WAF-SUS-030 – Green Region & Carbon-Aware Workload Placement

Pillar: Sustainability | Severity: Medium | Category: Data Governance | Automatable: High

Description

Workloads without strict data-residency requirements MUST consider carbon intensity of cloud regions in placement decisions. When architectural and regulatory constraints allow, workloads SHOULD be placed in regions with high renewable energy mix or low grid carbon intensity. Region selection decisions MUST document sustainability considerations alongside latency and cost factors. Batch workloads with flexible placement MUST evaluate green region alternatives.

Rationale

Risk	Description
Risk	Data may leave approved jurisdictions and violate regulatory requirements.
Risk	Vendor lock-in reduces future portability and sovereignty options.

Risk

Description

Risk

Data may leave approved jurisdictions and violate regulatory requirements.

Risk

Vendor lock-in reduces future portability and sovereignty options.

Requirements

Workloads without strict data-residency requirements MUST consider carbon intensity of cloud regions in placement decisions.
When architectural and regulatory constraints allow, workloads SHOULD be placed in regions with high renewable energy mix or low grid carbon intensity.
Region selection decisions MUST document sustainability considerations alongside latency and cost factors.
Batch workloads with flexible placement MUST evaluate green region alternatives.

Implementation Guidance

Document the requirement in a version-controlled policy or standard.
Assign ownership and establish a review cadence (e.g., quarterly).
Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level	Name	Criteria
L1	Ad hoc – control not consistently applied	* Manual evidence exists for some workloads, but coverage is unknown.
L2	Standardised – policy defined and communicated	* A version-controlled policy, ADR, or standard describes the requirement.
L3	Integrated – automated validation in CI/CD	* Terraform checks run automatically on pull requests and report results.
L4	Auditable – metrics and exceptions tracked	* Control coverage, failures, and approved exceptions are reported quarterly.
L5	Optimised – continuous improvement based on data	* Control effectiveness is measured and iteratively improved.

Level

Name

Criteria

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-sus-030.tf.aws.preferred-regions

Engine: terraform | Provider: aws | Automated: Yes

AWS provider region should be a low-carbon-intensity region

This check validates that the AWS provider is configured to use a region with known high renewable energy mix. High-carbon regions are flagged as warnings to trigger documentation of the sustainability justification.

Scope: provider — aws

Assertions: * region in ['us-west-2', 'eu-north-1', 'eu-west-1'] — AWS region has a high carbon intensity. Consider us-west-2, eu-north-1, eu-west-1 for lower emissions.

Remediation: If workloads can be placed in a lower-carbon region without violating data residency, latency, or compliance requirements, prefer: us-west-2 (Oregon, ~89% renewable), eu-north-1 (Stockholm, ~95% renewable), eu-west-1 (Ireland, ~80% renewable). If high-carbon region is required, document the justification in an ADR and offset through RECs for that region’s workload footprint.

Compliant

provider "aws" {
  region = "eu-north-1"  # Stockholm – ~95% renewable energy
  # Sustainability justification: low carbon intensity region selected per WAF-SUS-030
}

Non-Compliant

provider "aws" {
  region = "ap-east-1"  # Hong Kong – high carbon intensity grid
  # WAF-SUS-030 Warning: document carbon justification or migrate to lower-carbon region
}

waf-sus-030.tf.google.preferred-regions

Engine: terraform | Provider: google | Automated: Yes

GCP provider region should be a low-carbon-intensity region

GCP regions vary significantly in carbon intensity. europe-north1 (Finland) and europe-west1 (Belgium) are among the lowest carbon-intensity regions globally.

Scope: provider — google

Assertions: * region in ['europe-north1', 'europe-west1', 'us-west1'] — GCP region has elevated carbon intensity. Consider europe-north1, europe-west1, or us-west1.

Remediation: For GCP workloads, prefer europe-north1 (Finland, ~97% renewable), europe-west1 (Belgium), or us-west1 (Oregon). GCP Carbon Footprint dashboard shows per-project emissions by region. Use carbon-free energy percentage (CFE%) metric available in GCP Sustainability console.

Compliant

provider "google" {
  project = var.project_id
  region  = "europe-north1"  # Finland – 97% carbon-free energy
}

Non-Compliant

provider "google" {
  project = var.project_id
  region  = "asia-east1"  # Taiwan – lower renewable energy share
  # WAF-SUS-030 Warning: document carbon justification
}

waf-sus-030.tf.azurerm.preferred-regions

Engine: terraform | Provider: azurerm | Automated: Yes

Azure provider location should be a low-carbon-intensity region

Azure regions differ in their carbon intensity. Sweden Central, Norway East, and North Europe (Ireland) consistently show the lowest carbon intensity in Azure’s Emissions Impact Dashboard.

Scope: resource — azurerm_resource_group

Assertions: * location in ['swedencentral', 'norwayeast', 'northeurope'] — Azure region may have elevated carbon intensity. Consider swedencentral, norwayeast, or northeurope.

Remediation: For Azure, prefer swedencentral (Sweden, ~95% renewable), norwayeast (Norway, hydro-powered), or northeurope (Ireland). Review Azure Emissions Impact Dashboard for current carbon intensity by region. Document sustainability rationale when using other regions.

Compliant

resource "azurerm_resource_group" "main" {
  name     = "rg-app-prod"
  location = "swedencentral"  # Sweden – ~95% renewable energy
  tags = {
    sustainability-region = "green"
  }
}

Non-Compliant

resource "azurerm_resource_group" "main" {
  name     = "rg-app-prod"
  location = "eastasia"
  # WAF-SUS-030 Warning: high carbon intensity region, document justification
}

waf-sus-030.tf.stackit.renewable-energy-used

Engine: terraform | Provider: stackit | Automated: Yes

Workloads without strict data-residency requirements for stackit

Workloads without strict data-residency requirements must be documented in IaC via a renewable-energy-used tag/label on stackit_project. This validates the control is tracked as code.

Scope: resource — stackit_project

Assertions: * labels key exists — stackit_project is missing the renewable-energy-used tag/label.

Remediation: Add a renewable-energy-used tag/label to the stackit_project resource to show the stackit implementation of WAF-SUS-030 is tracked in IaC.

Compliant

resource "stackit_project" "example" {
  labels = {
    renewable-energy-used = "true"
  }
}

Non-Compliant

resource "stackit_project" "example" {
  # Missing renewable-energy-used labels
}

waf-sus-030.tf.ovh.renewable-energy-used

Engine: terraform | Provider: ovh | Automated: Yes

Workloads without strict data-residency requirements for ovh

Workloads without strict data-residency requirements must be documented in IaC via a renewable-energy-used tag/label on ovh_cloud_project. This validates the control is tracked as code.

Scope: resource — ovh_cloud_project

Assertions: * tags key exists — ovh_cloud_project is missing the renewable-energy-used tag/label.

Remediation: Add a renewable-energy-used tag/label to the ovh_cloud_project resource to show the ovh implementation of WAF-SUS-030 is tracked in IaC.

Compliant

resource "ovh_cloud_project" "example" {
  tags = {
    renewable-energy-used = "true"
  }
}

Non-Compliant

resource "ovh_cloud_project" "example" {
  # Missing renewable-energy-used tags
}

waf-sus-030.tf.hcloud.renewable-energy-used

Engine: terraform | Provider: hcloud | Automated: Yes

Workloads without strict data-residency requirements for hcloud

Workloads without strict data-residency requirements must be documented in IaC via a renewable-energy-used tag/label on hcloud_server. This validates the control is tracked as code.

Scope: resource — hcloud_server

Assertions: * labels key exists — hcloud_server is missing the renewable-energy-used tag/label.

Remediation: Add a renewable-energy-used tag/label to the hcloud_server resource to show the hcloud implementation of WAF-SUS-030 is tracked in IaC.

Compliant

resource "hcloud_server" "example" {
  labels = {
    renewable-energy-used = "true"
  }
}

Non-Compliant

resource "hcloud_server" "example" {
  # Missing renewable-energy-used labels
}

Evidence

Kind Required Description

Kind	Required	Description
`iac`	Required	Terraform configuration implementing the control.
`governance`	Required	Policy, ADR, or standard documenting the requirement.
`config`	Optional	Cloud console or API output confirming runtime state.

iac

Required

Terraform configuration implementing the control.

governance

Required

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Related Controls

Framework	Controls
EU CSRD (Corporate Sustainability Reporting Directive)	* ESRS E1 – Climate Change – Scope 3 reduction actions
GHG Protocol	* Scope 2 – Market-based method (renewable energy certificates, PPAs) * Scope 3 – Category 11: purchased cloud services location factor
Green Software Foundation	* Carbon Aware Computing – location-based optimization * Software Carbon Intensity (SCI) – location component
ISO 14001	* 6.1.2 – Environmental aspects: procurement and infrastructure decisions

Framework

Controls

EU CSRD (Corporate Sustainability Reporting Directive)

* ESRS E1 – Climate Change – Scope 3 reduction actions

GHG Protocol

* Scope 2 – Market-based method (renewable energy certificates, PPAs) * Scope 3 – Category 11: purchased cloud services location factor

Green Software Foundation

* Carbon Aware Computing – location-based optimization * Software Carbon Intensity (SCI) – location component

ISO 14001

* 6.1.2 – Environmental aspects: procurement and infrastructure decisions