing scalability-tested labels
}

waf-perf-030.tf.ovh.scalability-tested

Engine: terraform | Provider: ovh | Automated: Ja

All workloads with repeated read patterns or high-latency data sources for ovh

All workloads with repeated read patterns or high-latency data sources must be documented in IaC via a scalability-tested tag/label on ovh_cloud_project. This validates the control is tracked as code.

Scope: resource — ovh_cloud_project

Assertions: * tags key exists — ovh_cloud_project is missing the scalability-tested tag/label.

Remediation: Add a scalability-tested tag/label to the ovh_cloud_project resource to show the ovh implementation of WAF-PERF-030 is tracked in IaC.

Compliant
resource "ovh_cloud_project" "example" {
  tags = {
    scalability-tested = "true"
  }
}
Non-Compliant
resource "ovh_cloud_project" "example" {
  # Missing scalability-tested tags
}

waf-perf-030.tf.hcloud.scalability-tested

Engine: terraform | Provider: hcloud | Automated: Ja

All workloads with repeated read patterns or high-latency data sources for hcloud

All workloads with repeated read patterns or high-latency data sources must be documented in IaC via a scalability-tested tag/label on hcloud_server. This validates the control is tracked as code.

Scope: resource — hcloud_server

Assertions: * labels key exists — hcloud_server is missing the scalability-tested tag/label.

Remediation: Add a scalability-tested tag/label to the hcloud_server resource to show the hcloud implementation of WAF-PERF-030 is tracked in IaC.

Compliant
resource "hcloud_server" "example" {
  labels = {
    scalability-tested = "true"
  }
}
Non-Compliant
resource "hcloud_server" "example" {
  # Missing scalability-tested labels
}

Evidenz

Art Erforderlich Beschreibung

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Verwandte Controls

Framework Controls

ISO/IEC 25010

* Performance Efficiency – Time Behavior * Performance Efficiency – Resource Utilization