AWS Config issues not evaulating when new accounts created, but will after some time when retrigger evaluation

Let me help break this down and explain the potential causes:

1. Initial Non-Compliant Status Issue: The behavior you're describing (initially non-compliant, then compliant after re-evaluation) could be due to several factors:

• Resource Initialization Delay: When a new AWS account is created, there is indeed a delay in the full initialization of various AWS services and resources. This "eventual consistency" model can affect Config rules evaluation.

• AWS Config Service Synchronization: Config needs time to discover and record the configuration state of resources in your account. The initial evaluation might occur before this process is complete.

2. Regarding the config:PutEvaluations Permission: It's important to note that:

• The config:PutEvaluations permission should be present in your Lambda execution role for the Config rule to function properly
• If your rule is working after retrigger, the permission must exist somewhere - check for:
  • Inline policies
  • Managed policies (both AWS and customer managed)
  • Permission boundaries
  • Service-linked roles

3. To troubleshoot this:

a) Verify permissions:

aws iam get-role-policy --role-name YOUR_LAMBDA_ROLE_NAME
aws iam list-attached-role-policies --role-name YOUR_LAMBDA_ROLE_NAME

b) Check if you're using the AWS-managed policy AWSConfigRole, which includes necessary permissions

4. Best Practices to Handle This:

• Add appropriate error handling in your Lambda function
• Implement retries for failed evaluations
• Add logging to track the evaluation process
• Consider adding a delay before the first evaluation

5. Example Lambda Role Policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "config:PutEvaluations",
            "Resource": "*"
        }
    ]
}

The fact that it works after retrigger suggests that the permission exists somewhere in your role structure. I'd recommend doing a thorough audit of your IAM roles and policies to locate where this permission is actually being granted.

To resolve the initial evaluation issue, you could:

1. Add error handling in your Lambda function
2. Implement a check for resource readiness
3. Add appropriate waiting periods for new account initialization
4. Ensure all required permissions are explicitly defined in your IAM roles