WAF-PERF-010 – Compute Instance Type & Sizing Validated

Pillar: Efficiancy | Severity: High | Category: Container Security | Automatable: High

Description

All compute resources (virtual machines, container workloads, managed compute services) MUST be sized based on measured workload requirements and validated performance baselines. Instance type selection MUST be documented in architecture records or sizing sheets. Oversized resources (utilization < 20% sustained) and undersized resources (sustained CPU/memory > 80% for non-autoscaling workloads) MUST be flagged and reviewed on a quarterly basis.

Rationale

Risk	Description
Risk	Outdated or wrongly sized compute instances waste cost and miss performance targets.
Risk	Missing SKU reviews lead to resources that are neither efficient nor resilient.

Risk

Description

Risk

Outdated or wrongly sized compute instances waste cost and miss performance targets.

Risk

Missing SKU reviews lead to resources that are neither efficient nor resilient.

Requirements

All compute resources (virtual machines, container workloads, managed compute services) MUST be sized based on measured workload requirements and validated performance baselines.
Instance type selection MUST be documented in architecture records or sizing sheets.
Oversized resources (utilization < 20% sustained) and undersized resources (sustained CPU/memory > 80% for non-autoscaling workloads) MUST be flagged and reviewed on a quarterly basis.

Implementation Guidance

Document the requirement in a version-controlled policy or standard.
Assign ownership and establish a review cadence (e.g., quarterly).
Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level	Name	Criteria
L1	Ad hoc – control not consistently applied	* Manual evidence exists for some workloads, but coverage is unknown.
L2	Standardised – policy defined and communicated	* A version-controlled policy, ADR, or standard describes the requirement.
L3	Integrated – automated validation in CI/CD	* Terraform checks run automatically on pull requests and report results.
L4	Auditable – metrics and exceptions tracked	* Control coverage, failures, and approved exceptions are reported quarterly.
L5	Optimised – continuous improvement based on data	* Control effectiveness is measured and iteratively improved.

Level

Name

Criteria

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-perf-010.tf.aws.ec2-current-generation

Engine: terraform | Provider: aws | Automated: Yes

AWS EC2 instances must use current-generation instance types

EC2 instances must not use previous-generation instance types (t2, m4, c4, r4, i2, d2, etc.). Current-generation instance types provide significantly better price-performance. All instances must be documented with a sizing rationale.

Scope: resource — aws_instance, aws_launch_template, aws_launch_configuration

Assertions: * instance_type not matches pattern ^(t2|m4|c4|r4|i2|d2|hs1|m3|c3|cr1|cc2|g2|hi1)\\..* — Instance is using a previous-generation type. Migrate to t3/t4g, m5/m6i, c5/c6i, or r5/r6i. * instance_type attribute exists — Instance type must be explicitly declared; no default allowed.

Remediation: Replace previous-generation instance types with current-generation equivalents. t2.* → t3.* or t4g.; m4. → m6i.; c4. → c6i.; r4. → r6i.*. Run AWS Compute Optimizer to get right-sizing recommendations before migrating.

Compliant

resource "aws_instance" "app" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.medium"  # Current-generation, validated with Compute Optimizer
  tags = {
    sizing-reviewed = "2026-01-15"
    workload        = "payment-api"
  }
}

Non-Compliant

resource "aws_instance" "app" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t2.medium"  # Previous-generation – WAF-PERF-010 violation
}

waf-perf-010.tf.azurerm.vm-sizing-documented

Engine: terraform | Provider: azurerm | Automated: Yes

Azure VMs must use current-generation sizes and have sizing metadata

Azure virtual machines must not use deprecated or previous-generation VM sizes. Sizing metadata must be present as tags on the resource.

Scope: resource — azurerm_linux_virtual_machine, azurerm_windows_virtual_machine, azurerm_virtual_machine_scale_set

Assertions: * size not matches pattern ^Standard_(A|D1$|D2$|D3$|D4$|DS1$|DS2$|DS3$|DS4$)$ — VM is using a deprecated or previous-generation size. Upgrade to Dv5 or Ev5 series. * tags key exists — VM must have a 'sizing-reviewed' tag with the date of the last sizing review.

Remediation: Replace deprecated VM sizes with current-generation equivalents (Dv5, Ev5, Bsv2, Dsv5). Use Azure Advisor recommendations for right-sizing guidance. Add a 'sizing-reviewed' tag with the review date.

Compliant

resource "azurerm_linux_virtual_machine" "app" {
  name                = "vm-payment-api"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  size                = "Standard_D2s_v5"
  tags = {
    sizing-reviewed = "2026-01-15"
    workload        = "payment-api"
  }
}

Non-Compliant

resource "azurerm_linux_virtual_machine" "app" {
  name                = "vm-payment-api"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  size                = "Standard_D2"  # Deprecated size – WAF-PERF-010 violation
}

waf-perf-010.tf.google.gce-machine-type-validated

Engine: terraform | Provider: google | Automated: Yes

GCP Compute Engine instances must use N2 or C2 series machine types

GCP VM instances must not use first-generation N1 machine types for production workloads. N2, N2D, C2, E2, or C3 series offer better performance and price-performance ratios.

Scope: resource — google_compute_instance, google_compute_instance_template

Assertions: * machine_type not matches pattern ^n1-(standard|highmem|highcpu)-.* — GCP instance uses N1 machine type. Migrate to N2, N2D, C2, or E2 series for better performance.

Remediation: Replace N1 machine types with current-generation equivalents. n1-standard-* → n2-standard-; n1-highmem- → n2-highmem-; n1-highcpu- → c2-standard-*. Use GCP Recommender for right-sizing analysis.

Compliant

resource "google_compute_instance" "app" {
  name         = "payment-api"
  machine_type = "n2-standard-2"
  zone         = "europe-west3-a"
  boot_disk {
    initialize_params { image = "debian-cloud/debian-11" }
  }
}

Non-Compliant

resource "google_compute_instance" "app" {
  name         = "payment-api"
  machine_type = "n1-standard-2"  # N1 series – WAF-PERF-010 violation
  zone         = "europe-west3-a"
}

waf-perf-010.tf.stackit.performance-slo-defined

Engine: terraform | Provider: stackit | Automated: Yes

All compute resources (virtual machines, container workloads, managed… for stackit

All compute resources (virtual machines, container workloads, managed… must be documented in IaC via a performance-slo-defined tag/label on stackit_project. This validates the control is tracked as code.

Scope: resource — stackit_project

Assertions: * labels key exists — stackit_project is missing the performance-slo-defined tag/label.

Remediation: Add a performance-slo-defined tag/label to the stackit_project resource to show the stackit implementation of WAF-PERF-010 is tracked in IaC.

Compliant

resource "stackit_project" "example" {
  labels = {
    performance-slo-defined = "true"
  }
}

Non-Compliant

resource "stackit_project" "example" {
  # Missing performance-slo-defined labels
}

waf-perf-010.tf.ovh.performance-slo-defined

Engine: terraform | Provider: ovh | Automated: Yes

All compute resources (virtual machines, container workloads, managed… for ovh

All compute resources (virtual machines, container workloads, managed… must be documented in IaC via a performance-slo-defined tag/label on ovh_cloud_project. This validates the control is tracked as code.

Scope: resource — ovh_cloud_project

Assertions: * tags key exists — ovh_cloud_project is missing the performance-slo-defined tag/label.

Remediation: Add a performance-slo-defined tag/label to the ovh_cloud_project resource to show the ovh implementation of WAF-PERF-010 is tracked in IaC.

Compliant

resource "ovh_cloud_project" "example" {
  tags = {
    performance-slo-defined = "true"
  }
}

Non-Compliant

resource "ovh_cloud_project" "example" {
  # Missing performance-slo-defined tags
}

waf-perf-010.tf.hcloud.performance-slo-defined

Engine: terraform | Provider: hcloud | Automated: Yes

All compute resources (virtual machines, container workloads, managed… for hcloud

All compute resources (virtual machines, container workloads, managed… must be documented in IaC via a performance-slo-defined tag/label on hcloud_server. This validates the control is tracked as code.

Scope: resource — hcloud_server

Assertions: * labels key exists — hcloud_server is missing the performance-slo-defined tag/label.

Remediation: Add a performance-slo-defined tag/label to the hcloud_server resource to show the hcloud implementation of WAF-PERF-010 is tracked in IaC.

Compliant

resource "hcloud_server" "example" {
  labels = {
    performance-slo-defined = "true"
  }
}

Non-Compliant

resource "hcloud_server" "example" {
  # Missing performance-slo-defined labels
}

Evidence

Kind Required Description

Kind	Required	Description
`iac`	Required	Terraform configuration implementing the control.
`governance`	Required	Policy, ADR, or standard documenting the requirement.
`config`	Optional	Cloud console or API output confirming runtime state.

iac

Required

Terraform configuration implementing the control.

governance

Required

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Related Controls

Framework	Controls
ISO/IEC 25010	* Performance Efficiency – Time Behavior * Performance Efficiency – Resource Utilization * Performance Efficiency – Capacity

Framework

Controls

ISO/IEC 25010

* Performance Efficiency – Time Behavior * Performance Efficiency – Resource Utilization * Performance Efficiency – Capacity