About Workload Manager rule findings

You can use rule findings in Workload Manager to identify configuration risks and best practice violations across your cloud resources. By reviewing aggregated findings from your workload evaluations across Google Cloud projects, you can proactively resolve issues to maintain the reliability, security, and performance of your workloads.

This page provides an overview of Workload Manager rule findings, explains how Workload Manager aggregates findings across projects, and describes their severity levels and impact categories.

Key benefits

  • Fleet-wide visibility: aggregate findings across multiple projects in a centralized view without needing to inspect evaluations individually.
  • Contextual integration: access rule findings directly within daily workflows, such as on the Compute Engine Overview page.
  • Actionable remediation: review detailed descriptions, affected resources, and recommended steps to remediate misconfigurations before they cause system outages or security issues.
  • Cross-project sharing: share rule findings across projects so that resource owners can view compliance data without requiring access to the central consumer project.

Rule-based evaluation and findings

When you create and run an evaluation in Workload Manager, the service scans specified resources in target projects against curated Google best practices or custom rules.

When an evaluation detects deviations from best practices, Workload Manager generates rule findings, aggregates them across projects, and categorizes them by severity level and impact category.

Multi-project aggregation

In complex environments with multiple Google Cloud projects, managing evaluations project-by-project can lead to fragmented visibility. Workload Manager rule findings support multi-project aggregation:

  • Consumer project: the project where you configure, store, and execute the evaluation.
  • Target projects: the projects containing the resources that the evaluation scans.

For more information about consumer and target project concepts, see Consumer and target projects.

Cross-project sharing

When configuring a workload evaluation in a consumer project, you can enable the Share findings option.

Enabling Share findings propagates rule findings to all target projects in the evaluation scope. This feature lets resource owners and DevOps teams view configuration findings for their specific resources in their local project consoles, eliminating the need to grant them direct IAM access to the consumer project.

For instructions on configuring this option, see Create and run an evaluation.

Rule findings in the Google Cloud console

In the Google Cloud console, rule findings appear across multiple pages to make compliance and reliability data available where you manage your infrastructure:

  • Rule findings tab in Workload Manager: displays a comprehensive, filterable table of all rule findings. You can filter findings by category, severity, or rule name, and click a specific finding to view affected resources and remediation guidance. For instructions, see View rule findings.
  • Workload Manager findings tile on the Compute Engine Overview page: summarizes top configuration risks across your VM fleet. You can click any severity count to drill down directly into the Rule findings tab in Workload Manager.

To learn how to view findings in Compute Engine, see View Workload Manager rule findings.

Severity levels and impact categories

Rule findings categorize each finding by severity level and impact category to help you prioritize remediation efforts.

Severity levels

When you run an evaluation, Workload Manager evaluates resources by comparing their current state with best practices. If a resource doesn't comply with a selected best practice, Workload Manager assigns it a severity level that indicates how far the resource is out of compliance. The Google Cloud console marks each non-compliant resource with an icon. The following table explains these icons, their corresponding severity levels, how the current resource setting might impact your workload, and recommendations for modifying the resource to adhere to best practices.
Icon Severity level Impacts Recommendation
Critical System Reliability, Unplanned Outages, Unsupported Configuration

Resolve as soon as possible to prevent an impact on system availability and data integrity due to a high risk of an unplanned outage.
High Degraded Performance, System Stability Resolve during the next planned maintenance window.
Medium Suboptimal Performance, Supportability Resolve at your earliest convenience.
Low Informational, Non-essential Behavior Although there's no resolution needed, reviewing this best practice can provide useful insights.

Impact categories

The following table describes the impact categories used to classify Workload Manager findings:
Category Description
Reliability Findings related to workload availability, fault tolerance, and backup configurations.
Security Findings related to access controls, encryption, and compliance with best practices for security.
Performance Findings related to resource utilization, latency, and system optimization.
Cost Findings related to underutilized resources and opportunities to optimize operational expenses.

Limitations

The following limitations apply to Workload Manager rule findings:

  • Workload Manager rule findings are only available at the project scope. Workload Manager does not support viewing or aggregating rule findings at the organization and folder levels.
  • If you disable the Share findings option for an evaluation, existing rule findings from earlier evaluation runs remain visible in target projects until their default time to live (TTL) retention period expires. Subsequent evaluation runs don't generate or share new rule findings with target projects.

What's next