WAF-AGN-040 – Memory & State Management

Pillar: Agentic | Severity: High | Category: Logging Monitoring | Automatable: High

Description

Memories and states must be managed consistently. Agent memory MUST be versioned and versioned memory stores MUST be used. State persistence MUST be configured to prevent data loss. Memory and state changes MUST be audited for compliance.

Rationale

Risk	Description
Risk	Inconsistent memory management leads to conflicting decisions and data inconsistencies.
Risk	Uncontrolled state persistence may leak sensitive contexts across sessions or tenants.

Risk

Description

Risk

Inconsistent memory management leads to conflicting decisions and data inconsistencies.

Risk

Uncontrolled state persistence may leak sensitive contexts across sessions or tenants.

Requirements

Memories and states must be managed consistently.
Agent memory MUST be versioned and versioned memory stores MUST be used.
State persistence MUST be configured to prevent data loss.
Memory and state changes MUST be audited for compliance.

Implementation Guidance

Document the requirement in a version-controlled policy or standard.
Assign ownership and establish a review cadence (e.g., quarterly).
Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level	Name	Criteria
L1	Ad hoc – control not consistently applied	* Manual evidence exists for some workloads, but coverage is unknown.
L2	Standardised – policy defined and communicated	* A version-controlled policy, ADR, or standard describes the requirement.
L3	Integrated – automated validation in CI/CD	* Terraform checks run automatically on pull requests and report results.
L4	Auditable – metrics and exceptions tracked	* Control coverage, failures, and approved exceptions are reported quarterly.
L5	Optimised – continuous improvement based on data	* Control effectiveness is measured and iteratively improved.

Level

Name

Criteria

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-agn-040.tf.aws.memory-versioning-enabled

Engine: terraform | Provider: aws | Automated: Yes

Agent memory must be versioned

AWS Bedrock agent memory (sessions, context) must be versioned using DynamoDB versioned tables or S3 versioned buckets. Memory changes must be tracked with timestamps and version IDs.

Scope: resource — aws_dynamodb_table, aws_s3_bucket

Assertions: * name not empty — Memory table must have versioning configuration.

Remediation: Configure versioning on DynamoDB tables or S3 buckets used for agent memory. Use AWS SDK to track memory version IDs with each agent interaction.

Compliant

resource "aws_dynamodb_table" "agent_memory" {
  name         = "agent-memory"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "session_id"

  attribute {
    name = "session_id"
    type = "S"
  }

  attribute {
    name = "version"
    type = "S"
  }

  global_secondary_index {
    name = "version-index"
    hash_key = "session_id"
    range_key = "version"
  }

  # Versioning enabled via application logic
}

Non-Compliant

resource "aws_dynamodb_table" "agent-memory" {
  name         = "agent-memory"
  billing_mode = "PAY_PER_REQUEST"
  # No versioning tracking
  # WAF-AGN-040 Violation
}

waf-agn-040.tf.aws.state-persistence-enabled

Engine: terraform | Provider: aws | Automated: Yes

Agent state must be persistently stored

Agent state (conversation history, context, preferences) must be persistently stored in DynamoDB, S3, or RDS. In-memory state (Redis/ElastiCache) must have replication and automatic backup configured.

Scope: resource — aws_dynamodb_table, aws_s3_bucket, aws_rds_cluster

Assertions: * name not empty — State storage must have persistence configured.

Remediation: Configure persistent storage for agent state. Use DynamoDB tables with point-in-time recovery enabled, or S3 buckets with versioning. Configure backup policies for all state storage.

Compliant

resource "aws_dynamodb_table" "agent_state" {
  name         = "agent-state"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "agent_id"

  attribute {
    name = "agent_id"
    type = "S"
  }

  point_in_time_recovery {
    enabled = true
  }

  ttl {
    attribute_name = "expires_at"
    enabled        = true
  }
}

Non-Compliant

resource "aws_dynamodb_table" "no_persistence" {
  name         = "temp-state"
  billing_mode = "PAY_PER_REQUEST"
  # No point-in-time recovery
  # WAF-AGN-040 Violation
}

waf-agn-040.tf.aws.memory-audit-logging

Engine: terraform | Provider: aws | Automated: Yes

Memory and state changes must be audited

All memory and state modifications must be logged to CloudWatch Logs or CloudTrail. Logs must include agent ID, operation type (read/write/delete), timestamp, and data modified.

Scope: resource — aws_dynamodb_table, aws_cloudwatch_log_group

Assertions: * stream_enabled is true — Memory table must have stream enabled for audit logging.

Remediation: Configure CloudWatch Logs or CloudTrail to capture memory/state changes. Use Lambda triggers on DynamoDB streams to log all modifications with full audit trail.

Compliant

resource "aws_cloudwatch_log_group" "memory_audit" {
  name = "/aws/bedrock/memory-audit"
}

resource "aws_lambda_function" "memory_audit_log" {
  function_name = "memory-audit-log"
  # Triggers on DynamoDB stream
  # Logs all modifications
}

resource "aws_dynamodb_table" "agent_memory" {
  # With stream enabled for audit
  stream_enabled = true
  stream_view_type = "NEW_AND_OLD_IMAGES"
}

Non-Compliant

resource "aws_dynamodb_table" "no_audit" {
  name = "agent-memory"
  # No stream enabled, no audit logging
  # WAF-AGN-040 Violation
}

waf-agn-040.tf.azurerm.cosmosdb-backup-configured

Engine: terraform | Provider: azurerm | Automated: Yes

Azure Cosmos DB agent memory must have backup and versioning configured

Azure Cosmos DB accounts used for agent memory/state must have periodic backup configured to prevent data loss and enable recovery.

Scope: resource — azurerm_cosmosdb_account

Assertions: * backup attribute exists — Cosmos DB account used for agent memory must have backup configured.

Remediation: Configure backup on azurerm_cosmosdb_account with periodic backup or continuous backup. Enable point-in-time restore where supported.

Compliant

resource "azurerm_cosmosdb_account" "agent_memory" {
  name                = "agent-memory-cosmos"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  offer_type          = "Standard"
  kind                = "GlobalDocumentDB"

  backup {
    type                = "Periodic"
    interval_in_minutes = 240
    retention_in_hours  = 168
    storage_redundancy    = "Local"
  }
}

Non-Compliant

resource "azurerm_cosmosdb_account" "agent_memory" {
  name                = "agent-memory-cosmos"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  offer_type          = "Standard"
  # No backup block configured
  # WAF-AGN-040 Violation
}

waf-agn-040.tf.google.firestore-backup-audit

Engine: terraform | Provider: google | Automated: Yes

GCP Firestore agent memory must have backup and audit logging configured

GCP Firestore databases used for agent memory/state must have backup (PITR) enabled and audit logging configured to track memory changes.

Scope: resource — google_firestore_database, google_logging_project_sink

Assertions: * point_in_time_recovery_enablement equals POINT_IN_TIME_RECOVERY_ENABLED — Firestore database must have point-in-time recovery enabled for agent memory.

Remediation: Configure google_firestore_database with point_in_time_recovery_enablement enabled. Enable Cloud Audit Logs for datastore.googleapis.com.

Compliant

resource "google_firestore_database" "agent_memory" {
  name        = "agent-memory"
  location_id = "eur3"
  type        = "FIRESTORE_NATIVE"
  point_in_time_recovery_enablement = "POINT_IN_TIME_RECOVERY_ENABLED"
}

resource "google_logging_project_sink" "firestore_audit" {
  name        = "firestore-audit-sink"
  destination = "bigquery.googleapis.com/projects/my-project/datasets/firestore_audit"
  filter      = "protoPayload.serviceName="firestore.googleapis.com""
}

Non-Compliant

resource "google_firestore_database" "agent_memory" {
  name        = "agent-memory"
  location_id = "eur3"
  type        = "FIRESTORE_NATIVE"
  # No point-in-time recovery enabled
  # WAF-AGN-040 Violation
}

waf-agn-040.tf.stackit.agentic-memory-managed

Engine: terraform | Provider: stackit | Automated: Yes

Memories and states must be managed consistently for stackit

Memories and states must be managed consistently must be documented in IaC via a agentic-memory-managed tag/label on stackit_project. This validates the control is tracked as code.

Scope: resource — stackit_project

Assertions: * labels key exists — stackit_project is missing the agentic-memory-managed tag/label.

Remediation: Add a agentic-memory-managed tag/label to the stackit_project resource to show the stackit implementation of WAF-AGN-040 is tracked in IaC.

Compliant

resource "stackit_project" "example" {
  labels = {
    agentic-memory-managed = "true"
  }
}

Non-Compliant

resource "stackit_project" "example" {
  # Missing agentic-memory-managed labels
}

waf-agn-040.tf.ovh.agentic-memory-managed

Engine: terraform | Provider: ovh | Automated: Yes

Memories and states must be managed consistently for ovh

Memories and states must be managed consistently must be documented in IaC via a agentic-memory-managed tag/label on ovh_cloud_project. This validates the control is tracked as code.

Scope: resource — ovh_cloud_project

Assertions: * tags key exists — ovh_cloud_project is missing the agentic-memory-managed tag/label.

Remediation: Add a agentic-memory-managed tag/label to the ovh_cloud_project resource to show the ovh implementation of WAF-AGN-040 is tracked in IaC.

Compliant

resource "ovh_cloud_project" "example" {
  tags = {
    agentic-memory-managed = "true"
  }
}

Non-Compliant

resource "ovh_cloud_project" "example" {
  # Missing agentic-memory-managed tags
}

waf-agn-040.tf.hcloud.agentic-memory-managed

Engine: terraform | Provider: hcloud | Automated: Yes

Memories and states must be managed consistently for hcloud

Memories and states must be managed consistently must be documented in IaC via a agentic-memory-managed tag/label on hcloud_server. This validates the control is tracked as code.

Scope: resource — hcloud_server

Assertions: * labels key exists — hcloud_server is missing the agentic-memory-managed tag/label.

Remediation: Add a agentic-memory-managed tag/label to the hcloud_server resource to show the hcloud implementation of WAF-AGN-040 is tracked in IaC.

Compliant

resource "hcloud_server" "example" {
  labels = {
    agentic-memory-managed = "true"
  }
}

Non-Compliant

resource "hcloud_server" "example" {
  # Missing agentic-memory-managed labels
}

Evidence

Kind Required Description

Kind	Required	Description
`iac`	Required	Terraform configuration implementing the control.
`governance`	Required	Policy, ADR, or standard documenting the requirement.
`config`	Optional	Cloud console or API output confirming runtime state.

iac

Required

Terraform configuration implementing the control.

governance

Required

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Related Controls

Framework	Controls
ISO 27001:2022	* A.8.1 – Information security roles and responsibilities * A.8.2 – Privileged access rights * A.8.23 – Data leakage prevention
ISO 27017	* CLD.9.5 – Segregation in virtual computing environments
SOC 2 Type II	* CC4.1 – Monitoring activities * CC7.1 – Infrastructure and software monitoring
NIST SP 800-53	* SC-28 – Storage protection * SC-39 – Process isolation
NIST CSF 2.0	* DE.CM – Continuous monitoring * DE.DP – Data protection
GDPR	* Art. 32 – Security of processing * Art. 25 – Data protection by design
PCI DSS v4.0	* Req 4 – Encryption of cardholder data * Req 8 – Identify and authenticate access
CSA STAR	* CCM Data Security and Privacy
BSI C5:2020	* IDM-01 – Identity and access management policy
TISAX	* Information security – Data protection
ANSSI SecNumCloud	* Domain – Data protection
BIO	* BIO – Gegevensbeveiliging
ENS High	* op.dat.5 – Protección de los datos
UK NCSC CAF	* B3 – Storage and processing
FedRAMP	* SC-28, SC-39 (Moderate baseline)
CMMC 2.0	* SC.L2-3.8.1 –Protect data at rest
IT-Grundschutz	* ORP.5 – Informationstechnisch-related Schutz
IRAP	* ISM – Data protection
CCCS PBMM	* SC-28 – Storage protection
MAS TRM	* Ch.4 – Data management
ISMAP	* Data protection controls
FISC	* Technical measures – Data protection

Framework

Controls

ISO 27001:2022

* A.8.1 – Information security roles and responsibilities * A.8.2 – Privileged access rights * A.8.23 – Data leakage prevention

ISO 27017

* CLD.9.5 – Segregation in virtual computing environments

SOC 2 Type II

* CC4.1 – Monitoring activities * CC7.1 – Infrastructure and software monitoring

NIST SP 800-53

* SC-28 – Storage protection * SC-39 – Process isolation

NIST CSF 2.0

* DE.CM – Continuous monitoring * DE.DP – Data protection

GDPR

* Art. 32 – Security of processing * Art. 25 – Data protection by design

PCI DSS v4.0

* Req 4 – Encryption of cardholder data * Req 8 – Identify and authenticate access

CSA STAR

* CCM Data Security and Privacy

BSI C5:2020

* IDM-01 – Identity and access management policy

TISAX

* Information security – Data protection

ANSSI SecNumCloud

* Domain – Data protection

BIO

* BIO – Gegevensbeveiliging

ENS High

* op.dat.5 – Protección de los datos

UK NCSC CAF

* B3 – Storage and processing

FedRAMP

* SC-28, SC-39 (Moderate baseline)

CMMC 2.0

* SC.L2-3.8.1 –Protect data at rest

IT-Grundschutz

* ORP.5 – Informationstechnisch-related Schutz

IRAP

* ISM – Data protection

CCCS PBMM

* SC-28 – Storage protection

MAS TRM

* Ch.4 – Data management

ISMAP

* Data protection controls

FISC

* Technical measures – Data protection