Wombat

WAF-SUS-010 – Carbon Footprint Measurement & Reporting

Säule: Sustainability | Schweregrad: Hoch | Kategorie: Data Governance | Automatisierbar: High

Beschreibung

Organizations MUST measure and report the carbon footprint of their cloud workloads. Cloud-provider carbon footprint tools (AWS Customer Carbon Footprint Tool, Azure Emissions Impact Dashboard, GCP Carbon Footprint) MUST be enabled and queried at least monthly. Emissions data MUST be exported, tagged by workload, and retained for ESG reporting. Organizations subject to CSRD MUST integrate cloud IT emissions into their ESRS E1 reporting.

Begründung

Risiko Beschreibung

Risk

Inefficient resource choices increase energy consumption and carbon emissions.

Risk

Unnecessary compute and storage waste budget and environmental targets.

Anforderungen

  • Organizations MUST measure and report the carbon footprint of their cloud workloads.

  • Cloud-provider carbon footprint tools (AWS Customer Carbon Footprint Tool, Azure Emissions Impact Dashboard, GCP Carbon Footprint) MUST be enabled and queried at least monthly.

  • Emissions data MUST be exported, tagged by workload, and retained for ESG reporting.

  • Organizations subject to CSRD MUST integrate cloud IT emissions into their ESRS E1 reporting.

Implementierungsleitfaden

  1. Document the requirement in a version-controlled policy or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Reifegrade

Level Name Kriterien

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-sus-010.tf.aws.cloudwatch-carbon-export

Engine: terraform | Provider: aws | Automated: Ja

AWS CloudWatch log group for carbon footprint data export must exist with retention

A CloudWatch log group or S3 bucket export for AWS Customer Carbon Footprint Tool data must be configured. This check verifies that a log retention policy is set on log groups used for carbon/cost data (no infinite retention which also wastes storage energy).

Scope: resource — aws_cloudwatch_log_group

Assertions: * retention_in_days attribute exists — CloudWatch log group has no retention policy – infinite retention wastes storage and blocks carbon data lifecycle. * retention_in_days greater than or equal 1 — Retention must be set to at least 1 day; recommended 90-365 days for carbon audit data.

Remediation: Set retention_in_days on all CloudWatch log groups. For carbon footprint audit logs, use 365 days to satisfy CSRD 7-year record retention. Use lifecycle policies to transition older logs to S3 Glacier for cost and energy efficiency.

Compliant
resource "aws_cloudwatch_log_group" "carbon_audit" {
  name              = "/sustainability/carbon-footprint-exports"
  retention_in_days = 365
  tags = {
    purpose     = "carbon-audit"
    workload    = "sustainability-reporting"
    environment = "production"
  }
}
Non-Compliant
resource "aws_cloudwatch_log_group" "carbon_audit" {
  name = "/sustainability/carbon-footprint-exports"
  # retention_in_days not set = infinite retention
  # WAF-SUS-010 Violation
}

waf-sus-010.tf.aws.s3-carbon-export-lifecycle

Engine: terraform | Provider: aws | Automated: Ja

S3 bucket for carbon footprint exports must have lifecycle rules

S3 buckets used to store carbon footprint exports from AWS Cost Explorer or Cost and Usage Reports must have lifecycle rules to transition data to cost-efficient storage tiers and eventually expire old records.

Scope: resource — aws_s3_bucket_lifecycle_configuration

Assertions: * rule not empty — S3 bucket has no lifecycle rules – carbon export data will accumulate indefinitely.

Remediation: Add lifecycle rules to transition objects to STANDARD_IA after 30 days, GLACIER after 90 days, and expire after 2555 days (7 years for CSRD compliance). This reduces storage emissions while satisfying regulatory retention requirements.

Compliant
resource "aws_s3_bucket_lifecycle_configuration" "carbon_exports" {
  bucket = aws_s3_bucket.carbon_data.id
  rule {
    id     = "carbon-data-lifecycle"
    status = "Enabled"
    transition {
      days          = 30
      storage_class = "STANDARD_IA"
    }
    transition {
      days          = 90
      storage_class = "GLACIER"
    }
    expiration {
      days = 2555
    }
  }
}
Non-Compliant
resource "aws_s3_bucket" "carbon_data" {
  bucket = "acme-carbon-footprint-exports"
  # No lifecycle rules – WAF-SUS-010 Violation
}

waf-sus-010.tf.azurerm.log-analytics-retention

Engine: terraform | Provider: azurerm | Automated: Ja

Azure Log Analytics workspace for sustainability data must have retention configured

Azure Log Analytics workspaces used for emissions dashboard data and sustainability reporting must have explicit retention periods. Default unlimited retention accumulates data with no governance.

Scope: resource — azurerm_log_analytics_workspace

Assertions: * retention_in_days attribute exists — Log Analytics workspace has no explicit retention period – data accumulates indefinitely. * retention_in_days greater than or equal 1 — Retention for sustainability audit data must be at least 90 days; recommended 365.

Remediation: Set retention_in_days to at least 365 for sustainability audit workspaces. Enable data export to Azure Storage with lifecycle management for long-term CSRD retention.

Compliant
resource "azurerm_log_analytics_workspace" "sustainability" {
  name                = "law-sustainability-reporting"
  location            = var.location
  resource_group_name = var.resource_group_name
  sku                 = "PerGB2018"
  retention_in_days   = 365
  tags = {
    purpose     = "carbon-audit"
    environment = "production"
  }
}
Non-Compliant
resource "azurerm_log_analytics_workspace" "sustainability" {
  name                = "law-sustainability-reporting"
  location            = var.location
  resource_group_name = var.resource_group_name
  # retention_in_days not set – WAF-SUS-010 Violation
}

waf-sus-010.tf.google.billing-export-bigquery

Engine: terraform | Provider: google | Automated: Ja

GCP billing export to BigQuery must be enabled for carbon footprint reporting

GCP projects must export billing data to a BigQuery dataset so carbon footprint and sustainability metrics can be derived. The dataset should be in an approved region and have appropriate labels.

Scope: resource — google_bigquery_dataset

Assertions: * labels key exists — BigQuery billing export dataset must be labeled with purpose. * location in ['EU', 'europe-west3', 'europe-west1'] — BigQuery billing export dataset must be in an approved region.

Remediation: Configure google_billing_budget or use the GCP console to enable detailed billing export to BigQuery. Create the BigQuery dataset in an approved region and label it for sustainability reporting.

Compliant
resource "google_bigquery_dataset" "billing_export" {
  dataset_id  = "billing_export"
  description = "Billing export for carbon footprint and ESG reporting"
  location    = "EU"
  labels = {
    purpose     = "carbon-audit"
    environment = "production"
  }
}
Non-Compliant
# No BigQuery dataset configured for billing/carbon export.

Evidenz

Art Erforderlich Beschreibung

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Verwandte Controls

Framework Controls

EU CSRD (Corporate Sustainability Reporting Directive)

* ESRS E1 – Climate Change * ESRS E1-6 – Gross Scope 1, 2, 3 GHG emissions

GHG Protocol

* Scope 3 – Category 11: Use of sold products * Scope 2 – Energy Indirect Emissions (location-based and market-based)

Green Software Foundation

* Software Carbon Intensity (SCI) – measurement standard

SBTi (Science Based Targets initiative)

* ICT Sector Guidance – Scope 3 measurement requirements

ISO 14001

* 6.1.2 – Environmental Aspects identification and assessment * 9.1 – Monitoring, measurement, analysis and evaluation