Troubleshoot "no data" evaluation results for custom rules - Cloud Config

When a custom rule runs, its Function Compute function evaluates resources and calls the PutEvaluations operation to return results to Cloud Config. If the evaluation result shows "no data" after you execute a custom rule, use one of the following methods to troubleshoot the issue:

Troubleshoot by using ActionTrail

In the ActionTrail console, use the Event Query feature to check for calls to the PutEvaluations API.

If invocation records of the PutEvaluations operation exist, the rule ran successfully but no resources matched. If no records exist, the rule failed to run.

Note
Select the Singapore region.
Troubleshoot by using Function Compute

If logging is enabled for the function, you can view invocation records of the PutEvaluations operation. To enable logging, see Configure logging.

After you run the custom rule, print logs on the Code tab and check for calls to the PutEvaluations API on the Logs tab. If call records for PutEvaluations exist, the rule ran successfully but found no matching resources. Otherwise, the rule failed to run.
Check the featurePath configuration of the conditional rule

For a conditional rule created by selecting Based on Condition, the featurePath property uses a JSONPath expression to extract a field value from the target resource's configuration. Cloud Config then compares this value to an expected value. If the JSONPath specified by featurePath does not match any node in the resource's configuration or returns an empty set, the evaluation result is "no data".

For example, you create a conditional rule to check whether a security group has an inbound rule where SourceCidrIp is 0.0.0.0/0. The featurePath is configured as $.Permissions.Permission[?(@.SourceCidrIp=='0.0.0.0/0')].SourceCidrIp. If a security group does not have an inbound rule with a SourceCidrIp of 0.0.0.0/0, the JSONPath filter expression returns an empty set. The evaluation result for that security group is "no data". However, a security group that has such a rule is considered non-compliant.

An evaluation result of "no data" does not mean the resource is non-compliant. It means the rule could not extract a value from the resource's configuration for comparison. Before creating a conditional rule, use the resource details page or an API to verify that the target resource's configuration contains the field referenced by featurePath.