Not able to exclude the resources from one trusted advisor finding

There are a few potential reasons why you're unable to exclude resources from the IAM external access finding in AWS Trusted Advisor:

1. Refresh limitations: Trusted Advisor findings, especially those related to security, may have specific refresh intervals. If the finding shows it was updated a day ago and you can't manually refresh it, this is likely due to the predetermined refresh schedule for that particular check. Security-related findings often have automated, periodic updates rather than on-demand refreshes.

2. Security Hub integration: Although you mentioned checking that it's not linked from Security Hub, it's worth double-checking this. If the finding is indeed coming from Security Hub, you cannot exclude resources directly from Trusted Advisor. Exclusions for Security Hub findings must be managed within Security Hub itself.

3. Check type: Some Trusted Advisor checks, particularly those related to security, may not allow exclusions due to their critical nature. The IAM external access check could fall into this category, which would explain why the exclusion option is grayed out.

4. Permission issues: Ensure that you have the necessary permissions to manage Trusted Advisor exclusions. This typically requires Business, Enterprise On-Ramp, or Enterprise Support plans and the appropriate IAM permissions.

5. Regional considerations: For IAM-related checks, which are typically global services, excluding specific regions may not be applicable. This could be why you're unable to exclude certain regions from the check.

To address your specific concern about excluding checks for other regions, you may need to approach this differently:

1. Review the IAM policies and roles to ensure they're properly scoped to the intended regions.
2. If the check is coming from Security Hub, you'll need to manage suppressions there instead of in Trusted Advisor.
3. Consider using AWS Organizations and Service Control Policies (SCPs) to limit IAM actions in specific regions if that aligns with your security requirements.

If you still need to exclude resources and the option remains unavailable, you may want to contact AWS Support for further assistance, especially if you have a Business or Enterprise support plan. They can provide more specific guidance based on your account's configuration and the exact nature of the finding.

Sources
How to exclude resources from AWS Trusted Advisor reports using Trusted Advisor API | AWS re:Post
AWS Trusted Advisor now supports API to exclude resources
Viewing AWS Security Hub controls in AWS Trusted Advisor - AWS Support