WAF-OPS-100 – Operational Debt Register & Review

Pillar: Excellence | Severity: Medium | Category: Data Governance | Automatable: High

Description

All known operational debt – manual processes, undocumented workarounds, toil-generating tasks, outdated runbooks, siloed knowledge – MUST be tracked in a version-controlled Operational Debt Register. The register MUST be reviewed quarterly with explicit prioritization and paydown allocation. Operational debt items MUST have severity classification, estimated toil hours, owner, and target resolution date.

Rationale

Risk	Description
Risk	Undocumented manual processes accumulate operational debt and knowledge-risk.
Risk	Unprioritized operational debt blocks planned automation and scaling.

Risk

Description

Risk

Undocumented manual processes accumulate operational debt and knowledge-risk.

Risk

Unprioritized operational debt blocks planned automation and scaling.

Requirements

All known operational debt – manual processes, undocumented workarounds, toil-generating tasks, outdated runbooks, siloed knowledge – MUST be tracked in a version-controlled Operational Debt Register.
The register MUST be reviewed quarterly with explicit prioritization and paydown allocation.
Operational debt items MUST have severity classification, estimated toil hours, owner, and target resolution date.

Implementation Guidance

Document the requirement in a version-controlled policy or standard.
Assign ownership and establish a review cadence (e.g., quarterly).
Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level	Name	Criteria
L1	Ad hoc – control not consistently applied	* Manual evidence exists for some workloads, but coverage is unknown.
L2	Standardised – policy defined and communicated	* A version-controlled policy, ADR, or standard describes the requirement.
L3	Integrated – automated validation in CI/CD	* Terraform checks run automatically on pull requests and report results.
L4	Auditable – metrics and exceptions tracked	* Control coverage, failures, and approved exceptions are reported quarterly.
L5	Optimised – continuous improvement based on data	* Control effectiveness is measured and iteratively improved.

Level

Name

Criteria

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-ops-100.tf.aws.eventbridge-ops-review-schedule

Engine: terraform | Provider: aws | Automated: Yes

EventBridge scheduled rule must exist for automated operational review reminders

An AWS EventBridge (CloudWatch Events) scheduled rule MUST be configured to send quarterly operational debt review reminders to the team’s notification channel.

Scope: resource — aws_cloudwatch_event_rule

Assertions: * schedule_expression attribute exists — CloudWatch Event rule must define a schedule_expression for periodic review.

Remediation: Create an aws_cloudwatch_event_rule with a cron schedule_expression for quarterly reviews and target it to an SNS topic or Lambda for notifications.

Compliant

resource "aws_cloudwatch_event_rule" "ops_review_reminder" {
  name                = "quarterly-ops-debt-review"
  description         = "Quarterly reminder to review and update Operational Debt Register"
  schedule_expression = "cron(0 9 1 1,4,7,10 ? *)"
  is_enabled          = true
}

resource "aws_cloudwatch_event_target" "ops_review_sns" {
  rule      = aws_cloudwatch_event_rule.ops_review_reminder.name
  target_id = "OpsReviewNotification"
  arn       = aws_sns_topic.team_notifications.arn
  input = jsonencode({
    message = "Quarterly Operational Debt Register review due. Runbook: https://wiki/ops-debt-review"
  })
}

Non-Compliant

# No scheduled operational review reminder configured
# WAF-OPS-100 Violation: no automated review cadence enforcement

waf-ops-100.tf.aws.ssm-automation-runbook

Engine: terraform | Provider: aws | Automated: Yes

AWS SSM automation documents must exist for repetitive operational tasks

Repetitive operational tasks (AMI patching, instance rotation, configuration updates) MUST be automated using AWS Systems Manager automation documents to reduce toil.

Scope: resource — aws_ssm_document

Assertions: * document_type not empty — SSM document must define a document_type. * content not empty — SSM document must have content defining automation steps.

Remediation: Create aws_ssm_document resources with Automation document type to automate repetitive operational procedures that currently require manual intervention.

Compliant

resource "aws_ssm_document" "rotate_instances" {
  name            = "RotateASGInstances"
  document_type   = "Automation"
  document_format = "YAML"

  content = <<-DOC
    description: Rotate all instances in an Auto Scaling Group
    schemaVersion: "0.3"
    parameters:
      AutoScalingGroupName:
        type: String
        description: Name of the Auto Scaling Group to rotate
    mainSteps:
      - name: TerminateInstances
        action: aws:executeScript
        inputs:
          Runtime: python3.11
          Handler: rotate_instances
  DOC
}

Non-Compliant

# No SSM automation documents defined
# Instance rotation performed manually via console
# WAF-OPS-100 Violation: manual process not automated

waf-ops-100.tf.stackit.ops-debt-tag

Engine: terraform | Provider: stackit | Automated: Yes

STACKIT resources must document operational debt

STACKIT resources must document operational debt. This check validates the Terraform configuration uses the expected resource and attribute.

Scope: resource — stackit_server, stackit_ske_cluster

Assertions: * labels.ops-debt key exists — STACKIT resource is missing the 'ops-debt' label.

Remediation: Review the Terraform configuration for the listed resource types and ensure the required attribute or tag is present. See the control narrative for provider-specific guidance.

Compliant

# Example resource meets the requirement.
resource "stackit_server" "example" {
  # required attribute/tag/label present
}

Non-Compliant

# Example resource does not meet the requirement.
resource "stackit_server" "example" {
  # Missing required attribute/tag/label
}

waf-ops-100.tf.ovh.ops-debt-tag

Engine: terraform | Provider: ovh | Automated: Yes

OVHcloud resources must document operational debt

OVHcloud resources must document operational debt. This check validates the Terraform configuration uses the expected resource and attribute.

Scope: resource — ovh_cloud_project_instance, ovh_cloud_project_kube

Assertions: * tags.ops-debt key exists — OVHcloud resource is missing the 'ops-debt' tag.

Remediation: Review the Terraform configuration for the listed resource types and ensure the required attribute or tag is present. See the control narrative for provider-specific guidance.

Compliant

# Example resource meets the requirement.
resource "ovh_cloud_project_instance" "example" {
  # required attribute/tag/label present
}

Non-Compliant

# Example resource does not meet the requirement.
resource "ovh_cloud_project_instance" "example" {
  # Missing required attribute/tag/label
}

waf-ops-100.tf.hcloud.ops-debt-tag

Engine: terraform | Provider: hcloud | Automated: Yes

Hetzner Cloud resources must document operational debt

Hetzner Cloud resources must document operational debt. This check validates the Terraform configuration uses the expected resource and attribute.

Scope: resource — hcloud_server

Assertions: * labels.ops-debt key exists — Hetzner Cloud server is missing the 'ops-debt' label.

Remediation: Review the Terraform configuration for the listed resource types and ensure the required attribute or tag is present. See the control narrative for provider-specific guidance.

Compliant

# Example resource meets the requirement.
resource "hcloud_server" "example" {
  # required attribute/tag/label present
}

Non-Compliant

# Example resource does not meet the requirement.
resource "hcloud_server" "example" {
  # Missing required attribute/tag/label
}

waf-ops-100.tf.azurerm.automation-runbook

Engine: terraform | Provider: azurerm | Automated: Yes

Azure Automation runbook must exist for repetitive operational tasks

Repetitive operational tasks (VM patching, certificate rotation, cleanup jobs) MUST be automated using Azure Automation runbooks to reduce toil.

Scope: resource — azurerm_automation_runbook

Assertions: * runbook_type not empty — Azure Automation runbook must define a runbook_type. * automation_account_name not empty — Azure Automation runbook must be linked to an automation account.

Remediation: Create an azurerm_automation_runbook resource with PowerShell or Python runbook_type and linked to an existing azurerm_automation_account for operational procedures that currently require manual intervention.

Compliant

resource "azurerm_automation_account" "ops" {
  name                = "ops-automation"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  sku_name            = "Basic"
}

resource "azurerm_automation_runbook" "rotate_certs" {
  name                    = "RotateKeyVaultCertificates"
  location                = azurerm_resource_group.main.location
  resource_group_name     = azurerm_resource_group.main.name
  automation_account_name = azurerm_automation_account.ops.name
  runbook_type            = "PowerShell"
  log_verbose             = true
  log_progress            = true
}

Non-Compliant

resource "azurerm_automation_runbook" "rotate_certs" {
  name        = "RotateKeyVaultCertificates"
  # Missing automation_account_name and runbook_type
  # WAF-OPS-100 Violation: operational process not automated
}

waf-ops-100.tf.google.scheduler-ops-review

Engine: terraform | Provider: google | Automated: Yes

Cloud Scheduler job must trigger quarterly operational debt review reminders

A GCP Cloud Scheduler job MUST be configured to send quarterly operational debt review reminders to the team’s notification channel.

Scope: resource — google_cloud_scheduler_job

Assertions: * schedule attribute exists — Cloud Scheduler job must define a schedule for periodic review reminders.

Remediation: Create a google_cloud_scheduler_job with a cron schedule for quarterly reviews and target it to a Pub/Sub topic or HTTP endpoint for notifications.

Compliant

resource "google_cloud_scheduler_job" "ops_review_reminder" {
  name             = "quarterly-ops-debt-review"
  description      = "Quarterly reminder to review and update Operational Debt Register"
  schedule         = "0 9 1 1,4,7,10 *"
  time_zone        = "Europe/Berlin"
  pubsub_target {
    topic_name = google_pubsub_topic.team_notifications.id
    data       = base64encode("Quarterly Operational Debt Register review due")
  }
}

Non-Compliant

# No Cloud Scheduler job configured
# WAF-OPS-100 Violation: no automated review cadence enforcement

Evidence

Kind Required Description

Kind	Required	Description
`iac`	Required	Terraform configuration implementing the control.
`governance`	Required	Policy, ADR, or standard documenting the requirement.
`config`	Optional	Cloud console or API output confirming runtime state.

iac

Required

Terraform configuration implementing the control.

governance

Required

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Related Controls

Framework	Controls
ISO/IEC 20000-1	* Continual improvement * Risk management
ITIL 4	* Continual improvement * Problem management
SRE Book (Google)	* Chapter 5: Eliminating Toil

Framework

Controls

ISO/IEC 20000-1

* Continual improvement * Risk management

ITIL 4

* Continual improvement * Problem management

SRE Book (Google)

* Chapter 5: Eliminating Toil