Quickstart: Evaluate workloads against Google Cloud best practices and custom rules

Workload Manager helps you scan your workloads to detect configuration deviations from standards and best practices, improving system quality, reliability, and performance. In this quickstart, you create and run a workload evaluation in the Google Cloud console to check your workloads against Google Cloud best practices and custom rules.

Before you begin

  1. Verify that the Google Cloud resources that you want to evaluate are already created in the target project. For a list of supported resources and rules, see the Google Cloud Best Practices Reference.
  2. Enable the following APIs in the Google Cloud consumer project where you create and run the evaluation:
  3. Optional: If you want to include custom rules in addition to built-in Google Cloud best practices, upload a sample rule from the GoogleCloudPlatform/workload-manager GitHub repository to a Cloud Storage bucket whose top level contains the /lib and /rules folders. For more information about uploading custom rules, see Write custom rules using Rego.

Required roles

To get the permissions that you need to create and run a workload evaluation, ask your administrator to grant you the following IAM roles:

  • Create and run an evaluation: Workload Manager Evaluation Administrator (roles/workloadmanager.evaluationAdmin) on the consumer project
  • Create a service agent (first evaluation only): Project IAM Admin (roles/resourcemanager.projectIamAdmin) on the consumer and target projects
  • Read Cloud Asset Inventory data: Cloud Asset Owner (roles/cloudasset.owner) on the consumer project
  • Read custom rules from a Cloud Storage bucket (optional): Storage Object Viewer (roles/storage.objectViewer) on the consumer project

For more information about granting roles, see Manage access to projects, folders, and organizations.

These predefined roles contain the permissions required to create and run a workload evaluation. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

The following permissions are required to create and run a workload evaluation:

  • Create and run an evaluation:
    • workloadmanager.evaluations.create on the consumer project
    • workloadmanager.evaluations.run on the consumer project
  • Create a service agent (first evaluation only): resourcemanager.projects.setIamPolicy on the consumer and target projects
  • Read Cloud Asset Inventory data: cloudasset.assets.searchAllResources on the consumer project
  • Read custom rules from a Cloud Storage bucket (optional):
    • storage.objects.get on the consumer project
    • storage.objects.list on the consumer project

You might also be able to get these permissions with custom roles or other predefined roles.

For more information about required roles in consumer and target projects, see IAM roles in consumer and target projects for evaluations and Workload Manager IAM roles and permissions.

Create a workload evaluation

To create a workload evaluation in the Google Cloud console, follow these steps:

  1. In the Google Cloud console, go to the Workload Manager page.

    Go to Workload Manager
    The remaining steps appear in the Google Cloud console.

  2. Select the Google Cloud consumer project where you want to store and run the evaluation.
  3. If prompted, to enable the required API for Workload Manager, click Enable.
  4. Click New evaluation.
  5. In the Name & rules pane, configure the evaluation details and select the rules to evaluate:
    1. For Evaluation name, enter my-custom-evaluation.
    2. Optional: For Description, enter a description for the workload evaluation.
    3. In the Workload type field, select Custom.
    4. Optional: To include custom rules in addition to built-in Google Cloud best practices, select the Cloud Storage bucket that contains your custom rules.
    5. From the Rules table, select the best practice rules to validate your resources against. For more information about the supported rules, see Google Cloud Best Practices Reference.
  6. Click Continue.
  7. In the Scope & filters pane, specify the target scopes, resource filters, and evaluation regions:
    1. In the Evaluation scope section, to select the organizations, folders, or projects in which you want to run the evaluation, click Browse scopes.
    2. Optional: To share rule findings across target scopes, select the Share findings checkbox.
    3. Optional: In the Apply filters to resources section, to select specific resources, click Add filter, and then use any of the following filter types:
      • Service account: filter Compute Engine instances by their attached service account.
      • Label: filter resources by key-value label pairs.
      • Name: filter resources by resource ID pattern.

      Multiple filters within the same filter type use OR logic. Filters across different filter types use AND logic.

    4. In the Locations for evaluation data section, select the Regions where you want Workload Manager to store the evaluation data.
  8. Click Continue.
  9. In the Frequency & notification pane, configure the evaluation schedule and alert notifications:
    1. In the Scheduling section, select how frequently you want the evaluation to run.
    2. Optional: In the Notification section, select the events for which you want to receive alert notifications, and then select your notification channels.
  10. Click Continue.
  11. In the Review pane, review the workload evaluation settings. To modify any settings, click the pane name in the left navigation.
  12. Click Create.

Run a workload evaluation

To run the workload evaluation on demand in the Google Cloud console, follow these steps:

  1. In the Google Cloud console, go to the Workload Manager page.

    Go to Workload Manager
    The remaining steps appear in the Google Cloud console.

  2. Click my-custom-evaluation.
  3. On the Evaluation information page, click Run.

    A workload evaluation takes a few minutes to complete. Before you view the results, wait for the evaluation run to finish.

Clean up

If you no longer need the my-custom-evaluation workload evaluation or the optional Cloud Storage bucket that you created in this quickstart, you can delete them. Deleting an evaluation doesn't affect your workloads. For more information about deleting an evaluation, see Delete an evaluation.

What's next