WAF-COST-030 – Resource Rightsizing & Idle Detection

Pillar: Cost | Severity: Medium | Category: Container Security | Automatable: High

Description

All persistent compute resources (EC2 instances, VMs, RDS instances, Kubernetes node groups) MUST carry a 'rightsizing-reviewed' tag with the date of the last review (ISO 8601, YYYY-MM-DD). Reviews must be performed at least every 90 days. Resources tagged with a review date older than 90 days are considered non-compliant. Idle detection must be configured for all compute workloads (CPU utilization < 5% over 7 days triggers an alert).

Rationale

Risk	Description
Risk	Unreviewed compute resources permanently lead to over-provisioning and cloud waste.
Risk	Missing rightsizing evidence complicates FinOps reviews and budget accountability.

Risk

Description

Risk

Unreviewed compute resources permanently lead to over-provisioning and cloud waste.

Risk

Missing rightsizing evidence complicates FinOps reviews and budget accountability.

Requirements

All persistent compute resources (EC2 instances, VMs, RDS instances, Kubernetes node groups) MUST carry a 'rightsizing-reviewed' tag with the date of the last review (ISO 8601, YYYY-MM-DD).
Reviews must be performed at least every 90 days.
Idle detection must be configured for all compute workloads (CPU utilization < 5% over 7 days triggers an alert).

Implementation Guidance

Document the requirement in a version-controlled policy or standard.
Assign ownership and establish a review cadence (e.g., quarterly).
Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level	Name	Criteria
L1	Ad hoc – control not consistently applied	* Manual evidence exists for some workloads, but coverage is unknown.
L2	Standardised – policy defined and communicated	* A version-controlled policy, ADR, or standard describes the requirement.
L3	Integrated – automated validation in CI/CD	* Terraform checks run automatically on pull requests and report results.
L4	Auditable – metrics and exceptions tracked	* Control coverage, failures, and approved exceptions are reported quarterly.
L5	Optimised – continuous improvement based on data	* Control effectiveness is measured and iteratively improved.

Level

Name

Criteria

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-cost-030.tf.aws.ec2-rightsizing-tag-required

Engine: terraform | Provider: aws | Automated: Yes

EC2 instances must have 'rightsizing-reviewed' tag

All EC2 instances must carry a 'rightsizing-reviewed' tag with the date (YYYY-MM-DD) of the last rightsizing review. This tag proves active resource management and enables automated detection of resources that have not been reviewed within 90 days.

Scope: resource — aws_instance, aws_launch_template

Assertions: * tags key exists — EC2 instance is missing the 'rightsizing-reviewed' tag. All compute resources must be actively reviewed.

Remediation: Add 'rightsizing-reviewed' tag to all EC2 instances and launch templates. Value format: YYYY-MM-DD (ISO 8601 date of last review). Example: rightsizing-reviewed = "2025-03-01" Schedule the next review within 90 days.

Compliant

resource "aws_instance" "app" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.medium"
  tags = merge(module.mandatory_tags.tags, {
    rightsizing-reviewed = "2025-03-01"
    rightsizing-result   = "no-change"
    capacity-commitment  = "on-demand"
  })
}

Non-Compliant

resource "aws_instance" "app" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.medium"
  tags = {
    cost-center = "fintech-platform"
    owner       = "payments-team"
    environment = "production"
    workload    = "payment-service"
    # Missing: rightsizing-reviewed – WAF-COST-030 violation
  }
}

waf-cost-030.tf.azurerm.vm-rightsizing-tag

Engine: terraform | Provider: azurerm | Automated: Yes

Azure VMs must have 'rightsizing-reviewed' tag

All Azure Virtual Machines must carry a 'rightsizing-reviewed' tag with the ISO 8601 date of the last rightsizing review, proving active management of compute costs.

Scope: resource — azurerm_virtual_machine, azurerm_linux_virtual_machine, azurerm_windows_virtual_machine, azurerm_kubernetes_cluster

Assertions: * tags key exists — Azure VM is missing 'rightsizing-reviewed' tag.

Remediation: Add 'rightsizing-reviewed' tag to all Azure compute resources. Use Azure Advisor recommendations to inform the rightsizing review.

Compliant

resource "azurerm_linux_virtual_machine" "app" {
  name                = "vm-payment-app-prod"
  resource_group_name = azurerm_resource_group.main.name
  location            = var.location
  size                = "Standard_D2s_v3"
  tags = merge(local.mandatory_tags, {
    "rightsizing-reviewed" = "2025-03-01"
    "rightsizing-result"   = "no-change"
  })
}

Non-Compliant

resource "azurerm_linux_virtual_machine" "app" {
  name                = "vm-payment-app-prod"
  resource_group_name = azurerm_resource_group.main.name
  location            = var.location
  size                = "Standard_D8s_v3"  # May be oversized; no review proof
  # Missing: rightsizing-reviewed tag
}

waf-cost-030.tf.google.compute-rightsizing-tag

Engine: terraform | Provider: google | Automated: Yes

GCP compute instances must have 'rightsizing-reviewed' label

All GCP Compute Engine instances and GKE node pools must carry a 'rightsizing-reviewed' label with the ISO 8601 date of the last rightsizing review, proving active management of compute costs.

Scope: resource — google_compute_instance, google_container_node_pool

Assertions: * labels key exists — GCP compute instance is missing 'rightsizing-reviewed' label.

Remediation: Add 'rightsizing-reviewed' label to all google_compute_instance and google_container_node_pool resources. Value format: YYYY-MM-DD. Use GCP Recommender rightsizing insights to inform the review.

Compliant

resource "google_compute_instance" "app" {
  name         = "vm-payment-app-prod"
  machine_type = "e2-medium"
  zone         = var.zone

  labels = merge(module.mandatory_tags.labels, {
    rightsizing-reviewed = "2025-03-01"
    rightsizing-result   = "no-change"
  })
}

Non-Compliant

resource "google_compute_instance" "app" {
  name         = "vm-payment-app-prod"
  machine_type = "e2-standard-8"  # May be oversized; no review proof
  # Missing: rightsizing-reviewed label
}

waf-cost-030.tf.stackit.server-rightsizing-tag

Engine: terraform | Provider: stackit | Automated: Yes

STACKIT compute resources must have a rightsizing-reviewed tag or label

STACKIT compute resources must have a rightsizing-reviewed tag or label. This check validates the Terraform configuration uses the expected resource and attribute.

Scope: resource — stackit_server, stackit_ske_cluster, stackit_ske_node_pool

Assertions: * labels key exists — STACKIT compute resource is missing the 'rightsizing-reviewed' label.

Remediation: Review the Terraform configuration for the listed resource types and ensure the required attribute or tag is present. See the control narrative for provider-specific guidance.

Compliant

# Example resource meets the requirement.
resource "stackit_server" "example" {
  # required attribute/tag/label present
}

Non-Compliant

# Example resource does not meet the requirement.
resource "stackit_server" "example" {
  # Missing required attribute/tag/label
}

waf-cost-030.tf.ovh.instance-rightsizing-tag

Engine: terraform | Provider: ovh | Automated: Yes

OVHcloud compute resources must have a rightsizing-reviewed tag

OVHcloud compute resources must have a rightsizing-reviewed tag. This check validates the Terraform configuration uses the expected resource and attribute.

Scope: resource — ovh_cloud_project_instance, ovh_vps, ovh_dedicated_server, ovh_cloud_project_kube, ovh_cloud_project_kube_nodepool

Assertions: * tags key exists — OVHcloud compute resource is missing the 'rightsizing-reviewed' tag.

Remediation: Review the Terraform configuration for the listed resource types and ensure the required attribute or tag is present. See the control narrative for provider-specific guidance.

Compliant

# Example resource meets the requirement.
resource "ovh_cloud_project_instance" "example" {
  # required attribute/tag/label present
}

Non-Compliant

# Example resource does not meet the requirement.
resource "ovh_cloud_project_instance" "example" {
  # Missing required attribute/tag/label
}

waf-cost-030.tf.hcloud.server-rightsizing-label

Engine: terraform | Provider: hcloud | Automated: Yes

Hetzner Cloud compute resources must have a rightsizing-reviewed label

Hetzner Cloud compute resources must have a rightsizing-reviewed label. This check validates the Terraform configuration uses the expected resource and attribute.

Scope: resource — hcloud_server

Assertions: * labels key exists — Hetzner Cloud server is missing the 'rightsizing-reviewed' label.

Remediation: Review the Terraform configuration for the listed resource types and ensure the required attribute or tag is present. See the control narrative for provider-specific guidance.

Compliant

# Example resource meets the requirement.
resource "hcloud_server" "example" {
  # required attribute/tag/label present
}

Non-Compliant

# Example resource does not meet the requirement.
resource "hcloud_server" "example" {
  # Missing required attribute/tag/label
}

Evidence

Kind Required Description

Kind	Required	Description
`iac`	Required	Terraform configuration implementing the control.
`governance`	Required	Policy, ADR, or standard documenting the requirement.
`config`	Optional	Cloud console or API output confirming runtime state.

iac

Required

Terraform configuration implementing the control.

governance

Required

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Related Controls

Framework	Controls
FinOps Foundation	* Optimize Phase – Rightsizing and Resource Optimization * Operate Phase – Continuous Resource Review

Framework

Controls

FinOps Foundation

* Optimize Phase – Rightsizing and Resource Optimization * Operate Phase – Continuous Resource Review