WAF-SUS-050 – Storage Lifecycle & Data Minimization

Säule: Sustainability | Schweregrad: Mittel | Kategorie: Backup Recovery | Automatisierbar: High

Beschreibung

All storage resources (S3 buckets, EBS volumes, Azure Blob Storage, GCS buckets) MUST have lifecycle policies defined. Data MUST be automatically tiered to cost- and energy-efficient cold storage after defined activity thresholds. Log data MUST have retention limits. Temporary data (build artifacts, test data, cache) MUST have explicit expiration. Unattached EBS volumes and unused snapshots MUST be detected and purged. Organizations MUST apply the principle of data minimization: store only what is needed, for as long as needed, in the most efficient tier.

Begründung

Risiko	Beschreibung
Risk	Unstructured storage lifecycles leave data on expensive, energy-intensive tiers.
Risk	Missing tiering strategies prevent automatic migration of less-used data.

Risiko

Beschreibung

Risk

Unstructured storage lifecycles leave data on expensive, energy-intensive tiers.

Risk

Missing tiering strategies prevent automatic migration of less-used data.

Anforderungen

All storage resources (S3 buckets, EBS volumes, Azure Blob Storage, GCS buckets) MUST have lifecycle policies defined.
Data MUST be automatically tiered to cost- and energy-efficient cold storage after defined activity thresholds.
Log data MUST have retention limits.
Temporary data (build artifacts, test data, cache) MUST have explicit expiration.
Unattached EBS volumes and unused snapshots MUST be detected and purged.
Organizations MUST apply the principle of data minimization: store only what is needed, for as long as needed, in the most efficient tier.

Implementierungsleitfaden

Document the requirement in a version-controlled policy or standard.
Assign ownership and establish a review cadence (e.g., quarterly).
Implement the required configuration as code in Terraform or equivalent IaC.

Reifegrade

Level	Name	Kriterien
L1	Ad hoc – control not consistently applied	* Manual evidence exists for some workloads, but coverage is unknown.
L2	Standardised – policy defined and communicated	* A version-controlled policy, ADR, or standard describes the requirement.
L3	Integrated – automated validation in CI/CD	* Terraform checks run automatically on pull requests and report results.
L4	Auditable – metrics and exceptions tracked	* Control coverage, failures, and approved exceptions are reported quarterly.
L5	Optimised – continuous improvement based on data	* Control effectiveness is measured and iteratively improved.

Level

Name

Kriterien

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-sus-050.tf.aws.s3-lifecycle-required

Engine: terraform | Provider: aws | Automated: Ja

S3 buckets must have lifecycle configuration

Every S3 bucket must have an associated aws_s3_bucket_lifecycle_configuration resource with at least one transition and expiration rule. Buckets without lifecycle rules accumulate data indefinitely in the highest-energy storage tier.

Scope: resource — aws_s3_bucket_lifecycle_configuration

Assertions: * rule not empty — S3 lifecycle configuration has no rules defined.

Remediation: Add lifecycle rules to all S3 buckets. Minimum recommended configuration: Transition to STANDARD_IA after 30 days, GLACIER after 90 days, expire after retention-policy-defined period. Enable S3 Intelligent-Tiering for unpredictable access pattern buckets as an alternative.

Compliant

resource "aws_s3_bucket_lifecycle_configuration" "app_data" {
  bucket = aws_s3_bucket.app_data.id

  rule {
    id     = "data-lifecycle"
    status = "Enabled"

    transition {
      days          = 30
      storage_class = "STANDARD_IA"
    }
    transition {
      days          = 90
      storage_class = "GLACIER"
    }
    expiration {
      days = 730  # 2 years – adjust per data retention policy
    }
  }

  rule {
    id     = "expire-incomplete-multipart"
    status = "Enabled"
    abort_incomplete_multipart_upload {
      days_after_initiation = 7
    }
  }
}

Non-Compliant

resource "aws_s3_bucket" "app_data" {
  bucket = "acme-app-data"
  # No lifecycle configuration – WAF-SUS-050 Violation
}

waf-sus-050.tf.aws.ebs-no-orphan

Engine: terraform | Provider: aws | Automated: Ja

EBS volumes should be set to delete on instance termination

EBS volumes must have delete_on_termination = true unless there is a specific need for data persistence beyond instance lifetime. This prevents orphaned volumes from accumulating energy consumption after instances are terminated.

Scope: resource — aws_instance

Assertions: * root_block_device.delete_on_termination is true — Root EBS volume should be set to delete on termination to prevent orphaned volumes.

Remediation: Set delete_on_termination = true on root_block_device for EC2 instances unless you have an explicit requirement to retain root volumes. For data volumes, use separate aws_ebs_volume resources with lifecycle management.

Compliant

resource "aws_instance" "app" {
  ami           = data.aws_ami.ubuntu_arm.id
  instance_type = "m7g.large"

  root_block_device {
    volume_size           = 20
    volume_type           = "gp3"
    delete_on_termination = true  # prevent orphaned volumes
  }
}

Non-Compliant

resource "aws_instance" "app" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "m4.large"

  root_block_device {
    volume_size           = 20
    delete_on_termination = false  # WAF-SUS-050 Warning: orphaned volume risk
  }
}

waf-sus-050.tf.azurerm.blob-lifecycle

Engine: terraform | Provider: azurerm | Automated: Ja

Azure storage accounts should have blob lifecycle management policies

Azure Storage accounts must have lifecycle management policies to tier blobs to Cool and Archive tiers after appropriate activity thresholds. This reduces energy consumption in hot storage tiers.

Scope: resource — azurerm_storage_management_policy

Assertions: * rule not empty — Azure storage management policy has no lifecycle rules.

Remediation: Add lifecycle management rules to Azure Storage accounts. Transition blobs to Cool tier after 30 days, Archive tier after 90 days. Configure delete rules based on data retention policy. Use azurerm_storage_management_policy resource.

Compliant

resource "azurerm_storage_management_policy" "app_data" {
  storage_account_id = azurerm_storage_account.app.id

  rule {
    name    = "data-lifecycle"
    enabled = true
    filters {
      blob_types = ["blockBlob"]
    }
    actions {
      base_blob {
        tier_to_cool_after_days_since_modification_greater_than    = 30
        tier_to_archive_after_days_since_modification_greater_than = 90
        delete_after_days_since_modification_greater_than          = 730
      }
    }
  }
}

Non-Compliant

resource "azurerm_storage_account" "app" {
  name                     = "acmeappstorage"
  resource_group_name      = var.resource_group_name
  location                 = var.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
  # No lifecycle policy – WAF-SUS-050 Violation
}

waf-sus-050.tf.google.storage-lifecycle

Engine: terraform | Provider: google | Automated: Ja

GCS buckets must have lifecycle rules to transition or expire objects

Google Cloud Storage buckets must define lifecycle rules that transition objects to cheaper storage classes and expire stale objects to reduce storage emissions and cost.

Scope: resource — google_storage_bucket

Assertions: * lifecycle_rule not empty — GCS bucket must have at least one lifecycle rule to manage object retention.

Remediation: Add lifecycle_rule blocks to google_storage_bucket with age-based transitions to NEARLINE, COLDLINE, ARCHIVE and expiration for old objects.

Compliant

resource "google_storage_bucket" "data" {
  name          = "acme-data"
  location      = "EU"
  lifecycle_rule {
    action {
      type = "SetStorageClass"
      storage_class = "NEARLINE"
    }
    condition {
      age = 30
    }
  }
  lifecycle_rule {
    action {
      type = "Delete"
    }
    condition {
      age = 2555
    }
  }
}

Non-Compliant

resource "google_storage_bucket" "data" {
  name     = "acme-data"
  location = "EU"
  # No lifecycle rules configured
}

Evidenz

Art Erforderlich Beschreibung

Art	Erforderlich	Beschreibung
`iac`	Erforderlich	Terraform configuration implementing the control.
`governance`	Erforderlich	Policy, ADR, or standard documenting the requirement.
`config`	Optional	Cloud console or API output confirming runtime state.

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

WAF-SUS-050 – Storage Lifecycle & Data Minimization

Beschreibung

Begründung

Anforderungen

Implementierungsleitfaden

Reifegrade

Checks

waf-sus-050.tf.aws.s3-lifecycle-required

waf-sus-050.tf.aws.ebs-no-orphan

waf-sus-050.tf.azurerm.blob-lifecycle

waf-sus-050.tf.google.storage-lifecycle

Evidenz

Verwandte Controls