Wombat

WAF-OPS-010 – CI/CD Pipeline Defined & Automated

Säule: Excellence | Schweregrad: Hoch | Kategorie: Deployment Automation | Automatisierbar: High

Beschreibung

Every production workload MUST have a defined, version-controlled CI/CD pipeline that automates build, test, and deployment steps. Manual deployments to production MUST NOT be permitted. All pipeline definitions MUST be stored as code in the same repository as the application or infrastructure they deploy.

Begründung

Risiko Beschreibung

Risk

Missing CI/CD pipelines force manual deployments and increase the risk of human error.

Risk

Undocumented deployment processes lead to non-reproducible environments and longer outages.

Anforderungen

  • Every production workload MUST have a defined, version-controlled CI/CD pipeline that automates build, test, and deployment steps.

  • Manual deployments to production MUST NOT be permitted.

  • All pipeline definitions MUST be stored as code in the same repository as the application or infrastructure they deploy.

Implementierungsleitfaden

  1. Document the requirement in a version-controlled policy or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Reifegrade

Level Name Kriterien

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-ops-010.tf.aws.codepipeline-exists

Engine: terraform | Provider: aws | Automated: Ja

AWS CodePipeline must be defined for application deployments

Production workloads deployed to AWS MUST use CodePipeline or equivalent IaC-defined pipeline. The pipeline must include at least source, build, and deploy stages.

Scope: resource — aws_codepipeline

Assertions: * name not empty — CodePipeline must have a non-empty name. * stage attribute exists — CodePipeline must define at least one stage.

Remediation: Define an aws_codepipeline resource with source, build, and deploy stages. Reference CodeBuild projects and S3 artifact buckets explicitly.

Compliant
resource "aws_codepipeline" "app_pipeline" {
  name     = "payment-service-pipeline"
  role_arn = aws_iam_role.codepipeline_role.arn

  artifact_store {
    location = aws_s3_bucket.artifacts.bucket
    type     = "S3"
  }

  stage {
    name = "Source"
    action {
      name             = "Source"
      category         = "Source"
      owner            = "AWS"
      provider         = "CodeStarSourceConnection"
      version          = "1"
      output_artifacts = ["source_output"]
      configuration = {
        ConnectionArn    = aws_codestarconnections_connection.github.arn
        FullRepositoryId = "myorg/payment-service"
        BranchName       = "main"
      }
    }
  }

  stage {
    name = "Build"
    action {
      name             = "Build"
      category         = "Build"
      owner            = "AWS"
      provider         = "CodeBuild"
      version          = "1"
      input_artifacts  = ["source_output"]
      output_artifacts = ["build_output"]
      configuration = {
        ProjectName = aws_codebuild_project.build.name
      }
    }
  }

  stage {
    name = "Deploy"
    action {
      name            = "Deploy"
      category        = "Deploy"
      owner           = "AWS"
      provider        = "ECS"
      version         = "1"
      input_artifacts = ["build_output"]
      configuration = {
        ClusterName = aws_ecs_cluster.main.name
        ServiceName = aws_ecs_service.app.name
      }
    }
  }
}
Non-Compliant
# No pipeline defined – deployments performed manually
# WAF-OPS-010 Violation: manual deployment without pipeline

waf-ops-010.tf.azurerm.devops-pipeline-exists

Engine: terraform | Provider: azurerm | Automated: Ja

Azure DevOps pipeline must be defined for application workloads

Applications deployed to Azure MUST have an Azure DevOps pipeline defined as code. The pipeline definition must be stored in the application repository.

Scope: resource — azuredevops_build_definition

Assertions: * name not empty — Azure DevOps pipeline must have a non-empty name. * repository attribute exists — Pipeline must reference a source repository.

Remediation: Define an azuredevops_build_definition resource linking to your repository and a YAML pipeline definition file (azure-pipelines.yml).

Compliant
resource "azuredevops_build_definition" "app_pipeline" {
  project_id = azuredevops_project.main.id
  name       = "payment-service-ci-cd"

  repository {
    repo_type   = "TfsGit"
    repo_id     = azuredevops_git_repository.app.id
    branch_name = "refs/heads/main"
    yml_path    = "azure-pipelines.yml"
  }
}
Non-Compliant
# No pipeline definition in Terraform
# Deployments done manually via Azure Portal – WAF-OPS-010 Violation

waf-ops-010.tf.google.cloudbuild-trigger-exists

Engine: terraform | Provider: google | Automated: Ja

Google Cloud Build trigger must be defined for CI/CD

GCP workloads MUST use Cloud Build triggers connected to source repositories. Build configuration must be stored as cloudbuild.yaml in the repository.

Scope: resource — google_cloudbuild_trigger

Assertions: * name not empty — Cloud Build trigger must have a non-empty name. * filename not empty — Cloud Build trigger must reference a build configuration file.

Remediation: Define a google_cloudbuild_trigger resource that references a cloudbuild.yaml file and connects to the application source repository.

Compliant
resource "google_cloudbuild_trigger" "app_trigger" {
  name        = "payment-service-trigger"
  description = "CI/CD trigger for payment service"

  github {
    owner = "myorg"
    name  = "payment-service"
    push {
      branch = "^main$"
    }
  }

  filename = "cloudbuild.yaml"
}
Non-Compliant
# No Cloud Build trigger defined
# WAF-OPS-010 Violation: no automated pipeline for GCP deployment

waf-ops-010.tf.stackit.infrastructure-as-code

Engine: terraform | Provider: stackit | Automated: Ja

Every production workload for stackit

Every production workload must be documented in IaC via a infrastructure-as-code tag/label on stackit_project. This validates the control is tracked as code.

Scope: resource — stackit_project

Assertions: * labels key exists — stackit_project is missing the infrastructure-as-code tag/label.

Remediation: Add a infrastructure-as-code tag/label to the stackit_project resource to show the stackit implementation of WAF-OPS-010 is tracked in IaC.

Compliant
resource "stackit_project" "example" {
  labels = {
    infrastructure-as-code = "true"
  }
}
Non-Compliant
resource "stackit_project" "example" {
  # Missing infrastructure-as-code labels
}

waf-ops-010.tf.ovh.infrastructure-as-code

Engine: terraform | Provider: ovh | Automated: Ja

Every production workload for ovh

Every production workload must be documented in IaC via a infrastructure-as-code tag/label on ovh_cloud_project. This validates the control is tracked as code.

Scope: resource — ovh_cloud_project

Assertions: * tags key exists — ovh_cloud_project is missing the infrastructure-as-code tag/label.

Remediation: Add a infrastructure-as-code tag/label to the ovh_cloud_project resource to show the ovh implementation of WAF-OPS-010 is tracked in IaC.

Compliant
resource "ovh_cloud_project" "example" {
  tags = {
    infrastructure-as-code = "true"
  }
}
Non-Compliant
resource "ovh_cloud_project" "example" {
  # Missing infrastructure-as-code tags
}

waf-ops-010.tf.hcloud.infrastructure-as-code

Engine: terraform | Provider: hcloud | Automated: Ja

Every production workload for hcloud

Every production workload must be documented in IaC via a infrastructure-as-code tag/label on hcloud_server. This validates the control is tracked as code.

Scope: resource — hcloud_server

Assertions: * labels key exists — hcloud_server is missing the infrastructure-as-code tag/label.

Remediation: Add a infrastructure-as-code tag/label to the hcloud_server resource to show the hcloud implementation of WAF-OPS-010 is tracked in IaC.

Compliant
resource "hcloud_server" "example" {
  labels = {
    infrastructure-as-code = "true"
  }
}
Non-Compliant
resource "hcloud_server" "example" {
  # Missing infrastructure-as-code labels
}

Evidenz

Art Erforderlich Beschreibung

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Verwandte Controls

Framework Controls

ISO/IEC 20000-1

* Change and deployment management * Release and deployment management

ITIL 4

* Change enablement * Deployment management

CIS Controls v8

* CIS-4.1: Establish and Maintain a Secure Configuration Process