AWS Config Rules error, Question regarding this behavior

This behavior in AWS Config rules can occur for several reasons. When you first create a custom rule, AWS Config evaluates your resources against that rule, but there might be a delay in the evaluation process or issues with the Lambda function that powers your custom rule.

The "INSUFFICIENT_DATA" status might be returned initially if:

1. AWS Config has not yet completed its first evaluation for the rule.
2. The Lambda function for your custom rule is failing to send evaluation results to AWS Config.
3. There might be permission issues with your Lambda function not having the proper config:PutEvaluations permission.

When you retrigger the evaluation later, these initial issues might have been resolved automatically:

• The Lambda function might have successfully completed its evaluation
• Any temporary permission or configuration issues might have been resolved
• AWS Config might have completed gathering all necessary data for evaluation

To fix this issue:

1. Ensure your Lambda execution role includes the config:PutEvaluations permission
2. Verify that the role assigned to your configuration recorder has the necessary permissions
3. Check the Lambda function logs for any errors during the initial evaluation
4. Consider the order of operations in your Python code - if it's making assumptions about resource state that might not be valid during the first evaluation

You can also use the DescribeConfigRuleEvaluationStatus API to check the LastSuccessfulInvocationTime and LastFailedInvocationTime to better understand the evaluation timing.
Sources
DescribeComplianceByConfigRule - AWS Config
Evaluating Your Resources with AWS Config Rules - AWS Config
Components of an AWS Config Rule - AWS Config
Config rule with custom lambda permission issue | AWS re:Post

You mentioned the issue is happening on new accounts. When you create a new AWS account, not all AWS resources and service metadata are immediately available. Some resources may not yet exist (e.g., IAM roles, baseline buckets, default VPC, CloudTrail trail, etc.). The custom rule runs immediately and results NON_COMPLIANT. Eventually, CloudTrail is created, SCP is configured, etc and eventually the status is changed to COMPLIANT.