Our IaC scans in InsightCloudSec are generating excessive noise. The plan analysis flags every ephemeral dev resource in our Terraform state, like transient S3 buckets and test EC2 instances. These are intentionally short-lived and we don't need compliance or cost alerts for them.
We've tried adjusting the `terraform plan` command itself, but the issue is the scan seems to evaluate the entire state file. Is there a way within InsightCloudSec to scope or filter these scans? We need to:
* Exclude resources tagged with `env: dev`
* Exclude specific resource types (e.g., `aws_s3_bucket` with a name pattern `*-temp`)
* Apply this filter at the plan analysis stage, not just in post-hoc reporting
Our current workflow:
```hcl
# Example of a resource we want to ignore
resource "aws_s3_bucket" "transient_artifacts" {
bucket = "app-dev-temp-${var.id}"
tags = {
env = "dev"
ephemeral = "true"
}
}
```
What are the actual configuration knobs for this? The documentation mentions "exclusion rules" but only for the continuous asset inventory, not for the Terraform plan scan.
Data over opinions