WAF-PERF-070 – Network Latency & Topology Optimization

Pillar: Efficiancy | Severity: Medium | Category: Network Encryption | Automatable: High

Description

All production workloads MUST be deployed with network topology optimized for latency. Services that communicate frequently MUST be co-located in the same availability zone or use VPC peering to avoid cross-region traversal. Content Delivery Networks (CDN) MUST be used for all public-facing static and cacheable content. VPC Endpoints MUST be used for internal AWS service traffic to avoid internet routing. Cross-AZ data transfer costs and latency MUST be evaluated and minimized in service topology design.

Rationale

Risk	Description
Risk	Internet-facing resources or open management ports become direct attack vectors.
Risk	Lateral movement is easier when network segmentation and access rules are missing.

Risk

Description

Risk

Internet-facing resources or open management ports become direct attack vectors.

Risk

Lateral movement is easier when network segmentation and access rules are missing.

Requirements

All production workloads MUST be deployed with network topology optimized for latency.
Services that communicate frequently MUST be co-located in the same availability zone or use VPC peering to avoid cross-region traversal.
Content Delivery Networks (CDN) MUST be used for all public-facing static and cacheable content.
VPC Endpoints MUST be used for internal AWS service traffic to avoid internet routing.
Cross-AZ data transfer costs and latency MUST be evaluated and minimized in service topology design.

Implementation Guidance

Document the requirement in a version-controlled policy or standard.
Assign ownership and establish a review cadence (e.g., quarterly).
Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level	Name	Criteria
L1	Ad hoc – control not consistently applied	* Manual evidence exists for some workloads, but coverage is unknown.
L2	Standardised – policy defined and communicated	* A version-controlled policy, ADR, or standard describes the requirement.
L3	Integrated – automated validation in CI/CD	* Terraform checks run automatically on pull requests and report results.
L4	Auditable – metrics and exceptions tracked	* Control coverage, failures, and approved exceptions are reported quarterly.
L5	Optimised – continuous improvement based on data	* Control effectiveness is measured and iteratively improved.

Level

Name

Criteria

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-perf-070.tf.aws.vpc-endpoint-s3

Engine: terraform | Provider: aws | Automated: Yes

AWS VPCs with private subnets must have S3 Gateway VPC Endpoints

VPCs containing private subnets that access S3 must use Gateway VPC Endpoints to avoid internet routing and reduce latency and data transfer costs.

Scope: resource — aws_vpc_endpoint

Assertions: * service_name matches pattern .*\\.s3$ — VPC Endpoint should be configured for S3 service. * vpc_endpoint_type equals Gateway — S3 VPC Endpoint must be Gateway type.

Remediation: Create an aws_vpc_endpoint resource for S3 with vpc_endpoint_type = "Gateway" and associate it with private route tables. This routes S3 traffic via AWS backbone.

Compliant

resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
  tags = { Name = "vpce-s3-${var.environment}" }
}
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

Non-Compliant

# No VPC Endpoints defined
# S3 and DynamoDB traffic routes via internet gateway
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
  # All service traffic exits to internet – WAF-PERF-070 violation
}

waf-perf-070.tf.azurerm.cdn-profile-configured

Engine: terraform | Provider: azurerm | Automated: Yes

Azure applications with public endpoints should use CDN or Front Door

Public-facing Azure applications should use Azure CDN or Azure Front Door to cache static content and reduce origin load and end-user latency.

Scope: resource — azurerm_cdn_profile, azurerm_frontdoor, azurerm_cdn_frontdoor_profile

Assertions: * sku not empty — CDN profile must have SKU defined.

Remediation: Deploy azurerm_cdn_profile with endpoints for static content delivery. For global applications, use Azure Front Door for routing and caching.

Compliant

resource "azurerm_cdn_profile" "main" {
  name                = "cdn-payment-frontend"
  resource_group_name = azurerm_resource_group.main.name
  location            = "global"
  sku                 = "Standard_Microsoft"
}
resource "azurerm_cdn_endpoint" "static" {
  name                = "static-assets"
  profile_name        = azurerm_cdn_profile.main.name
  resource_group_name = azurerm_resource_group.main.name
  location            = "global"
  origin {
    name      = "storage-origin"
    host_name = azurerm_storage_account.static.primary_blob_host
  }
}

Non-Compliant

# No CDN or Front Door configured
# All static content served directly from Storage Account or App Service
# – WAF-PERF-070 violation

waf-perf-070.tf.google.cloud-cdn-enabled

Engine: terraform | Provider: google | Automated: Yes

GCP backends with public traffic should have Cloud CDN enabled

GCP HTTP(S) Load Balancer backend services serving public content should have Cloud CDN enabled to reduce origin latency and improve user experience.

Scope: resource — google_compute_backend_service

Assertions: * enable_cdn is true — External backend service should have Cloud CDN enabled.

Remediation: Set enable_cdn = true on google_compute_backend_service for external load balancers. Configure cdn_policy with appropriate cache mode and TTL settings.

Compliant

resource "google_compute_backend_service" "frontend" {
  name                  = "backend-payment-frontend"
  protocol              = "HTTP"
  load_balancing_scheme = "EXTERNAL"
  enable_cdn            = true
  cdn_policy {
    cache_mode                   = "CACHE_ALL_STATIC"
    default_ttl                  = 3600
    client_ttl                   = 3600
    negative_caching             = true
    serve_while_stale            = 86400
  }
  backend {
    group = google_compute_instance_group.frontend.id
  }
}

Non-Compliant

resource "google_compute_backend_service" "frontend" {
  name                  = "backend-payment-frontend"
  protocol              = "HTTP"
  load_balancing_scheme = "EXTERNAL"
  enable_cdn            = false  # CDN disabled – WAF-PERF-070 violation
}

waf-perf-070.tf.stackit.database-performance-reviewed

Engine: terraform | Provider: stackit | Automated: Yes

All production workloads for stackit

All production workloads must be documented in IaC via a database-performance-reviewed tag/label on stackit_project. This validates the control is tracked as code.

Scope: resource — stackit_project

Assertions: * labels key exists — stackit_project is missing the database-performance-reviewed tag/label.

Remediation: Add a database-performance-reviewed tag/label to the stackit_project resource to show the stackit implementation of WAF-PERF-070 is tracked in IaC.

Compliant

resource "stackit_project" "example" {
  labels = {
    database-performance-reviewed = "true"
  }
}

Non-Compliant

resource "stackit_project" "example" {
  # Missing database-performance-reviewed labels
}

waf-perf-070.tf.ovh.database-performance-reviewed

Engine: terraform | Provider: ovh | Automated: Yes

All production workloads for ovh

All production workloads must be documented in IaC via a database-performance-reviewed tag/label on ovh_cloud_project. This validates the control is tracked as code.

Scope: resource — ovh_cloud_project

Assertions: * tags key exists — ovh_cloud_project is missing the database-performance-reviewed tag/label.

Remediation: Add a database-performance-reviewed tag/label to the ovh_cloud_project resource to show the ovh implementation of WAF-PERF-070 is tracked in IaC.

Compliant

resource "ovh_cloud_project" "example" {
  tags = {
    database-performance-reviewed = "true"
  }
}

Non-Compliant

resource "ovh_cloud_project" "example" {
  # Missing database-performance-reviewed tags
}

waf-perf-070.tf.hcloud.database-performance-reviewed

Engine: terraform | Provider: hcloud | Automated: Yes

All production workloads for hcloud

All production workloads must be documented in IaC via a database-performance-reviewed tag/label on hcloud_server. This validates the control is tracked as code.

Scope: resource — hcloud_server

Assertions: * labels key exists — hcloud_server is missing the database-performance-reviewed tag/label.

Remediation: Add a database-performance-reviewed tag/label to the hcloud_server resource to show the hcloud implementation of WAF-PERF-070 is tracked in IaC.

Compliant

resource "hcloud_server" "example" {
  labels = {
    database-performance-reviewed = "true"
  }
}

Non-Compliant

resource "hcloud_server" "example" {
  # Missing database-performance-reviewed labels
}

Evidence

Kind Required Description

Kind	Required	Description
`iac`	Required	Terraform configuration implementing the control.
`governance`	Required	Policy, ADR, or standard documenting the requirement.
`config`	Optional	Cloud console or API output confirming runtime state.

iac

Required

Terraform configuration implementing the control.

governance

Required

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Related Controls

Framework	Controls
ISO/IEC 25010	* Performance Efficiency – Time Behavior

Framework

Controls

ISO/IEC 25010

* Performance Efficiency – Time Behavior