# Evaluation Modes

## **Evaluation Mode and Trigger Types for AWS Config Rules**

AWS Config rules allow you to evaluate your resource configurations at different stages and frequencies. Below are the evaluation modes and trigger types available for AWS Config rules.

### **Evaluation Modes:**

1. **Proactive Evaluation:**
   * Evaluates resources *before* deployment.
   * Helps ensure resources meet compliance before they are provisioned.
   * Example: Use the `S3_BUCKET_LOGGING_ENABLED` rule to check if an S3 bucket has logging enabled before deploying it.
   * Use APIs like `StartResourceEvaluation` and `GetResourceEvaluationSummary` to test resource configurations.
2. **Detective Evaluation:**
   * Evaluates resources *after* deployment.
   * Ensures existing resources are compliant with configuration rules.
   * Example: Use `S3_BUCKET_LOGGING_ENABLED` to check compliance when an S3 bucket is created or modified.

### **Trigger Types:**

1. **Configuration Change Trigger:**
   * Evaluates resources when a change occurs (e.g., resource creation, modification, or deletion).
   * Example: A rule evaluates every time an S3 bucket's settings are updated.
2. **Periodic Trigger:**
   * Runs evaluations at regular intervals (e.g., every 24 hours).
   * Example: `IAM_PASSWORD_POLICY` checks if user password policies meet account standards every 24 hours.
3. **Hybrid Trigger:**
   * Combines both configuration change and periodic triggers.
   * Example: A rule evaluates CloudTrail trails whenever a trail is updated or deleted and also every 12 hours.

#### **Examples:**

* **Change-Triggered Rule:**
  * `S3_BUCKET_LOGGING_ENABLED` triggers evaluations whenever an S3 bucket is modified.
* **Periodic Rule:**
  * `IAM_PASSWORD_POLICY` runs every 24 hours to ensure password policies meet requirements.
* **Hybrid Rule:**
  * A custom rule monitors if CloudTrail trails are logging across all regions both when a trail is updated and at 12-hour intervals.

### **Impact of Turning Off the Configuration Recorder:**

* **Periodic Rules:** Continue to run on schedule.
* **Change-Triggered Rules:** Stop evaluating when the configuration recorder is off.
* **Hybrid Rules:** Only run evaluations at scheduled intervals, not on configuration changes.
