Wombat

WAF-SUS-100 – Sustainability Debt Register & Quarterly Review

Säule: Sustainability | Schweregrad: Niedrig | Kategorie: Cost Governance | Automatisierbar: High

Beschreibung

Organizations MUST maintain a Sustainability Debt Register documenting all known gaps between current sustainability posture and target state across all WAF-SUS controls. The register MUST be reviewed and updated at least quarterly. Each entry MUST include: estimated carbon impact, remediation priority, owner, and target resolution date. Sustainability debt MUST be treated as a governance risk item and reported in the organization’s ESG or sustainability report. Quarterly reviews MUST produce measurable progress against reduction targets.

Begründung

Risiko Beschreibung

Risk

Undocumented sustainability debt prevents targeted optimization and budget approvals.

Risk

Missing prioritization of green-debt items lets inefficient workloads run unchanged.

Anforderungen

  • Organizations MUST maintain a Sustainability Debt Register documenting all known gaps between current sustainability posture and target state across all WAF-SUS controls.

  • The register MUST be reviewed and updated at least quarterly.

  • Each entry MUST include: estimated carbon impact, remediation priority, owner, and target resolution date.

  • Sustainability debt MUST be treated as a governance risk item and reported in the organization’s ESG or sustainability report.

  • Quarterly reviews MUST produce measurable progress against reduction targets.

Implementierungsleitfaden

  1. Document the requirement in a version-controlled policy or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Reifegrade

Level Name Kriterien

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-sus-100.tf.aws.config-rule-sustainability-governance

Engine: terraform | Provider: aws | Automated: Ja

AWS Config rules should be enabled for sustainability-relevant resource types

AWS Config provides continuous monitoring of resource configuration compliance. Enabling Config rules for sustainability-relevant resource types (EC2 instance types, S3 lifecycle policies, CloudWatch log retention) enables automated detection of sustainability debt as it is created.

Scope: resource — aws_config_config_rule

Assertions: * name attribute exists — AWS Config rule must have a name. * source attribute exists — AWS Config rule must have a source configuration.

Remediation: Enable AWS Config and create managed rules for: required-tags, ec2-instance-managed-by-ssm, cloudwatch-log-group-retention-period-check, s3-lifecycle-policy-check. These rules provide continuous monitoring of the most common sources of sustainability debt.

Compliant
resource "aws_config_config_rule" "log_retention" {
  name        = "cloudwatch-log-group-retention-period-check"
  description = "Checks that CloudWatch log groups have retention policy set (sustainability debt detection)"

  source {
    owner             = "AWS"
    source_identifier = "CLOUD_WATCH_LOG_GROUP_RETENTION_PERIOD_CHECK"
  }

  input_parameters = jsonencode({
    MinRetentionTime = "14"
  })

  tags = {
    purpose  = "sustainability-governance"
    control  = "WAF-SUS-100"
  }
}
Non-Compliant
# No AWS Config rules configured – WAF-SUS-100 Warning
# Sustainability debt accumulates undetected without automated config compliance

waf-sus-100.tf.aws.tag-sustainability-reviewed

Engine: terraform | Provider: aws | Automated: Ja

Compute resources should have sustainability-reviewed tag to indicate review date

Resources tagged with 'sustainability-reviewed' demonstrate active governance: the sustainability posture of the resource was explicitly reviewed on the given date. This tag drives the sustainability debt register by identifying stale reviews.

Scope: resource — aws_instance, aws_eks_cluster, aws_ecs_cluster

Assertions: * tags key exists — Resource has no sustainability-reviewed tag – add date of last sustainability review.

Remediation: Add sustainability-reviewed = "YYYY-MM-DD" tag to all major compute resources. Set up quarterly reminder to update this tag after sustainability review. Use AWS Config custom rule to alert when sustainability-reviewed tag is older than 180 days.

Compliant
resource "aws_instance" "app" {
  ami           = data.aws_ami.ubuntu_arm.id
  instance_type = "m7g.large"

  tags = {
    environment              = "production"
    workload                 = "payment-service"
    owner                    = "platform-team"
    sustainability-reviewed  = "2026-01-15"  # quarterly review date
  }
}
Non-Compliant
resource "aws_instance" "app" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "m4.large"

  tags = {
    Name        = "payment-app"
    # WAF-SUS-100 Warning: no sustainability-reviewed tag
  }
}

waf-sus-100.tf.azurerm.sustainability-tag

Engine: terraform | Provider: azurerm | Automated: Ja

Azure compute resources should have sustainability governance tags

Azure compute resources should carry a sustainability-reviewed tag indicating the last date the resource’s sustainability posture was reviewed as part of the quarterly sustainability debt register process.

Scope: resource — azurerm_linux_virtual_machine, azurerm_kubernetes_cluster, azurerm_container_group

Assertions: * tags key exists — Azure compute resource has no sustainability-reviewed tag – quarterly review required.

Remediation: Add sustainability-reviewed tag with format YYYY-MM-DD to all Azure compute resources. Use Azure Policy to enforce tag presence on resource creation and flag resources where the date is older than 180 days.

Compliant
resource "azurerm_linux_virtual_machine" "app" {
  name                = "vm-app-prod"
  resource_group_name = var.resource_group_name
  location            = var.location
  size                = "Standard_D4ps_v5"

  tags = {
    environment             = "production"
    workload                = "payment-service"
    sustainability-reviewed = "2026-01-15"
  }
}
Non-Compliant
resource "azurerm_linux_virtual_machine" "app" {
  name                = "vm-app-prod"
  resource_group_name = var.resource_group_name
  location            = var.location
  size                = "Standard_D4_v3"
  # WAF-SUS-100 Warning: old instance series AND no sustainability-reviewed tag
}

waf-sus-100.tf.google.sustainability-debt-label

Engine: terraform | Provider: google | Automated: Ja

GCP project resources must track sustainability debt via labels

GCP projects and compute resources should declare whether they carry known sustainability debt via a sustainability-debt-register label, linking to the central register.

Scope: resource — google_project

Assertions: * labels key exists — GCP project must have a sustainability-debt-register label referencing the central register.

Remediation: Add a sustainability-debt-register label to google_project resources. The label value should reference the central Sustainability Debt Register document.

Compliant
resource "google_project" "app" {
  name       = "Application Project"
  project_id = "app-prod-123"
  labels = {
    sustainability-debt-register = "docs/sustainability/debt-register.md"
  }
}
Non-Compliant
resource "google_project" "app" {
  name       = "Application Project"
  project_id = "app-prod-123"
  # Missing sustainability-debt-register label
}

Evidenz

Art Erforderlich Beschreibung

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Verwandte Controls

Framework Controls

EU CSRD (Corporate Sustainability Reporting Directive)

* ESRS 2 – General Disclosures: Governance, strategy and management of sustainability matters * ESRS E1 – Climate Change: governance of climate-related risks and opportunities

GHG Protocol

* Corporate Standard – management and governance of GHG inventory

SBTi (Science Based Targets initiative)

* ICT Sector Guidance – progress tracking and governance

ISO 14001

* 10.3 – Continual improvement * 6.1 – Actions to address risks and opportunities