Sustainability for AWS

Overview

AWS publishes your estimated carbon emissions and your estimated water withdrawals through the AWS Sustainability service. To show them in OneLens, add four read-only permissions to the IAM role you already created when you connected AWS.

There is nothing to deploy into your workloads and no new role to create. The four permissions return aggregate environmental estimates only, and grant no access to your resources, your data or your configuration.

Where to add the permissions

Use your management (payer) account

When the permissions are held in your AWS Organizations management account, AWS returns the consolidated footprint of every member account, broken down by usage account. When they are held in a member account, AWS returns that member account's own data only.

If you report at group level, add these permissions to the role in the management account.

Option 1: Deploy the CloudFormation template

The template creates one managed policy and attaches it to your existing OneLens role. It does not modify the role itself, and it creates nothing else.

onelens-sustainability-policy.yaml

2KB

Open

CloudFormation template: adds the AWS Sustainability read permissions to your existing OneLens role

1

Find your OneLens role name

In the account you are configuring, go to IAM > Roles and copy the name of the role you created when connecting AWS to OneLens. It begins with OneLens-.

Use the role name, not the ARN.

2

Create the stack

Open the CloudFormation console, select Create stack > With new resources (standard), choose Upload a template file, and select the file you downloaded above.

IAM is a global service, so the region you choose does not matter.

3

Enter the role name

Give the stack a name, for example onelens-sustainability, and paste your role name into the OneLens IAM role name parameter.

4

Acknowledge and submit

On the review screen, tick I acknowledge that AWS CloudFormation might create IAM resources with custom names, then select Submit.

The stack finishes in under a minute. The Outputs tab shows the policy ARN and the role it was attached to.

To remove the permissions later, delete the stack. That deletes the managed policy and detaches it. Your OneLens role and every other policy on it are untouched.

Option 2: Add the policy by hand

If you would rather not run a stack, add this as an inline policy on the same role. The AWS Sustainability service does not support resource-level restrictions, so Resource must be *.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowSustainabilityRead",
            "Effect": "Allow",
            "Action": [
                "sustainability:GetEstimatedCarbonEmissions",
                "sustainability:GetEstimatedCarbonEmissionsDimensionValues",
                "sustainability:GetEstimatedWaterAllocation",
                "sustainability:GetEstimatedWaterAllocationDimensionValues"
            ],
            "Resource": "*"
        }
    ]
}

1

Open the OneLens role

Go to IAM > Roles and open the role you created when connecting AWS to OneLens.

2

Create the policy

Select Add permissions > Create inline policy, switch to the JSON tab, and paste the policy above.

3

Name and save

Name the policy OneLensSustainabilityPolicy and select Create policy.

Confirm the permissions are live

You can verify the grant yourself from the AWS CLI, in the account that holds the role:

aws sustainability get-estimated-carbon-emissions \
  --time-period Start=2025-01-01T00:00:00Z,End=2025-12-31T23:59:59.999Z \
  --granularity MONTHLY \
  --group-by SERVICE

A successful call returns emission values per service. AccessDeniedException means the policy has not taken effect yet or was added to a different role.

What to send back to OneLens

Nothing. OneLens already has the role it assumes in this account, so the new permissions are picked up automatically.

The one thing worth telling us is which account you configured, if it is not the management account you originally connected. That tells us whether to expect consolidated figures or a single account's.

What you get in OneLens

	Carbon emissions	Water withdrawals
Granularity	Monthly, with quarterly and annual rollups	Annual
History	From January 2022	From 2023
Unit	Metric tons of CO2 equivalent (MTCO2e)	Cubic metres (m3)
Breakdown by	Usage account, AWS Region, service	Usage account, AWS Region, service
Published	By the 21st of the following month	In Q2, for the previous calendar year

Carbon is reported under both the location-based and the market-based method, with scope 1, scope 2 and scope 3 available separately under each.

Water is reported annually, not monthly. AWS publishes water withdrawals once a year for the previous calendar year, so a water panel updates once per year rather than every month.

Good to know

• Emissions from global services, such as Amazon CloudFront, are reported under the Global region rather than a named Region.

• The finest breakdown AWS offers is account, Region and service. Per-resource carbon is not published, so emissions cannot be attributed to an individual EC2 instance or bucket. OneLens allocates to your cost centres using the account key.

• AWS recalculates history when its methodology changes. When a new methodology version is released, AWS restates earlier months so that comparisons over time stay consistent. A figure you recorded previously can therefore move without your usage having changed.

• Accounts that join or leave an organization carry their emissions with the organization they were part of at the time, for the period they were linked.