Wombat

WAF-SOV-030 – Backup Location & Retention Controlled

Säule: Sovereign | Schweregrad: Hoch | Kategorie: Logging Monitoring | Automatisierbar: High

Beschreibung

Backup policies MUST explicitly define region/location constraints, minimum retention periods, and restore-test schedules. Cross-region replication MUST be explicitly configured and documented with an approved sovereign destination. Backup storage MUST remain within the same jurisdictional boundary as primary data unless explicitly approved and documented.

Begründung

Risiko Beschreibung

Risk

Data loss or ransomware impact is magnified when recovery points are absent.

Risk

Regulatory recovery-time requirements may be missed without tested backups.

Anforderungen

  • Backup policies MUST explicitly define region/location constraints, minimum retention periods, and restore-test schedules.

  • Cross-region replication MUST be explicitly configured and documented with an approved sovereign destination.

  • Backup storage MUST remain within the same jurisdictional boundary as primary data unless explicitly approved and documented.

Implementierungsleitfaden

  1. Implement the required configuration as code in Terraform or equivalent IaC.

  2. Add an automated check to CI/CD so deviations are caught before deployment.

Reifegrade

Level Name Kriterien

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-sov-030.tf.aws.db-instance-backup-retention

Engine: terraform | Provider: aws | Automated: Ja

RDS instance backup retention must be >= 7 days

AWS RDS instances must have backup_retention_period set to at least 7 days to meet minimum recovery requirements for sovereign data stores.

Scope: resource — aws_db_instance

Assertions: * backup_retention_period attribute exists — aws_db_instance is missing 'backup_retention_period' attribute. * backup_retention_period greater than or equal 7 — RDS backup_retention_period must be >= 7 days for sovereign compliance.

Remediation: Set backup_retention_period to at least 7 (days) on all production RDS instances and 30 days for instances processing PII or financial data.

Compliant
resource "aws_db_instance" "main" {
  identifier             = "prod-db"
  engine                 = "postgres"
  backup_retention_period = 30
  backup_window          = "03:00-04:00"
  # ...
}
Non-Compliant
resource "aws_db_instance" "main" {
  identifier             = "prod-db"
  engine                 = "postgres"
  backup_retention_period = 0  # Backups disabled
}

waf-sov-030.tf.aws.rds-cluster-backup-retention

Engine: terraform | Provider: aws | Automated: Ja

Aurora cluster backup retention must be >= 7 days

AWS RDS Aurora clusters must have backup_retention_period set to at least 7 days.

Scope: resource — aws_rds_cluster

Assertions: * backup_retention_period greater than or equal 7 — Aurora cluster backup_retention_period must be >= 7 days.

Remediation: Set backup_retention_period >= 7 on all Aurora clusters.

Compliant
resource "aws_rds_cluster" "main" {
  backup_retention_period = 14
  preferred_backup_window = "02:00-03:00"
}
Non-Compliant
resource "aws_rds_cluster" "main" {
  backup_retention_period = 1
}

waf-sov-030.tf.aws.dynamodb-pitr-enabled

Engine: terraform | Provider: aws | Automated: Ja

DynamoDB tables must have point-in-time recovery enabled

DynamoDB tables storing sovereign data must have point_in_time_recovery enabled to allow restoration to any point in the last 35 days.

Scope: resource — aws_dynamodb_table

Assertions: * point_in_time_recovery.enabled is true — DynamoDB table must have point_in_time_recovery.enabled = true.

Remediation: Add a point_in_time_recovery block with enabled = true to all DynamoDB tables.

Compliant
resource "aws_dynamodb_table" "sovereign" {
  name = "sovereign-table"
  point_in_time_recovery {
    enabled = true
  }
}
Non-Compliant
resource "aws_dynamodb_table" "sovereign" {
  name = "sovereign-table"
  # No PITR configured
}

waf-sov-030.tf.aws.backup-vault-in-approved-region

Engine: terraform | Provider: aws | Automated: Ja

AWS Backup vault must be in an approved sovereign region

AWS Backup vault configurations must not target non-sovereign regions. Any aws_backup_copy_action destination vault must be verified against the approved region list.

Scope: resource — aws_backup_plan

Assertions: * rule.copy_action.destination_vault_arn matches pattern arn:aws:[^:]:([a-z0-9-]+):. — Backup copy action destination vault is in a non-approved region.

Remediation: Ensure all backup copy action destination vaults reference backup vaults in approved sovereign regions only.

waf-sov-030.tf.azurerm.recovery-vault-location

Engine: terraform | Provider: azurerm | Automated: Ja

Azure Recovery Services vault must be in approved location

Azure Recovery Services vaults used for backups must have their 'location' set to an approved sovereign region.

Scope: resource — azurerm_recovery_services_vault

Assertions: * location in ['germanywestcentral', 'westeurope', 'northeurope', 'switzerlandnorth', 'francecentral'] — Azure Recovery Services vault location is not in the approved sovereign locations list.

Remediation: Move the Recovery Services vault to an approved sovereign Azure location.

Compliant
resource "azurerm_recovery_services_vault" "backup" {
  name                = "rsv-sovereign-prod"
  location            = "germanywestcentral"
  resource_group_name = azurerm_resource_group.main.name
  sku                 = "Standard"
  soft_delete_enabled = true
}
Non-Compliant
resource "azurerm_recovery_services_vault" "backup" {
  name     = "rsv-prod"
  location = "eastus"  # Non-sovereign location
}

waf-sov-030.tf.aws.s3-versioning-enabled

Engine: terraform | Provider: aws | Automated: Ja

S3 buckets storing backup data should have versioning enabled

S3 buckets used as backup destinations must have versioning enabled to protect against accidental deletion and support point-in-time recovery.

Scope: resource — aws_s3_bucket_versioning

Assertions: * versioning_configuration.status equals Enabled — S3 bucket versioning must be Enabled for backup/sovereign data stores.

Remediation: Enable versioning on S3 buckets used for backup or sovereign data storage.

Compliant
resource "aws_s3_bucket_versioning" "backup" {
  bucket = aws_s3_bucket.backup.id
  versioning_configuration {
    status = "Enabled"
  }
}
Non-Compliant
resource "aws_s3_bucket_versioning" "backup" {
  bucket = aws_s3_bucket.backup.id
  versioning_configuration {
    status = "Suspended"
  }
}

waf-sov-030.tf.stackit.backup-retention

Engine: terraform | Provider: stackit | Automated: Ja

StackIT database instances must have backup retention enabled

StackIT MySQL, Redis, OpenSearch instances must have backup retention configured. Backups must remain within approved sovereign regions.

Scope: resource — stackit_mysql_instance, stackit_redis_instance, stackit_opensearch_instance

Assertions: * backup_retention_period attribute exists — StackIT database instance is missing backup_retention_period. * backup_retention_period greater than or equal 7 — StackIT backup_retention_period must be >= 7 days.

Remediation: Configure backup_retention_period on all StackIT database resources and ensure backups are stored in approved sovereign regions (eu-central-1, eu-west-1).

Compliant
resource "stackit_mysql_instance" "main" {
  project_id     = stackit_project.main.id
  name           = "sovereign-mysql"
  backup_retention_period = 14
  # backups stored in eu-central-1
}
Non-Compliant
resource "stackit_mysql_instance" "main" {
  project_id = stackit_project.main.id
  name       = "mysql"
  # No backup retention configured
}

waf-sov-030.tf.ovh.backup-location-sovereign

Engine: terraform | Provider: ovh | Automated: Ja

OVH backups must remain in sovereign regions

OVH cloud backups, VPS snapshots, and dedicated server backups must not be exported outside approved sovereign regions (DE, EU).

Scope: resource — ovh_cloud_project, ovh_vps, ovh_dedicated_server

Assertions: * backup_location in ['eu-central-1', 'eu-west-1', 'eu-west-3', 'germanywestcentral', 'westeurope', 'northeurope', 'europe-west3', 'europe-west1', 'fsn1', 'hel1', 'de', 'fi'] — OVH backup location must be in approved sovereign regions only.

Remediation: Configure OVH backup policies to restrict backup locations to sovereign regions and prevent cross-border data transfers.

Compliant
# OVH backups configured to stay within DE-FRA and EU-CY regions
# No export to non-sovereign regions like US-CA, SG, etc.
Non-Compliant
# Backup exported to US region - GDPR violation

waf-sov-030.tf.hcloud.backup-location-sovereign

Engine: terraform | Provider: hcloud | Automated: Ja

Hetzner Cloud backups must remain in sovereign regions

Hetzner Cloud server backups, volume snapshots, and image exports must not be exported outside approved sovereign regions (DE, FI).

Scope: resource — hcloud_server, hcloud_volume, hcloud_image

Assertions: * location in ['eu-central-1', 'eu-west-1', 'eu-west-3', 'germanywestcentral', 'westeurope', 'northeurope', 'europe-west3', 'europe-west1', 'fsn1', 'hel1', 'de', 'fi'] — Hetzner Cloud backup location must be in approved sovereign regions only.

Remediation: Configure Hetzner Cloud backup and snapshot policies to restrict locations to sovereign regions and prevent cross-border data transfers.

Compliant
# Hetzner backups configured to stay within fsn1 (DE) and hel1 (FI) regions
Non-Compliant
# Backup exported to non-sovereign region

waf-sov-030.tf.google.sql-backup-location

Engine: terraform | Provider: google | Automated: Ja

GCP Cloud SQL backups must be enabled and stored in approved sovereign locations

GCP Cloud SQL instances storing sovereign data must have backup configuration enabled and the instance located in an approved sovereign region. Backup geo-redundancy must be disabled or explicitly approved for cross-border transfers.

Scope: resource — google_sql_database_instance

Assertions: * region in ['europe-west3', 'europe-west1', 'europe-north1', 'europe-central2'] — Cloud SQL instance must be in an approved sovereign region. * settings.backup_configuration.enabled is true — Cloud SQL backup configuration must be enabled. * settings.backup_configuration.geo_redundancy_enabled is false — Cloud SQL backup geo-redundancy must be disabled unless explicitly approved for cross-border transfer.

Remediation: Set settings.backup_configuration.enabled = true on google_sql_database_instance, choose an approved location (e.g., europe-west3), and disable settings.backup_configuration.geo_redundancy_enabled unless explicitly approved.

Compliant
resource "google_sql_database_instance" "sovereign" {
  name             = "sovereign-db"
  region           = "europe-west3"
  database_version = "POSTGRES_15"
  settings {
    backup_configuration {
      enabled                   = true
      start_time                = "03:00"
      geo_redundancy_enabled    = false
    }
  }
}
Non-Compliant
resource "google_sql_database_instance" "sovereign" {
  name             = "sovereign-db"
  region           = "us-central1"
  database_version = "POSTGRES_15"
  settings {
    backup_configuration {
      enabled = false
    }
  }
}

Evidenz

Art Erforderlich Beschreibung

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Verwandte Controls

Framework Controls

GDPR

* Art. 5(1)(e) – Storage limitation * Art. 32 – Security of processing (availability and resilience) * Art. 44-46 – Transfers to third countries

BSI C5:2020

* OPS-04 – Data management * BCM-01 – Business continuity

BSI C3A:2026

* Dimension 4 – Data: Backup location and residency * Dimension 6 – Supply Chain: Backup provider inventory

EUCS (ENISA)

* BCR-01 – Backup policy * DSP-04 – Data portability

ISO 27001:2022

* A.8.13 – Information backup * A.5.29 – Information security during disruption