> For the complete documentation index, see [llms.txt](https://docs.onelens.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.onelens.cloud/integrations/sustainability/sustainability-for-aws.md). # Sustainability for AWS ## Overview AWS publishes your estimated carbon emissions and your estimated water withdrawals through the AWS Sustainability service. To show them in OneLens, add four read-only permissions to the IAM role you already created when you connected AWS. There is nothing to deploy into your workloads and no new role to create. The four permissions return aggregate environmental estimates only, and grant no access to your resources, your data or your configuration. ## Where to add the permissions {% hint style="warning" %} ## Use your management (payer) account When the permissions are held in your AWS Organizations management account, AWS returns the consolidated footprint of every member account, broken down by usage account. When they are held in a member account, AWS returns that member account's own data only. If you report at group level, add these permissions to the role in the management account. {% endhint %} ## Option 1: Deploy the CloudFormation template The template creates one managed policy and attaches it to your existing OneLens role. It does not modify the role itself, and it creates nothing else. {% file src="/files/anh8JuQZG0ujz1QeOmCj" %} CloudFormation template: adds the AWS Sustainability read permissions to your existing OneLens role {% endfile %} {% stepper %} {% step %} **Find your OneLens role name** In the account you are configuring, go to **IAM** > **Roles** and copy the name of the role you created when connecting AWS to OneLens. It begins with `OneLens-`. Use the role **name**, not the ARN. {% endstep %} {% step %} **Create the stack** Open the **CloudFormation** console, select **Create stack** > **With new resources (standard)**, choose **Upload a template file**, and select the file you downloaded above. IAM is a global service, so the region you choose does not matter. {% endstep %} {% step %} **Enter the role name** Give the stack a name, for example `onelens-sustainability`, and paste your role name into the **OneLens IAM role name** parameter. {% endstep %} {% step %} **Acknowledge and submit** On the review screen, tick **I acknowledge that AWS CloudFormation might create IAM resources with custom names**, then select **Submit**. The stack finishes in under a minute. The **Outputs** tab shows the policy ARN and the role it was attached to. {% endstep %} {% endstepper %} {% hint style="info" %} To remove the permissions later, delete the stack. That deletes the managed policy and detaches it. Your OneLens role and every other policy on it are untouched. {% endhint %} ## Option 2: Add the policy by hand If you would rather not run a stack, add this as an inline policy on the same role. The AWS Sustainability service does not support resource-level restrictions, so `Resource` must be `*`. ```json { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowSustainabilityRead", "Effect": "Allow", "Action": [ "sustainability:GetEstimatedCarbonEmissions", "sustainability:GetEstimatedCarbonEmissionsDimensionValues", "sustainability:GetEstimatedWaterAllocation", "sustainability:GetEstimatedWaterAllocationDimensionValues" ], "Resource": "*" } ] } ``` {% stepper %} {% step %} **Open the OneLens role** Go to **IAM** > **Roles** and open the role you created when connecting AWS to OneLens. {% endstep %} {% step %} **Create the policy** Select **Add permissions** > **Create inline policy**, switch to the **JSON** tab, and paste the policy above. {% endstep %} {% step %} **Name and save** Name the policy `OneLensSustainabilityPolicy` and select **Create policy**. {% endstep %} {% endstepper %} ## Confirm the permissions are live You can verify the grant yourself from the AWS CLI, in the account that holds the role: ```bash aws sustainability get-estimated-carbon-emissions \ --time-period Start=2025-01-01T00:00:00Z,End=2025-12-31T23:59:59.999Z \ --granularity MONTHLY \ --group-by SERVICE ``` A successful call returns emission values per service. `AccessDeniedException` means the policy has not taken effect yet or was added to a different role. ## What to send back to OneLens Nothing. OneLens already has the role it assumes in this account, so the new permissions are picked up automatically. The one thing worth telling us is **which account you configured**, if it is not the management account you originally connected. That tells us whether to expect consolidated figures or a single account's. ## What you get in OneLens | | Carbon emissions | Water withdrawals | | ------------ | ------------------------------------------ | ------------------------------------- | | Granularity | Monthly, with quarterly and annual rollups | Annual | | History | From January 2022 | From 2023 | | Unit | Metric tons of CO2 equivalent (MTCO2e) | Cubic metres (m3) | | Breakdown by | Usage account, AWS Region, service | Usage account, AWS Region, service | | Published | By the 21st of the following month | In Q2, for the previous calendar year | Carbon is reported under both the **location-based** and the **market-based** method, with scope 1, scope 2 and scope 3 available separately under each. {% hint style="info" %} **Water is reported annually, not monthly.** AWS publishes water withdrawals once a year for the previous calendar year, so a water panel updates once per year rather than every month. {% endhint %} ## Good to know * **Emissions from global services**, such as Amazon CloudFront, are reported under the `Global` region rather than a named Region. * **The finest breakdown AWS offers is account, Region and service.** Per-resource carbon is not published, so emissions cannot be attributed to an individual EC2 instance or bucket. OneLens allocates to your cost centres using the account key. * **AWS recalculates history when its methodology changes.** When a new methodology version is released, AWS restates earlier months so that comparisons over time stay consistent. A figure you recorded previously can therefore move without your usage having changed. * **Accounts that join or leave an organization** carry their emissions with the organization they were part of at the time, for the period they were linked. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.onelens.cloud/integrations/sustainability/sustainability-for-aws.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.