By using AWS re:Post, you agree to the Terms of Use

Config Custom Rule Evaluations Limit

2

The AWS Config Put_Evaluations API call has a maximum limit of 100 resource evaluations for a Custom Rule. Resource types such as IAM policies or VPC Security Groups in an AWS Account would easily have more than 100 resources available to evaluate. Attempting to do so, however, results in an HTTP 400 Error: "Member must have length less than or equal to 100"

Splitting the resource array into multiple put_evaluations requests doesn't work; the ResultToken becomes invalid after just one invocation and results in InvalidResultTokenException.

Is this a limit that can be increased? If not, are there any recommended workarounds?

1 Answer
0

Hello!

Ive looked into the issue you are having and understand that you are having a problem with the Config Rule Evaluation limit. Although the limit of 100 resource evaluations for a Custom Rule cannot be increased, the workaround would be to split the resource array into multiple PutEvaluations API calls. You can reuse the same ResultToken from the Lambda execution.

Since you are getting an InvalidResultTokenException, I would also suggest to check if the ResultToken is parsed correctly in your code and if it is being used in the correct region, account, etc. I hope that helps with the issue you are having! I have attached a link below that goes more in depth on request parameters.

  1. https://docs.aws.amazon.com/config/latest/APIReference/API_PutEvaluations.html#API_PutEvaluations_RequestParameters:~:text=%22%3A%20boolean%0A%7D-,Request%20Parameters,-For%20information%20about
answered a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions