Wombat

WAF-SUS-090 – ESG Reporting & Compliance Automation

Säule: Sustainability | Schweregrad: Mittel | Kategorie: Agentic Governance | Automatisierbar: High

Beschreibung

Organizations subject to CSRD (or voluntarily reporting ESG) MUST have documented processes for collecting, aggregating, and reporting cloud IT emissions as part of Scope 3 GHG inventory. Cloud IT emissions data MUST be exported from cloud provider tools at least quarterly. CSRD-scope organizations MUST map cloud emissions to ESRS E1-6 reporting requirements. Emission reduction targets MUST be documented and tracked against baseline. Where possible, ESG data collection MUST be automated (scheduled exports, API integrations) to ensure data quality and reduce manual reporting burden.

Begründung

Risiko Beschreibung

Risk

Missing sustainability reporting prevents ESG transparency and regulatory compliance.

Risk

Incomplete carbon data complicates defining and monitoring reduction targets.

Anforderungen

  • Organizations subject to CSRD (or voluntarily reporting ESG) MUST have documented processes for collecting, aggregating, and reporting cloud IT emissions as part of Scope 3 GHG inventory.

  • Cloud IT emissions data MUST be exported from cloud provider tools at least quarterly.

  • CSRD-scope organizations MUST map cloud emissions to ESRS E1-6 reporting requirements.

  • Emission reduction targets MUST be documented and tracked against baseline.

  • Where possible, ESG data collection MUST be automated (scheduled exports, API integrations) to ensure data quality and reduce manual reporting burden.

Implementierungsleitfaden

  1. Document the requirement in a version-controlled policy or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Reifegrade

Level Name Kriterien

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-sus-090.tf.aws.cost-explorer-export-s3

Engine: terraform | Provider: aws | Automated: Ja

S3 bucket for Cost Explorer / Carbon Footprint Tool exports must exist with appropriate retention

An S3 bucket dedicated to receiving automated exports from AWS Cost Explorer (including the Customer Carbon Footprint Tool data) must exist with appropriate lifecycle policies for ESG audit data retention (7 years for CSRD).

Scope: resource — aws_s3_bucket

Assertions: * tags key exists — ESG/sustainability S3 buckets should have a 'purpose' tag for audit identification.

Remediation: Create a dedicated S3 bucket for sustainability data exports. Tag it with purpose = "esg-reporting" and configure lifecycle policies for 7-year retention (CSRD requires 7 years for sustainability disclosures). Enable versioning and access logging for audit trail completeness.

Compliant
resource "aws_s3_bucket" "esg_data" {
  bucket = "acme-esg-carbon-footprint-exports"
  tags = {
    purpose     = "esg-reporting"
    owner       = "sustainability-team"
    environment = "production"
    workload    = "esg-reporting"
  }
}

resource "aws_s3_bucket_versioning" "esg_data" {
  bucket = aws_s3_bucket.esg_data.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_lifecycle_configuration" "esg_data" {
  bucket = aws_s3_bucket.esg_data.id
  rule {
    id     = "esg-audit-retention"
    status = "Enabled"
    transition {
      days          = 365
      storage_class = "GLACIER"
    }
    expiration {
      days = 2555  # 7 years CSRD retention
    }
  }
}
Non-Compliant
resource "aws_s3_bucket" "esg_data" {
  bucket = "esg-exports-bucket"
  # WAF-SUS-090 Warning: no purpose tag, no lifecycle policy, no versioning
}

waf-sus-090.tf.aws.budgets-sustainability-alert

Engine: terraform | Provider: aws | Automated: Ja

AWS Budgets must include sustainability monitoring (cost as carbon proxy)

AWS cost budgets serve as a proxy for sustainability monitoring. Carbon emissions are broadly proportional to cost for equivalent workloads. Budget alerts that detect unexpected cost increases also detect unexpected emission increases.

Scope: resource — aws_budgets_budget

Assertions: * notification not empty — AWS Budget has no notification configured – cost/carbon anomalies will go undetected.

Remediation: Configure at least two budget notifications: at 80% (warning) and 100% (breach) of monthly budget. Add an additional ANOMALY_DETECTION notification type to catch unexpected spending spikes that indicate workload carbon anomalies.

Compliant
resource "aws_budgets_budget" "sustainability_proxy" {
  name         = "sustainability-carbon-proxy"
  budget_type  = "COST"
  limit_amount = "500"
  limit_unit   = "USD"
  time_unit    = "MONTHLY"

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 80
    threshold_type             = "PERCENTAGE"
    notification_type          = "ACTUAL"
    subscriber_email_addresses = [var.sustainability_team_email]
  }

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 100
    threshold_type             = "PERCENTAGE"
    notification_type          = "FORECASTED"
    subscriber_email_addresses = [var.sustainability_team_email]
  }
}
Non-Compliant
resource "aws_budgets_budget" "main" {
  name         = "monthly-budget"
  budget_type  = "COST"
  limit_amount = "1000"
  limit_unit   = "USD"
  time_unit    = "MONTHLY"
  # WAF-SUS-090 Violation: no notifications – cost/carbon overruns not detected
}

waf-sus-090.tf.azurerm.cost-management-export

Engine: terraform | Provider: azurerm | Automated: Ja

Azure Cost Management export should be configured for sustainability reporting

Azure Cost Management exports enable automated delivery of cost and emissions data to Azure Storage, which can then feed into ESG reporting platforms. At minimum, a monthly actual cost export should be configured for the subscription.

Scope: resource — azurerm_cost_management_export_resource_group_cost, azurerm_subscription_cost_management_export

Assertions: * active is true — Azure Cost Management export is not active – ESG data collection interrupted.

Remediation: Configure azurerm_subscription_cost_management_export with type = "ActualCost", recurrence_type = "Monthly", and export to an Azure Storage account with appropriate retention. Connect to Azure Emissions Impact Dashboard for carbon data.

Compliant
resource "azurerm_subscription_cost_management_export" "sustainability" {
  name            = "monthly-sustainability-export"
  subscription_id = var.subscription_id
  active          = true

  recurrence_type    = "Monthly"
  recurrence_period_start_date = "2024-01-01T00:00:00Z"
  recurrence_period_end_date   = "2030-12-31T00:00:00Z"

  export_data_storage_location {
    container_id     = azurerm_storage_container.esg_exports.resource_manager_id
    root_folder_path = "/carbon-footprint"
  }

  export_data_options {
    type       = "ActualCost"
    time_frame = "TheLastMonth"
  }
}
Non-Compliant
# No Azure Cost Management export configured – WAF-SUS-090 Violation
# ESG data collection requires automated export configuration

waf-sus-090.tf.google.bigquery-billing-export

Engine: terraform | Provider: google | Automated: Ja

GCP BigQuery dataset must be configured for billing/ESG export

GCP projects must export detailed billing data to a BigQuery dataset so cost and carbon data can be queried for CSRD/ESG reporting. The dataset must be labeled for ESG use.

Scope: resource — google_bigquery_dataset

Assertions: * labels key exists — BigQuery dataset for ESG export must be labeled with purpose. * labels.purpose matches pattern esg|billing|sustainability|carbon — BigQuery dataset purpose label should indicate ESG/sustainability/billing use.

Remediation: Create a BigQuery dataset named or labeled for billing/ESG export and enable billing export in the GCP console.

Compliant
resource "google_bigquery_dataset" "esg_billing" {
  dataset_id = "esg_billing_export"
  location   = "EU"
  labels = {
    purpose     = "esg-reporting"
    environment = "production"
  }
}
Non-Compliant
resource "google_bigquery_dataset" "other" {
  dataset_id = "other"
  location   = "US"
  # Not labeled for ESG/billing export
}

Evidenz

Art Erforderlich Beschreibung

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Verwandte Controls

Framework Controls

EU CSRD (Corporate Sustainability Reporting Directive)

* ESRS E1 – Climate Change * ESRS E1-6 – Gross Scope 1, 2, and 3 GHG emissions and total GHG emissions * ESRS 2 – General Disclosures: data collection and reporting processes

GHG Protocol

* Corporate Standard – Scope 3 Category 11 * Scope 2 Guidance – market-based and location-based methods

SBTi (Science Based Targets initiative)

* ICT Sector Guidance – target setting and tracking * Near-term corporate targets – annual progress reporting

ISO 14001

* 9.1 – Monitoring, measurement, analysis and evaluation * 9.3 – Management review – including environmental performance