WAF-SEC-090 – Policy-as-Code & Compliance Automation

Säule: Security | Schweregrad: Mittel | Kategorie: Identity Access | Automatisierbar: High

Beschreibung

Compliance controls MUST be expressed as machine-readable policies using AWS Config rules, Open Policy Agent (OPA) policies, HashiCorp Sentinel, or Wombat Control definitions. AWS Config recorder MUST be enabled with recording of all supported resource types in all active regions. A Config delivery channel MUST be configured to deliver configuration snapshots and compliance notifications. Policy compliance checks MUST run automatically on every infrastructure change via CI/CD pipeline gates. Non-compliant resources MUST trigger automated alerts and initiate a documented remediation workflow.

Begründung

Risiko	Beschreibung
Risk	Compliance rules that are only documented and not maintained as code become outdated and ignored.
Risk	Manual controls cannot be checked at scale and provide no repeatable audit evidence.

Risiko

Beschreibung

Risk

Compliance rules that are only documented and not maintained as code become outdated and ignored.

Risk

Manual controls cannot be checked at scale and provide no repeatable audit evidence.

Anforderungen

Compliance controls MUST be expressed as machine-readable policies using AWS Config rules, Open Policy Agent (OPA) policies, HashiCorp Sentinel, or Wombat Control definitions.
AWS Config recorder MUST be enabled with recording of all supported resource types in all active regions.
A Config delivery channel MUST be configured to deliver configuration snapshots and compliance notifications.
Policy compliance checks MUST run automatically on every infrastructure change via CI/CD pipeline gates.
Non-compliant resources MUST trigger automated alerts and initiate a documented remediation workflow.

Implementierungsleitfaden

Document the requirement in a version-controlled policy or standard.
Assign ownership and establish a review cadence (e.g., quarterly).
Implement the required configuration as code in Terraform or equivalent IaC.

Reifegrade

Level	Name	Kriterien
L1	Ad hoc – control not consistently applied	* Manual evidence exists for some workloads, but coverage is unknown.
L2	Standardised – policy defined and communicated	* A version-controlled policy, ADR, or standard describes the requirement.
L3	Integrated – automated validation in CI/CD	* Terraform checks run automatically on pull requests and report results.
L4	Auditable – metrics and exceptions tracked	* Control coverage, failures, and approved exceptions are reported quarterly.
L5	Optimised – continuous improvement based on data	* Control effectiveness is measured and iteratively improved.

Level

Name

Kriterien

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-sec-090.tf.aws.config-recorder-enabled

Engine: terraform | Provider: aws | Automated: Ja

AWS Config configuration recorder must be enabled for all resource types

An aws_config_configuration_recorder resource must exist with a recording_group block that records all supported resource types. This ensures continuous tracking of configuration changes across all AWS resources in the account.

Scope: resource — aws_config_configuration_recorder

Assertions: * name attribute exists — AWS Config configuration recorder must have a name attribute defined. * recording_group attribute exists — AWS Config configuration recorder must have a recording_group block specifying which resources to record.

Remediation: Create an aws_config_configuration_recorder resource with a recording_group block setting all_supported = true and include_global_resource_types = true. Create an IAM role with the AWS managed policy AWSConfigRole and reference it via the role_arn attribute.

Compliant

resource "aws_iam_role" "config" {
  name               = "aws-config-role"
  assume_role_policy = data.aws_iam_policy_document.config_assume.json
}
resource "aws_iam_role_policy_attachment" "config" {
  role       = aws_iam_role.config.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWS_ConfigRole"
}
resource "aws_config_configuration_recorder" "main" {
  name     = "default"
  role_arn = aws_iam_role.config.arn
  recording_group {
    all_supported                 = true
    include_global_resource_types = true
  }
}
resource "aws_config_configuration_recorder_status" "main" {
  name       = aws_config_configuration_recorder.main.name
  is_enabled = true
  depends_on = [aws_config_delivery_channel.main]
}

Non-Compliant

# aws_config_configuration_recorder absent from Terraform configuration
# WAF-SEC-090 violation: AWS Config is not deployed in this account

waf-sec-090.tf.aws.config-delivery-channel

Engine: terraform | Provider: aws | Automated: Ja

AWS Config delivery channel must be configured

An aws_config_delivery_channel resource must exist pointing to a valid S3 bucket for configuration snapshot delivery. This ensures compliance history is persisted and available for audit.

Scope: resource — aws_config_delivery_channel

Assertions: * name attribute exists — AWS Config delivery channel must have a name attribute.

Remediation: Create an aws_config_delivery_channel resource with s3_bucket_name pointing to a dedicated logging bucket. Optionally configure sns_topic_arn to receive configuration change notifications and compliance state change notifications.

Compliant

resource "aws_config_delivery_channel" "main" {
  name           = "default"
  s3_bucket_name = aws_s3_bucket.config_logs.bucket
  sns_topic_arn  = aws_sns_topic.config_notifications.arn
  snapshot_delivery_properties {
    delivery_frequency = "TwentyFour_Hours"
  }
  depends_on = [aws_config_configuration_recorder.main]
}

Non-Compliant

# aws_config_delivery_channel resource absent
# WAF-SEC-090 violation: Config findings not delivered to any persistent destination

waf-sec-090.tf.azurerm.policy-assignment-audit

Engine: terraform | Provider: azurerm | Automated: Ja

Azure Policy assignments must enforce or audit compliance controls

At least one azurerm_policy_assignment resource must exist with a non-empty policy_definition_id and enforcement_mode set to "Default" so that compliance controls are expressed as machine-readable policies.

Scope: resource — azurerm_policy_assignment

Assertions: * policy_definition_id attribute exists — Azure Policy assignment must reference a policy definition. * enforcement_mode equals Default — Azure Policy assignment must be in Default enforcement mode.

Remediation: Create azurerm_policy_assignment resources using built-in or custom azurerm_policy_definition definitions that audit/enforce required controls (e.g., allowed locations, required tags, encryption). Set enforcement_mode to "Default".

Compliant

resource "azurerm_policy_definition" "require_tag" {
  name         = "require-owner-tag"
  policy_type  = "Custom"
  mode         = "Indexed"
  display_name = "Require owner tag on resources"
  policy_rule  = jsonencode({})
}

resource "azurerm_policy_assignment" "require_tag" {
  name                 = "require-owner-tag"
  scope                = data.azurerm_subscription.current.id
  policy_definition_id = azurerm_policy_definition.require_tag.id
  enforcement_mode     = "Default"
}

Non-Compliant

# No azurerm_policy_assignment resources exist.
# WAF-SEC-090 violation: Azure Policy not used to enforce compliance controls

waf-sec-090.tf.google.org-policy-constraint

Engine: terraform | Provider: google | Automated: Ja

GCP organization policies must express compliance constraints

A google_org_policy_policy resource must exist with at least one rule enforcing a constraint (e.g., restricted locations, disable service account key creation) so that compliance controls are machine-readable.

Scope: resource — google_org_policy_policy

Assertions: * spec attribute exists — GCP organization policy must define a spec with enforcement rules.

Remediation: Create google_org_policy_policy resources for constraints relevant to the workload (e.g., iam.disableServiceAccountKeyCreation, gcp.resourceLocations). Use enforce = true for mandatory controls.

Compliant

resource "google_org_policy_policy" "disable_sa_keys" {
  name   = "projects/${var.project_id}/policies/iam.disableServiceAccountKeyCreation"
  parent = "projects/${var.project_id}"

  spec {
    rules {
      enforce = "TRUE"
    }
  }
}

Non-Compliant

# No google_org_policy_policy resources enforce compliance constraints.
# WAF-SEC-090 violation: GCP organization policy constraints missing

waf-sec-090.config.stackit.stackit-identity-access

Engine: config | Provider: stackit | Automated: Ja

STACKIT compliance controls must be expressed as documented policies

A version-controlled policy document must exist at docs/security/waf-sec-090-stackit-identity-access.md and document the STACKIT implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/security/waf-sec-090-stackit-identity-access.md

Remediation: Create or update docs/security/waf-sec-090-stackit-identity-access.md. State the requirement, how it is implemented for STACKIT, the review cadence, and the owner.

Compliant

docs/security/waf-sec-090-stackit-identity-access.md:
- The STACKIT implementation of WAF-SEC-090 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).

Non-Compliant

# `docs/security/waf-sec-090-stackit-identity-access.md` is missing or does not contain a normative requirement.
# WAF-SEC-090 violation: STACKIT control is not documented

waf-sec-090.config.ovh.ovh-identity-access

Engine: config | Provider: ovh | Automated: Ja

OVHcloud compliance controls must be expressed as documented policies

A version-controlled policy document must exist at docs/security/waf-sec-090-ovh-identity-access.md and document the OVHcloud implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/security/waf-sec-090-ovh-identity-access.md

Remediation: Create or update docs/security/waf-sec-090-ovh-identity-access.md. State the requirement, how it is implemented for OVHcloud, the review cadence, and the owner.

Compliant

docs/security/waf-sec-090-ovh-identity-access.md:
- The OVHcloud implementation of WAF-SEC-090 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).

Non-Compliant

# `docs/security/waf-sec-090-ovh-identity-access.md` is missing or does not contain a normative requirement.
# WAF-SEC-090 violation: OVHcloud control is not documented

waf-sec-090.config.hcloud.hcloud-identity-access

Engine: config | Provider: hcloud | Automated: Ja

Hetzner Cloud compliance controls must be expressed as documented policies

A version-controlled policy document must exist at docs/security/waf-sec-090-hcloud-identity-access.md and document the Hetzner Cloud implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/security/waf-sec-090-hcloud-identity-access.md

Remediation: Create or update docs/security/waf-sec-090-hcloud-identity-access.md. State the requirement, how it is implemented for Hetzner Cloud, the review cadence, and the owner.

Compliant

docs/security/waf-sec-090-hcloud-identity-access.md:
- The Hetzner Cloud implementation of WAF-SEC-090 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).

Non-Compliant

# `docs/security/waf-sec-090-hcloud-identity-access.md` is missing or does not contain a normative requirement.
# WAF-SEC-090 violation: Hetzner Cloud control is not documented

Evidenz

Art Erforderlich Beschreibung

Art	Erforderlich	Beschreibung
`iac`	Erforderlich	Terraform configuration implementing the control.
`governance`	Erforderlich	Policy, ADR, or standard documenting the requirement.
`config`	Optional	Cloud console or API output confirming runtime state.

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

WAF-SEC-090 – Policy-as-Code & Compliance Automation

Beschreibung

Begründung

Anforderungen

Implementierungsleitfaden

Reifegrade

Checks

waf-sec-090.tf.aws.config-recorder-enabled

waf-sec-090.tf.aws.config-delivery-channel

waf-sec-090.tf.azurerm.policy-assignment-audit

waf-sec-090.tf.google.org-policy-constraint

waf-sec-090.config.stackit.stackit-identity-access

waf-sec-090.config.ovh.ovh-identity-access

waf-sec-090.config.hcloud.hcloud-identity-access

Evidenz

Verwandte Controls