> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-iac/detect-manually-created-resources/ignore-unmanaged-resources.md).
# Ignore unmanaged resources
The `.snyk` policy file can be used to exclude unmanaged resources from being detected by `snyk iac describe`. See [the `.snyk` policy file doc](/scan-fix-and-prevent/prevent/policies/the-.snyk-file.md) for general information.
If you need to exclude only a set of resources, use `.snyk`. If you have more complex requirements, consider using filter rules. For more information see [Filter rules](/scan-fix-and-prevent/scan-with-snyk/snyk-iac/detect-manually-created-resources/filter-rules.md).
Create the `.snyk` file in the directory where you launch the `snyk iac describe` command, typically the root of your IaC repo.
Each line must be structured as follows:
* `resource_type.resource_id`, where `resource_id` is a wildcard to exclude all resources of a given type
* `resource_type.resource_id.path.to.field_name`, where `resource_id` is a wildcard to ignore a drift on a given field for a given type and `path,` can also contain wildcards.
## Examples of IaC ignores
Ignore a single IAM user (*aws\_iam\_user*) named "*tfc-demo*".
{% code title=".snyk" %}
```yaml
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
version: v1.22.1
exclude:
iac-drift:
- aws_iam_user.tfc-demo
```
{% endcode %}
Ignore all unmanaged resource in S3 buckets.
{% code title=".snyk" %}
```yaml
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
version: v1.22.1
exclude:
iac-drift:
- aws_s3_bucket.*
```
{% endcode %}
The `.snyk` policy file also supports the negation of rules. This allows you to ignore everything except certain types. In this example, only S3 buckets will not be ignored:
{% code title=".snyk" %}
```yaml
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
version: v1.22.1
exclude:
iac-drift:
- '*'
- '!aws_s3_bucket'
```
{% endcode %}
Ignore a specific IAM Policy Attachment (AWSServiceRoleForRDS) using its ARN (`arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy`).
{% code title=".snyk" %}
```yaml
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
version: v1.22.1
exclude:
iac-drift:
- aws_iam_policy_attachment.AWSServiceRoleForRDS-arn:aws:iam::aws:policy/aws-service-role/AmazonRDSServiceRolePolicy
```
{% endcode %}
Ignore the S3 bucket called `my-bucket` and so on, as shown.
```
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
version: v1.22.1
exclude:
iac-drift:
# Will ignore S3 bucket called my-bucket
- aws_s3_bucket.my-bucket
# Will ignore every aws_instance resource
- aws_instance.*
# Will ignore environment for all lambda functions
- aws_lambda_function.*.environment
# Will ignore resources like aws_iam_role.AmazonSSMRoleForInstances and aws_iam_role.AWSServiceRoleForAmazonSSM
- *role.*Amazon*
# Will ignore lastModified for my-lambda-name lambda function
- aws_lambda_function.my-lambda-name.last_modified
```
## Precedence over filter rules[](https://docs.driftctl.com/0.22.0/usage/filtering/driftignore#precedence-over-filter-rules)
You can use the means to ignore resources explained on this page in combination with filter rules.
**Note:** If the same resource is included by a filter rule and excluded inside the `.snyk` file, `snyk iac describe` ignores this resource.
## Automatically generate unmanaged resource exclusion rules[](https://docs.driftctl.com/0.22.0/usage/filtering/driftignore#automatically-generate-a-driftignore-file)
For details, run `snyk iac update-exclude-policy --help` .
This command helps to generate a `.snyk` policy file, adding all the detected drifts to it in order to ignore them all.
For example, to ignore all the unmanaged resources at once, run the following command:
```
$ snyk iac describe --json | snyk iac update-exclude-policy
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-iac/detect-manually-created-resources/ignore-unmanaged-resources.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.