In CrowdStrike Falcon Cloud Security, exclusions for cloud scans are designed to be precise and scalable so that organizations can safely reduce noise without weakening overall security coverage. According to CrowdStrike best practices,tagsare the recommended and supported criterion for creating cloud scan exclusions.

Tags are metadata labels applied to cloud resources (such as AWS accounts, instances, or services) and are commonly used for ownership, environment classification (for example, dev, test, or prod), or application grouping. By using tags as exclusion criteria, security teams can dynamically control which resources are excluded from scans without relying on static identifiers. This is especially important in cloud environments where resources are frequently created, modified, or terminated.

Exclusions based onaccounts,regions, orservicesare broader in scope and can unintentionally exclude large portions of the environment, increasing the risk of blind spots. Tag-based exclusions allow CrowdStrike Falcon to maintain least-privilege security principles by excluding only explicitly labeled resources.

Because Falcon continuously evaluates cloud resources, tag-based exclusions automatically apply to newly created assets that inherit the same tag, ensuring consistent policy enforcement. For these reasons, CrowdStrike documentation and operational guidance identifyTagas the correct and most effective criterion for creating cloud scan exclusions.