{"id":637,"date":"2026-04-14T20:31:38","date_gmt":"2026-04-14T20:31:38","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/google-cloud-workload-manager-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-compute\/"},"modified":"2026-04-14T20:31:38","modified_gmt":"2026-04-14T20:31:38","slug":"google-cloud-workload-manager-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-compute","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/google-cloud-workload-manager-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-compute\/","title":{"rendered":"Google Cloud Workload Manager Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Compute"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Compute<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What this service is<\/h3>\n\n\n\n<p><strong>Workload Manager<\/strong> is a Google Cloud service that helps you <strong>assess workload configurations against Google-recommended best practices<\/strong> and identify risks, misconfigurations, and operational gaps\u2014especially for complex, production workloads that rely on Google Cloud Compute resources.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Simple explanation (one paragraph)<\/h3>\n\n\n\n<p>Think of Workload Manager as an <strong>automated reviewer<\/strong> for your cloud workload setup. It looks at your Google Cloud environment, compares it to best-practice rules, and then highlights what to fix so your workload is more reliable, secure, and supportable.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Technical explanation (one paragraph)<\/h3>\n\n\n\n<p>Technically, Workload Manager runs <strong>evaluations<\/strong> (rule-based checks) over supported Google Cloud resources in a project (and potentially across a scope you define). It analyzes configuration and metadata\u2014typically via Google Cloud APIs\u2014to produce structured results (pass\/fail findings, severities, and recommendations). It\u2019s commonly associated with validating operational readiness and best practices for specific workload types (for example, SAP-related evaluations in Google Cloud). <strong>Verify supported workload types and rule sets in the official documentation<\/strong>, because coverage evolves.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What problem it solves<\/h3>\n\n\n\n<p>In real environments, misconfigurations creep in: overly permissive IAM, missing monitoring\/alerting, insufficient redundancy, inconsistent network controls, and drift from reference architectures. Workload Manager addresses this by providing:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Repeatable evaluations<\/strong> instead of ad-hoc reviews<\/li>\n<li><strong>Consistent best-practice validation<\/strong> across teams and environments<\/li>\n<li><strong>Actionable findings<\/strong> you can use for remediation planning and governance<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is Workload Manager?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Official purpose<\/h3>\n\n\n\n<p>Workload Manager\u2019s purpose is to help customers <strong>evaluate workloads running on Google Cloud<\/strong> against <strong>Google-defined best practices<\/strong> and generate <strong>recommendations<\/strong> to improve reliability, security, operations, and alignment with support requirements.<\/p>\n\n\n\n<p>Because product scope can change, treat the above as the stable \u201ccenter\u201d: Workload Manager is about <strong>workload evaluations<\/strong> and <strong>best-practice checks<\/strong>. For the exact, current list of supported workload types and checks, <strong>verify in official docs<\/strong>:\n&#8211; https:\/\/cloud.google.com\/workload-manager\/docs<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Core capabilities<\/h3>\n\n\n\n<p>Commonly documented capabilities include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Run evaluations<\/strong> for supported workload categories using curated rules<\/li>\n<li><strong>View evaluation results<\/strong> including failed checks and recommended actions<\/li>\n<li><strong>Track posture over time<\/strong> by re-running evaluations (manual or scheduled if supported in your release track)<\/li>\n<li><strong>Use IAM-controlled access<\/strong> so the right teams can run and review assessments<\/li>\n<\/ul>\n\n\n\n<p>(Details like \u201cscheduled evaluations,\u201d \u201cexport destinations,\u201d or \u201cintegration with ticketing\u201d can vary\u2014<strong>verify in official docs<\/strong> for your environment.)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Major components (conceptual model)<\/h3>\n\n\n\n<p>Workload Manager typically involves:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Evaluations<\/strong>: A run of a ruleset against a defined scope (project\/resources)<\/li>\n<li><strong>Rules \/ checks<\/strong>: Individual validations (for example, \u201clogging enabled,\u201d \u201credundancy configured,\u201d \u201cmonitoring present,\u201d etc.\u2014exact checks depend on the workload type)<\/li>\n<li><strong>Results \/ findings<\/strong>: Output of an evaluation (pass\/fail, severity, guidance)<\/li>\n<li><strong>Console UI + API<\/strong>: Administrative interface and programmatic access (API availability and methods depend on release status\u2014<strong>verify in official API reference<\/strong>)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Service type<\/h3>\n\n\n\n<p>Workload Manager is a <strong>managed Google Cloud service<\/strong> (control-plane service). It does not host your application compute; rather, it evaluates configuration of your workloads and related Google Cloud resources.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Scope (regional\/global\/project-scoped)<\/h3>\n\n\n\n<p>In practice, Workload Manager is <strong>project-scoped<\/strong> in terms of access control and configuration. Many Google Cloud services store resources in a <strong>location<\/strong> (regional or <code>global<\/code>) even when they analyze multi-regional resources. The Workload Manager API and UI may ask you to choose a <strong>location<\/strong> when creating evaluation resources.<br\/>\n<strong>Verify the current location model (regional vs global) in official docs and the console<\/strong>, as this can change by release.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How it fits into the Google Cloud ecosystem<\/h3>\n\n\n\n<p>Workload Manager complements (not replaces) other governance and \u201cadvisor\u201d services:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Active Assist \/ Recommender<\/strong>: cost, performance, security recommendations in specific domains<\/li>\n<li><strong>Security Command Center<\/strong>: security posture management and threat detection<\/li>\n<li><strong>Cloud Logging + Cloud Monitoring<\/strong>: operational telemetry and alerting<\/li>\n<li><strong>Cloud Asset Inventory<\/strong>: inventory and configuration visibility<\/li>\n<li><strong>IAM + Org Policy<\/strong>: access control and preventive governance<\/li>\n<\/ul>\n\n\n\n<p>Workload Manager is most useful when you want a <strong>workload-specific<\/strong> best-practice lens (often for mission-critical workloads) that can be repeated across environments.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use Workload Manager?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Reduce outage risk<\/strong>: identify reliability gaps before they cause incidents<\/li>\n<li><strong>Improve time-to-production<\/strong>: standardize readiness checks instead of repeating manual reviews<\/li>\n<li><strong>Supportability<\/strong>: ensure configurations align with vendor and platform best practices (especially important for enterprise workloads)<\/li>\n<li><strong>Audit readiness<\/strong>: produce repeatable evidence that best-practice checks are performed regularly (how you store evidence is up to your process)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Rules-based validation<\/strong>: consistent evaluation logic instead of subjective reviews<\/li>\n<li><strong>Workload-aware checks<\/strong>: focuses on a workload pattern rather than generic recommendations (scope depends on current product coverage\u2014verify)<\/li>\n<li><strong>Drift detection by repetition<\/strong>: re-run evaluations to detect config drift<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Operational posture<\/strong>: highlight missing monitoring, logging, backup posture, redundancy patterns, and IAM hygiene<\/li>\n<li><strong>Standardization across teams<\/strong>: SRE\/platform teams can define \u201cwhat good looks like\u201d using Google\u2019s baseline evaluations<\/li>\n<li><strong>Faster triage<\/strong>: results are typically grouped and prioritized<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Surface misconfigurations<\/strong> that increase exposure (broad IAM, weak network controls, missing logging)<\/li>\n<li><strong>Encourage least privilege<\/strong> by making access issues visible<\/li>\n<li><strong>Improve governance<\/strong> by supporting periodic assessments<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Identify architecture gaps<\/strong> that can cause scalability bottlenecks (depending on the checks supported)<\/li>\n<li><strong>Promote consistent deployment patterns<\/strong> for scaling and resilience<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose it<\/h3>\n\n\n\n<p>Choose Workload Manager when:\n&#8211; You run <strong>production workloads<\/strong> with strict availability\/security requirements\n&#8211; You need <strong>repeatable best-practice evaluations<\/strong> across multiple projects\/environments\n&#8211; You want a <strong>Google Cloud-native<\/strong> approach to workload assessments<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should not choose it<\/h3>\n\n\n\n<p>Workload Manager may not be the right tool when:\n&#8211; You only need <strong>generic cloud hygiene<\/strong> (Recommender \/ SCC may be sufficient)\n&#8211; Your workloads are highly custom and you require <strong>fully custom rules<\/strong> (verify if\/when custom rule authoring is supported; if not, consider policy-as-code tools)\n&#8211; You need runtime performance profiling or APM (use Cloud Monitoring, Cloud Trace, Application Performance Management tooling)<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is Workload Manager used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Financial services (risk reduction, change control)<\/li>\n<li>Healthcare and life sciences (audit posture, security baseline)<\/li>\n<li>Manufacturing and retail (mission-critical ERP backends)<\/li>\n<li>Public sector (governance and repeatable compliance practices)<\/li>\n<li>SaaS and technology (platform standardization across many projects)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Center of Excellence (CCoE)<\/li>\n<li>Platform engineering<\/li>\n<li>SRE \/ operations<\/li>\n<li>Security engineering \/ GRC teams<\/li>\n<li>Application teams (during go-live readiness)<\/li>\n<li>Cloud architecture teams (reference architecture enforcement)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<p>Workload Manager is especially relevant for workloads that are:\n&#8211; Mission-critical and difficult to \u201ceyeball\u201d (many moving parts)\n&#8211; Sensitive to misconfiguration (identity, network, logging, redundancy)\n&#8211; Deployed across multiple projects and environments<\/p>\n\n\n\n<p>Workload Manager is often discussed in the context of <strong>enterprise workloads that run on Compute Engine<\/strong> and related services. <strong>Verify supported workload categories in current documentation<\/strong>:\n&#8211; https:\/\/cloud.google.com\/workload-manager\/docs<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Multi-tier applications (web\/app\/db) with separate network zones<\/li>\n<li>Hub-and-spoke shared VPC architectures<\/li>\n<li>Multi-project landing zone setups<\/li>\n<li>Hybrid connectivity (Cloud VPN \/ Cloud Interconnect) where governance is critical<\/li>\n<li>Regulated environments with strict logging and IAM controls<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Production vs dev\/test usage<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Production<\/strong>: primary value\u2014ensure compliance with best practices, reduce incident risk<\/li>\n<li><strong>Dev\/test<\/strong>: useful for early detection of misconfigurations and for establishing golden patterns, but the cost\/benefit depends on how rigorously you enforce findings<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic scenarios where Workload Manager is commonly valuable. The exact rules and workload support vary\u2014<strong>validate in official docs<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Pre\u2013go-live readiness assessment<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Teams are unsure whether the workload meets baseline reliability\/security\/operations requirements.<\/li>\n<li><strong>Why Workload Manager fits:<\/strong> Provides a structured evaluation rather than a manual checklist.<\/li>\n<li><strong>Example scenario:<\/strong> Before production cutover, run an evaluation and resolve high-severity findings.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Periodic posture checks for production workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Configuration drift accumulates over months (new firewall rules, relaxed IAM, unmonitored VMs).<\/li>\n<li><strong>Why it fits:<\/strong> Repeat evaluations help detect drift and provide consistent reporting.<\/li>\n<li><strong>Example:<\/strong> Run quarterly evaluations and track findings closure in your change-management system.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Standardizing a platform \u201cdefinition of done\u201d<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Different app teams interpret \u201cbest practice\u201d differently.<\/li>\n<li><strong>Why it fits:<\/strong> Platform team can require passing evaluation thresholds before approvals.<\/li>\n<li><strong>Example:<\/strong> Require \u201cno critical findings\u201d before onboarding workloads into a shared platform.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Multi-project governance for a business unit<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Dozens of projects, inconsistent controls, limited central visibility.<\/li>\n<li><strong>Why it fits:<\/strong> Workload Manager can be used to evaluate each project and compare results.<\/li>\n<li><strong>Example:<\/strong> A central team runs evaluations per environment (dev\/test\/prod) and publishes reports.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Audit evidence support (process-driven)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Auditors ask, \u201cHow do you prove you review configurations regularly?\u201d<\/li>\n<li><strong>Why it fits:<\/strong> Evaluation records can support your evidence trail (how you store\/process evidence is your responsibility).<\/li>\n<li><strong>Example:<\/strong> Export evaluation summaries to an internal compliance repository.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Security hardening verification after changes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Hardening initiatives are implemented, but teams need confirmation.<\/li>\n<li><strong>Why it fits:<\/strong> Post-remediation evaluation can validate improved posture.<\/li>\n<li><strong>Example:<\/strong> After IAM policy tightening and logging changes, re-run evaluation to confirm reduced findings.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Reliability improvements for critical compute backends<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Workload relies on Compute Engine; outages occur due to single points of failure.<\/li>\n<li><strong>Why it fits:<\/strong> Evaluations may highlight availability-related gaps (depending on rule coverage).<\/li>\n<li><strong>Example:<\/strong> Findings indicate missing redundancy patterns; team redesigns to multi-zone.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Operational excellence for on-call teams<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> On-call inherits systems without consistent monitoring\/alerting\/logging.<\/li>\n<li><strong>Why it fits:<\/strong> Evaluations can reveal missing operations basics.<\/li>\n<li><strong>Example:<\/strong> Workload Manager highlights missing logging\/monitoring posture; SRE creates standard dashboards\/alerts.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Mergers\/acquisitions environment normalization<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Newly acquired teams bring inconsistent cloud patterns.<\/li>\n<li><strong>Why it fits:<\/strong> Common evaluation framework accelerates standardization.<\/li>\n<li><strong>Example:<\/strong> Run evaluations across acquired projects and prioritize remediation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Landing zone and foundation validation<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Platform baseline (VPC, IAM, logging) must be correct before apps deploy.<\/li>\n<li><strong>Why it fits:<\/strong> While not a landing-zone tool itself, it can validate parts of readiness depending on checks.<\/li>\n<li><strong>Example:<\/strong> Validate that foundational logging and IAM posture match expectations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">11) Vendor workload support readiness (enterprise)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Some enterprise workloads have strict support expectations (architecture, monitoring, patch posture).<\/li>\n<li><strong>Why it fits:<\/strong> Workload-specific evaluations reduce the risk of missing prerequisites.<\/li>\n<li><strong>Example:<\/strong> Evaluate before engaging vendor support for a production incident to ensure baseline requirements.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">12) Post-incident preventive review<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> After an outage\/security incident, teams need systematic prevention.<\/li>\n<li><strong>Why it fits:<\/strong> Evaluations provide a structured lens to find adjacent weaknesses.<\/li>\n<li><strong>Example:<\/strong> After a network misconfiguration incident, run evaluations to identify other risky network patterns.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<blockquote>\n<p>Important: Workload Manager capabilities evolve. The features below describe common, stable patterns of the service. <strong>Verify exact feature availability, supported checks, and limitations in official docs<\/strong>: https:\/\/cloud.google.com\/workload-manager\/docs<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 1: Workload evaluations (rules-based assessments)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Runs a set of checks (rules) against your Google Cloud environment\/resources for a given workload type.<\/li>\n<li><strong>Why it matters:<\/strong> Standardizes assessments so outcomes don\u2019t depend on who performs the review.<\/li>\n<li><strong>Practical benefit:<\/strong> Faster and more consistent readiness checks for production.<\/li>\n<li><strong>Caveats:<\/strong> Coverage depends on supported workloads and resources; results are only as complete as the rule set.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 2: Curated best-practice rule sets<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Provides predefined checks aligned to Google Cloud best practices (often workload-specific).<\/li>\n<li><strong>Why it matters:<\/strong> Encodes platform guidance into executable checks.<\/li>\n<li><strong>Practical benefit:<\/strong> Helps teams align with reference architectures and operational recommendations.<\/li>\n<li><strong>Caveats:<\/strong> If your organization needs custom or policy-as-code checks, Workload Manager may not cover that (verify customization options).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 3: Findings with severity and remediation guidance<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Produces evaluation outputs that identify failed checks and suggest improvements.<\/li>\n<li><strong>Why it matters:<\/strong> Prioritization makes it easier to address the highest-risk items first.<\/li>\n<li><strong>Practical benefit:<\/strong> A backlog of actionable items for platform\/app\/SRE teams.<\/li>\n<li><strong>Caveats:<\/strong> Remediation steps still require engineering judgment\u2014some findings may not apply due to business constraints.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 4: Console experience for review and triage<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Lets teams browse evaluations, view results, and drill into specific checks.<\/li>\n<li><strong>Why it matters:<\/strong> Lowers the barrier to adoption for teams that aren\u2019t API-first.<\/li>\n<li><strong>Practical benefit:<\/strong> Fast triage and collaboration across ops\/security\/app teams.<\/li>\n<li><strong>Caveats:<\/strong> Large enterprises often want API export and integration; verify export\/API support.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 5: API-based access (where available)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Enables programmatic creation, execution, and retrieval of evaluation artifacts.<\/li>\n<li><strong>Why it matters:<\/strong> Supports automation and integration with CI\/CD or governance workflows.<\/li>\n<li><strong>Practical benefit:<\/strong> Automated periodic evaluations and reporting.<\/li>\n<li><strong>Caveats:<\/strong> API surface, methods, and IAM permissions can change; confirm in the official API reference.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 6: IAM-controlled access and separation of duties<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Uses Google Cloud IAM to control who can create\/run evaluations and who can view results.<\/li>\n<li><strong>Why it matters:<\/strong> Findings may reveal sensitive configuration details.<\/li>\n<li><strong>Practical benefit:<\/strong> Least-privilege posture and auditability.<\/li>\n<li><strong>Caveats:<\/strong> Exact predefined roles and permissions should be confirmed in documentation for your version.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 7: Repeatability to measure improvement over time<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> By re-running evaluations, you can see whether posture improves or degrades.<\/li>\n<li><strong>Why it matters:<\/strong> Prevents \u201cone-and-done\u201d assessment culture.<\/li>\n<li><strong>Practical benefit:<\/strong> Continuous improvement and reduced drift.<\/li>\n<li><strong>Caveats:<\/strong> Workload Manager is not a replacement for continuous policy enforcement (Org Policy, SCC, policy-as-code).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level architecture<\/h3>\n\n\n\n<p>At a high level, Workload Manager works like this:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>You define or select an <strong>evaluation<\/strong> (including scope and rule set).<\/li>\n<li>Workload Manager collects required <strong>configuration\/metadata<\/strong> about relevant Google Cloud resources via Google Cloud APIs (for example, asset\/configuration inventory and service-specific APIs).<\/li>\n<li>Workload Manager evaluates that data against <strong>rules<\/strong>.<\/li>\n<li>Results are stored and presented as <strong>findings<\/strong> in the console (and\/or via API).<\/li>\n<\/ol>\n\n\n\n<p>This is a control-plane workflow. Your workload traffic does not \u201cgo through\u201d Workload Manager.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Request\/data\/control flow<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control plane:<\/strong> User triggers evaluation via console\/API.<\/li>\n<li><strong>Data plane:<\/strong> No application traffic interception; Workload Manager primarily reads configuration and state.<\/li>\n<li><strong>Result plane:<\/strong> Findings stored as evaluation results for review and governance.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related services (typical)<\/h3>\n\n\n\n<p>Depending on evaluation type and what is being checked, Workload Manager may interact (read-only) with:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Cloud Asset Inventory<\/strong> (for resource inventory\/configuration metadata)<\/li>\n<li><strong>Compute Engine<\/strong> (instance\/disk\/network metadata)<\/li>\n<li><strong>Cloud Monitoring \/ Cloud Logging<\/strong> (to validate operational telemetry posture)<\/li>\n<li><strong>IAM<\/strong> (to validate access patterns and service accounts)<\/li>\n<li><strong>Organization Policy Service<\/strong> (to validate governance posture)<\/li>\n<\/ul>\n\n\n\n<p>Exact dependencies vary\u2014<strong>verify for your evaluation type<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Google Cloud IAM<\/strong>: authentication and authorization<\/li>\n<li><strong>APIs &amp; Services<\/strong>: enabling the Workload Manager API and any required supporting APIs<\/li>\n<li><strong>Underlying evaluated services<\/strong>: Compute Engine, VPC, Cloud Logging\/Monitoring, etc.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>User access is controlled by <strong>IAM roles<\/strong>.<\/li>\n<li>When you enable Workload Manager, Google Cloud typically creates\/uses a <strong>Google-managed service identity (service agent)<\/strong> to perform service operations in your project.<br\/>\n  You should review IAM to understand what service agent exists and what it can access. <strong>Verify the service agent name and required permissions in official docs<\/strong>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>There is typically <strong>no VPC networking configuration<\/strong> required for Workload Manager itself.<\/li>\n<li>The service operates via Google Cloud control-plane APIs.<\/li>\n<li>If your organization restricts API access (VPC Service Controls, org policies), ensure Workload Manager is allowed where needed (verify supported configurations).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>Cloud Audit Logs<\/strong> to track who created\/ran evaluations and who accessed results.<\/li>\n<li>Consider setting up centralized logging and retention if evaluation evidence matters.<\/li>\n<li>Establish governance: who can run evaluations, how often, and how findings are handled.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Simple architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  U[Engineer \/ SRE] --&gt;|Create \/ Run evaluation| WM[Workload Manager]\n  WM --&gt;|Read metadata via APIs| GCP[(Google Cloud resources\\nCompute, IAM, Logging, Monitoring...)]\n  WM --&gt; R[Evaluation results \/ Findings]\n  U --&gt;|Review findings| R\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Production-style architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph Org[Google Cloud Organization]\n    subgraph Landing[Landing Zone \/ Governance]\n      IAM[IAM &amp; Org Policy]\n      LOG[Cloud Logging \/ Audit Logs]\n      MON[Cloud Monitoring]\n    end\n\n    subgraph Projects[Projects \/ Environments]\n      DEV[Dev Project\\nCompute workloads]\n      TEST[Test Project\\nCompute workloads]\n      PROD[Prod Project\\nCompute workloads]\n    end\n\n    WM[Workload Manager\\nEvaluations + Findings]\n    REPORT[Reporting Workflow\\n(Internal dashboard \/ ticketing)]\n  end\n\n  SRE[SRE \/ Platform Team] --&gt;|Run periodic evaluations| WM\n  WM --&gt;|Read-only config access| DEV\n  WM --&gt;|Read-only config access| TEST\n  WM --&gt;|Read-only config access| PROD\n\n  WM --&gt;|Findings| REPORT\n  REPORT --&gt;|Tickets \/ backlogs| SRE\n\n  WM --&gt; LOG\n  WM --&gt; IAM\n  WM --&gt; MON\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Account\/project requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A <strong>Google Cloud project<\/strong> with <strong>billing enabled<\/strong><\/li>\n<li>Access to the <strong>Google Cloud Console<\/strong><\/li>\n<li>You must be allowed to <strong>enable APIs<\/strong> in the project<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM roles<\/h3>\n\n\n\n<p>You need permissions to:\n&#8211; Enable the Workload Manager service\/API\n&#8211; Create and run evaluations\n&#8211; View evaluation results<\/p>\n\n\n\n<p>In many organizations, the simplest approach for a lab is using a project role like <strong>Project Owner<\/strong>. For production, use least privilege.<\/p>\n\n\n\n<p>Workload Manager typically provides predefined roles (for example, \u201cAdmin\u201d and \u201cViewer\u201d-style roles).<br\/>\n<strong>Verify exact role IDs and minimal permissions in official docs<\/strong> before granting access broadly:\n&#8211; https:\/\/cloud.google.com\/workload-manager\/docs<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Billing requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Billing must be enabled to create and manage evaluated resources (Compute Engine, logging retention, etc.)<\/li>\n<li>Workload Manager itself may or may not have direct charges (see pricing section)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">CLI\/SDK\/tools needed<\/h3>\n\n\n\n<p>For the hands-on lab in this tutorial:\n&#8211; <strong>Google Cloud SDK (gcloud)<\/strong> (optional but recommended)<br\/>\n  Install: https:\/\/cloud.google.com\/sdk\/docs\/install\n&#8211; A shell environment (Cloud Shell is fine)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<p>Workload Manager is a managed service; availability can depend on the service and its supported locations.<br\/>\n<strong>Verify current availability and supported locations<\/strong> in official docs and in the console when creating evaluations.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits<\/h3>\n\n\n\n<p>Potential quota categories (examples):\n&#8211; Number of evaluations\n&#8211; Frequency of evaluation runs\n&#8211; API request rates<\/p>\n\n\n\n<p>Quotas differ by project, region\/location, and service maturity.<br\/>\nCheck in:\n&#8211; Google Cloud Console \u2192 <strong>IAM &amp; Admin \u2192 Quotas<\/strong>\n&#8211; Or search for Workload Manager quotas in the console\u2019s quota UI<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services<\/h3>\n\n\n\n<p>Depending on evaluation type, you may need APIs enabled for:\n&#8211; Compute Engine\n&#8211; Cloud Asset Inventory\n&#8211; Cloud Logging\n&#8211; Cloud Monitoring\n&#8211; IAM<\/p>\n\n\n\n<p>Workload Manager or the console may prompt you to enable required APIs.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<blockquote>\n<p>Pricing for governance\/control-plane services can change, and some services do not publish a dedicated pricing page with standalone SKUs. <strong>Do not rely on assumptions\u2014verify in official Google Cloud documentation and in Cloud Billing SKUs for your account.<\/strong><\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Current pricing model (what to verify)<\/h3>\n\n\n\n<p>As of this writing, many customers treat Workload Manager like other assessment\/control-plane services where:\n&#8211; The service may have <strong>no direct per-use price<\/strong>, or pricing may be bundled\/implicit.\n&#8211; The <strong>main costs are indirect<\/strong>, coming from resources you evaluate and from any logging\/monitoring\/storage you retain.<\/p>\n\n\n\n<p>However, you should confirm the current state for Workload Manager specifically by checking:\n&#8211; Official Workload Manager documentation: https:\/\/cloud.google.com\/workload-manager\/docs\n&#8211; Google Cloud Pricing resources:\n  &#8211; Pricing overview: https:\/\/cloud.google.com\/pricing\n  &#8211; Pricing calculator: https:\/\/cloud.google.com\/products\/calculator\n  &#8211; Your Cloud Billing account SKUs (Billing \u2192 Reports \u2192 SKUs; depends on your org setup)<\/p>\n\n\n\n<p>If Google publishes a Workload Manager pricing page in your environment, use that as the source of truth.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing dimensions (typical possibilities)<\/h3>\n\n\n\n<p>Depending on how Google packages Workload Manager, pricing (if any) could be based on:\n&#8211; Number of evaluations\n&#8211; Number of resources assessed\n&#8211; Frequency\/schedule\n&#8211; API usage<\/p>\n\n\n\n<p><strong>Verify<\/strong> which, if any, apply.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Free tier (if applicable)<\/h3>\n\n\n\n<p>Some control-plane services offer free usage tiers or are free during preview.<br\/>\n<strong>Verify<\/strong> in the official docs\/release notes for Workload Manager.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Cost drivers (direct and indirect)<\/h3>\n\n\n\n<p>Even if Workload Manager itself has no direct SKU, you should plan for indirect costs:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Evaluated resources (Compute)<\/strong>\n   &#8211; Compute Engine VMs, disks, snapshots, load balancers, IP addresses<\/li>\n<li><strong>Operational telemetry<\/strong>\n   &#8211; Cloud Logging ingestion and retention (especially if you export logs)\n   &#8211; Cloud Monitoring metrics (custom metrics can add cost)<\/li>\n<li><strong>Data exports \/ storage<\/strong>\n   &#8211; BigQuery (if you export findings there\u2014verify if supported)\n   &#8211; Cloud Storage for reports\/artifacts (if you implement this)<\/li>\n<li><strong>Network egress<\/strong>\n   &#8211; Usually minimal for Workload Manager itself, but any cross-region exports, dashboards, or tooling can create egress<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Hidden or indirect costs to watch<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Long log retention<\/strong> and verbose logging exports<\/li>\n<li><strong>Duplicate evaluations<\/strong> run too frequently across many projects without governance<\/li>\n<li><strong>Engineering time<\/strong>: findings require remediation effort (often the largest \u201ccost\u201d)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost optimization tips<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Start with <strong>production and pre-production<\/strong> projects; avoid evaluating every sandbox unless needed.<\/li>\n<li>Establish <strong>evaluation cadence<\/strong> (for example monthly\/quarterly) based on change rate.<\/li>\n<li>Use <strong>findings triage<\/strong>: prioritize critical\/high severity first.<\/li>\n<li>Keep logging exports targeted; avoid exporting massive volumes of unrelated logs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (no fabricated numbers)<\/h3>\n\n\n\n<p>A low-cost learning path usually looks like:\n&#8211; One small project\n&#8211; A minimal Compute Engine VM (or no VM at all if you\u2019re just exploring the UI)\n&#8211; Default logging\/monitoring settings<\/p>\n\n\n\n<p>Your primary costs in this setup are the VM and any logs you choose to retain\/export. Use the pricing calculator for VM sizing and disk type.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations (no fabricated numbers)<\/h3>\n\n\n\n<p>In production, cost planning is more about scale and governance:\n&#8211; Many projects \u00d7 recurring evaluations \u00d7 remediation effort\n&#8211; Logging retention policies and exports for audit\/compliance\n&#8211; Potential BigQuery datasets or dashboards (if you build reporting)<\/p>\n\n\n\n<p>Plan costs by modeling:\n&#8211; Number of environments and workloads\n&#8211; How often you run evaluations\n&#8211; Your evidence\/reporting requirements<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<p>This lab focuses on learning the <strong>mechanics<\/strong> of Workload Manager: enabling it, creating an evaluation, running it, reviewing results, and cleaning up. Because Workload Manager evaluations can be workload-type-specific (often used for enterprise workloads), you may see different rule sets and findings depending on your environment.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable Workload Manager in a Google Cloud project<\/li>\n<li>Run a basic evaluation (using an available ruleset)<\/li>\n<li>Review results and understand how to operationalize findings<\/li>\n<li>Clean up resources to keep cost low<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will:\n1. Create\/select a project and enable billing\n2. (Optional) Create a small Compute Engine VM to have something to evaluate\n3. Enable Workload Manager and required APIs\n4. Create and run an evaluation in the console\n5. Review findings and learn a remediation workflow\n6. Clean up<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Create or select a Google Cloud project<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the Google Cloud Console: https:\/\/console.cloud.google.com\/<\/li>\n<li>In the top bar, select an existing project or click <strong>New Project<\/strong>.<\/li>\n<li>Note your <strong>Project ID<\/strong>.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You have a project you can use for the lab.<\/p>\n\n\n\n<p>If you want to use Cloud Shell, set your project:<\/p>\n\n\n\n<pre><code class=\"language-bash\">gcloud config set project YOUR_PROJECT_ID\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2 (Optional): Create a small Compute Engine VM (low-cost)<\/h3>\n\n\n\n<p>If you already have compute resources, you can skip this. Creating a small VM helps demonstrate that evaluations can detect configuration posture.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>Compute Engine \u2192 VM instances<\/strong>:\n   https:\/\/console.cloud.google.com\/compute\/instances<\/li>\n<li>Click <strong>Create instance<\/strong><\/li>\n<li>Choose a small machine type (for example, an e2 family VM) and keep defaults to minimize cost.<\/li>\n<li>Keep the VM in a region close to you.<\/li>\n<li>Click <strong>Create<\/strong><\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> One VM is running and visible in the VM instances list.<\/p>\n\n\n\n<p><strong>Cost note:<\/strong> VM cost depends on machine type, disk, and runtime hours. Stop\/delete it in cleanup.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Enable Workload Manager (and required APIs)<\/h3>\n\n\n\n<p>Workload Manager may prompt you to enable its API and supporting APIs automatically.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the console navigation menu, search for <strong>Workload Manager<\/strong>.<\/li>\n<li>Open <strong>Workload Manager<\/strong>.<\/li>\n<li>If prompted, click <strong>Enable<\/strong> to enable the service\/API.<\/li>\n<li>If the UI prompts you to enable additional APIs (for example, for inventory\/monitoring\/logging), approve them.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> Workload Manager opens and you can access the evaluations UI.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Go to <strong>APIs &amp; Services \u2192 Enabled APIs &amp; services<\/strong>:\n  https:\/\/console.cloud.google.com\/apis\/dashboard\n&#8211; Confirm that Workload Manager (and any required dependencies) are enabled.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Confirm IAM permissions for your user<\/h3>\n\n\n\n<p>If you can\u2019t create evaluations, you may be missing IAM permissions.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>IAM &amp; Admin \u2192 IAM<\/strong>:\n   https:\/\/console.cloud.google.com\/iam-admin\/iam<\/li>\n<li>Find your principal (user\/group).<\/li>\n<li>Ensure you have sufficient rights for the lab. For a lab, <strong>Project Owner<\/strong> is simplest.<\/li>\n<li>For production, prefer least privilege. Workload Manager typically provides predefined roles; <strong>verify exact role names\/IDs in docs<\/strong>.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You can create and run evaluations.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Create an evaluation in Workload Manager<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In <strong>Workload Manager<\/strong>, find the section for <strong>Evaluations<\/strong> (naming can vary slightly).<\/li>\n<li>Click <strong>Create evaluation<\/strong> (or similar).<\/li>\n<li>\n<p>Choose:\n   &#8211; <strong>Evaluation name<\/strong>: <code>wm-lab-eval<\/code>\n   &#8211; <strong>Location<\/strong>: choose what the UI supports (some services use <code>global<\/code> or a region)\n   &#8211; <strong>Ruleset \/ workload type<\/strong>: select one that is available in your console\n   &#8211; <strong>Scope<\/strong>: typically the current project; some evaluations may ask for resource filters\/labels<\/p>\n<\/li>\n<li>\n<p>Save\/create the evaluation.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> The evaluation object is created and appears in the evaluations list.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; You can see <code>wm-lab-eval<\/code> listed.\n&#8211; Status is \u201cReady\u201d or similar.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Run the evaluation and wait for completion<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the evaluation <code>wm-lab-eval<\/code><\/li>\n<li>Click <strong>Run evaluation<\/strong> (or <strong>Execute<\/strong>)<\/li>\n<li>Wait for status to change to <strong>Completed<\/strong> (or similar)<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> Workload Manager produces a set of results\/findings.<\/p>\n\n\n\n<p><strong>Verification checklist:<\/strong>\n&#8211; The evaluation run has a timestamp\n&#8211; You can see a summary: total checks, passed\/failed counts (exact UI depends on version)\n&#8211; You can open failed checks and read guidance<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Review findings and create a remediation plan<\/h3>\n\n\n\n<p>In your evaluation results, do the following:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Sort or filter by <strong>severity<\/strong> (critical\/high first)<\/li>\n<li>Pick 1\u20133 findings and answer:\n   &#8211; Which resource is affected?\n   &#8211; Is the finding actionable and relevant to your environment?\n   &#8211; What team owns remediation (network, IAM, compute, ops)?<\/li>\n<li>Create a simple remediation note (even in a text file) describing:\n   &#8211; Finding ID\/title\n   &#8211; Risk description\n   &#8211; Proposed fix\n   &#8211; Change window and rollback plan<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You have a mini remediation backlog derived from Workload Manager findings.<\/p>\n\n\n\n<p><strong>Optional operationalization:<\/strong><br\/>\nIf you manage work with tickets, create an internal ticket per high-severity item and include the evaluation output details.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8 (Optional): Validate change by re-running evaluation<\/h3>\n\n\n\n<p>If you remediated any item, re-run the evaluation.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Apply a safe remediation (for example, enabling a monitoring agent, tightening a firewall rule, or enabling a governance setting\u2014<strong>choose changes appropriate for your environment<\/strong>).<\/li>\n<li>Re-run <code>wm-lab-eval<\/code>.<\/li>\n<li>Compare the results.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> The related finding improves (resolved or reduced severity), if the rule maps to your change.<\/p>\n\n\n\n<p><strong>Note:<\/strong> Not all changes will affect findings immediately; some checks rely on inventory refresh cycles.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>Use this checklist:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>[ ] Workload Manager is enabled and accessible in the console  <\/li>\n<li>[ ] You successfully created an evaluation  <\/li>\n<li>[ ] You ran the evaluation to completion  <\/li>\n<li>[ ] You can view findings and drill down to impacted resources  <\/li>\n<li>[ ] Cloud Audit Logs show an audit trail for evaluation actions (where applicable)<\/li>\n<\/ul>\n\n\n\n<p>To check audit logs (general approach):<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>Logging \u2192 Logs Explorer<\/strong>:\n   https:\/\/console.cloud.google.com\/logs\/query<\/li>\n<li>Filter by the Workload Manager service name if available in your logs (service name can vary\u2014use the UI to find relevant entries).<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<p>Common issues and fixes:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>\u201cPermission denied\u201d when creating\/running evaluation<\/strong>\n   &#8211; Ensure your user has sufficient IAM permissions in the project.\n   &#8211; Check if organization policies restrict service enablement or access.\n   &#8211; In enterprise orgs, you may need a platform admin to grant Workload Manager roles.<\/p>\n<\/li>\n<li>\n<p><strong>API not enabled \/ service not available<\/strong>\n   &#8211; Enable Workload Manager via the console (APIs &amp; Services).\n   &#8211; If the API is restricted by policy, request an exception from your org admin.<\/p>\n<\/li>\n<li>\n<p><strong>Evaluation completes but shows \u201cno resources found\u201d<\/strong>\n   &#8211; The selected ruleset may target a workload type not present in your project.\n   &#8211; Try a different available ruleset, or run the evaluation in a project that hosts the target workload.<\/p>\n<\/li>\n<li>\n<p><strong>Findings don\u2019t change after remediation<\/strong>\n   &#8211; Some checks may take time due to inventory refresh.\n   &#8211; Confirm the change was applied to the correct resource\/project.\n   &#8211; Re-run the evaluation and confirm you\u2019re viewing the latest run results.<\/p>\n<\/li>\n<li>\n<p><strong>Evaluation stuck in running state<\/strong>\n   &#8211; Check Cloud Status Dashboard for service issues: https:\/\/status.cloud.google.com\/\n   &#8211; Try again later; if persistent, consult official docs support guidance.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To keep costs low:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Delete the VM<\/strong> (if created):\n   &#8211; Compute Engine \u2192 VM instances \u2192 select VM \u2192 <strong>Delete<\/strong><\/li>\n<li><strong>Delete the evaluation<\/strong> (if the UI supports deletion):\n   &#8211; Workload Manager \u2192 Evaluations \u2192 select <code>wm-lab-eval<\/code> \u2192 <strong>Delete<\/strong><\/li>\n<li>(Optional) <strong>Disable APIs<\/strong> if the project is disposable:\n   &#8211; APIs &amp; Services \u2192 Enabled APIs &amp; services \u2192 disable Workload Manager (and any lab-only APIs)<\/li>\n<\/ol>\n\n\n\n<p>Best cleanup option for labs: delete the entire project if it\u2019s dedicated to this tutorial.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Treat Workload Manager as a <strong>validation layer<\/strong>, not a replacement for reference architectures.<\/li>\n<li>Use it as part of a <strong>release readiness<\/strong> process (pre-prod gate) and a <strong>periodic production posture<\/strong> check.<\/li>\n<li>Keep evaluation scopes aligned to ownership boundaries (per app, per platform, per BU).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Apply <strong>least privilege<\/strong>: separate \u201crun evaluations\u201d vs \u201cview results\u201d vs \u201cadminister service\u201d access.<\/li>\n<li>Limit access to evaluation results because findings can reveal sensitive configuration details.<\/li>\n<li>Review the service\u2019s <strong>Google-managed service identity<\/strong> permissions after enabling the API.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Avoid excessive evaluation frequency unless you have a change rate that justifies it.<\/li>\n<li>Prioritize evaluations in <strong>production<\/strong> and <strong>pre-production<\/strong> where the risk reduction is highest.<\/li>\n<li>Control logging and exports; retain evidence only as long as required.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices (process performance)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Standardize a triage workflow:\n  1. Critical\/high severity within SLA\n  2. Medium severity as part of sprint work\n  3. Low severity scheduled improvements<\/li>\n<li>Keep a \u201crisk acceptance\u201d process for findings that are not applicable.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use evaluations during:<\/li>\n<li>go-live readiness<\/li>\n<li>post-incident reviews<\/li>\n<li>platform upgrades and migration waves<\/li>\n<li>Re-run evaluations after major changes (network refactors, IAM redesign, landing zone changes).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Create an operations runbook:<\/li>\n<li>Who runs Workload Manager evaluations?<\/li>\n<li>How often?<\/li>\n<li>Where are findings tracked?<\/li>\n<li>How do exceptions get approved?<\/li>\n<li>Consider centralized reporting (internal) if you operate at multi-project scale.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use consistent labels\/tags on projects and workloads so you can map findings to owners.<\/li>\n<li>Naming:<\/li>\n<li>Evaluations: <code>wm-&lt;env&gt;-&lt;workload&gt;-&lt;date&gt;<\/code> or <code>wm-&lt;app&gt;-baseline<\/code><\/li>\n<li>Projects: include environment and ownership in project naming conventions<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Workload Manager is accessed via <strong>Google Cloud IAM<\/strong>.<\/li>\n<li>You should separate:<\/li>\n<li>Admins who configure and manage evaluations<\/li>\n<li>Viewers who can read findings (security\/ops)<\/li>\n<li>Operators who can run evaluations<\/li>\n<\/ul>\n\n\n\n<p><strong>Verify exact IAM roles<\/strong> in official docs:\n&#8211; https:\/\/cloud.google.com\/workload-manager\/docs<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Data at rest and in transit is protected by Google Cloud\u2019s standard encryption controls for managed services.<\/li>\n<li>If findings are exported to your own storage (BigQuery, Cloud Storage), configure:<\/li>\n<li>CMEK (if required)<\/li>\n<li>bucket\/dataset IAM<\/li>\n<li>retention and deletion policies<\/li>\n<\/ul>\n\n\n\n<p>(Export mechanisms and CMEK applicability depend on what Workload Manager supports\u2014verify.)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Workload Manager typically doesn\u2019t require inbound network exposure to your VPC.<\/li>\n<li>The primary \u201cexposure\u201d is through:<\/li>\n<li>IAM (who can access findings)<\/li>\n<li>API access controls (org policy\/VPC SC if applicable)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Do not store secrets in evaluation descriptions, tickets, or exports.<\/li>\n<li>If you automate evaluation runs, store credentials securely:<\/li>\n<li>Prefer Workload Identity \/ short-lived credentials<\/li>\n<li>Use Secret Manager for secret storage (when needed)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ensure <strong>Cloud Audit Logs<\/strong> are enabled and retained according to policy.<\/li>\n<li>Track:<\/li>\n<li>who enabled the service<\/li>\n<li>who ran evaluations<\/li>\n<li>who accessed findings<\/li>\n<li>For regulated environments, export audit logs to a centralized logging project with controlled retention.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<p>Workload Manager can support compliance processes, but it is not a compliance certification by itself. Use it as:\n&#8211; a control to demonstrate periodic assessment\n&#8211; an input to risk management\n&#8211; a trigger for remediation workflows<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Granting broad permissions (Owner\/Editor) to too many users \u201cjust to run evaluations\u201d<\/li>\n<li>Treating findings as non-sensitive and sharing them widely<\/li>\n<li>Not reviewing service agent permissions after enabling APIs<\/li>\n<li>Not retaining audit evidence for who accessed\/changed evaluation configurations<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use least-privilege IAM and group-based access<\/li>\n<li>Centralize audit logs<\/li>\n<li>Establish a formal exception\/risk-acceptance workflow for findings that won\u2019t be remediated<\/li>\n<li>Combine with preventive controls (Org Policy, SCC posture, policy-as-code)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<p>Because Workload Manager is evaluation-based, many \u201cgotchas\u201d are about scope, coverage, and process.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Known limitations (general)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Coverage depends on supported workloads\/rulesets<\/strong>; you may not find checks for every service you use.<\/li>\n<li>Findings may not capture organization-specific policies unless custom checks are supported (verify customization).<\/li>\n<li>Results can lag behind changes due to inventory refresh timing.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You may be limited by:<\/li>\n<li>number of evaluations per project\/location<\/li>\n<li>number of runs per time window<\/li>\n<li>API rate limits<br\/>\n<strong>Check quotas<\/strong> in the Cloud Console quota pages.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Regional constraints<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Evaluation resources may need to be created in a specific location supported by the service.<\/li>\n<li>Some organizations restrict regions; ensure allowed locations align with Workload Manager\u2019s supported ones.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing surprises<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Even if Workload Manager has no direct cost, you can incur:<\/li>\n<li>log retention\/export costs<\/li>\n<li>BigQuery or storage costs for reporting<\/li>\n<li>engineering effort for remediation work<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compatibility issues<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Some evaluations may expect specific deployment patterns; if your workload is deployed differently, findings may be noisy.<\/li>\n<li>Projects with strong restrictions (org policies, VPC SC) may require additional configuration.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational gotchas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u201cNo resources found\u201d is common if you pick a ruleset that doesn\u2019t match your deployed workload type.<\/li>\n<li>Teams may ignore findings unless you integrate with an operational workflow (ticketing, sprint planning, change management).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Migration challenges<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If you use a third-party posture tool today, migrating to Workload Manager is often a <strong>process change<\/strong>, not just a tool swap.<\/li>\n<li>Normalize severity and prioritization across tools.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Vendor-specific nuances<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Workload Manager is Google Cloud-native and aligns with Google\u2019s best practices; it may not match other cloud frameworks one-to-one.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<p>Workload Manager is one part of a broader governance and assessment toolbox.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Google Cloud alternatives (nearest fits)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Recommender (Active Assist):<\/strong> Great for cost\/performance\/security recommendations in specific areas; not always workload-specific.<\/li>\n<li><strong>Security Command Center (SCC):<\/strong> Security posture management, misconfiguration detection, threat findings; broader security focus.<\/li>\n<li><strong>Organization Policy Service:<\/strong> Preventive guardrails; doesn\u2019t \u201cevaluate\u201d after the fact so much as enforce constraints.<\/li>\n<li><strong>Cloud Asset Inventory + custom rules:<\/strong> DIY approach; flexible but requires building your own evaluation pipeline.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Other cloud equivalents<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AWS Well-Architected Tool:<\/strong> Framework-based reviews; often manual inputs with some integrations.<\/li>\n<li><strong>AWS Trusted Advisor:<\/strong> Account-level checks for cost, security, fault tolerance, performance.<\/li>\n<li><strong>Azure Advisor:<\/strong> Recommendations for cost, security, reliability, operational excellence.<\/li>\n<li><strong>Azure Policy + initiatives:<\/strong> Preventive enforcement and compliance reporting.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Open-source \/ self-managed<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Prowler \/ ScoutSuite:<\/strong> Security posture scanning; requires running and maintaining tools, mapping findings.<\/li>\n<li><strong>Cloud Custodian:<\/strong> Policy-as-code with enforcement; needs engineering and lifecycle ownership.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Comparison table<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Google Cloud Workload Manager<\/strong><\/td>\n<td>Workload-focused best-practice evaluations in Google Cloud (often enterprise workloads)<\/td>\n<td>Curated evaluations; repeatable checks; Google Cloud-native<\/td>\n<td>Coverage depends on supported rulesets; customization may be limited (verify)<\/td>\n<td>When you want Google-provided workload evaluations and a repeatable assessment process<\/td>\n<\/tr>\n<tr>\n<td><strong>Google Cloud Recommender (Active Assist)<\/strong><\/td>\n<td>Cost\/perf\/security suggestions across services<\/td>\n<td>Deep service integration; actionable recommendations<\/td>\n<td>Not always workload-pattern-specific<\/td>\n<td>When you want continuous recommendations in supported domains (rightsizing, IAM, etc.)<\/td>\n<\/tr>\n<tr>\n<td><strong>Security Command Center (SCC)<\/strong><\/td>\n<td>Security posture + threat detection<\/td>\n<td>Centralized security findings; compliance posture features<\/td>\n<td>Security-centric; may not cover workload operational readiness<\/td>\n<td>When security posture is primary goal and you need a security operations view<\/td>\n<\/tr>\n<tr>\n<td><strong>Org Policy Service<\/strong><\/td>\n<td>Preventing misconfigurations<\/td>\n<td>Strong guardrails; scalable governance<\/td>\n<td>Not a \u201cposture assessment report\u201d tool by itself<\/td>\n<td>When you want preventive controls that block risky configurations<\/td>\n<\/tr>\n<tr>\n<td><strong>Cloud Asset Inventory + custom tooling<\/strong><\/td>\n<td>Custom governance and reporting<\/td>\n<td>Maximum flexibility<\/td>\n<td>Build\/maintain everything; engineering overhead<\/td>\n<td>When you need organization-specific rules and deep integration<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Well-Architected \/ Trusted Advisor<\/strong><\/td>\n<td>AWS environments<\/td>\n<td>Mature frameworks and checks<\/td>\n<td>Not for Google Cloud; different mapping<\/td>\n<td>When your workloads run on AWS<\/td>\n<\/tr>\n<tr>\n<td><strong>Azure Advisor \/ Azure Policy<\/strong><\/td>\n<td>Azure environments<\/td>\n<td>Recommendations + enforcement<\/td>\n<td>Not for Google Cloud<\/td>\n<td>When your workloads run on Azure<\/td>\n<\/tr>\n<tr>\n<td><strong>Prowler \/ ScoutSuite (self-managed)<\/strong><\/td>\n<td>Multi-cloud\/security scanning<\/td>\n<td>Flexible; community ecosystems<\/td>\n<td>Ops overhead; false positives; needs tuning<\/td>\n<td>When you want self-managed scanning and custom integration control<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example: regulated manufacturer running mission-critical ERP<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A manufacturing company runs a mission-critical ERP backend on Google Cloud Compute. Auditors require evidence of periodic configuration reviews; operations wants fewer outages.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Hub-and-spoke networking with Shared VPC<\/li>\n<li>Dedicated prod project(s) for the workload<\/li>\n<li>Central logging and audit log retention<\/li>\n<li>Workload Manager evaluations run quarterly (and before major releases)<\/li>\n<li>Findings tracked in an internal ticketing system, with exception workflow<\/li>\n<li><strong>Why Workload Manager was chosen:<\/strong><\/li>\n<li>Standardizes workload best-practice assessment using Google Cloud-native tooling<\/li>\n<li>Reduces dependence on manual review checklists<\/li>\n<li>Provides repeatable evaluation artifacts for governance processes<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Fewer high-risk misconfigurations reaching production<\/li>\n<li>Faster go-live approval cycles due to consistent checks<\/li>\n<li>Improved audit posture through evidence of periodic assessments<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example: SaaS company professionalizing operations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A small SaaS team is scaling quickly and adopting stricter operational practices. They\u2019ve had incidents due to missing monitoring and ad-hoc IAM changes.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Separate dev\/stage\/prod projects<\/li>\n<li>Basic SRE playbook and on-call rotation<\/li>\n<li>Workload Manager used as a periodic \u201coperations readiness review\u201d<\/li>\n<li>Recommender used for cost optimization alongside it<\/li>\n<li><strong>Why Workload Manager was chosen:<\/strong><\/li>\n<li>Provides a structured evaluation process without building a custom toolchain<\/li>\n<li>Helps the team prioritize improvements with limited engineering time<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Better visibility into gaps<\/li>\n<li>Clearer prioritization for reliability\/security work<\/li>\n<li>More predictable production operations<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Is Workload Manager the same as a runtime monitoring tool?<\/strong><br\/>\n   No. Workload Manager focuses on <strong>configuration\/best-practice evaluations<\/strong>, not real-time application performance monitoring. Use Cloud Monitoring\/Logging\/APM tools for runtime telemetry.<\/p>\n<\/li>\n<li>\n<p><strong>Does Workload Manager change my resources automatically?<\/strong><br\/>\n   Typically, it reports findings and guidance. Remediation is performed by your teams and processes. <strong>Verify<\/strong> if any auto-remediation features exist for your rulesets.<\/p>\n<\/li>\n<li>\n<p><strong>Is Workload Manager only for Compute Engine workloads?<\/strong><br\/>\n   It\u2019s commonly associated with workloads that rely heavily on Compute, but evaluations may cover related services too. <strong>Verify current supported resources and workload types<\/strong> in docs.<\/p>\n<\/li>\n<li>\n<p><strong>Can I run Workload Manager across multiple projects?<\/strong><br\/>\n   Many governance workflows operate multi-project, but the exact mechanism depends on how evaluations are scoped in the product. <strong>Verify multi-project support<\/strong> and recommended patterns in official docs.<\/p>\n<\/li>\n<li>\n<p><strong>Do I need Cloud Asset Inventory enabled?<\/strong><br\/>\n   Many evaluation systems rely on asset metadata. The console will typically prompt for dependencies. <strong>Follow the console prompts and verify in docs<\/strong>.<\/p>\n<\/li>\n<li>\n<p><strong>How often should I run evaluations?<\/strong><br\/>\n   Base it on change rate and risk. Common cadences: before go-live, after major changes, and quarterly for production governance.<\/p>\n<\/li>\n<li>\n<p><strong>What should I do with \u201clow severity\u201d findings?<\/strong><br\/>\n   Triage them. Some are quick wins; others may be acceptable risk. Track and address them when capacity allows.<\/p>\n<\/li>\n<li>\n<p><strong>Are findings considered sensitive?<\/strong><br\/>\n   Yes, often. Findings can reveal network\/IAM\/configuration details. Control access and avoid broad sharing.<\/p>\n<\/li>\n<li>\n<p><strong>Can I export results to BigQuery or Cloud Storage?<\/strong><br\/>\n   Export capabilities depend on the current product features and API. <strong>Verify export options<\/strong> in official docs.<\/p>\n<\/li>\n<li>\n<p><strong>How does Workload Manager relate to Security Command Center?<\/strong><br\/>\n   SCC is security posture and threat detection. Workload Manager is focused on workload best-practice evaluations (often broader than security alone, depending on rulesets).<\/p>\n<\/li>\n<li>\n<p><strong>Will Workload Manager replace our architecture review board?<\/strong><br\/>\n   No. It reduces manual effort for best-practice validation, but you still need architecture decision-making and tradeoff analysis.<\/p>\n<\/li>\n<li>\n<p><strong>Can I create custom rules?<\/strong><br\/>\n   Custom rule authoring is not guaranteed. <strong>Verify<\/strong> whether custom evaluations or custom rulesets are supported in the current release.<\/p>\n<\/li>\n<li>\n<p><strong>What if my architecture intentionally deviates from a recommendation?<\/strong><br\/>\n   Document a risk acceptance\/exception and re-evaluate periodically. Not every best practice is universally applicable.<\/p>\n<\/li>\n<li>\n<p><strong>Why do I see \u201cno resources found\u201d?<\/strong><br\/>\n   Usually because the ruleset targets a workload pattern not present in your project, or because required APIs\/permissions are missing.<\/p>\n<\/li>\n<li>\n<p><strong>How do I operationalize this for SRE and platform teams?<\/strong><br\/>\n   Establish cadence, ownership, triage SLAs, and a ticketing\/remediation workflow. Treat evaluations as an input to reliability\/security backlogs.<\/p>\n<\/li>\n<li>\n<p><strong>Does Workload Manager require agents installed on VMs?<\/strong><br\/>\n   Many config checks are agentless (API-based). Some operational checks may depend on monitoring\/logging setup. <strong>Verify per ruleset<\/strong>.<\/p>\n<\/li>\n<li>\n<p><strong>Can I use this for dev\/test environments too?<\/strong><br\/>\n   Yes, especially to catch issues early\u2014but prioritize production if you must choose.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn Workload Manager<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official documentation<\/td>\n<td>Workload Manager docs \u2014 https:\/\/cloud.google.com\/workload-manager\/docs<\/td>\n<td>Primary source for supported evaluations, setup, permissions, and workflows<\/td>\n<\/tr>\n<tr>\n<td>Official console<\/td>\n<td>Google Cloud Console \u2014 https:\/\/console.cloud.google.com\/<\/td>\n<td>Where you create\/run evaluations and review findings<\/td>\n<\/tr>\n<tr>\n<td>API reference (official)<\/td>\n<td>Google Cloud APIs Explorer \/ API reference \u2014 https:\/\/cloud.google.com\/apis<\/td>\n<td>Find the Workload Manager API reference if you plan automation (verify exact API name from docs)<\/td>\n<\/tr>\n<tr>\n<td>Pricing<\/td>\n<td>Google Cloud Pricing overview \u2014 https:\/\/cloud.google.com\/pricing<\/td>\n<td>Starting point for understanding pricing; Workload Manager may not have a standalone SKU page<\/td>\n<\/tr>\n<tr>\n<td>Pricing calculator<\/td>\n<td>Google Cloud Pricing Calculator \u2014 https:\/\/cloud.google.com\/products\/calculator<\/td>\n<td>Model indirect costs (VMs, logging, monitoring, storage)<\/td>\n<\/tr>\n<tr>\n<td>Audit logging<\/td>\n<td>Cloud Audit Logs \u2014 https:\/\/cloud.google.com\/logging\/docs\/audit<\/td>\n<td>Track evaluation activity and access patterns<\/td>\n<\/tr>\n<tr>\n<td>Inventory<\/td>\n<td>Cloud Asset Inventory \u2014 https:\/\/cloud.google.com\/asset-inventory\/docs<\/td>\n<td>Understanding resource inventory concepts that often underpin evaluations<\/td>\n<\/tr>\n<tr>\n<td>Governance<\/td>\n<td>Organization Policy Service \u2014 https:\/\/cloud.google.com\/resource-manager\/docs\/organization-policy\/overview<\/td>\n<td>Preventive controls to complement evaluation-based approaches<\/td>\n<\/tr>\n<tr>\n<td>Security posture<\/td>\n<td>Security Command Center \u2014 https:\/\/cloud.google.com\/security-command-center\/docs<\/td>\n<td>Broader security posture and findings management complementing Workload Manager<\/td>\n<\/tr>\n<tr>\n<td>Community learning<\/td>\n<td>Google Cloud Community \u2014 https:\/\/www.googlecloudcommunity.com\/<\/td>\n<td>Practitioner discussions and patterns (use carefully; validate against official docs)<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Institute<\/th>\n<th>Suitable Audience<\/th>\n<th>Likely Learning Focus<\/th>\n<th>Mode<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps engineers, SREs, platform teams<\/td>\n<td>Google Cloud operations, DevOps practices, governance tooling<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>ScmGalaxy.com<\/td>\n<td>Beginners to intermediate practitioners<\/td>\n<td>DevOps fundamentals, cloud tooling basics<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.scmgalaxy.com\/<\/td>\n<\/tr>\n<tr>\n<td>CLoudOpsNow.in<\/td>\n<td>Cloud operations and platform teams<\/td>\n<td>Cloud operations practices, monitoring\/governance<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.cloudopsnow.in\/<\/td>\n<\/tr>\n<tr>\n<td>SreSchool.com<\/td>\n<td>SREs, reliability engineers, ops teams<\/td>\n<td>Reliability engineering, operations readiness, assessments<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.sreschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>AiOpsSchool.com<\/td>\n<td>Ops teams exploring AIOps<\/td>\n<td>Operations analytics and automation concepts<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.aiopsschool.com\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Platform\/Site<\/th>\n<th>Likely Specialization<\/th>\n<th>Suitable Audience<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>RajeshKumar.xyz<\/td>\n<td>DevOps \/ cloud training content<\/td>\n<td>Engineers seeking guided learning<\/td>\n<td>https:\/\/rajeshkumar.xyz\/<\/td>\n<\/tr>\n<tr>\n<td>devopstrainer.in<\/td>\n<td>DevOps training and coaching<\/td>\n<td>Beginners to working professionals<\/td>\n<td>https:\/\/www.devopstrainer.in\/<\/td>\n<\/tr>\n<tr>\n<td>devopsfreelancer.com<\/td>\n<td>Freelance DevOps guidance\/services<\/td>\n<td>Teams needing hands-on support<\/td>\n<td>https:\/\/www.devopsfreelancer.com\/<\/td>\n<\/tr>\n<tr>\n<td>devopssupport.in<\/td>\n<td>DevOps support and learning<\/td>\n<td>Ops teams needing implementation help<\/td>\n<td>https:\/\/www.devopssupport.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Company Name<\/th>\n<th>Likely Service Area<\/th>\n<th>Where They May Help<\/th>\n<th>Consulting Use Case Examples<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>cotocus.com<\/td>\n<td>Cloud\/DevOps consulting<\/td>\n<td>Architecture reviews, ops maturity, automation<\/td>\n<td>Workload evaluation processes, remediation planning, governance workflows<\/td>\n<td>https:\/\/cotocus.com\/<\/td>\n<\/tr>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps and cloud consulting\/training<\/td>\n<td>Enablement, assessments, implementation support<\/td>\n<td>Setting up evaluation cadence, CI\/CD integration patterns, ops best practices<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>DEVOPSCONSULTING.IN<\/td>\n<td>DevOps consulting services<\/td>\n<td>DevOps transformation, cloud operations<\/td>\n<td>Building runbooks around findings, standardizing deployment practices<\/td>\n<td>https:\/\/www.devopsconsulting.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before this service<\/h3>\n\n\n\n<p>To use Workload Manager effectively, you should understand:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Google Cloud basics: projects, billing, IAM, APIs<\/li>\n<li>Compute fundamentals: Compute Engine VMs, disks, images, networks<\/li>\n<li>Operations basics: Cloud Logging, Cloud Monitoring, alerting concepts<\/li>\n<li>Security basics: least privilege IAM, service accounts, network segmentation<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after this service<\/h3>\n\n\n\n<p>To operationalize findings and prevent recurrence:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Organization Policy Service<\/strong> for guardrails<\/li>\n<li><strong>Security Command Center<\/strong> for posture\/threat detection integration<\/li>\n<li><strong>Infrastructure as Code<\/strong> (Terraform) to remediate and standardize config<\/li>\n<li><strong>SRE practices<\/strong>: SLIs\/SLOs, error budgets, incident response<\/li>\n<li><strong>Policy-as-code tooling<\/strong> if you need custom governance<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud architect<\/li>\n<li>Platform engineer<\/li>\n<li>SRE \/ operations engineer<\/li>\n<li>Cloud security engineer \/ security architect<\/li>\n<li>Governance \/ compliance engineering roles<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (if available)<\/h3>\n\n\n\n<p>There isn\u2019t a Workload Manager\u2013specific certification. Most relevant Google Cloud certs include:\n&#8211; Associate Cloud Engineer\n&#8211; Professional Cloud Architect\n&#8211; Professional Cloud DevOps Engineer\n&#8211; Professional Cloud Security Engineer<\/p>\n\n\n\n<p>Choose based on your role; then practice by using Workload Manager to validate architecture and ops readiness.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Build a \u201cproduction readiness checklist\u201d that maps to Workload Manager findings.<\/li>\n<li>Create a monthly evaluation routine and a ticket triage workflow.<\/li>\n<li>Pair Workload Manager with Org Policy guardrails: for each recurring finding, add a preventive constraint (where feasible).<\/li>\n<li>Create an internal scorecard per environment: critical\/high findings count and time-to-remediate.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Workload Manager:<\/strong> Google Cloud service for evaluating workload configurations against best practices using rule-based evaluations.<\/li>\n<li><strong>Evaluation:<\/strong> A defined set of checks run against a scope (project\/resources) that produces results\/findings.<\/li>\n<li><strong>Ruleset:<\/strong> A collection of rules\/checks for a workload category or best-practice domain.<\/li>\n<li><strong>Finding:<\/strong> A result item indicating a pass\/fail or improvement opportunity, often with severity.<\/li>\n<li><strong>Scope:<\/strong> The boundary of resources assessed (project, filtered resources, etc.).<\/li>\n<li><strong>Least privilege:<\/strong> Security principle of granting only the permissions required to perform a task.<\/li>\n<li><strong>Service agent:<\/strong> A Google-managed service identity that a Google Cloud service uses to operate in your project.<\/li>\n<li><strong>Configuration drift:<\/strong> Unplanned divergence from an intended configuration over time.<\/li>\n<li><strong>Control plane:<\/strong> Management layer (APIs, IAM, configuration), not application traffic\/data plane.<\/li>\n<li><strong>Org Policy:<\/strong> Google Cloud governance constraints that prevent or restrict risky configurations.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p>Workload Manager in <strong>Google Cloud Compute<\/strong> is a managed service for running <strong>repeatable, best-practice evaluations<\/strong> against your workload environment and producing <strong>actionable findings<\/strong>. It matters because it replaces ad-hoc, manual reviews with structured assessments that help reduce outage risk, improve security posture, and standardize operational readiness\u2014especially for complex, production workloads.<\/p>\n\n\n\n<p>Cost-wise, you should plan primarily for <strong>indirect costs<\/strong> (the Compute resources you run, and any logging\/monitoring\/storage you retain), and verify whether Workload Manager has any direct SKUs in your billing catalog. Security-wise, treat findings as sensitive, use least-privilege IAM, and retain audit logs appropriately.<\/p>\n\n\n\n<p>Use Workload Manager when you need <strong>workload-specific configuration validation<\/strong> and a repeatable readiness process. For your next step, read the official Workload Manager documentation and run evaluations in a controlled pre-production project to establish a triage and remediation workflow:\n&#8211; https:\/\/cloud.google.com\/workload-manager\/docs<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Compute<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26,51],"tags":[],"class_list":["post-637","post","type-post","status-publish","format-standard","hentry","category-compute","category-google-cloud"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/637","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=637"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/637\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=637"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=637"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=637"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}