Evaluate your workloads using custom rules

This document describes how to use custom rules in Workload Manager to evaluate your workloads against best practices recommended for your organization.

For more information, see About custom rules in Workload Manager.

Before you begin

  • Create custom rules using Rego and upload rules to a Cloud Storage bucket.
  • Enable the following APIs in your Google Cloud project where you create and run the evaluation:
    • Service Usage API
    • Cloud Monitoring API

Required roles

For more information about the required IAM roles, see required permissions to create and run an evaluation.

Evaluate workloads using custom rules

To create a workload evaluation using custom rules, follow these steps:

  1. In the Google Cloud console, go to the Workload Manager page.

    Go to Workload Manager

  2. Select a Google Cloud project.

  3. If prompted, to enable the required API for Workload Manager, click Enable.

  4. Click New evaluation.

  5. In the Name & rules pane, do the following:

    1. For Evaluation name, enter a name for the workload evaluation.
    2. For Workload type, select Custom.

    3. Optional: Select the Cloud Storage bucket containing the custom rules.

      You can use the sample rules available in the GoogleCloudPlatform/workload-manager GitHub repository or build your own rules and upload them to the Cloud Storage bucket. For more information, see Write custom rules using Rego.

    4. From the Rules table, select the custom rules you want to validate the selected resources against.

  6. In the Scope & filters pane, select the resources that you want to include in the evaluation.

    1. Click Browse scopes and select the organizations, folders, or projects in which you want to run the evaluation.
    2. Optional: In the Apply filters to resources section, use filters to only select specific resources.
    3. In the Location for evaluation data section, select the Regions where you want Workload Manager to store the evaluation data.

  7. Click Continue.

  8. In the Frequency & notification section, do the following:

    1. Optional: To export evaluation results to a BigQuery dataset, select Save to BigQuery dataset, and then specify the name of the dataset.

    2. Optional: To create a separate table for each evaluation, click Create a new results table for this evaluation.

    3. Optional: To encrypt evaluation data with customer-managed encryption keys (CMEK), click Encryption and provide an encryption key for each region. For more information, see Enable customer-managed encryption keys for evaluations.

  9. Click Continue.

  10. In the Evaluation scope section, select the resources that you want to include in the evaluation.

    1. Click Browse scopes and select the organizations, folders, or projects in which you want to run the evaluation.
    2. Optional: In the Apply filters to resources section, use filters to only select specific resources.

  11. Click Continue.

  12. In the Evaluation rules section, select the custom rules you want to validate the selected resources against.

  13. In the Scheduling section, select the frequency at which you want the evaluation to run.

  14. Click Continue.

  15. In the Notifications section, select the notification channel and select the events for which you want to receive notifications.

  16. Click Continue.

  17. Review the evaluation settings, and then click Create.

Run the evaluation

To run a workload evaluation, follow these steps:

  1. In the Google Cloud console, go to the Workload Manager page.

    Go to Workload Manager.

  2. Click the Evaluation name.

  3. On the Evaluation information page, click Run. A workload evaluation takes a few minutes to complete. There might be evaluations that aren't completely real-time due to the time it takes for an evaluation to complete.

What's next