Wombat

WAF-SUS-080 – Network & Data Transfer Efficiency

Säule: Sustainability | Schweregrad: Mittel | Kategorie: Network Encryption | Automatisierbar: High

Beschreibung

All data transfers MUST be designed to minimize unnecessary movement across network boundaries. Cross-region data transfers MUST be justified; same-region communication MUST be preferred. Content Delivery Networks (CDN) MUST be used for all user-facing static and semi-static content. HTTP compression (gzip/brotli) MUST be enabled for all API responses larger than 1KB. VPC Endpoints MUST be used for AWS service communication to avoid internet gateway egress. Data transfer optimization is both a cost control and a carbon reduction measure: every byte transferred consumes network energy; minimizing transfers minimizes emissions.

Begründung

Risiko Beschreibung

Risk

Unnecessary data transfers across regions increase network cost and emissions.

Risk

Missing data-locality strategies waste bandwidth and slow down workloads.

Anforderungen

  • All data transfers MUST be designed to minimize unnecessary movement across network boundaries.

  • Cross-region data transfers MUST be justified; same-region communication MUST be preferred.

  • Content Delivery Networks (CDN) MUST be used for all user-facing static and semi-static content.

  • HTTP compression (gzip/brotli) MUST be enabled for all API responses larger than 1KB.

  • VPC Endpoints MUST be used for AWS service communication to avoid internet gateway egress.

Implementierungsleitfaden

  1. Implement the required configuration as code in Terraform or equivalent IaC.

  2. Add an automated check to CI/CD so deviations are caught before deployment.

Reifegrade

Level Name Kriterien

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-sus-080.tf.aws.cloudfront-compression

Engine: terraform | Provider: aws | Automated: Ja

CloudFront distributions must enable compression

CloudFront distributions must have compress = true on all cache behaviors to automatically compress compressible content (text, JSON, HTML, CSS, JavaScript) before delivery. This reduces data transfer volume by 60-80% for text content.

Scope: resource — aws_cloudfront_distribution

Assertions: * default_cache_behavior.compress is true — CloudFront distribution does not have compression enabled – enable compress = true for 60-80% transfer reduction.

Remediation: Set compress = true on all cache_behavior and default_cache_behavior blocks in the CloudFront distribution. CloudFront will automatically compress eligible responses (text/html, text/css, application/json, etc.) using gzip or brotli.

Compliant
resource "aws_cloudfront_distribution" "web" {
  default_cache_behavior {
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    target_origin_id       = "web-origin"
    viewer_protocol_policy = "redirect-to-https"
    compress               = true  # 60-80% transfer reduction for text content
  }
  # ...
}
Non-Compliant
resource "aws_cloudfront_distribution" "web" {
  default_cache_behavior {
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    target_origin_id       = "web-origin"
    viewer_protocol_policy = "redirect-to-https"
    compress               = false  # WAF-SUS-080 Violation: uncompressed delivery
  }
}

waf-sus-080.tf.aws.vpc-endpoint-s3

Engine: terraform | Provider: aws | Automated: Ja

VPC should have S3 and DynamoDB gateway endpoints to avoid internet egress

S3 and DynamoDB gateway VPC Endpoints allow EC2 instances and Lambda functions to communicate with these services through the AWS private network instead of through an internet gateway. This eliminates internet data transfer charges and energy, as the traffic stays within AWS’s backbone network.

Scope: resource — aws_vpc_endpoint

Assertions: * service_name not empty — VPC endpoint has no service_name – check configuration.

Remediation: Create gateway VPC endpoints for com.amazonaws.REGION.s3 and com.amazonaws.REGION.dynamodb in each VPC. Associate them with all route tables. For interface endpoints (STS, ECR, CloudWatch, SSM): create them in private subnets to eliminate all internet gateway dependencies.

Compliant
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = aws_route_table.private[*].id
  tags = {
    Name    = "s3-gateway-endpoint"
    purpose = "eliminate-internet-egress"
  }
}

resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = aws_route_table.private[*].id
}
Non-Compliant
# VPC with no endpoints – all AWS service traffic goes via internet gateway
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
  # WAF-SUS-080 Warning: no VPC endpoints configured
}

waf-sus-080.tf.azurerm.cdn-compression

Engine: terraform | Provider: azurerm | Automated: Ja

Azure CDN endpoints must have compression enabled

Azure CDN endpoints should have compression enabled to reduce data transfer volume for compressible content types. Without compression, each user receives the full uncompressed payload, multiplying network energy consumption.

Scope: resource — azurerm_cdn_endpoint

Assertions: * is_compression_enabled is true — Azure CDN endpoint has compression disabled – enable for significant transfer reduction.

Remediation: Set is_compression_enabled = true and provide content_types_to_compress list including text/html, text/css, application/json, application/javascript. Ensure origin also supports compressed responses or configure CDN-level compression.

Compliant
resource "azurerm_cdn_endpoint" "web" {
  name                = "web-cdn"
  profile_name        = azurerm_cdn_profile.main.name
  resource_group_name = var.resource_group_name
  location            = "global"
  origin_host_header  = azurerm_storage_account.web.primary_blob_host

  is_compression_enabled = true
  content_types_to_compress = [
    "text/html",
    "text/css",
    "application/json",
    "application/javascript",
    "image/svg+xml",
  ]
}
Non-Compliant
resource "azurerm_cdn_endpoint" "web" {
  name                   = "web-cdn"
  profile_name           = azurerm_cdn_profile.main.name
  resource_group_name    = var.resource_group_name
  location               = "global"
  is_compression_enabled = false  # WAF-SUS-080 Violation
}

waf-sus-080.tf.google.backend-compression

Engine: terraform | Provider: google | Automated: Ja

GCP backend services and buckets should have compression enabled

GCP backend services (global and regional) and backend buckets used with Cloud CDN should enable compression to reduce outbound data transfer and energy consumption.

Scope: resource — google_compute_backend_service, google_compute_backend_bucket

Assertions: * compression_mode equals AUTOMATIC — GCP backend service/bucket should have compression_mode set to AUTOMATIC.

Remediation: Set compression_mode = "AUTOMATIC" on google_compute_backend_service and google_compute_backend_bucket where supported by Cloud CDN.

Compliant
resource "google_compute_backend_service" "api" {
  name             = "api-backend"
  compression_mode = "AUTOMATIC"
  enable_cdn       = true
}
Non-Compliant
resource "google_compute_backend_service" "api" {
  name             = "api-backend"
  compression_mode = "DISABLED"
}

Evidenz

Art Erforderlich Beschreibung

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Verwandte Controls

Framework Controls

Green Software Foundation

* Energy Efficiency – minimize network data transfer * Software Carbon Intensity (SCI) – network embodied energy

EU CSRD (Corporate Sustainability Reporting Directive)

* ESRS E1 – Climate Change – operational energy efficiency

GHG Protocol

* Scope 3 Category 11 – reducing network-related cloud emissions