Wombat

WAF-PERF-100 – Performance Debt Register & Quarterly Review

Säule: Efficiancy | Schweregrad: Mittel | Kategorie: Cost Governance | Automatisierbar: High

Beschreibung

All known performance limitations, anti-patterns, and deferred optimizations MUST be documented in a Performance Debt Register. Each entry MUST include: ID, description of the performance issue, estimated impact (latency increase, throughput reduction, cost), affected services, owner, priority, and a remediation plan or acceptance rationale. The Performance Debt Register MUST be reviewed quarterly by engineering leadership. New performance anti-patterns identified in postmortems, load tests, or reviews MUST be added to the register within 30 days of identification.

Begründung

Risiko Beschreibung

Risk

Poor user experience and missed SLAs result from unoptimised resources.

Risk

Unnecessary compute waste increases cost and carbon footprint.

Anforderungen

  • All known performance limitations, anti-patterns, and deferred optimizations MUST be documented in a Performance Debt Register.

  • Each entry MUST include: ID, description of the performance issue, estimated impact (latency increase, throughput reduction, cost), affected services, owner, priority, and a remediation plan or acceptance rationale.

  • The Performance Debt Register MUST be reviewed quarterly by engineering leadership.

  • New performance anti-patterns identified in postmortems, load tests, or reviews MUST be added to the register within 30 days of identification.

Implementierungsleitfaden

  1. Document the requirement in a version-controlled policy or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Reifegrade

Level Name Kriterien

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-perf-100.tf.aws.config-performance-rules

Engine: terraform | Provider: aws | Automated: Ja

AWS Config rules should include performance governance checks

AWS Config should have rules configured that detect common performance anti-patterns such as previous-generation instance types, missing performance insights, or unencrypted volumes that reduce throughput. This enables automated detection of performance debt.

Scope: resource — aws_config_config_rule

Assertions: * name not empty — AWS Config rules must have descriptive names. * source not empty — AWS Config rules must have a source (AWS managed or custom Lambda).

Remediation: Create AWS Config rules for performance governance: desired-instance-type, rds-enhanced-monitoring-enabled, ec2-ebs-encryption-by-default. Use AWS Security Hub for centralized findings aggregation.

Compliant
resource "aws_config_config_rule" "rds_performance_insights" {
  name        = "rds-performance-insights-enabled"
  description = "WAF-PERF-040: Checks RDS instances have Performance Insights enabled"
  source {
    owner             = "AWS"
    source_identifier = "RDS_INSTANCE_PUBLIC_ACCESS_CHECK"
  }
  tags = {
    pillar  = "performance"
    control = "WAF-PERF-040"
  }
}
Non-Compliant
# No AWS Config rules for performance governance
# Performance anti-patterns not automatically detected – WAF-PERF-100 advisory

waf-perf-100.tf.azurerm.policy-performance-governance

Engine: terraform | Provider: azurerm | Automated: Ja

Azure Policy should include performance governance initiatives

Azure Policy should include policy definitions or initiatives that detect and audit performance anti-patterns such as non-Premium storage for databases or missing Application Insights deployments.

Scope: resource — azurerm_resource_group_policy_assignment, azurerm_subscription_policy_assignment

Assertions: * name not empty — Policy assignment must be named.

Remediation: Create Azure Policy assignments for performance governance. Use built-in policies like "Storage accounts should use geo-redundant storage" or custom policies for performance requirements specific to your organization.

Compliant
resource "azurerm_resource_group_policy_assignment" "perf_monitoring" {
  name                 = "require-application-insights"
  resource_group_id    = azurerm_resource_group.main.id
  policy_definition_id = var.require_app_insights_policy_id
  description          = "WAF-PERF-050: Require Application Insights for all web applications"
}
Non-Compliant
# No performance governance policies assigned
# Performance anti-patterns not systematically audited – WAF-PERF-100 advisory

waf-perf-100.tf.google.security-health-analytics

Engine: terraform | Provider: google | Automated: Ja

GCP Security Command Center should monitor performance governance findings

GCP Security Command Center or Cloud Asset Inventory should be configured to track performance governance findings and provide a consolidated view of performance risk.

Scope: resource — google_scc_notification_config

Assertions: * streaming_config not empty — SCC notification config must have streaming_config defined.

Remediation: Enable Security Command Center findings export to Pub/Sub for performance-related findings. Configure asset inventory queries for performance governance.

Compliant
resource "google_scc_notification_config" "performance_findings" {
  config_id    = "perf-governance-notifications"
  organization = var.org_id
  description  = "Notifications for performance governance findings"
  pubsub_topic = google_pubsub_topic.security_notifications.id
  streaming_config {
    filter = "category = \"INSTANCE_TYPE_RECOMMENDATION\" OR category = \"DISK_TYPE_RECOMMENDATION\""
  }
}
Non-Compliant
# No SCC notification config for performance findings
# Performance recommendations not surfaced to engineering – WAF-PERF-100 advisory

waf-perf-100.tf.stackit.capacity-plan-reviewed

Engine: terraform | Provider: stackit | Automated: Ja

All known performance limitations, anti-patterns, and deferred optimizations…​ for stackit

All known performance limitations, anti-patterns, and deferred optimizations…​ must be documented in IaC via a capacity-plan-reviewed tag/label on stackit_project. This validates the control is tracked as code.

Scope: resource — stackit_project

Assertions: * labels key exists — stackit_project is missing the capacity-plan-reviewed tag/label.

Remediation: Add a capacity-plan-reviewed tag/label to the stackit_project resource to show the stackit implementation of WAF-PERF-100 is tracked in IaC.

Compliant
resource "stackit_project" "example" {
  labels = {
    capacity-plan-reviewed = "true"
  }
}
Non-Compliant
resource "stackit_project" "example" {
  # Missing capacity-plan-reviewed labels
}

waf-perf-100.tf.ovh.capacity-plan-reviewed

Engine: terraform | Provider: ovh | Automated: Ja

All known performance limitations, anti-patterns, and deferred optimizations…​ for ovh

All known performance limitations, anti-patterns, and deferred optimizations…​ must be documented in IaC via a capacity-plan-reviewed tag/label on ovh_cloud_project. This validates the control is tracked as code.

Scope: resource — ovh_cloud_project

Assertions: * tags key exists — ovh_cloud_project is missing the capacity-plan-reviewed tag/label.

Remediation: Add a capacity-plan-reviewed tag/label to the ovh_cloud_project resource to show the ovh implementation of WAF-PERF-100 is tracked in IaC.

Compliant
resource "ovh_cloud_project" "example" {
  tags = {
    capacity-plan-reviewed = "true"
  }
}
Non-Compliant
resource "ovh_cloud_project" "example" {
  # Missing capacity-plan-reviewed tags
}

waf-perf-100.tf.hcloud.capacity-plan-reviewed

Engine: terraform | Provider: hcloud | Automated: Ja

All known performance limitations, anti-patterns, and deferred optimizations…​ for hcloud

All known performance limitations, anti-patterns, and deferred optimizations…​ must be documented in IaC via a capacity-plan-reviewed tag/label on hcloud_server. This validates the control is tracked as code.

Scope: resource — hcloud_server

Assertions: * labels key exists — hcloud_server is missing the capacity-plan-reviewed tag/label.

Remediation: Add a capacity-plan-reviewed tag/label to the hcloud_server resource to show the hcloud implementation of WAF-PERF-100 is tracked in IaC.

Compliant
resource "hcloud_server" "example" {
  labels = {
    capacity-plan-reviewed = "true"
  }
}
Non-Compliant
resource "hcloud_server" "example" {
  # Missing capacity-plan-reviewed labels
}

Evidenz

Art Erforderlich Beschreibung

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Verwandte Controls

Framework Controls

ISO/IEC 25010

* Performance Efficiency – Capacity