Wombat

WAF-SOV-040 – Logging & Telemetry Residency Controlled

Säule: Sovereign | Schweregrad: Hoch | Kategorie: Network Security | Automatisierbar: High

Beschreibung

All observability data—logs, traces, and metrics—MUST be stored in approved sovereign regions. Exports to external platforms (SaaS observability, third-party SIEM) MUST be explicitly approved, documented, and controlled. Log retention periods MUST be defined and enforced. VPC flow logs MUST be enabled to support forensic investigation within sovereign infrastructure.

Begründung

Risiko Beschreibung

Risk

Observability data outside approved regions can violate data-protection and sovereignty requirements.

Risk

Missing data-location control for logs and metrics complicates audits and regulatory evidence.

Anforderungen

  • All observability data—logs, traces, and metrics—MUST be stored in approved sovereign regions.

  • Exports to external platforms (SaaS observability, third-party SIEM) MUST be explicitly approved, documented, and controlled.

  • Log retention periods MUST be defined and enforced.

  • VPC flow logs MUST be enabled to support forensic investigation within sovereign infrastructure.

Implementierungsleitfaden

  1. Implement the required configuration as code in Terraform or equivalent IaC.

  2. Add an automated check to CI/CD so deviations are caught before deployment.

Reifegrade

Level Name Kriterien

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-sov-040.tf.aws.cloudtrail-multi-region

Engine: terraform | Provider: aws | Automated: Ja

CloudTrail must be multi-region and have log file validation enabled

AWS CloudTrail must be enabled for all regions (is_multi_region_trail = true) and log file validation must be enabled to detect tampering.

Scope: resource — aws_cloudtrail

Assertions: * is_multi_region_trail is true — CloudTrail must be multi-region to capture events from all regions. * enable_log_file_validation is true — CloudTrail log file validation must be enabled to detect tampering.

Remediation: Set is_multi_region_trail = true and enable_log_file_validation = true on all CloudTrail resources.

Compliant
resource "aws_cloudtrail" "sovereign" {
  name                          = "sovereign-audit-trail"
  s3_bucket_name                = aws_s3_bucket.cloudtrail.id
  is_multi_region_trail         = true
  enable_log_file_validation    = true
  include_global_service_events = true
}
Non-Compliant
resource "aws_cloudtrail" "trail" {
  name           = "my-trail"
  s3_bucket_name = "my-logs"
  # is_multi_region_trail defaults to false
  # enable_log_file_validation defaults to false
}

waf-sov-040.tf.aws.cloudwatch-log-group-retention

Engine: terraform | Provider: aws | Automated: Ja

CloudWatch log groups must have retention period set

CloudWatch log groups must have an explicit retention_in_days value set. A value of 0 means logs never expire and violates data minimization requirements. Minimum 90 days for audit/security logs; 30 days for operational logs.

Scope: resource — aws_cloudwatch_log_group

Assertions: * retention_in_days attribute exists — CloudWatch log group is missing 'retention_in_days' attribute. * retention_in_days not equals 0 — CloudWatch log group retention_in_days must not be 0 (never expire). * retention_in_days greater than or equal 30 — Log group retention must be at least 30 days.

Remediation: Set retention_in_days on all CloudWatch log groups. Use 90 days minimum for audit and security logs, 30 days minimum for application logs.

Compliant
resource "aws_cloudwatch_log_group" "audit" {
  name              = "/sovereign/audit"
  retention_in_days = 365
  kms_key_id        = aws_kms_key.log_encryption.arn
  tags = {
    data-class     = "audit"
    data-residency = "eu-only"
  }
}
Non-Compliant
resource "aws_cloudwatch_log_group" "app" {
  name = "/app/logs"
  # retention_in_days not set – logs never expire
}

waf-sov-040.tf.aws.vpc-flow-logs-enabled

Engine: terraform | Provider: aws | Automated: Ja

VPC flow logs must be enabled for all VPCs

Every aws_vpc resource should have a corresponding aws_flow_log resource to enable network-level forensics within the sovereign environment.

Scope: resource — aws_vpc

Assertions: * id has associated resource — VPC does not have flow logging enabled. Add an aws_flow_log resource.

Remediation: Create an aws_flow_log resource referencing each VPC to capture network traffic metadata for forensic investigation.

Compliant
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}
resource "aws_flow_log" "main" {
  vpc_id          = aws_vpc.main.id
  traffic_type    = "ALL"
  iam_role_arn    = aws_iam_role.flow_log.arn
  log_destination = aws_cloudwatch_log_group.flow_log.arn
}
Non-Compliant
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
  # No flow log configured
}

waf-sov-040.tf.aws.cloudtrail-cloudwatch-integration

Engine: terraform | Provider: aws | Automated: Ja

CloudTrail should integrate with CloudWatch for real-time monitoring

CloudTrail should have cloud_watch_logs_group_arn set to enable real-time monitoring and alerting on privileged actions and anomalous activity.

Scope: resource — aws_cloudtrail

Assertions: * cloud_watch_logs_group_arn attribute exists — CloudTrail should have cloud_watch_logs_group_arn configured for real-time monitoring. * cloud_watch_logs_role_arn attribute exists — CloudTrail requires cloud_watch_logs_role_arn when CloudWatch integration is used.

Remediation: Set cloud_watch_logs_group_arn and cloud_watch_logs_role_arn on the CloudTrail resource to enable real-time detection of privileged and anomalous activities.

waf-sov-040.tf.aws.log-group-kms-encryption

Engine: terraform | Provider: aws | Automated: Ja

CloudWatch log groups containing audit data should use KMS encryption

CloudWatch log groups that capture audit, security, or administrative events should have kms_key_id set to a CMK to ensure encryption with customer-managed keys.

Scope: resource — aws_cloudwatch_log_group

Assertions: * kms_key_id attribute exists — Audit/security log group should be encrypted with a customer-managed KMS key.

Remediation: Add kms_key_id referencing a CMK to log groups capturing sensitive audit data.

waf-sov-040.tf.stackit.logging-region-sovereign

Engine: terraform | Provider: stackit | Automated: Ja

StackIT logging must be stored in sovereign regions

StackIT log service instances must have data stored in approved sovereign regions only (eu-central-1, eu-west-1).

Scope: resource — stackit_log_service

Assertions: * region in ['eu-central-1', 'eu-west-1', 'eu-west-3', 'germanywestcentral', 'westeurope', 'northeurope', 'europe-west3', 'europe-west1', 'fsn1', 'hel1', 'de', 'fi'] — StackIT log service must be in approved sovereign regions only.

Remediation: Configure StackIT log service to store logs in approved sovereign regions and enable log export restrictions.

Compliant
resource "stackit_log_service" "main" {
  project_id = stackit_project.main.id
  name       = "sovereign-logs"
  # Data stored in eu-central-1 by default
}
Non-Compliant
resource "stackit_log_service" "main" {
  project_id = stackit_project.main.id
  name       = "logs"
  # Data exported to non-sovereign region
}

waf-sov-040.tf.ovh.logging-region-sovereign

Engine: terraform | Provider: ovh | Automated: Ja

OVH logging must be stored in sovereign regions

OVH logging services must store logs in approved sovereign regions only (DE-FRA, DE-EDE, EU-CY).

Scope: resource — ovh_cloud_project

Assertions: * region in ['eu-central-1', 'eu-west-1', 'eu-west-3', 'germanywestcentral', 'westeurope', 'northeurope', 'europe-west3', 'europe-west1', 'fsn1', 'hel1', 'de', 'fi'] — OVH logging must be in approved sovereign regions only.

Remediation: Configure OVH logging services to store logs in approved sovereign regions.

Compliant
# OVH logging configured to stay within DE-FRA and EU-CY regions
Non-Compliant
# Logs exported to non-sovereign region

waf-sov-040.tf.hcloud.logging-region-sovereign

Engine: terraform | Provider: hcloud | Automated: Ja

Hetzner Cloud logging must be stored in sovereign regions

Hetzner Cloud monitoring and logging must be stored in approved sovereign regions only (fsn1, nbg1, hel1).

Scope: resource — hcloud_server

Assertions: * location in ['eu-central-1', 'eu-west-1', 'eu-west-3', 'germanywestcentral', 'westeurope', 'northeurope', 'europe-west3', 'europe-west1', 'fsn1', 'hel1', 'de', 'fi'] — Hetzner Cloud logging must be in approved sovereign regions only.

Remediation: Configure Hetzner Cloud monitoring to store logs in approved sovereign regions.

Compliant
# Hetzner monitoring configured to stay within fsn1 and hel1 regions
Non-Compliant
# Logs exported to non-sovereign region

waf-sov-040.tf.azurerm.log-analytics-location

Engine: terraform | Provider: azurerm | Automated: Ja

Azure Log Analytics workspace for observability data must be in approved sovereign location

Azure Log Analytics workspaces storing audit, security, and operational logs must be provisioned in an approved sovereign location. Data must not be replicated to non-sovereign regions.

Scope: resource — azurerm_log_analytics_workspace

Assertions: * location in ['germanywestcentral', 'westeurope', 'northeurope', 'switzerlandnorth', 'francecentral'] — Log Analytics workspace must be in an approved sovereign location.

Remediation: Create azurerm_log_analytics_workspace in an approved sovereign location (e.g., germanywestcentral, westeurope, northeurope) and configure linked storage accounts in the same jurisdiction.

Compliant
resource "azurerm_log_analytics_workspace" "sovereign" {
  name                = "law-sovereign-audit"
  location            = "germanywestcentral"
  resource_group_name = azurerm_resource_group.main.name
  sku                 = "PerGB2018"
  retention_in_days   = 365
}
Non-Compliant
resource "azurerm_log_analytics_workspace" "sovereign" {
  name                = "law-sovereign-audit"
  location            = "eastus"
  resource_group_name = azurerm_resource_group.main.name
  sku                 = "PerGB2018"
}

waf-sov-040.tf.google.logging-bucket-location

Engine: terraform | Provider: google | Automated: Ja

GCP log buckets and sinks must store observability data in approved sovereign locations

GCP logging project buckets and storage buckets receiving log sinks must be located in approved sovereign regions. Cloud Logging data must not be routed to non-sovereign destinations.

Scope: resource — google_logging_project_bucket_config

Assertions: * location in ['europe-west3', 'europe-west1', 'europe-north1', 'europe-central2'] — GCP log bucket must be in an approved sovereign location.

Remediation: Configure google_logging_project_bucket_config in an approved location (e.g., europe-west3) and ensure google_logging_project_sink destinations are buckets in sovereign regions.

Compliant
resource "google_logging_project_bucket_config" "sovereign" {
  bucket_id    = "sovereign-audit-logs"
  location     = "europe-west3"
  retention_days = 365
}

resource "google_logging_project_sink" "audit" {
  name        = "audit-sink"
  destination = "bigquery.googleapis.com/projects/${var.project_id}/datasets/${google_bigquery_dataset.logs.id}"
}
Non-Compliant
resource "google_logging_project_bucket_config" "sovereign" {
  bucket_id    = "audit-logs"
  location     = "us-central1"
  retention_days = 365
}

Evidenz

Art Erforderlich Beschreibung

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Verwandte Controls

Framework Controls

GDPR

* Art. 32 – Security of processing (including integrity monitoring) * Art. 44-46 – Transfers to third countries * Art. 5(1)(e) – Storage limitation

BSI C5:2020

* LOG-01 – Logging * LOG-02 – Log protection * OPS-04 – Data management

BSI C3A:2026

* Dimension 5 – Operational: Logging and monitoring location * Dimension 5 – Operational: SOC (Security Operations Center)

EUCS (ENISA)

* LOG-01 – Audit logging * IVS-09 – Network logging

ISO 27001:2022

* A.8.15 – Logging * A.8.16 – Monitoring activities