What personal data is in it, in a few concrete words — the categories a reviewer or a subject-access request needs, e.g. "Customer KYC documents and government ID images". Not a restatement of the resource's name.
KEEP TO THE CONSERVATIVE AWS TAG-VALUE CHARSET: letters, digits,
spaces, and + - = . _ : / @, up to 256 characters. Commas,
apostrophes, parentheses and em dashes are outside the set AWS
documents as portable across services, and a rejected tag fails the
whole pulumi up — on buckets and clusters that are protected and
awkward to retry. Use / where you want a comma and drop the
possessive.
Vanta's "Inventory list tracks resources that contain user data" control reads two AWS resource tags off everything it inventories — S3 buckets, RDS clusters and instances, DynamoDB tables:
VantaContainsUserData "true" | "false" VantaUserDataStored what personal data is actually in there
An untagged resource is not "no user data", it is unanswered, and the control fails on unanswered. So this is a union rather than two optional fields: a resource declares that it holds user data AND says what, or declares that it holds none. There is no third state, and no way to claim user data without describing it.
Spread
vantaUserDataTags(args)into the resource's existingtags. Every creation helper that takes this on its args type turns a new resource into a compile error until the question is answered — which is the point, since the failure mode of a lookup table keyed by resource name is a new resource silently defaulting to untagged.Vanta honours two further tags that remove a resource from scope entirely rather than answering a question about it —
VantaNonProd: "true"andVantaNoAlert: <reason>, the latter keyed on the tag's PRESENCE rather than its value. Nothing in a Pulumi program wants them (every stack here is real dev or prod infrastructure), so there is no helper for them. They are set on the ephemeralpr-<N>SST preview stages, via the AWS provider'sdefaultTagsin each dashboard'ssst.config.ts— an SST config cannot import this package, because bundling a second@pulumi/pulumiinto it breaks every invoke.