Config rules that have never evaluated a single resource
What does ZopNight detect here?
A Config rule whose FirstEvaluationStarted flag is still false has evaluated 0 resources since creation, usually because its scope matches nothing in the account. ZopNight surfaces these as compliance findings with no dollar value attached, since AWS bills per evaluation and a rule with zero evaluations has cost almost nothing.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-199 |
| Category | compliance |
| Severity | low |
| Metric | none — pure configuration read |
| Source | config_rules_unused.go |
Where it applies
A rule that never ran is a control that never existed
Config rules are how compliance intent becomes an automated check. One that has never evaluated anything is worse than missing: it appears on the dashboard as a control, someone believes the account is covered, and nothing has ever actually been inspected. The usual cause is a scope filter pointing at a resource type the account simply does not contain: a DynamoDB encryption rule in an account with no tables, or a rule copied from another account’s conformance pack wholesale.
How ZopNight decides
The discoverer joins the rule list with each rule’s evaluation status and stamps
evaluations_unused=true when AWS reports FirstEvaluationStarted=false, the service’s own
record that the rule has never begun a single evaluation. The recommendation fires only on
that confirmed flag. A rule whose status could not be read abstains; an unknown rule is never
reported as unused.
Why the finding is deliberately worth nothing
AWS Config’s published rate is $0.001 per rule evaluation. A rule with zero evaluations has therefore accrued roughly zero evaluation spend, and deleting it recovers roughly zero. Framing this as a cost recommendation would mean fabricating a saving or shipping a $0 card into a list sorted by dollars, so it ships as compliance instead, where the payload is the broken control, not the invoice line.
Find yours in one command
aws configservice describe-config-rule-evaluation-status \ --query 'ConfigRulesEvaluationStatus[?FirstEvaluationStarted==`false`].ConfigRuleName' \ --output tableFix the scope or delete the rule
Two legitimate outcomes exist. If the control matters, fix the reason it never fired: correct
the resource-type filter, confirm the target type exists in this account and region, and watch
the first evaluation land. If the rule guards a resource type this account will never use,
delete it. A permanently-idle rule is dashboard noise that trains people to stop reading the
compliance list. What you should not do is leave it as-is, because every quarter it sits there
it reinforces a coverage claim that has never been true. Check the rule again a day after any
scope change; FirstEvaluationStarted flips permanently once the first evaluation begins.