Config Custom Rule Evaluations Limit

Question

The AWS Config [Put_Evaluations API call](https://docs.aws.amazon.com/config/latest/APIReference/API_PutEvaluations.html) has a maximum limit of 100 resource evaluations for a Custom Rule. Resource types such as IAM policies or VPC Security Groups in an AWS Account would easily have more than 100 resources available to evaluate. Attempting to do so, however, results in an HTTP 400 Error: "Member must have length less than or equal to 100"

Splitting the resource array into multiple put_evaluations requests doesn't work; the ResultToken becomes invalid after just one invocation and results in InvalidResultTokenException.

Is this a limit that can be increased? If not, are there any recommended workarounds?

Answer

Hello!
 
Ive looked into the issue you are having and understand that you are having a problem with the Config Rule Evaluation limit. Although the limit of 100 resource evaluations for a Custom Rule cannot be increased, the workaround would be to split the resource array into multiple PutEvaluations API calls. You can reuse the same ResultToken from the Lambda execution. 
 
Since you are getting an InvalidResultTokenException, I would also suggest to check if the ResultToken is parsed correctly in your code and if it is being used in the correct region, account, etc. I hope that helps with the issue you are having! I have attached a link below that goes more in depth on request parameters. 
 
1) https://docs.aws.amazon.com/config/latest/APIReference/API_PutEvaluations.html#API_PutEvaluations_RequestParameters:~:text=%22%3A%20boolean%0A%7D-,Request%20Parameters,-For%20information%20about

Config Custom Rule Evaluations Limit

関連するコンテンツ