# Excluding AWS resources with tags

> Use the TidalExclude tag to exclude supported AWS resources from test verdicts while retaining their evidence. Review resource scope, evidence and removal.

Source: https://tidalcontrol.com/docs/tests/excluding-aws-resources-with-tags

Use the `TidalExclude` tag to exclude an AWS resource from the verdicts of supported checks. The resource's observed results, evidence and exclusion reason remain visible.

For help deciding whether to use a tag or a per-test exception, see [Resource exclusions](/docs/tests/resource-exclusions).

## Exclude a resource with a tag

Manage the exclusion on the resource in AWS.

1. Open the resource in the AWS Management Console and locate its tags.
2. Add `TidalExclude` as the tag key and enter the reason as its value, for example `Development sandbox outside audit scope`.
3. Save the tag, then run the relevant Tidal Control tests again or wait for the next scheduled run.

The tag key is case-sensitive. Any string value excludes the resource, including an empty value or `false`. Remove the tag to stop the exclusion.

## Supported resources and scope

Tag exclusions apply to supported checks for these AWS resources:

- EC2 resources and S3 buckets.
- RDS databases, snapshots and event subscriptions.
- ECS clusters, services and task definitions.
- IAM users, roles, customer-managed policies, server certificates and IAM Access Analyzer analyzers.
- Secrets Manager secrets and customer-managed KMS keys.
- CloudWatch alarms, log groups and CloudTrail trails.

Access keys and inline user or role policies follow the owning identity's tag. Instance status and launch template versions follow the instance or template tag. S3 bucket settings and KMS policies follow their parent resource.

A tag does not exclude an entire account or region, or all resources inside a VPC or ECS cluster. Account and region checks remain included, such as root-account security, password policies, support-role coverage, CloudShell policy coverage, default EBS encryption and VPC Block Public Access. IAM groups and their inline policies remain included.

An excluded resource can still supply evidence for another resource's check. For example, tagging a CloudWatch alarm does not remove its evidence from a CloudTrail monitoring check.

## Review or remove an exclusion

Excluded resources retain their observed Passed or Failed result and the tag value as their reason in test evidence and exports. Adding or removing a tag affects subsequent runs; saved results retain the evidence and reason recorded at execution.

Remove `TidalExclude` in AWS and run the relevant tests again to include the resource in future results. Any per-test exclusions still apply.

To include the resource in a saved result, use Include in that result's evidence table. This does not remove the AWS tag, so future runs still follow it. Some tests require at least one included resource to pass.