WAF-PERF-040 – Database Performance Baseline & Index Strategy

Pillar: Efficiancy | Severity: High | Category: Logging Monitoring | Automatable: High

Description

All relational and document databases used in production MUST have a documented performance baseline including query execution times, I/O throughput, and connection pool utilization. An index strategy MUST be defined and maintained for all tables with significant read/write loads. Slow query logging MUST be enabled and reviewed regularly. Database performance insights or equivalent monitoring MUST be active on all production database instances. Missing indexes on frequently queried columns in high-traffic tables are treated as violations.

Rationale

Risk	Description
Risk	Databases without performance insights let slow queries and capacity bottlenecks go unnoticed.
Risk	Missing monitoring data complicates targeted optimization and capacity planning.

Risk

Description

Risk

Databases without performance insights let slow queries and capacity bottlenecks go unnoticed.

Risk

Missing monitoring data complicates targeted optimization and capacity planning.

Requirements

All relational and document databases used in production MUST have a documented performance baseline including query execution times, I/O throughput, and connection pool utilization.
An index strategy MUST be defined and maintained for all tables with significant read/write loads.
Slow query logging MUST be enabled and reviewed regularly.
Database performance insights or equivalent monitoring MUST be active on all production database instances.

Implementation Guidance

Document the requirement in a version-controlled policy or standard.
Assign ownership and establish a review cadence (e.g., quarterly).
Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level	Name	Criteria
L1	Ad hoc – control not consistently applied	* Manual evidence exists for some workloads, but coverage is unknown.
L2	Standardised – policy defined and communicated	* A version-controlled policy, ADR, or standard describes the requirement.
L3	Integrated – automated validation in CI/CD	* Terraform checks run automatically on pull requests and report results.
L4	Auditable – metrics and exceptions tracked	* Control coverage, failures, and approved exceptions are reported quarterly.
L5	Optimised – continuous improvement based on data	* Control effectiveness is measured and iteratively improved.

Level

Name

Criteria

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-perf-040.tf.aws.rds-performance-insights

Engine: terraform | Provider: aws | Automated: Yes

AWS RDS instances must have Performance Insights enabled

RDS and Aurora instances must have Performance Insights enabled to allow query-level performance monitoring and diagnosis of slow queries and lock contention.

Scope: resource — aws_db_instance, aws_rds_cluster_instance

Assertions: * performance_insights_enabled is true — RDS instance must have Performance Insights enabled. * enabled_cloudwatch_logs_exports not empty — RDS instance must export logs to CloudWatch (slowquery, error, general). * monitoring_interval greater than or equal 1 — Enhanced Monitoring must be enabled (monitoring_interval >= 1).

Remediation: Set performance_insights_enabled = true, monitoring_interval = 60 (or 1 for high-granularity). Set enabled_cloudwatch_logs_exports = ["slowquery", "error"] for MySQL or ["postgresql"] for PostgreSQL.

Compliant

resource "aws_db_instance" "main" {
  identifier             = "db-payment-api"
  engine                 = "postgres"
  instance_class         = "db.t3.medium"
  allocated_storage      = 100
  performance_insights_enabled          = true
  performance_insights_retention_period = 7
  monitoring_interval                   = 60
  monitoring_role_arn                   = aws_iam_role.rds_monitoring.arn
  enabled_cloudwatch_logs_exports        = ["postgresql"]
  deletion_protection    = true
}

Non-Compliant

resource "aws_db_instance" "main" {
  identifier    = "db-payment-api"
  engine        = "postgres"
  instance_class = "db.t3.medium"
  # Performance Insights disabled – WAF-PERF-040 violation
  # No CloudWatch log exports
  # No Enhanced Monitoring
}

waf-perf-040.tf.azurerm.sql-query-insights

Engine: terraform | Provider: azurerm | Automated: Yes

Azure SQL Database must have auditing and threat detection enabled

Azure SQL Database must have auditing enabled which captures query execution data, and should have Query Performance Insight accessible via the portal.

Scope: resource — azurerm_mssql_database, azurerm_mssql_server

Assertions: * min_tls_version equals TLS1_2 — Azure SQL Server must enforce TLS 1.2. * public_network_access_enabled is false — Azure SQL Server must not be publicly accessible; use private endpoints.

Remediation: Set min_tls_version = "1.2" and public_network_access_enabled = false. Configure azurerm_mssql_server_extended_auditing_policy for query performance tracking.

Compliant

resource "azurerm_mssql_server" "main" {
  name                         = "sql-payment-api"
  resource_group_name          = azurerm_resource_group.main.name
  location                     = azurerm_resource_group.main.location
  version                      = "12.0"
  administrator_login          = var.db_admin_user
  administrator_login_password = var.db_admin_password
  minimum_tls_version          = "1.2"
  public_network_access_enabled = false
}
resource "azurerm_mssql_server_extended_auditing_policy" "main" {
  server_id              = azurerm_mssql_server.main.id
  storage_endpoint       = azurerm_storage_account.audit.primary_blob_endpoint
  retention_in_days      = 90
  log_monitoring_enabled = true
}

Non-Compliant

resource "azurerm_mssql_server" "main" {
  name                          = "sql-payment-api"
  minimum_tls_version           = "1.0"  # Old TLS – violation
  public_network_access_enabled = true    # Publicly accessible – WAF-PERF-040 violation
}

waf-perf-040.tf.google.cloudsql-insights-enabled

Engine: terraform | Provider: google | Automated: Yes

GCP Cloud SQL must have Query Insights enabled

GCP Cloud SQL instances must have Query Insights enabled to track query performance, identify slow queries, and monitor database efficiency.

Scope: resource — google_sql_database_instance

Assertions: * settings.insights_config.query_insights_enabled is true — Cloud SQL Query Insights must be enabled. * settings.backup_configuration.enabled is true — Cloud SQL automated backups must be enabled. * deletion_protection is true — Cloud SQL deletion protection must be enabled.

Remediation: Set insights_config { query_insights_enabled = true } in settings block. Enable backup_configuration and deletion_protection = true.

Compliant

resource "google_sql_database_instance" "main" {
  name             = "db-payment-api"
  database_version = "POSTGRES_15"
  deletion_protection = true
  settings {
    tier = "db-custom-2-4096"
    backup_configuration {
      enabled    = true
      start_time = "03:00"
    }
    insights_config {
      query_insights_enabled  = true
      query_string_length     = 1024
      record_application_tags = true
    }
  }
}

Non-Compliant

resource "google_sql_database_instance" "main" {
  name             = "db-payment-api"
  database_version = "POSTGRES_15"
  settings {
    tier = "db-custom-2-4096"
    # No insights_config – WAF-PERF-040 violation
    # No backup_configuration
  }
}

waf-perf-040.tf.stackit.auto-scaling-enabled

Engine: terraform | Provider: stackit | Automated: Yes

All relational and document databases used in production for stackit

All relational and document databases used in production must be documented in IaC via a auto-scaling-enabled tag/label on stackit_project. This validates the control is tracked as code.

Scope: resource — stackit_project

Assertions: * labels key exists — stackit_project is missing the auto-scaling-enabled tag/label.

Remediation: Add a auto-scaling-enabled tag/label to the stackit_project resource to show the stackit implementation of WAF-PERF-040 is tracked in IaC.

Compliant

resource "stackit_project" "example" {
  labels = {
    auto-scaling-enabled = "true"
  }
}

Non-Compliant

resource "stackit_project" "example" {
  # Missing auto-scaling-enabled labels
}

waf-perf-040.tf.ovh.auto-scaling-enabled

Engine: terraform | Provider: ovh | Automated: Yes

All relational and document databases used in production for ovh

All relational and document databases used in production must be documented in IaC via a auto-scaling-enabled tag/label on ovh_cloud_project. This validates the control is tracked as code.

Scope: resource — ovh_cloud_project

Assertions: * tags key exists — ovh_cloud_project is missing the auto-scaling-enabled tag/label.

Remediation: Add a auto-scaling-enabled tag/label to the ovh_cloud_project resource to show the ovh implementation of WAF-PERF-040 is tracked in IaC.

Compliant

resource "ovh_cloud_project" "example" {
  tags = {
    auto-scaling-enabled = "true"
  }
}

Non-Compliant

resource "ovh_cloud_project" "example" {
  # Missing auto-scaling-enabled tags
}

waf-perf-040.tf.hcloud.auto-scaling-enabled

Engine: terraform | Provider: hcloud | Automated: Yes

All relational and document databases used in production for hcloud

All relational and document databases used in production must be documented in IaC via a auto-scaling-enabled tag/label on hcloud_server. This validates the control is tracked as code.

Scope: resource — hcloud_server

Assertions: * labels key exists — hcloud_server is missing the auto-scaling-enabled tag/label.

Remediation: Add a auto-scaling-enabled tag/label to the hcloud_server resource to show the hcloud implementation of WAF-PERF-040 is tracked in IaC.

Compliant

resource "hcloud_server" "example" {
  labels = {
    auto-scaling-enabled = "true"
  }
}

Non-Compliant

resource "hcloud_server" "example" {
  # Missing auto-scaling-enabled labels
}

Evidence

Kind Required Description

Kind	Required	Description
`iac`	Required	Terraform configuration implementing the control.
`governance`	Required	Policy, ADR, or standard documenting the requirement.
`config`	Optional	Cloud console or API output confirming runtime state.

iac

Required

Terraform configuration implementing the control.

governance

Required

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Related Controls

Framework	Controls
ISO/IEC 25010	* Performance Efficiency – Time Behavior * Performance Efficiency – Resource Utilization

Framework

Controls

ISO/IEC 25010

* Performance Efficiency – Time Behavior * Performance Efficiency – Resource Utilization