WAF-SOV-070 – Break-Glass Process & Logging

Pillar: Sovereign | Severity: High | Category: Identity Access | Automatable: High

Description

A formally documented break-glass procedure MUST exist defining trigger criteria, approval workflow, activation steps, and post-incident review requirements. All break-glass actions MUST be fully logged via CloudTrail (or equivalent) with log file validation enabled. Root account and emergency admin activities MUST trigger real-time alerts. Post-incident reviews MUST be documented and linked to the activation event.

Rationale

Risk	Description
Risk	Emergency access procedures without documentation lead to unauthorized break-glass actions in a crisis.
Risk	Missing break-glass processes extend recovery time during severe incidents.

Risk

Description

Risk

Emergency access procedures without documentation lead to unauthorized break-glass actions in a crisis.

Risk

Missing break-glass processes extend recovery time during severe incidents.

Requirements

A formally documented break-glass procedure MUST exist defining trigger criteria, approval workflow, activation steps, and post-incident review requirements.
All break-glass actions MUST be fully logged via CloudTrail (or equivalent) with log file validation enabled.
Root account and emergency admin activities MUST trigger real-time alerts.
Post-incident reviews MUST be documented and linked to the activation event.

Implementation Guidance

Implement the required configuration as code in Terraform or equivalent IaC.
Add an automated check to CI/CD so deviations are caught before deployment.

Maturity Levels

Level	Name	Criteria
L1	Ad hoc – control not consistently applied	* Manual evidence exists for some workloads, but coverage is unknown.
L2	Standardised – policy defined and communicated	* A version-controlled policy, ADR, or standard describes the requirement.
L3	Integrated – automated validation in CI/CD	* Terraform checks run automatically on pull requests and report results.
L4	Auditable – metrics and exceptions tracked	* Control coverage, failures, and approved exceptions are reported quarterly.
L5	Optimised – continuous improvement based on data	* Control effectiveness is measured and iteratively improved.

Level

Name

Criteria

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-sov-070.tf.aws.cloudtrail-enabled-all-regions

Engine: terraform | Provider: aws | Automated: Yes

CloudTrail must be multi-region with log file validation

At least one CloudTrail must be configured with is_multi_region_trail = true and enable_log_file_validation = true to capture all API activity and detect log tampering.

Scope: resource — aws_cloudtrail

Assertions: * is_multi_region_trail is true — CloudTrail must be multi-region to capture break-glass events from all regions. * enable_log_file_validation is true — CloudTrail log file validation must be enabled to detect tampering. * include_global_service_events is true — CloudTrail must include global service events (IAM, STS, etc.).

Remediation: Set is_multi_region_trail = true, enable_log_file_validation = true, and include_global_service_events = true on CloudTrail.

Compliant

resource "aws_cloudtrail" "sovereign" {
  name                          = "sovereign-audit-trail"
  s3_bucket_name                = aws_s3_bucket.cloudtrail.id
  is_multi_region_trail         = true
  enable_log_file_validation    = true
  include_global_service_events = true
  cloud_watch_logs_group_arn    = "${aws_cloudwatch_log_group.cloudtrail.arn}:*"
  cloud_watch_logs_role_arn     = aws_iam_role.cloudtrail_cw.arn
}

Non-Compliant

resource "aws_cloudtrail" "trail" {
  name           = "my-trail"
  s3_bucket_name = "my-logs"
  # Defaults: single region, no validation, no CloudWatch
}

waf-sov-070.tf.aws.cloudtrail-s3-bucket-not-public

Engine: terraform | Provider: aws | Automated: Yes

CloudTrail S3 bucket must not be publicly accessible

The S3 bucket storing CloudTrail logs must have public access blocked. Public CloudTrail logs expose the full API activity of the account.

Scope: resource — aws_s3_bucket_public_access_block

Assertions: * block_public_acls is true — CloudTrail S3 bucket must block public ACLs. * block_public_policy is true — CloudTrail S3 bucket must block public bucket policy. * ignore_public_acls is true — CloudTrail S3 bucket must ignore public ACLs. * restrict_public_buckets is true — CloudTrail S3 bucket must restrict public buckets.

Remediation: Create an aws_s3_bucket_public_access_block resource for the CloudTrail bucket with all four settings set to true.

Compliant

resource "aws_s3_bucket_public_access_block" "cloudtrail" {
  bucket                  = aws_s3_bucket.cloudtrail.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

Non-Compliant

resource "aws_s3_bucket_public_access_block" "cloudtrail" {
  bucket            = aws_s3_bucket.cloudtrail.id
  block_public_acls = true
  # Other settings missing – defaults to false
}

waf-sov-070.tf.aws.cloudwatch-alarm-root-login

Engine: terraform | Provider: aws | Automated: Yes

CloudWatch alarm must exist for root account sign-in

A CloudWatch metric filter and alarm must be configured to detect and alert on any root account API call or console sign-in. Root usage outside a documented break-glass process is a critical sovereignty violation.

Scope: resource — aws_cloudwatch_metric_alarm

Assertions: * log_group_name has associated resource — No CloudWatch alarm found monitoring root account activity.

Remediation: Create a CloudWatch metric filter matching root API calls and an alarm that notifies a security SNS topic when the metric is triggered.

Compliant

resource "aws_cloudwatch_log_metric_filter" "root_usage" {
  name           = "root-account-usage"
  pattern        = "{$.userIdentity.type = Root && $.userIdentity.invokedBy NOT EXISTS && $.eventType != AwsServiceEvent}"
  log_group_name = aws_cloudwatch_log_group.cloudtrail.name
  metric_transformation {
    name      = "RootAccountUsageCount"
    namespace = "CloudTrailMetrics"
    value     = "1"
  }
}
resource "aws_cloudwatch_metric_alarm" "root_usage" {
  alarm_name          = "root-account-usage"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = "1"
  metric_name         = "RootAccountUsageCount"
  namespace           = "CloudTrailMetrics"
  period              = "60"
  statistic           = "Sum"
  threshold           = "1"
  alarm_actions       = [aws_sns_topic.security_alerts.arn]
}

Non-Compliant

# No metric filter or alarm for root account activity

waf-sov-070.tf.aws.cloudwatch-alarm-iam-policy-changes

Engine: terraform | Provider: aws | Automated: Yes

CloudWatch alarm must exist for IAM policy changes

Unauthorized IAM policy changes can escalate privileges or disable sovereignty controls. An alarm must detect and alert on IAM policy creation, modification, or deletion events.

Scope: resource — aws_cloudwatch_log_metric_filter

Assertions: * pattern matches pattern CreatePolicy|DeletePolicy|AttachRolePolicy|DetachRolePolicy — No CloudWatch metric filter found monitoring IAM policy changes.

Remediation: Create metric filters for IAM policy changes (CreatePolicy, DeletePolicy, AttachRolePolicy, DetachRolePolicy) with associated CloudWatch alarms.

waf-sov-070.tf.aws.cloudtrail-s3-access-logging

Engine: terraform | Provider: aws | Automated: Yes

CloudTrail S3 bucket should have server access logging enabled

The S3 bucket storing CloudTrail logs should have access logging enabled to detect unauthorized access attempts to the audit logs themselves.

Scope: resource — aws_s3_bucket_logging

Assertions: * s3_bucket_name has associated resource — CloudTrail S3 bucket should have an aws_s3_bucket_logging resource configured.

Remediation: Create an aws_s3_bucket_logging resource for the CloudTrail bucket targeting a separate access logs bucket.

waf-sov-070.tf.stackit.logging-enabled

Engine: terraform | Provider: stackit | Automated: Yes

StackIT services must have logging enabled

StackIT services (MySQL, Redis, OpenSearch, Container Registry) must have logging enabled for break-glass activity monitoring.

Scope: resource — stackit_mysql_instance, stackit_redis_instance, stackit_opensearch_instance, stackit_container_registry

Assertions: * logging.enabled is true — StackIT service must have logging enabled for audit purposes.

Remediation: Enable logging on all StackIT services with log file validation.

Compliant

resource "stackit_mysql_instance" "main" {
  project_id = stackit_project.main.id
  name       = "sovereign-mysql"
  logging {
    enabled = true
  }
}

Non-Compliant

resource "stackit_mysql_instance" "main" {
  project_id = stackit_project.main.id
  name       = "mysql"
  # Logging not enabled
}

waf-sov-070.tf.ovh.logging-enabled

Engine: terraform | Provider: ovh | Automated: Yes

OVH services must have logging enabled

OVH cloud services must have logging enabled for break-glass activity monitoring.

Scope: resource — ovh_cloud_project, ovh_vps, ovh_dedicated_server

Assertions: * logging_enabled is true — OVH service must have logging enabled for audit purposes.

Remediation: Enable logging on OVH services for audit trail compliance.

Compliant

# OVH services with logging enabled

Non-Compliant

# OVH services without logging

waf-sov-070.tf.hcloud.logging-enabled

Engine: terraform | Provider: hcloud | Automated: Yes

Hetzner Cloud services must have logging enabled

Hetzner Cloud servers must have logging enabled for break-glass activity monitoring.

Scope: resource — hcloud_server

Assertions: * labels key exists — Hetzner Cloud server must have logging-enabled label.

Remediation: Enable ssh access logging and system logging on Hetzner Cloud servers.

Compliant

resource "hcloud_server" "main" {
  name        = "sovereign-server"
  server_type = "cx22"
  labels = {
    logging-enabled = "true"
  }
}

Non-Compliant

resource "hcloud_server" "main" {
  name        = "server"
  server_type = "cx22"
  # No logging configuration
}

waf-sov-070.config.azurerm.break-glass-policy

Engine: config | Provider: azurerm | Automated: Yes

Azure break-glass procedure must be documented

A version-controlled policy document must exist at docs/sovereign/waf-sov-070-azurerm-break-glass.md and document the Azure break-glass procedure including triggers, approvers, credentials, and revocation steps.

Scope: file — docs/sovereign/waf-sov-070-azurerm-break-glass.md

Remediation: Create or update docs/sovereign/waf-sov-070-azurerm-break-glass.md. State triggers, approvers, emergency account details, audit trail, and periodic test schedule.

Compliant

docs/sovereign/waf-sov-070-azurerm-break-glass.md:
- Break-glass triggers are defined (e.g., PIM outage, global admin lockout).
- Two cloud-only emergency accounts are created with strong authentication.
- Credential storage and revocation steps are documented.

Non-Compliant

# docs/sovereign/waf-sov-070-azurerm-break-glass.md is missing or does not contain a normative requirement.

waf-sov-070.config.google.break-glass-policy

Engine: config | Provider: google | Automated: Yes

GCP break-glass procedure must be documented

A version-controlled policy document must exist at docs/sovereign/waf-sov-070-google-break-glass.md and document the GCP break-glass procedure including triggers, approvers, credentials, and revocation steps.

Scope: file — docs/sovereign/waf-sov-070-google-break-glass.md

Remediation: Create or update docs/sovereign/waf-sov-070-google-break-glass.md. State triggers, approvers, emergency account details, audit trail, and periodic test schedule.

Compliant

docs/sovereign/waf-sov-070-google-break-glass.md:
- Break-glass triggers are defined (e.g., IAM policy lockout).
- Organization-level emergency accounts are configured.
- Credential storage and revocation steps are documented.

Non-Compliant

# docs/sovereign/waf-sov-070-google-break-glass.md is missing or does not contain a normative requirement.

Evidence

Kind Required Description

Kind	Required	Description
`iac`	Required	Terraform configuration implementing the control.
`governance`	Required	Policy, ADR, or standard documenting the requirement.
`config`	Optional	Cloud console or API output confirming runtime state.

iac

Required

Terraform configuration implementing the control.

governance

Required

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Related Controls

Framework	Controls
GDPR	* Art. 32 – Security of processing * Art. 33 – Notification of personal data breach
BSI C5:2020	* IAM-03 – Privileged access management * LOG-01 – Logging * BCM-02 – Incident management
BSI C3A:2026	* Dimension 3 – State of Defense Takeover: Emergency procedures * Dimension 3 – State of Defense Takeover: Federal takeover provisions
EUCS (ENISA)	* IAM-03 – Emergency access * LOG-01 – Audit logging
ISO 27001:2022	* A.5.26 – Response to information security incidents * A.8.15 – Logging * A.8.16 – Monitoring activities
SOC 2 Type II	* CC7.4 – Security incident response

Framework

Controls

GDPR

* Art. 32 – Security of processing * Art. 33 – Notification of personal data breach

BSI C5:2020

* IAM-03 – Privileged access management * LOG-01 – Logging * BCM-02 – Incident management

BSI C3A:2026

* Dimension 3 – State of Defense Takeover: Emergency procedures * Dimension 3 – State of Defense Takeover: Federal takeover provisions

EUCS (ENISA)

* IAM-03 – Emergency access * LOG-01 – Audit logging

ISO 27001:2022

* A.5.26 – Response to information security incidents * A.8.15 – Logging * A.8.16 – Monitoring activities

SOC 2 Type II

* CC7.4 – Security incident response