# AWS Config Rule With No Evaluations > A Config rule whose FirstEvaluationStarted flag is still false has evaluated 0 resources since creation, usually because its scope matches nothing in the account. ZopNight surfaces these as compliance findings with no dollar value attached, since AWS bills per evaluation and a rule with zero evaluations has cost almost nothing. Source: https://zop.dev/integrations/aws/recommendations/aws-config-rule-with-no-evaluations Updated: 2026-08-19 --- ## A rule that never ran is a control that never existed Config rules are how compliance intent becomes an automated check. One that has never evaluated anything is worse than missing: it appears on the dashboard as a control, someone believes the account is covered, and nothing has ever actually been inspected. The usual cause is a scope filter pointing at a resource type the account simply does not contain: a DynamoDB encryption rule in an account with no tables, or a rule copied from another account's conformance pack wholesale. ## How ZopNight decides The discoverer joins the rule list with each rule's evaluation status and stamps `evaluations_unused=true` when AWS reports `FirstEvaluationStarted=false`, the service's own record that the rule has never begun a single evaluation. The recommendation fires only on that confirmed flag. A rule whose status could not be read abstains; an unknown rule is never reported as unused. ## Why the finding is deliberately worth nothing AWS Config's [published rate is $0.001 per rule evaluation](https://aws.amazon.com/config/pricing/). A rule with zero evaluations has therefore accrued roughly zero evaluation spend, and deleting it recovers roughly zero. Framing this as a cost recommendation would mean fabricating a saving or shipping a $0 card into a list sorted by dollars, so it ships as compliance instead, where the payload is the broken control, not the invoice line. ## Find yours in one command ```bash aws configservice describe-config-rule-evaluation-status \ --query 'ConfigRulesEvaluationStatus[?FirstEvaluationStarted==`false`].ConfigRuleName' \ --output table ``` ## Fix the scope or delete the rule Two legitimate outcomes exist. If the control matters, fix the reason it never fired: correct the resource-type filter, confirm the target type exists in this account and region, and watch the first evaluation land. If the rule guards a resource type this account will never use, delete it. A permanently-idle rule is dashboard noise that trains people to stop reading the compliance list. What you should not do is leave it as-is, because every quarter it sits there it reinforces a coverage claim that has never been true. Check the rule again a day after any scope change; `FirstEvaluationStarted` flips permanently once the first evaluation begins.