Wombat

WAF-OPS-080 – Feature Flag & Safe Deployment Patterns

Säule: Excellence | Schweregrad: Mittel | Kategorie: Deployment Automation | Automatisierbar: High

Beschreibung

Production deployments MUST use safe deployment patterns – canary releases, blue/green deployments, or feature flags – to reduce blast radius and enable fast rollback. New features with significant user impact MUST be gated behind feature flags to allow controlled rollout and instant kill-switch capability. Deployments MUST be reversible without a new deployment for at least 24 hours after release.

Begründung

Risiko Beschreibung

Risk

Big-bang deployments can hit all users with failures at once and complicate rollbacks.

Risk

Missing canary or feature-flag mechanisms slow detection of regressive changes.

Anforderungen

  • Production deployments MUST use safe deployment patterns – canary releases, blue/green deployments, or feature flags – to reduce blast radius and enable fast rollback.

  • New features with significant user impact MUST be gated behind feature flags to allow controlled rollout and instant kill-switch capability.

  • Deployments MUST be reversible without a new deployment for at least 24 hours after release.

Implementierungsleitfaden

  1. Document the requirement in a version-controlled policy or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Reifegrade

Level Name Kriterien

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-ops-080.tf.aws.codedeploy-deployment-config

Engine: terraform | Provider: aws | Automated: Ja

AWS CodeDeploy must use canary or linear deployment configuration

AWS CodeDeploy deployment groups MUST use a deployment configuration that implements progressive delivery (canary or linear) rather than all-at-once for production.

Scope: resource — aws_codedeploy_deployment_group

Assertions: * deployment_config_name not in ['0.0.0.0/0', ''] — Production CodeDeploy must not use AllAtOnce – use canary or linear strategy.

Remediation: Set deployment_config_name to CodeDeployDefault.ECSCanary10Percent5Minutes or CodeDeployDefault.LambdaCanary10Percent5Minutes for production deployments.

Compliant
resource "aws_codedeploy_deployment_group" "production" {
  app_name               = aws_codedeploy_app.app.name
  deployment_group_name  = "payment-service-production"
  service_role_arn       = aws_iam_role.codedeploy.arn
  deployment_config_name = "CodeDeployDefault.ECSCanary10Percent5Minutes"

  auto_rollback_configuration {
    enabled = true
    events  = ["DEPLOYMENT_FAILURE", "DEPLOYMENT_STOP_ON_ALARM"]
  }
}
Non-Compliant
resource "aws_codedeploy_deployment_group" "production" {
  app_name               = aws_codedeploy_app.app.name
  deployment_group_name  = "payment-service-production"
  service_role_arn       = aws_iam_role.codedeploy.arn
  deployment_config_name = "CodeDeployDefault.AllAtOnce"
  # All-at-once deployment – WAF-OPS-080 Violation
}

waf-ops-080.tf.aws.appconfig-feature-flag

Engine: terraform | Provider: aws | Automated: Ja

AWS AppConfig must be configured for feature flag management

Feature flag configuration MUST be managed through AWS AppConfig or equivalent to enable runtime toggle without redeployment.

Scope: resource — aws_appconfig_application

Assertions: * name not empty — AppConfig application must have a non-empty name.

Remediation: Create an aws_appconfig_application with environments and configuration profiles for feature flag management.

Compliant
resource "aws_appconfig_application" "feature_flags" {
  name        = "payment-service-feature-flags"
  description = "Feature flags for payment service"
}

resource "aws_appconfig_environment" "production" {
  name           = "production"
  application_id = aws_appconfig_application.feature_flags.id
}

resource "aws_appconfig_configuration_profile" "flags" {
  name           = "payment-features"
  application_id = aws_appconfig_application.feature_flags.id
  location_uri   = "hosted"
  type           = "AWS.AppConfig.FeatureFlags"
}
Non-Compliant
# No AppConfig or feature flag infrastructure defined
# Feature flags hardcoded in application code or environment variables
# WAF-OPS-080 Violation

waf-ops-080.tf.azurerm.traffic-manager-canary

Engine: terraform | Provider: azurerm | Automated: Ja

Azure Traffic Manager must configure weighted routing for canary deployments

Azure Traffic Manager profiles used for production traffic MUST support weighted routing to enable canary deployments with controlled traffic splits.

Scope: resource — azurerm_traffic_manager_profile

Assertions: * traffic_routing_method in ['Weighted'] — Traffic Manager routing method must support weighted traffic for canary deployments.

Remediation: Set traffic_routing_method to "Weighted" to enable canary deployment traffic splits.

Compliant
resource "azurerm_traffic_manager_profile" "canary" {
  name                   = "payment-service-canary"
  resource_group_name    = azurerm_resource_group.main.name
  traffic_routing_method = "Weighted"

  dns_config {
    relative_name = "payment-service"
    ttl           = 30
  }

  monitor_config {
    protocol                     = "HTTPS"
    port                         = 443
    path                         = "/health"
    expected_status_code_ranges  = ["200-299"]
  }
}
Non-Compliant
resource "azurerm_traffic_manager_profile" "main" {
  name                   = "payment-service"
  resource_group_name    = azurerm_resource_group.main.name
  traffic_routing_method = "Priority"
  # Priority routing doesn't support canary splits – WAF-OPS-080 Violation
}

waf-ops-080.tf.google.cloud-run-traffic-split

Engine: terraform | Provider: google | Automated: Ja

GCP Cloud Run services must use safe traffic-split deployments

GCP Cloud Run services used in production MUST define traffic blocks that split traffic between revisions (canary/blue-green) rather than sending 100% to a single revision. Feature flags should be managed via a dedicated configuration resource.

Scope: resource — google_cloud_run_service

Assertions: * traffic attribute exists — Cloud Run service must define traffic splitting across revisions.

Remediation: Configure google_cloud_run_service traffic blocks with split percentages across revisions. For GKE workloads, use Gateway API or Traffic Splitting. Manage kill-switches via a feature flag provider.

Compliant
resource "google_cloud_run_service" "payment" {
  name     = "payment-service"
  location = var.region

  template {
    spec {
      containers {
        image = var.image
      }
    }
  }

  traffic {
    percent         = 90
    revision_name   = "payment-service-00001"
  }

  traffic {
    percent         = 10
    revision_name   = "payment-service-00002"
    tag             = "canary"
  }
}
Non-Compliant
resource "google_cloud_run_service" "payment" {
  name     = "payment-service"
  location = var.region

  traffic {
    percent       = 100
    revision_name = "payment-service-00002"
  }
}

waf-ops-080.tf.stackit.ske-safe-rollout

Engine: terraform | Provider: stackit | Automated: Ja

STACKIT Kubernetes deployments must use safe rollout strategy

STACKIT Kubernetes deployments must use safe rollout strategy. This check validates the Terraform configuration uses the expected resource and attribute.

Scope: resource — stackit_ske_cluster

Assertions: * maintenance_window attribute exists — STACKIT SKE cluster must define a maintenance window for safe rollouts.

Remediation: Review the Terraform configuration for the listed resource types and ensure the required attribute or tag is present. See the control narrative for provider-specific guidance.

Compliant
# Example resource meets the requirement.
resource "stackit_ske_cluster" "example" {
  # required attribute/tag/label present
}
Non-Compliant
# Example resource does not meet the requirement.
resource "stackit_ske_cluster" "example" {
  # Missing required attribute/tag/label
}

waf-ops-080.tf.ovh.kube-safe-rollout

Engine: terraform | Provider: ovh | Automated: Ja

OVHcloud Kubernetes deployments must use safe rollout strategy

OVHcloud Kubernetes deployments must use safe rollout strategy. This check validates the Terraform configuration uses the expected resource and attribute.

Scope: resource — ovh_cloud_project_kube, ovh_cloud_project_kube_nodepool

Assertions: * update_strategy attribute exists — OVHcloud Kubernetes cluster/nodepool should define an update strategy.

Remediation: Review the Terraform configuration for the listed resource types and ensure the required attribute or tag is present. See the control narrative for provider-specific guidance.

Compliant
# Example resource meets the requirement.
resource "ovh_cloud_project_kube" "example" {
  # required attribute/tag/label present
}
Non-Compliant
# Example resource does not meet the requirement.
resource "ovh_cloud_project_kube" "example" {
  # Missing required attribute/tag/label
}

waf-ops-080.tf.hcloud.server-safe-maintenance

Engine: terraform | Provider: hcloud | Automated: Ja

Hetzner Cloud production changes must use safe rollout practices

Hetzner Cloud production changes must use safe rollout practices. This check validates the Terraform configuration uses the expected resource and attribute.

Scope: resource — hcloud_server, hcloud_placement_group

Assertions: * labels.safe-rollout key exists — Hetzner Cloud server must be marked with safe-rollout label.

Remediation: Review the Terraform configuration for the listed resource types and ensure the required attribute or tag is present. See the control narrative for provider-specific guidance.

Compliant
# Example resource meets the requirement.
resource "hcloud_server" "example" {
  # required attribute/tag/label present
}
Non-Compliant
# Example resource does not meet the requirement.
resource "hcloud_server" "example" {
  # Missing required attribute/tag/label
}

Evidenz

Art Erforderlich Beschreibung

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Verwandte Controls

Framework Controls

ITIL 4

* Release management * Change enablement

ISO/IEC 20000-1

* Change and deployment management