Introduction

You can limit your cloud scans to specific resources in your AWS account, Azure subscription, or GCP project by using the tags or labels already assigned to your resources.

This allows you to control which resources are included in or excluded from a scan without changing your cloud infrastructure.

How tag-based filtering works

You can configure two types of rules:

Each rule must be entered as a key=value pair, and both the key and value must match the resource's tag.

Important rules

• Exclusion rules always take precedence. If a resource matches both an include and an exclude rule, it is skipped.

• Multiple rules within the same list use OR logic. For example, env=prod or env=staging.

• Tag values must match exactly. prod does not match production.

• If no tag rules are configured, all accessible resources are scanned.

• If an include rule does not match any resources, no resource-level findings will be reported.

• Tags applied to a parent resource can cover its child resources, depending on the cloud provider.

Before you start

Make sure that:

1. Your cloud resources have the tags or labels you want to use for filtering.

2. The scan credentials have the required permissions to read those tags.

3. For AWS, us-east-1 is included in the scan region list if you want to filter global services such as CloudFront, IAM policies and certificates, or Route 53.

4. The tag key and value are entered exactly as they appear on the resource.

Configure tag rules

Tag rules can be configured from the target's Scan Scope section.

1. Open the cloud target and go to Scan Scope.

2. Enable Use tag rules for this target.

3. Add your rules as key=value.

4. Choose either:

   • Include resources with these tags to scan only matching resources.

   • Exclude resources with these tags to skip matching resources.

5. Review the What gets scanned section to confirm the expected scope.

6. Click Save Changes.

The rules will apply to the next scan and scheduled scans going forward.

Example

If you want to scan only the Payments team's resources while excluding production and disaster recovery resources:

In this example, only resources tagged team=payments are eligible for scanning, and resources also tagged env=prod or env=dr are excluded.

AWS

Required permission

The scan requires tag:GetResources from the AWS Resource Groups Tagging API. This permission is included in the AWS managed ReadOnlyAccess and SecurityAudit policies.

AWS tag matching is case-sensitive.

For global AWS services, tags are reported from us-east-1, so make sure that region is included in the scan configuration.

Azure

Required permission

The scan requires the Reader role on the subscription.

Azure tag names are case-insensitive, while tag values are case-sensitive.

A tag applied to a resource group covers the resources inside that group.

Google Cloud

GCP supports two tag systems:

• Labels, which are key-value pairs available on many resources.

• Resource Manager tags, which can be attached to projects, folders, or resources and inherited by resources beneath them.

The scanner checks both systems when evaluating configured tag rules.

Required permissions

The scan requires cloudasset.assets.searchAllResources, included in the Cloud Asset Viewer role, and the Cloud Asset API must be enabled in each scanned project.

Resources that are always scanned

Some checks cover resources that cannot carry tags. These checks run regardless of your configured tag filters.

For example:

• AWS: IAM users, roles, groups, root account, and certain account-level services.

• Azure: Entra ID users, groups, applications, and service principals.

• GCP: Organization and project-level IAM and API settings.

As a result, configuring an include rule does not necessarily mean that every finding outside the selected resources will disappear.

Troubleshooting

The scan reports an invalid tag

The tag may contain a character that is not supported by the provider's filtering rules, or the key or value may exceed the allowed length.

Correct the tag rule and start the scan again.

The scan completed but reports almost no findings

If an include rule does not match any resources, the scan can complete without reporting resource-level findings.

Check:

• The spelling and case of the tag.

• That the tag is applied to the resource, resource group, project, or folder as applicable.

• That the resource's region is included in the AWS scan configuration.

An excluded resource still appears

Check whether:

• The resource is a child of a parent that was not excluded.

• The resource is one of the always-scanned resources.

• For AWS global services, us-east-1 is included in the scan region list.

An included resource is missing

For GCP, some resources such as VPC resources and service accounts do not support labels. Use a Resource Manager tag instead.

Also note that tags are read when the scan starts. A tag added after the scan has started will not affect that scan.