Wombat

WAF-SUS-110 – Regional carbon intensity MUST be considered and documented in location decisions

Pillar: Sustainability | Severity: 🟡 Medium | Category: Data Governance | Automatable: Medium

Description

New workloads and data stores MUST document carbon intensity alongside latency, cost, and compliance factors when selecting regions. Region selection decisions MUST be captured in an Architecture Decision Record or equivalent register. Batch and non-latency-sensitive workloads SHOULD prefer lower-carbon regions where data residency allows. Carbon intensity assumptions MUST be revisited annually using current provider data.

Rationale

Risk Description

Risk

Ignoring grid carbon intensity when selecting regions increases emissions without business justification.

Risk

Undocumented region decisions prevent sustainability audits and optimization over time.

Requirements

  • New workloads and data stores MUST document carbon intensity alongside latency, cost, and compliance factors when selecting regions.

  • Region selection decisions MUST be captured in an Architecture Decision Record or equivalent register.

  • Batch and non-latency-sensitive workloads SHOULD prefer lower-carbon regions where data residency allows.

  • Carbon intensity assumptions MUST be revisited annually using current provider data.

Implementation Guidance

  1. Document the requirement in a version-controlled policy, ADR, or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level Name Criteria

L1

Ad hoc – control not consistently applied

* Die Anforderung ist nicht einheitlich umgesetzt; Nachweis existiert nur punktuell oder fehlt.

L2

Standardised – policy defined and communicated

* Eine dokumentierte Policy oder ein Standard beschreibt die Anforderung.

L3

Integrated – automated validation in CI/CD

* Terraform-Checks oder IaC-Gates prüfen die Anforderung automatisch in CI/CD.

L4

Auditable – metrics and exceptions tracked

* Abdeckung, Ausnahmen und Qualitätsmetriken werden quartalsweise berichtet.

L5

Optimised – continuous improvement based on data

* Die Effektivität wird kontinuierlich gemessen und automatisch optimiert.

Checks

waf-sus-110.tf.aws.green-region

Engine: terraform | Provider: aws | Automated: Yes

AWS provider region should be a low-carbon region

AWS provider region should be a low-carbon region

Scope: provider — aws

Assertions: * region in ['us-west-2', 'eu-north-1', 'eu-west-1'] — AWS region has a high carbon intensity. Document justification or migrate.

Remediation: AWS provider region should be a low-carbon region

Compliant
# Example compliant with waf-sus-110.tf.aws.green-region
Non-Compliant
# Example non-compliant with waf-sus-110.tf.aws.green-region

waf-sus-110.config.carbon-adr

Engine: config | Provider: any | Automated: No

Carbon intensity region decision must be documented in ADR

Carbon intensity region decision must be documented in ADR

Scope: file — docs/adr/carbon.md

Assertions: * exists attribute_exists — ADR must document carbon intensity consideration.

Remediation: Carbon intensity region decision must be documented in ADR

Compliant
# Example compliant with waf-sus-110.config.carbon-adr
Non-Compliant
# Example non-compliant with waf-sus-110.config.carbon-adr

Evidence

  • Terraform configuration implementing the requirement.

  • Policy, ADR, or standard documenting the requirement.

  • Optional cloud console or API output confirming runtime state.

Related Controls

  • WAF-SUS-010

  • WAF-SUS-020

  • WAF-SUS-030

  • WAF-SUS-120

  • WAF-COST-010

  • WAF-SOV-120 == Regulatory Mapping

  • EU CSRD (Corporate Sustainability Reporting Directive): ESRS E1 – Climate Change

  • GHG Protocol: Scope 3 – Category 11: purchased cloud services location factor

  • Green Software Foundation: Carbon Aware Computing – location-based optimization

  • ISO 14001: 6.1.2 – Environmental aspects