Evaluate your workloads using custom rules

This document describes how to use custom rules in Workload Manager to evaluate your workloads against best practices recommended for your organization.

For more information, see About custom rules in Workload Manager .

Before you begin

• Create custom rules using Rego and upload rules to a Cloud Storage bucket.
• Enable the following APIs in your Google Cloud project where you create and run the evaluation:
  • Service Usage API
  • Cloud Monitoring API

Required roles

For more information about the required IAM roles, see required permissions to create and run an evaluation .

Evaluate workloads using custom rules

To create a workload evaluation using custom rules, follow these steps:

1. In the Google Cloud console, go to the Workload Managerpage.

   Go to Workload Manager

2. Select a Google Cloud project.

3. If prompted, to enable the required API for Workload Manager, click Enable.

4. Click add New evaluation.

5. In the Name & rulespane, do the following:

   1. For Evaluation name, enter a name for the workload evaluation.
   2. For Workload type, select Custom.

   3. Optional: Select the Cloud Storage bucket containing the custom rules.

      You can use the sample rules available in the GoogleCloudPlatform/workload-manager GitHub repository or build your own rules and upload them to the Cloud Storage bucket. For more information, see Write custom rules using Rego .

   4. From the Rules table, select the custom rules you want to validate the selected resources against.

6. In the Scope & filterspane, select the resources that you want to include in the evaluation.

   1. Click Browse scopesand select the organizations, folders, or projects in which you want to run the evaluation.
   2. Optional: In the Apply filters to resourcessection, use filters to only select specific resources.
   3. In the Location for evaluation datasection, select the Regionswhere you want Workload Manager to store the evaluation data.

7. Click Continue.

8. In the Frequency & notificationsection, do the following:

   1. Optional: To export evaluation results to a BigQuery dataset, select Save to BigQuery dataset, and then specify the name of the dataset.

   2. Optional: To create a separate table for each evaluation, click Create a new results table for this evaluation.

   3. Optional: To encrypt evaluation data with customer-managed encryption keys (CMEK), click Encryptionand provide an encryption key for each region. For more information, see Enable customer-managed encryption keys for evaluations .

9. Click Continue.

10. In the Evaluation scopesection, select the resources that you want to include in the evaluation.

    1. Click Browse scopesand select the organizations, folders, or projects in which you want to run the evaluation.
    2. Optional: In the Apply filters to resourcessection, use filters to only select specific resources.

11. Click Continue.

12. In the Evaluation rulessection, select the custom rules you want to validate the selected resources against.

13. In the Schedulingsection, select the frequency at which you want the evaluation to run.

14. Click Continue.

15. In the Notificationssection, select the notification channel and select the events for which you want to receive notifications.

16. Click Continue.

17. Review the evaluation settings, and then click Create.

Run the evaluation

To run a workload evaluation, follow these steps:

1. In the Google Cloud console, go to the Workload Managerpage.

   Go to Workload Manager .

2. Click the Evaluation name.

3. On the Evaluation informationpage, click Run. A workload evaluation takes a few minutes to complete. There might be evaluations that aren't completely real-time due to the time it takes for an evaluation to complete.

What's next

• Learn more about workload evaluations .