Wombat

WAF-COST-120 – Reserved capacity and savings plans MUST be reviewed and documented for steady-state workloads

Pillar: Cost | Severity: 🟡 Medium | Category: Cost Governance | Automatable: Medium

Description

Workloads with predictable baseline utilization MUST be evaluated for Reserved Instances, Reserved VM Instances, Committed Use Discounts, or Savings Plans. The reservation decision and coverage ratio MUST be documented in IaC or a FinOps register. Unused reservations MUST be reviewed quarterly and reallocated or sold where supported. Expiration dates MUST be tracked to avoid lapse into on-demand pricing.

Rationale

Risk Description

Risk

Persistent on-demand usage for predictable workloads wastes up to 60-70% of compute budget.

Risk

Unmonitored reservation expiration silently reverts workloads to expensive on-demand rates.

Requirements

  • Workloads with predictable baseline utilization MUST be evaluated for Reserved Instances, Reserved VM Instances, Committed Use Discounts, or Savings Plans.

  • The reservation decision and coverage ratio MUST be documented in IaC or a FinOps register.

  • Unused reservations MUST be reviewed quarterly and reallocated or sold where supported.

  • Expiration dates MUST be tracked to avoid lapse into on-demand pricing.

Implementation Guidance

  1. Document the requirement in a version-controlled policy, ADR, or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level Name Criteria

L1

Ad hoc – control not consistently applied

* Die Anforderung ist nicht einheitlich umgesetzt; Nachweis existiert nur punktuell oder fehlt.

L2

Standardised – policy defined and communicated

* Eine dokumentierte Policy oder ein Standard beschreibt die Anforderung.

L3

Integrated – automated validation in CI/CD

* Terraform-Checks oder IaC-Gates prüfen die Anforderung automatisch in CI/CD.

L4

Auditable – metrics and exceptions tracked

* Abdeckung, Ausnahmen und Qualitätsmetriken werden quartalsweise berichtet.

L5

Optimised – continuous improvement based on data

* Die Effektivität wird kontinuierlich gemessen und automatisch optimiert.

Checks

waf-cost-120.tf.aws.savings-plan

Engine: terraform | Provider: aws | Automated: Yes

AWS savings plans or reserved capacity must exist for steady-state compute

AWS savings plans or reserved capacity must exist for steady-state compute

Scope: resource — aws_savingsplans_plan, aws_ec2_host, aws_ec2_capacity_reservation

Assertions: * name attribute_exists — Reservation or savings plan must be defined for steady-state workloads.

Remediation: AWS savings plans or reserved capacity must exist for steady-state compute

Compliant
# Example compliant with waf-cost-120.tf.aws.savings-plan
Non-Compliant
# Example non-compliant with waf-cost-120.tf.aws.savings-plan

waf-cost-120.config.reservation-register

Engine: config | Provider: any | Automated: No

Reservation decisions must be documented in FinOps register

Reservation decisions must be documented in FinOps register

Scope: file — docs/finops/reservation-register.md

Assertions: * exists attribute_exists — Reservation register must document coverage ratio, expiration, and owner.

Remediation: Reservation decisions must be documented in FinOps register

Compliant
# Example compliant with waf-cost-120.config.reservation-register
Non-Compliant
# Example non-compliant with waf-cost-120.config.reservation-register

Evidence

  • Terraform configuration implementing the requirement.

  • Policy, ADR, or standard documenting the requirement.

  • Optional cloud console or API output confirming runtime state.

Related Controls