Wombat

WAF-REL-020 – Health Checks & Readiness Probes Configured

Säule: Reliability | Schweregrad: Hoch | Kategorie: Network Encryption | Automatisierbar: High

Beschreibung

All production services MUST expose health check endpoints and configure readiness and liveness probes. Load balancers and orchestrators MUST use health checks to route traffic only to healthy instances. Kubernetes workloads MUST define readinessProbe and livenessProbe. AWS load balancers MUST have health check paths configured. Health check intervals, thresholds, and timeout values MUST be explicitly defined – no reliance on cloud provider defaults.

Begründung

Risiko Beschreibung

Risk

Services without health checks are not recognized as failed by load balancers and keep receiving traffic.

Risk

Missing state-check endpoints delay detection of partial outages.

Anforderungen

  • All production services MUST expose health check endpoints and configure readiness and liveness probes.

  • Load balancers and orchestrators MUST use health checks to route traffic only to healthy instances.

  • Kubernetes workloads MUST define readinessProbe and livenessProbe.

  • AWS load balancers MUST have health check paths configured.

  • Health check intervals, thresholds, and timeout values MUST be explicitly defined – no reliance on cloud provider defaults.

Implementierungsleitfaden

  1. Implement the required configuration as code in Terraform or equivalent IaC.

  2. Add an automated check to CI/CD so deviations are caught before deployment.

Reifegrade

Level Name Kriterien

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-rel-020.tf.aws.alb-target-group-health-check

Engine: terraform | Provider: aws | Automated: Ja

AWS ALB target group must have explicit health check configuration

AWS Application Load Balancer target groups must define an explicit health_check block with a non-default path, interval, timeout, and healthy/unhealthy thresholds.

Scope: resource — aws_lb_target_group

Assertions: * health_check attribute exists — Target group must define a health_check block. * health_check.path not empty — Health check path must be explicitly defined (not default '/'). * health_check.interval attribute exists — Health check interval must be explicitly defined. * health_check.healthy_threshold attribute exists — Healthy threshold must be explicitly defined.

Remediation: Add a health_check block to the aws_lb_target_group resource. Define path, interval, timeout, healthy_threshold, and unhealthy_threshold explicitly.

Compliant
resource "aws_lb_target_group" "api" {
  name     = "payment-api-tg"
  port     = 8080
  protocol = "HTTP"
  vpc_id   = var.vpc_id

  health_check {
    enabled             = true
    path                = "/health/ready"
    interval            = 15
    timeout             = 5
    healthy_threshold   = 2
    unhealthy_threshold = 3
    matcher             = "200"
  }
}
Non-Compliant
resource "aws_lb_target_group" "api" {
  name     = "payment-api-tg"
  port     = 8080
  protocol = "HTTP"
  vpc_id   = var.vpc_id
  # Missing: health_check block – uses cloud defaults
  # WAF-REL-020 violation
}

waf-rel-020.tf.azurerm.lb-probe

Engine: terraform | Provider: azurerm | Automated: Ja

Azure Load Balancer must have a health probe configured

Azure Load Balancer or Application Gateway backends must have explicit health probes defined with non-default paths and intervals.

Scope: resource — azurerm_lb_probe, azurerm_application_gateway

Assertions: * name not empty — Health probe must have a name. * protocol not empty — Health probe protocol must be specified. * request_path not empty — Health probe request path must be explicitly configured.

Remediation: Define an azurerm_lb_probe resource with protocol, port, request_path, interval_in_seconds, and number_of_probes configured.

Compliant
resource "azurerm_lb_probe" "api_health" {
  loadbalancer_id     = azurerm_lb.main.id
  name                = "api-health-probe"
  protocol            = "Http"
  port                = 8080
  request_path        = "/health/ready"
  interval_in_seconds = 15
  number_of_probes    = 2
}
Non-Compliant
resource "azurerm_lb_probe" "probe" {
  loadbalancer_id = azurerm_lb.main.id
  name            = "probe"
  protocol        = "Tcp"
  port            = 80
  # Missing: request_path – TCP probe does not validate application health
}

waf-rel-020.tf.google.compute-health-check

Engine: terraform | Provider: google | Automated: Ja

GCP Compute health check must be configured for managed instance groups

GCP managed instance groups and load balancers must use explicit health checks with HTTP paths and defined thresholds.

Scope: resource — google_compute_health_check, google_compute_backend_service

Assertions: * name not empty — Health check must have a name. * http_health_check attribute exists — HTTP health check configuration must be defined. * check_interval_sec attribute exists — Health check interval must be explicitly defined.

Remediation: Define a google_compute_health_check with http_health_check specifying the request_path, check_interval_sec, timeout_sec, and thresholds.

Compliant
resource "google_compute_health_check" "api" {
  name                = "payment-api-health"
  check_interval_sec  = 15
  timeout_sec         = 5
  healthy_threshold   = 2
  unhealthy_threshold = 3

  http_health_check {
    port         = 8080
    request_path = "/health/ready"
  }
}
Non-Compliant
resource "google_compute_health_check" "api" {
  name = "health-check"
  tcp_health_check {
    port = 80
  }
  # Missing: http_health_check with request_path
  # Missing: explicit thresholds and intervals
}

waf-rel-020.tf.stackit.failure-mode-analyzed

Engine: terraform | Provider: stackit | Automated: Ja

All production services for stackit

All production services must be documented in IaC via a failure-mode-analyzed tag/label on stackit_project. This validates the control is tracked as code.

Scope: resource — stackit_project

Assertions: * labels key exists — stackit_project is missing the failure-mode-analyzed tag/label.

Remediation: Add a failure-mode-analyzed tag/label to the stackit_project resource to show the stackit implementation of WAF-REL-020 is tracked in IaC.

Compliant
resource "stackit_project" "example" {
  labels = {
    failure-mode-analyzed = "true"
  }
}
Non-Compliant
resource "stackit_project" "example" {
  # Missing failure-mode-analyzed labels
}

waf-rel-020.tf.ovh.failure-mode-analyzed

Engine: terraform | Provider: ovh | Automated: Ja

All production services for ovh

All production services must be documented in IaC via a failure-mode-analyzed tag/label on ovh_cloud_project. This validates the control is tracked as code.

Scope: resource — ovh_cloud_project

Assertions: * tags key exists — ovh_cloud_project is missing the failure-mode-analyzed tag/label.

Remediation: Add a failure-mode-analyzed tag/label to the ovh_cloud_project resource to show the ovh implementation of WAF-REL-020 is tracked in IaC.

Compliant
resource "ovh_cloud_project" "example" {
  tags = {
    failure-mode-analyzed = "true"
  }
}
Non-Compliant
resource "ovh_cloud_project" "example" {
  # Missing failure-mode-analyzed tags
}

waf-rel-020.tf.hcloud.failure-mode-analyzed

Engine: terraform | Provider: hcloud | Automated: Ja

All production services for hcloud

All production services must be documented in IaC via a failure-mode-analyzed tag/label on hcloud_server. This validates the control is tracked as code.

Scope: resource — hcloud_server

Assertions: * labels key exists — hcloud_server is missing the failure-mode-analyzed tag/label.

Remediation: Add a failure-mode-analyzed tag/label to the hcloud_server resource to show the hcloud implementation of WAF-REL-020 is tracked in IaC.

Compliant
resource "hcloud_server" "example" {
  labels = {
    failure-mode-analyzed = "true"
  }
}
Non-Compliant
resource "hcloud_server" "example" {
  # Missing failure-mode-analyzed labels
}

Evidenz

Art Erforderlich Beschreibung

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Verwandte Controls

Framework Controls

ISO 27001:2022

* A.17.2 – Redundancies

ITIL 4

* Availability Management * Event Management