Exception rules

Exceptions ("suppressions") tell StaleSweep that a resource is intentional — stop flagging it — without disabling an entire rule. Suppressed findings are hidden from results and totals but remain inspectable via the Show suppressed toggle on the Resources page.

Quick suppress

On the Resources page, find the flagged resource.
Click Suppress(or select several rows and bulk-suppress — there's an Undo on the confirmation toast).
StaleSweep creates an exception rule matching that specific resource.

Exception rules

For broader policies, create a rule on the Exceptions page. A rule has a name, an optional reason (write one — your future self will thank you), an enabled toggle, and any combination of match conditions. Every unset field is a wildcard:

Field	Matches	Example
Resource type	One detector's findings	`rds_read_replica_idle`
Region	Findings in one region	`eu-west-1`
Resource ID	One specific resource	`vol-0abc123…`
Tag key / value	Resources carrying a tag	key `environment`, value `dr`
Detail key / value	A field from the finding's details	key `is_default`, value `true`

Conditions combine with AND. For example: "never flag our DR read replicas" → resource type rds_read_replica_idle + tag purpose=dr. Rules can be edited, disabled, or deleted at any time.

Tag-based protection

Independent of exception rules, the scanner honors a small set of protection tag keys directly on AWS resources — currently applied where intentional long-term retention is common (Secrets Manager secrets and manual RDS snapshots): stalesweep:ignore, donotdelete / do-not-delete, retention, and compliance (any value, case-insensitive). For all other resource types, use an exception rule with a tag match — same effect, and manageable in one place.

Managing at the right level

You want to…	Use
Turn a detector off entirely, workspace-wide	Rules page toggle
Ignore a category of resources (by tag, region, type)	Exceptions rule with broad match fields
Ignore one specific resource	Suppress button, or a rule with its Resource ID
Protect compliance/retention resources at the source	Protection tags on the AWS resource

Tip: Prefer narrow rules with a written reason over disabling detectors — a disabled rule finds nothing, forever. Use tag-based rules for fleets so new resources are covered automatically, and review the Exceptions page periodically. Exception and rule changes are recorded in the audit log.