Wombat

WAF-REL-110 – Circuit breaker, backpressure, and rate limiting MUST be defined for downstream dependencies

Pillar: Reliability | Severity: 🟠 High | Category: Reliability Design | Automatable: High

Description

Every downstream HTTP/gRPC dependency MUST have explicit timeout, retry, circuit breaker, and bulkhead configuration. Services MUST propagate backpressure instead of accepting unbounded load. Rate limits MUST protect backends from accidental or malicious overload. Configuration MUST be observable through metrics and tested via chaos or fault injection.

Rationale

Risk Description

Risk

Cascading failures spread when a single slow dependency saturates all callers.

Risk

Unbounded retries during outages amplify load and prevent recovery of failing services.

Requirements

  • Every downstream HTTP/gRPC dependency MUST have explicit timeout, retry, circuit breaker, and bulkhead configuration.

  • Services MUST propagate backpressure instead of accepting unbounded load.

  • Rate limits MUST protect backends from accidental or malicious overload.

  • Configuration MUST be observable through metrics and tested via chaos or fault injection.

Implementation Guidance

  1. Document the requirement in a version-controlled policy, ADR, or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level Name Criteria

L1

Ad hoc – control not consistently applied

* Die Anforderung ist nicht einheitlich umgesetzt; Nachweis existiert nur punktuell oder fehlt.

L2

Standardised – policy defined and communicated

* Eine dokumentierte Policy oder ein Standard beschreibt die Anforderung.

L3

Integrated – automated validation in CI/CD

* Terraform-Checks oder IaC-Gates prüfen die Anforderung automatisch in CI/CD.

L4

Auditable – metrics and exceptions tracked

* Abdeckung, Ausnahmen und Qualitätsmetriken werden quartalsweise berichtet.

L5

Optimised – continuous improvement based on data

* Die Effektivität wird kontinuierlich gemessen und automatisch optimiert.

Checks

waf-rel-110.tf.aws.alb-timeout

Engine: terraform | Provider: aws | Automated: Yes

AWS ALB idle timeout must be explicitly configured

AWS ALB idle timeout must be explicitly configured

Scope: resource — aws_lb

Assertions: * idle_timeout attribute_exists — ALB idle_timeout must be explicitly set.

Remediation: AWS ALB idle timeout must be explicitly configured

Compliant
# Example compliant with waf-rel-110.tf.aws.alb-timeout
Non-Compliant
# Example non-compliant with waf-rel-110.tf.aws.alb-timeout

waf-rel-110.tf.aws.api-gateway-throttle

Engine: terraform | Provider: aws | Automated: Yes

AWS API Gateway must define throttling settings

AWS API Gateway must define throttling settings

Scope: resource — aws_api_gateway_stage, aws_apigatewayv2_stage

Assertions: * throttle_settings attribute_exists — API Gateway stage must define throttling.

Remediation: AWS API Gateway must define throttling settings

Compliant
# Example compliant with waf-rel-110.tf.aws.api-gateway-throttle
Non-Compliant
# Example non-compliant with waf-rel-110.tf.aws.api-gateway-throttle

waf-rel-110.tf.azurerm.app-gateway-timeout

Engine: terraform | Provider: azurerm | Automated: Yes

Azure Application Gateway backend settings must define explicit request timeout

Azure Application Gateway backend settings must define explicit request timeout

Scope: resource — azurerm_application_gateway

Assertions: * backend_http_settings.request_timeout_in_seconds attribute_exists — Backend HTTP settings must define request timeout.

Remediation: Azure Application Gateway backend settings must define explicit request timeout

Compliant
# Example compliant with waf-rel-110.tf.azurerm.app-gateway-timeout
Non-Compliant
# Example non-compliant with waf-rel-110.tf.azurerm.app-gateway-timeout

waf-rel-110.config.resilience-policy

Engine: config | Provider: any | Automated: No

Circuit breaker policy must be documented

Circuit breaker policy must be documented

Scope: file — docs/reliability/circuit-breaker-policy.md

Assertions: * exists attribute_exists — Circuit breaker/backpressure policy must exist.

Remediation: Circuit breaker policy must be documented

Compliant
# Example compliant with waf-rel-110.config.resilience-policy
Non-Compliant
# Example non-compliant with waf-rel-110.config.resilience-policy

Evidence

  • Terraform configuration implementing the requirement.

  • Policy, ADR, or standard documenting the requirement.

  • Optional cloud console or API output confirming runtime state.

Related Controls