# Rules

> Define conditional logic that runs on a schedule and triggers actions when the condition is met

---

Site [llms.txt](/llms.txt)

---

A rule lets Cloud Management Platform (CMP) administrators check the state of the environment and act on what they find. Use rules to enforce policy with corrective actions, respond to changes as they happen, or run health checks and tell the right people what needs attention.

## How a rule works

A rule is a logical statement in two parts:

- **Condition** (the "if"). One action that tests something and reports whether it found anything.
- **Actions** (the "then"). One or more actions that run when the condition is met.

Both parts are CMP actions of type **CloudBolt Plug-in**. The condition is written a little differently from other plugins; see [Write a condition plugin](#write-a-condition-plugin).

## When rules run

A rule runs on its schedule only when two things are switched on: the rule, and the **Execute all Rules** recurring job that evaluates every enabled rule.

<div class="alert alert-info" role="alert">


**Execute all Rules** is disabled on a newly installed instance. Until you switch it on at **Admin** > **Recurring Jobs**, no rule runs on a schedule, however many rules you have enabled. See [Built-in recurring jobs](/docs/cmp/use/orchestration/recurring-jobs/built-in/).
</div>


**Execute all Rules** runs at 1:00 AM by default, in the time zone set on the CMP appliance. See [Schedule format](/docs/cmp/use/orchestration/recurring-jobs/manage/#schedule-format).

You can also run a rule on demand from **Admin** > **Rules**, one at a time or in bulk. On-demand runs do not depend on the recurring job.

## Built-in rules

CMP ships with the rules below. Go to **Admin** > **Rules** to view them and switch them on or off. Because rules are built from actions, you can read and edit their source at **Admin** > **All Actions**.

| Rule | What it does | Default state |
| --- | --- | --- |
| Email CB Admin when license warning for thresholds | Emails the CMP administrator when the license is close to expiring, or when too much of its server allowance is in use. | Enabled |
| Notify admins when a newer version of CloudBolt is available | Checks the latest general availability release and saves the result, so an alert can appear on the Admin page. | Enabled |
| Fetch and Cache Available AWS AMIs | Fetches AMIs for every imported region on each AWS resource handler. | Enabled |
| Fetch and Cache Available Azure Images | Fetches Azure images using a CloudBolt-supplied allowlist, which you can replace with your own. | Enabled |
| Fetch and Cache Available GCP Images | Fetches images for every imported project on each GCP resource handler. | Enabled |
| Fetch and Cache Available VMWare Templates | Fetches VMware templates using a CloudBolt-supplied allowlist, which you can replace with your own. | Enabled |
| Email group admins when quota usage over threshold | Emails everyone whose role in a group carries the `group.manage_subgroup_quotas` permission when that group's quota usage passes a threshold. | Disabled |
| Email owners of AWS VMs Missing Required Tags | Checks AWS instances for a set of required tags and emails the owner of any server that is missing one. | Disabled |
| Clean up Old Snapshots | Finds and destroys old snapshots that can degrade performance. | Disabled |
| Expire Resources | Finds deployed resources whose expiration date has passed and runs the configured expiration actions. | Disabled |

Several of these rules start with threshold values you can change on the rule itself:

- **Email CB Admin when license warning for thresholds.** 30 days before expiration, and 75% of the licensed servers in use.
- **Email group admins when quota usage over threshold.** 80% of the quota.
- **Clean up Old Snapshots.** Snapshots older than 30 days.
- **Expire Resources.** Resources that passed their expiration date more than 30 days ago.

<div class="alert alert-info" role="alert">


**Clean up Old Snapshots** also ships with its **Dry Run** input switched on, so it reports the snapshots it would remove without deleting anything. Turn **Dry Run** off once you are satisfied with what it finds.
</div>


## Write a condition plugin

A condition is a CloudBolt plugin, so everything that applies to [CloudBolt plugins](/docs/cmp/use/orchestration/plugins/) applies. Two things differ from every other plugin:

- The entry point is `check()`, not `run()`.
- It returns a four-tuple rather than a three-tuple. The extra member is a parameters dictionary that decides whether the rule's actions run.

`check(job, logger)` receives a CMP job object and a standard Python [logger](https://docs.python.org/3/library/logging.html), and returns `(status, output, errors, params)`. The rules that ship with CMP return `("SUCCESS", "", "", params)`.

The fourth member governs what happens next:

- **Return `None` as `params`** and the condition counts as unmet. The job ends, and the rule's actions do not run.
- **Return a populated dictionary** and the actions run, each as its own job, each receiving that dictionary through its job parameters.

## Related

- [Built-in recurring jobs](/docs/cmp/use/orchestration/recurring-jobs/built-in/): the **Execute all Rules** job that puts rules on a schedule.
- [CloudBolt plugins](/docs/cmp/use/orchestration/plugins/): how to write the actions a rule is built from.