Wombat

WAF-PERF-110 – Caching strategies MUST be defined for workloads with repeated read patterns or latency-sensitive endpoints

Pillar: Efficiancy | Severity: 🟡 Medium | Category: Network Security | Automatable: High

Description

Workloads serving repeated content MUST use edge caches (CDN), application caches, or in-memory stores. Cache invalidation and TTL policies MUST be documented and aligned with data freshness requirements. Latency-sensitive APIs MUST define cache-control headers or use managed cache layers. Cache hit ratios and latency percentiles MUST be monitored.

Rationale

Risk Description

Risk

Uncached repeated requests overload backends and increase latency without business value.

Risk

Missing cache invalidation strategies can serve stale or incorrect data to users.

Requirements

  • Workloads serving repeated content MUST use edge caches (CDN), application caches, or in-memory stores.

  • Cache invalidation and TTL policies MUST be documented and aligned with data freshness requirements.

  • Latency-sensitive APIs MUST define cache-control headers or use managed cache layers.

  • Cache hit ratios and latency percentiles MUST be monitored.

Implementation Guidance

  1. Document the requirement in a version-controlled policy, ADR, or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level Name Criteria

L1

Ad hoc – control not consistently applied

* Die Anforderung ist nicht einheitlich umgesetzt; Nachweis existiert nur punktuell oder fehlt.

L2

Standardised – policy defined and communicated

* Eine dokumentierte Policy oder ein Standard beschreibt die Anforderung.

L3

Integrated – automated validation in CI/CD

* Terraform-Checks oder IaC-Gates prüfen die Anforderung automatisch in CI/CD.

L4

Auditable – metrics and exceptions tracked

* Abdeckung, Ausnahmen und Qualitätsmetriken werden quartalsweise berichtet.

L5

Optimised – continuous improvement based on data

* Die Effektivität wird kontinuierlich gemessen und automatisch optimiert.

Checks

waf-perf-110.tf.aws.cloudfront-cache

Engine: terraform | Provider: aws | Automated: Yes

AWS CloudFront distributions must define default cache behavior

AWS CloudFront distributions must define default cache behavior

Scope: resource — aws_cloudfront_distribution

Assertions: * default_cache_behavior attribute_exists — CloudFront must define default cache behavior.

Remediation: AWS CloudFront distributions must define default cache behavior

Compliant
# Example compliant with waf-perf-110.tf.aws.cloudfront-cache
Non-Compliant
# Example non-compliant with waf-perf-110.tf.aws.cloudfront-cache

waf-perf-110.tf.azurerm.cdn-endpoint

Engine: terraform | Provider: azurerm | Automated: Yes

Azure CDN endpoints must have origin host header and compression configured

Azure CDN endpoints must have origin host header and compression configured

Scope: resource — azurerm_cdn_endpoint

Assertions: * origin_host_header attribute_exists — CDN endpoint must have origin host header configured.

Remediation: Azure CDN endpoints must have origin host header and compression configured

Compliant
# Example compliant with waf-perf-110.tf.azurerm.cdn-endpoint
Non-Compliant
# Example non-compliant with waf-perf-110.tf.azurerm.cdn-endpoint

waf-perf-110.config.cache-adr

Engine: config | Provider: any | Automated: No

Caching strategy must be documented in architecture decision record

Caching strategy must be documented in architecture decision record

Scope: file — docs/adr/*.md

Assertions: * exists attribute_exists — At least one ADR must document caching strategy.

Remediation: Caching strategy must be documented in architecture decision record

Compliant
# Example compliant with waf-perf-110.config.cache-adr
Non-Compliant
# Example non-compliant with waf-perf-110.config.cache-adr

Evidence

  • Terraform configuration implementing the requirement.

  • Policy, ADR, or standard documenting the requirement.

  • Optional cloud console or API output confirming runtime state.

Related Controls