Wombat

WAF-COST-110 – Spot and preemptible instances MUST be explicitly allowed and documented where workload characteristics permit

Pillar: Cost | Severity: 🟡 Medium | Category: Data Governance | Automatable: Medium

Description

Workloads that tolerate interruption MUST use Spot/Preemptible instances by default unless business justification documents on-demand use. IaC definitions MUST tag interruptible workloads with spot-eligibility and maximum Spot price or eviction policy. Auto Scaling Groups and Managed Instance Groups SHOULD define mixed instance policies combining Spot and On-Demand capacity. Documentation MUST cover workload interruption handling and fallback behavior.

Rationale

Risk Description

Risk

Always using on-demand compute for interruptible workloads increases cost without reliability benefit.

Risk

Undocumented Spot usage leads to inconsistent financial planning and surprise evictions.

Requirements

  • Workloads that tolerate interruption MUST use Spot/Preemptible instances by default unless business justification documents on-demand use.

  • IaC definitions MUST tag interruptible workloads with spot-eligibility and maximum Spot price or eviction policy.

  • Auto Scaling Groups and Managed Instance Groups SHOULD define mixed instance policies combining Spot and On-Demand capacity.

  • Documentation MUST cover workload interruption handling and fallback behavior.

Implementation Guidance

  1. Document the requirement in a version-controlled policy, ADR, or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level Name Criteria

L1

Ad hoc – control not consistently applied

* Die Anforderung ist nicht einheitlich umgesetzt; Nachweis existiert nur punktuell oder fehlt.

L2

Standardised – policy defined and communicated

* Eine dokumentierte Policy oder ein Standard beschreibt die Anforderung.

L3

Integrated – automated validation in CI/CD

* Terraform-Checks oder IaC-Gates prüfen die Anforderung automatisch in CI/CD.

L4

Auditable – metrics and exceptions tracked

* Abdeckung, Ausnahmen und Qualitätsmetriken werden quartalsweise berichtet.

L5

Optimised – continuous improvement based on data

* Die Effektivität wird kontinuierlich gemessen und automatisch optimiert.

Checks

waf-cost-110.tf.aws.spot-tagged

Engine: terraform | Provider: aws | Automated: Yes

AWS interruptible workloads must carry spot-eligibility tag

AWS interruptible workloads must carry spot-eligibility tag

Scope: resource — aws_autoscaling_group, aws_spot_instance_request, aws_ec2_fleet

Assertions: * tags key_exists spot-eligibility — Interruptible workload must be tagged with spot-eligibility.

Remediation: AWS interruptible workloads must carry spot-eligibility tag

Compliant
# Example compliant with waf-cost-110.tf.aws.spot-tagged
Non-Compliant
# Example non-compliant with waf-cost-110.tf.aws.spot-tagged

waf-cost-110.tf.azurerm.spot-eviction-policy

Engine: terraform | Provider: azurerm | Automated: Yes

Azure Spot VMs must define eviction policy

Azure Spot VMs must define eviction policy

Scope: resource — azurerm_linux_virtual_machine, azurerm_windows_virtual_machine

Assertions: * priority in ['Spot', 'spot'] — Spot VM must have priority Spot with eviction policy.

Remediation: Azure Spot VMs must define eviction policy

Compliant
# Example compliant with waf-cost-110.tf.azurerm.spot-eviction-policy
Non-Compliant
# Example non-compliant with waf-cost-110.tf.azurerm.spot-eviction-policy

waf-cost-110.config.spot-policy-documented

Engine: config | Provider: any | Automated: No

Spot instance policy must be documented

Spot instance policy must be documented

Scope: file — docs/finops/spot-policy.md

Assertions: * exists attribute_exists — Spot/preemptible policy must document eligible workload classes.

Remediation: Spot instance policy must be documented

Compliant
# Example compliant with waf-cost-110.config.spot-policy-documented
Non-Compliant
# Example non-compliant with waf-cost-110.config.spot-policy-documented

Evidence

  • Terraform configuration implementing the requirement.

  • Policy, ADR, or standard documenting the requirement.

  • Optional cloud console or API output confirming runtime state.

Related Controls