Why is my AWS Config rule with required-tags status stuck on "Evaluating"?

Last updated: 2020-08-06

I created an AWS Config managed rule using required-tags to check for specific resources. However, my AWS Config rule with required-tags status is still "Evaluating" resources, or reporting unexpected results.

Resolution

Use the following best practices when creating and editing AWS Config rules using required-tags.

  • The AWS Config configuration recorder must be turned on and configured in the same AWS Region as the AWS Config rule. To turn the configuration recorder on or off, see managing the configuration recorder.
  • AWS Config rules using required-tags typically return results in 20 minutes or less. Results can vary depending on the service or resource type due to downstream dependencies.
  • If the AWS Config rules Scope of changes is set to Resources, verify that the resource type (for example, EC2::Instance) is specified for the trigger.
  • If the AWS Config rules Scope of changes is set to Tags with or without a tag value, a supported resource must be tagged with a tag key.
  • Verify that the IAM role assigned to AWS Config has the AWSConfigRole managed policy attached. For more information, see IAM role policy for getting configuration details.
  • For configuring AWS Config to record to Amazon Simple Storage Service (Amazon S3) buckets, verify that the permissions allow recording changes. For more information, see Troubleshooting for recording S3 buckets.