WAF-PERF-100 – Performance Debt Register & Quarterly Review

Pillar: Efficiancy | Severity: Medium | Category: Cost Governance | Automatable: High

Description

All known performance limitations, anti-patterns, and deferred optimizations MUST be documented in a Performance Debt Register. Each entry MUST include: ID, description of the performance issue, estimated impact (latency increase, throughput reduction, cost), affected services, owner, priority, and a remediation plan or acceptance rationale. The Performance Debt Register MUST be reviewed quarterly by engineering leadership. New performance anti-patterns identified in postmortems, load tests, or reviews MUST be added to the register within 30 days of identification.

Rationale

Risk	Description
Risk	Poor user experience and missed SLAs result from unoptimised resources.
Risk	Unnecessary compute waste increases cost and carbon footprint.

Risk

Description

Risk

Poor user experience and missed SLAs result from unoptimised resources.

Risk

Unnecessary compute waste increases cost and carbon footprint.

Requirements

All known performance limitations, anti-patterns, and deferred optimizations MUST be documented in a Performance Debt Register.
Each entry MUST include: ID, description of the performance issue, estimated impact (latency increase, throughput reduction, cost), affected services, owner, priority, and a remediation plan or acceptance rationale.
The Performance Debt Register MUST be reviewed quarterly by engineering leadership.
New performance anti-patterns identified in postmortems, load tests, or reviews MUST be added to the register within 30 days of identification.

Implementation Guidance

Document the requirement in a version-controlled policy or standard.
Assign ownership and establish a review cadence (e.g., quarterly).
Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level	Name	Criteria
L1	Ad hoc – control not consistently applied	* Manual evidence exists for some workloads, but coverage is unknown.
L2	Standardised – policy defined and communicated	* A version-controlled policy, ADR, or standard describes the requirement.
L3	Integrated – automated validation in CI/CD	* Terraform checks run automatically on pull requests and report results.
L4	Auditable – metrics and exceptions tracked	* Control coverage, failures, and approved exceptions are reported quarterly.
L5	Optimised – continuous improvement based on data	* Control effectiveness is measured and iteratively improved.

Level

Name

Criteria

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-perf-100.tf.aws.config-performance-rules

Engine: terraform | Provider: aws | Automated: Yes

AWS Config rules should include performance governance checks

AWS Config should have rules configured that detect common performance anti-patterns such as previous-generation instance types, missing performance insights, or unencrypted volumes that reduce throughput. This enables automated detection of performance debt.

Scope: resource — aws_config_config_rule

Assertions: * name not empty — AWS Config rules must have descriptive names. * source not empty — AWS Config rules must have a source (AWS managed or custom Lambda).

Remediation: Create AWS Config rules for performance governance: desired-instance-type, rds-enhanced-monitoring-enabled, ec2-ebs-encryption-by-default. Use AWS Security Hub for centralized findings aggregation.

Compliant

resource "aws_config_config_rule" "rds_performance_insights" {
  name        = "rds-performance-insights-enabled"
  description = "WAF-PERF-040: Checks RDS instances have Performance Insights enabled"
  source {
    owner             = "AWS"
    source_identifier = "RDS_INSTANCE_PUBLIC_ACCESS_CHECK"
  }
  tags = {
    pillar  = "performance"
    control = "WAF-PERF-040"
  }
}

Non-Compliant

# No AWS Config rules for performance governance
# Performance anti-patterns not automatically detected – WAF-PERF-100 advisory

waf-perf-100.tf.azurerm.policy-performance-governance

Engine: terraform | Provider: azurerm | Automated: Yes

Azure Policy should include performance governance initiatives

Azure Policy should include policy definitions or initiatives that detect and audit performance anti-patterns such as non-Premium storage for databases or missing Application Insights deployments.

Scope: resource — azurerm_resource_group_policy_assignment, azurerm_subscription_policy_assignment

Assertions: * name not empty — Policy assignment must be named.

Remediation: Create Azure Policy assignments for performance governance. Use built-in policies like "Storage accounts should use geo-redundant storage" or custom policies for performance requirements specific to your organization.

Compliant

resource "azurerm_resource_group_policy_assignment" "perf_monitoring" {
  name                 = "require-application-insights"
  resource_group_id    = azurerm_resource_group.main.id
  policy_definition_id = var.require_app_insights_policy_id
  description          = "WAF-PERF-050: Require Application Insights for all web applications"
}

Non-Compliant

# No performance governance policies assigned
# Performance anti-patterns not systematically audited – WAF-PERF-100 advisory

waf-perf-100.tf.google.security-health-analytics

Engine: terraform | Provider: google | Automated: Yes

GCP Security Command Center should monitor performance governance findings

GCP Security Command Center or Cloud Asset Inventory should be configured to track performance governance findings and provide a consolidated view of performance risk.

Scope: resource — google_scc_notification_config

Assertions: * streaming_config not empty — SCC notification config must have streaming_config defined.

Remediation: Enable Security Command Center findings export to Pub/Sub for performance-related findings. Configure asset inventory queries for performance governance.

Compliant

resource "google_scc_notification_config" "performance_findings" {
  config_id    = "perf-governance-notifications"
  organization = var.org_id
  description  = "Notifications for performance governance findings"
  pubsub_topic = google_pubsub_topic.security_notifications.id
  streaming_config {
    filter = "category = \"INSTANCE_TYPE_RECOMMENDATION\" OR category = \"DISK_TYPE_RECOMMENDATION\""
  }
}

Non-Compliant

# No SCC notification config for performance findings
# Performance recommendations not surfaced to engineering – WAF-PERF-100 advisory

waf-perf-100.tf.stackit.capacity-plan-reviewed

Engine: terraform | Provider: stackit | Automated: Yes

All known performance limitations, anti-patterns, and deferred optimizations… for stackit

All known performance limitations, anti-patterns, and deferred optimizations… must be documented in IaC via a capacity-plan-reviewed tag/label on stackit_project. This validates the control is tracked as code.

Scope: resource — stackit_project

Assertions: * labels key exists — stackit_project is missing the capacity-plan-reviewed tag/label.

Remediation: Add a capacity-plan-reviewed tag/label to the stackit_project resource to show the stackit implementation of WAF-PERF-100 is tracked in IaC.

Compliant

resource "stackit_project" "example" {
  labels = {
    capacity-plan-reviewed = "true"
  }
}

Non-Compliant

resource "stackit_project" "example" {
  # Missing capacity-plan-reviewed labels
}

waf-perf-100.tf.ovh.capacity-plan-reviewed

Engine: terraform | Provider: ovh | Automated: Yes

All known performance limitations, anti-patterns, and deferred optimizations… for ovh

All known performance limitations, anti-patterns, and deferred optimizations… must be documented in IaC via a capacity-plan-reviewed tag/label on ovh_cloud_project. This validates the control is tracked as code.

Scope: resource — ovh_cloud_project

Assertions: * tags key exists — ovh_cloud_project is missing the capacity-plan-reviewed tag/label.

Remediation: Add a capacity-plan-reviewed tag/label to the ovh_cloud_project resource to show the ovh implementation of WAF-PERF-100 is tracked in IaC.

Compliant

resource "ovh_cloud_project" "example" {
  tags = {
    capacity-plan-reviewed = "true"
  }
}

Non-Compliant

resource "ovh_cloud_project" "example" {
  # Missing capacity-plan-reviewed tags
}

waf-perf-100.tf.hcloud.capacity-plan-reviewed

Engine: terraform | Provider: hcloud | Automated: Yes

All known performance limitations, anti-patterns, and deferred optimizations… for hcloud

All known performance limitations, anti-patterns, and deferred optimizations… must be documented in IaC via a capacity-plan-reviewed tag/label on hcloud_server. This validates the control is tracked as code.

Scope: resource — hcloud_server

Assertions: * labels key exists — hcloud_server is missing the capacity-plan-reviewed tag/label.

Remediation: Add a capacity-plan-reviewed tag/label to the hcloud_server resource to show the hcloud implementation of WAF-PERF-100 is tracked in IaC.

Compliant

resource "hcloud_server" "example" {
  labels = {
    capacity-plan-reviewed = "true"
  }
}

Non-Compliant

resource "hcloud_server" "example" {
  # Missing capacity-plan-reviewed labels
}

Evidence

Kind Required Description

Kind	Required	Description
`iac`	Required	Terraform configuration implementing the control.
`governance`	Required	Policy, ADR, or standard documenting the requirement.
`config`	Optional	Cloud console or API output confirming runtime state.

iac

Required

Terraform configuration implementing the control.

governance

Required

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Related Controls

Framework	Controls
ISO/IEC 25010	* Performance Efficiency – Capacity

Framework

Controls

ISO/IEC 25010

* Performance Efficiency – Capacity