Wombat

WAF-SOV-020 – Region Pinning Enforced (IaC)

Säule: Sovereign | Schweregrad: Kritisch | Kategorie: Identity Access | Automatisierbar: High

Beschreibung

Deployments MUST be restricted to approved sovereign regions through policy-as-code and IaC guardrails. Region constraints must be technically enforced—not merely documented. Violations must be blocked in CI or flagged as critical policy exceptions requiring explicit documented approval.

Begründung

Risiko Beschreibung

Risk

Data may leave approved jurisdictions and violate regulatory requirements.

Risk

Vendor lock-in reduces future portability and sovereignty options.

Anforderungen

  • Deployments MUST be restricted to approved sovereign regions through policy-as-code and IaC guardrails.

  • Region constraints must be technically enforced—not merely documented.

  • Violations must be blocked in CI or flagged as critical policy exceptions requiring explicit documented approval.

Implementierungsleitfaden

  1. Implement the required configuration as code in Terraform or equivalent IaC.

  2. Add an automated check to CI/CD so deviations are caught before deployment.

Reifegrade

Level Name Kriterien

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-sov-020.tf.aws.provider-region-in-allowed-list

Engine: terraform | Provider: aws | Automated: Ja

AWS provider region must be explicitly set

Every AWS provider block must have a 'region' attribute explicitly set. Relying on AWS_DEFAULT_REGION environment variables or provider defaults is prohibited for sovereign workloads.

Scope: provider — aws

Assertions: * region attribute exists — AWS provider block is missing an explicit 'region' attribute.

Remediation: Add 'region = var.aws_region' to all AWS provider blocks.

Compliant
provider "aws" {
  region = var.aws_region
}
Non-Compliant
provider "aws" {
  # region sourced from AWS_DEFAULT_REGION – not sovereign-safe
}

waf-sov-020.tf.aws.region-variable-validation

Engine: terraform | Provider: aws | Automated: Ja

AWS region variable must have a validation constraint

Any Terraform variable whose name contains 'region' or 'location' must have a validation block to restrict values to the organization’s approved region list.

Scope: variable

Assertions: * validation block exists — Region/location variable is missing a 'validation' block to restrict to approved values.

Remediation: Add a validation block to region variables that uses 'contains()' or 'startswith()' to restrict values to the approved list.

Compliant
variable "aws_region" {
  type        = string
  description = "AWS region for sovereign deployments"
  default     = "eu-central-1"
  validation {
    condition     = contains(["eu-central-1", "eu-west-1", "eu-north-1"], var.aws_region)
    error_message = "Must be an approved sovereign EU region."
  }
}
Non-Compliant
variable "aws_region" {
  type        = string
  default     = "us-east-1"
  # No validation – any region is accepted
}

waf-sov-020.tf.azurerm.location-variable-validation

Engine: terraform | Provider: azurerm | Automated: Ja

Azure location variable must have a validation constraint

Any Terraform variable whose name contains 'location' or 'region' for Azure must have a validation block restricting to approved Azure regions.

Scope: variable

Assertions: * validation block exists — Azure location variable is missing a 'validation' block.

Remediation: Add a validation block restricting location to approved Azure sovereign regions.

Compliant
variable "azure_location" {
  type    = string
  default = "germanywestcentral"
  validation {
    condition = contains(
      ["germanywestcentral", "germanynorth", "westeurope", "northeurope", "switzerlandnorth"],
      var.azure_location
    )
    error_message = "Azure location must be an approved sovereign region."
  }
}
Non-Compliant
variable "azure_location" {
  type    = string
  default = "eastus"
  # No validation block
}

waf-sov-020.tf.google.region-variable-validation

Engine: terraform | Provider: google | Automated: Ja

GCP region variable must have a validation constraint

GCP region and location variables must have validation blocks restricting to approved European or sovereign GCP regions.

Scope: variable

Assertions: * validation block exists — GCP region/location variable is missing a 'validation' block.

Remediation: Add a validation block restricting GCP region to approved sovereign values.

Compliant
variable "gcp_region" {
  type    = string
  default = "europe-west3"
  validation {
    condition     = startswith(var.gcp_region, "europe-")
    error_message = "Only European GCP regions are approved for sovereign workloads."
  }
}
Non-Compliant
variable "gcp_region" {
  type    = string
  default = "us-central1"
  # No validation
}

waf-sov-020.tf.aws.no-hardcoded-non-sovereign-region

Engine: terraform | Provider: aws | Automated: Ja

No hardcoded non-sovereign AWS region in resource or provider blocks

Hardcoded AWS region strings referencing non-sovereign regions (e.g., us-east-1, ap-southeast-1) are forbidden in provider, resource, and data source blocks.

Scope: any Terraform block

Assertions: * region not matches pattern ^(us-|ap-|sa-|ca-|me-|af-) — Hardcoded non-sovereign AWS region detected. Only EU/approved regions are permitted.

Remediation: Replace hardcoded region values with variable references that have validation constraints.

Compliant
provider "aws" {
  region = var.aws_region  # validated to eu-central-1 or eu-west-1
}
Non-Compliant
provider "aws" {
  region = "us-east-1"  # Non-sovereign region hardcoded
}

waf-sov-020.tf.stackit.region-validation

Engine: terraform | Provider: stackit | Automated: Ja

StackIT region variable must have a validation constraint

StackIT project region variables must have validation blocks restricting to approved sovereign regions. StackIT regions include: eu-central-1 (Karlsruhe), eu-west-1 (Strasbourg).

Scope: variable

Assertions: * validation block exists — StackIT region/location variable is missing a 'validation' block.

Remediation: Add a validation block restricting the StackIT region to approved sovereign values.

Compliant
variable "stackit_region" {
  type    = string
  default = "eu-central-1"
  validation {
    condition     = contains(["eu-central-1", "eu-west-1"], var.stackit_region)
    error_message = "StackIT region must be an approved sovereign region."
  }
}
provider "stackit" {
  region = var.stackit_region
}
Non-Compliant
variable "stackit_region" {
  type    = string
  default = "us-east-1"
  # No validation block
}

waf-sov-020.tf.ovh.location-validation

Engine: terraform | Provider: ovh | Automated: Ja

OVH location variable must have a validation constraint

OVH project location variables must have validation blocks restricting to approved sovereign regions. OVH regions include: DE-FRA (Frankfurt), DE-EDE (Ede), EU-CY (Cyprus).

Scope: variable

Assertions: * validation block exists — OVH location variable is missing a 'validation' block.

Remediation: Add a validation block restricting OVH location to approved sovereign regions.

Compliant
variable "ovh_location" {
  type    = string
  default = "DE-FRA"
  validation {
    condition     = contains(["DE-FRA", "DE-EDE", "EU-CY"], var.ovh_location)
    error_message = "OVH location must be an approved sovereign region."
  }
}
provider "ovh" {
  endpoint = "ovh-eu"
}
Non-Compliant
variable "ovh_location" {
  type    = string
  default = "US-CA"
  # No validation block
}

waf-sov-020.tf.hcloud.location-validation

Engine: terraform | Provider: hcloud | Automated: Ja

Hetzner Cloud location variable must have a validation constraint

Hetzner Cloud location variables must have validation blocks restricting to approved sovereign regions. Hetzner regions include: fsn1 (Frankfurt), nbg1 (Nuremberg), hel1 (Helsinki).

Scope: variable

Assertions: * validation block exists — Hetzner Cloud location variable is missing a 'validation' block.

Remediation: Add a validation block restricting Hetzner Cloud location to approved sovereign regions.

Compliant
variable "hcloud_location" {
  type    = string
  default = "fsn1"
  validation {
    condition     = contains(["fsn1", "nbg1", "hel1"], var.hcloud_location)
    error_message = "Hetzner Cloud location must be an approved sovereign region."
  }
}
resource "hcloud_server" "main" {
  name        = "sovereign-server"
  server_type = "cx22"
  location    = var.hcloud_location
}
Non-Compliant
variable "hcloud_location" {
  type    = string
  default = "us-ca"
  # No validation block
}

Evidenz

Art Erforderlich Beschreibung

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Verwandte Controls

Framework Controls

GDPR

* Art. 44 – General principle for transfers * Art. 46 – Transfers to third countries

BSI C5:2020

* OPS-04 – Data management * INF-01 – Physical location

BSI C3A:2026

* Dimension 4 – Data: Location of data processing * Dimension 1 – Strategic: Jurisdictional alignment

EUCS (ENISA)

* SOV-01 – Data location * SOV-02 – Jurisdiction control

GAIA-X

* Data Sovereignty – Location transparency

ISO 27001:2022

* A.8.10 – Information deletion * A.5.29 – Information security during disruption