WAF-REL-080 – Dependency & Upstream Resilience Management

Pillar: Reliability | Severity: Medium | Category: Reliability Design | Automatable: High

Description

All production workloads MUST maintain an up-to-date inventory of external and internal service dependencies. Each dependency MUST be assessed for reliability risk: SLA provided, failure history, substitutability. Critical dependencies MUST have defined fallback behaviors. Third-party API dependencies MUST implement graceful degradation when the upstream is unavailable. Dependency inventory MUST be reviewed quarterly and updated after each significant architecture change.

Rationale

Risk	Description
Risk	Incomplete dependency inventories complicate impact analysis and emergency planning.
Risk	External dependencies without documentation are underestimated or overlooked during incidents.

Risk

Description

Risk

Incomplete dependency inventories complicate impact analysis and emergency planning.

Risk

External dependencies without documentation are underestimated or overlooked during incidents.

Requirements

All production workloads MUST maintain an up-to-date inventory of external and internal service dependencies.
Each dependency MUST be assessed for reliability risk: SLA provided, failure history, substitutability.
Critical dependencies MUST have defined fallback behaviors.
Third-party API dependencies MUST implement graceful degradation when the upstream is unavailable.
Dependency inventory MUST be reviewed quarterly and updated after each significant architecture change.

Implementation Guidance

Document the requirement in a version-controlled policy or standard.
Assign ownership and establish a review cadence (e.g., quarterly).
Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level	Name	Criteria
L1	Ad hoc – control not consistently applied	* Manual evidence exists for some workloads, but coverage is unknown.
L2	Standardised – policy defined and communicated	* A version-controlled policy, ADR, or standard describes the requirement.
L3	Integrated – automated validation in CI/CD	* Terraform checks run automatically on pull requests and report results.
L4	Auditable – metrics and exceptions tracked	* Control coverage, failures, and approved exceptions are reported quarterly.
L5	Optimised – continuous improvement based on data	* Control effectiveness is measured and iteratively improved.

Level

Name

Criteria

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-rel-080.tf.aws.vpc-endpoint-dependency-isolation

Engine: terraform | Provider: aws | Automated: Yes

AWS services should use VPC endpoints to isolate AWS API dependencies

Critical AWS API dependencies (S3, DynamoDB, SQS, etc.) should be accessed through VPC endpoints to reduce dependency on internet routing and improve reliability and security.

Scope: resource — aws_vpc_endpoint

Assertions: * vpc_id not empty — VPC endpoint must be associated with a VPC. * service_name not empty — VPC endpoint must specify the AWS service name.

Remediation: Create aws_vpc_endpoint resources for S3, DynamoDB, and other heavily used AWS services. Interface endpoints are recommended for SQS, SNS, and SSM.

Compliant

resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.aws_region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
  tags = merge(var.mandatory_tags, { Name = "s3-vpc-endpoint" })
}

resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.aws_region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
  tags = merge(var.mandatory_tags, { Name = "dynamodb-vpc-endpoint" })
}

Non-Compliant

# No VPC endpoints configured – all AWS API calls traverse internet NAT gateway
# Dependency on NAT gateway availability and internet routing
# WAF-REL-080 violation for high-traffic AWS API dependencies

waf-rel-080.tf.azurerm.private-endpoint-dependency

Engine: terraform | Provider: azurerm | Automated: Yes

Azure private endpoints should be used for critical managed service dependencies

Azure managed services (Storage, Key Vault, Service Bus) accessed by production workloads should use private endpoints to reduce dependency on public routing.

Scope: resource — azurerm_private_endpoint

Assertions: * name not empty — Private endpoint must have a name. * private_service_connection attribute exists — Private endpoint must define private_service_connection.

Remediation: Create azurerm_private_endpoint resources for each critical Azure managed service. Configure private_service_connection with the target resource ID and subresource names.

Compliant

resource "azurerm_private_endpoint" "storage" {
  name                = "storage-private-endpoint"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  subnet_id           = azurerm_subnet.private.id

  private_service_connection {
    name                           = "storage-connection"
    private_connection_resource_id = azurerm_storage_account.main.id
    is_manual_connection           = false
    subresource_names              = ["blob"]
  }
}

Non-Compliant

# azurerm_storage_account accessed directly from public endpoint
# No private endpoint configured – WAF-REL-080 violation
resource "azurerm_storage_account" "main" {
  name                     = "paymentdataprod"
  resource_group_name      = azurerm_resource_group.main.name
  location                 = azurerm_resource_group.main.location
  account_tier             = "Standard"
  account_replication_type = "GRS"
  # public_network_access_enabled = true (default)
}

waf-rel-080.tf.google.vpc-sc-dependency-isolation

Engine: terraform | Provider: google | Automated: Yes

GCP services should use Private Service Connect for dependency isolation

GCP workloads should access Google APIs through Private Service Connect or private Google access to improve reliability by avoiding public internet routing.

Scope: resource — google_compute_subnetwork

Assertions: * private_ip_google_access is true — Subnetwork must enable private_ip_google_access for reliable Google API access.

Remediation: Set private_ip_google_access = true on google_compute_subnetwork resources to allow VMs without public IPs to access Google APIs reliably.

Compliant

resource "google_compute_subnetwork" "private" {
  name                     = "payment-private-subnet"
  ip_cidr_range            = "10.0.0.0/24"
  region                   = var.region
  network                  = google_compute_network.main.id
  private_ip_google_access = true
}

Non-Compliant

resource "google_compute_subnetwork" "private" {
  name                     = "payment-private-subnet"
  ip_cidr_range            = "10.0.0.0/24"
  region                   = var.region
  network                  = google_compute_network.main.id
  private_ip_google_access = false  # WAF-REL-080 violation
}

waf-rel-080.tf.stackit.dependency-mapped

Engine: terraform | Provider: stackit | Automated: Yes

All production workloads for stackit

All production workloads must be documented in IaC via a dependency-mapped tag/label on stackit_project. This validates the control is tracked as code.

Scope: resource — stackit_project

Assertions: * labels key exists — stackit_project is missing the dependency-mapped tag/label.

Remediation: Add a dependency-mapped tag/label to the stackit_project resource to show the stackit implementation of WAF-REL-080 is tracked in IaC.

Compliant

resource "stackit_project" "example" {
  labels = {
    dependency-mapped = "true"
  }
}

Non-Compliant

resource "stackit_project" "example" {
  # Missing dependency-mapped labels
}

waf-rel-080.tf.ovh.dependency-mapped

Engine: terraform | Provider: ovh | Automated: Yes

All production workloads for ovh

All production workloads must be documented in IaC via a dependency-mapped tag/label on ovh_cloud_project. This validates the control is tracked as code.

Scope: resource — ovh_cloud_project

Assertions: * tags key exists — ovh_cloud_project is missing the dependency-mapped tag/label.

Remediation: Add a dependency-mapped tag/label to the ovh_cloud_project resource to show the ovh implementation of WAF-REL-080 is tracked in IaC.

Compliant

resource "ovh_cloud_project" "example" {
  tags = {
    dependency-mapped = "true"
  }
}

Non-Compliant

resource "ovh_cloud_project" "example" {
  # Missing dependency-mapped tags
}

waf-rel-080.tf.hcloud.dependency-mapped

Engine: terraform | Provider: hcloud | Automated: Yes

All production workloads for hcloud

All production workloads must be documented in IaC via a dependency-mapped tag/label on hcloud_server. This validates the control is tracked as code.

Scope: resource — hcloud_server

Assertions: * labels key exists — hcloud_server is missing the dependency-mapped tag/label.

Remediation: Add a dependency-mapped tag/label to the hcloud_server resource to show the hcloud implementation of WAF-REL-080 is tracked in IaC.

Compliant

resource "hcloud_server" "example" {
  labels = {
    dependency-mapped = "true"
  }
}

Non-Compliant

resource "hcloud_server" "example" {
  # Missing dependency-mapped labels
}

Evidence

Kind Required Description

Kind	Required	Description
`iac`	Required	Terraform configuration implementing the control.
`governance`	Required	Policy, ADR, or standard documenting the requirement.
`config`	Optional	Cloud console or API output confirming runtime state.

iac

Required

Terraform configuration implementing the control.

governance

Required

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Related Controls

Framework	Controls
ISO 27001:2022	* A.15.1 – Information security in supplier relationships * A.17.1 – Information security continuity
ITIL 4	* Supplier Management * Service Configuration Management

Framework

Controls

ISO 27001:2022

* A.15.1 – Information security in supplier relationships * A.17.1 – Information security continuity

ITIL 4

* Supplier Management * Service Configuration Management