Tagging AWS resources for auditing with your own CloudFormation or Terraform

If you deploy DataMasque and its target databases with your own CloudFormation or Terraform rather than the DataMasque AWS RDS masking blueprint, your resources are not tagged by the blueprint, and so they do not carry the DataMasque auditing tags. This page gives you copy-paste CloudFormation and Terraform snippets that add those tags to your own resources so the masked-data signal is present for auditing.

It covers the snapshot-only path: you tag the resource in your own template and let the tags propagate to snapshots automatically. You do not need the full snapshot → restore → mask → re-snapshot orchestration the blueprint performs.

• Who this is for
• The auditing tags
• CloudFormation
• Terraform
• How the tags reach snapshots
• Verifying the tags
• Related pages

Who this is for

Use this guide if all of the following apply:

• You provision DataMasque or its target databases with your own CloudFormation or Terraform, not the DataMasque blueprint.
• You want the DataMasque auditing tags present on those resources.
• You only need the resource and its snapshots tagged. You are not adopting the blueprint's full snapshot/restore/mask/re-snapshot Step Functions flow.

If DataMasque masks the resource directly, it already applies these tags automatically after a successful run, with no template changes required. See AWS Resource Tagging. The snippets here are for resources that your own IaC owns, where you want the auditing tags present regardless of how the resource is masked.

The auditing tags

The auditing signal relies on two tags:

Tag key	Value format	Purpose
datamasque:masked	true	Governance signal: this resource holds masked data.
aws-apn-id	pc:<product-code>	The product ID of the DataMasque product, used for auditing with AWS.

The aws-apn-id value is the pc: prefix followed by your DataMasque AWS product code. Use the value DataMasque applies to automatically masked resources (read it back with aws rds list-tags-for-resource on a resource DataMasque has masked), or ask your DataMasque contact for the product code for your licence. The key and value must match exactly, including the pc: prefix.

The two other tags DataMasque applies on a real masking run — datamasque:masked-date and datamasque:run-id — describe that specific run, so they are intentionally omitted here.

In the snippets below the product code is a template parameter / variable so you set it in one place.

CloudFormation

Add an ApnIdTagValue parameter, then add the tags to each resource you want audited and set CopyTagsToSnapshot: true on RDS instances so the tags follow the resource into its snapshots:

Parameters:
  ApnIdTagValue:
    Type: String
    Description: aws-apn-id tag value in the format pc:<product-code>.
    Default: "pc:dp9c56sw1n8t10q5s4pxlgl3x"

Resources:
  MaskedDatabase:
    Type: AWS::RDS::DBInstance
    Properties:
      Engine: postgres
      DBInstanceClass: db.t3.medium
      AllocatedStorage: "20"
      # CopyTagsToSnapshot makes the auditing tags propagate to every snapshot of this
      # instance, so the masked-data signal survives the snapshot/restore chain.
      CopyTagsToSnapshot: true
      Tags:
        - Key: "datamasque:masked"
          Value: "true"
        - Key: "aws-apn-id"
          Value: !Ref ApnIdTagValue

The same tags can be added to the Tags list of any other resource you want audited (for example AWS::DynamoDB::Table or AWS::Redshift::Cluster); only RDS instances need CopyTagsToSnapshot.

Terraform

Declare an apn_id_tag_value variable, then tag the resource and set copy_tags_to_snapshot = true:

variable "apn_id_tag_value" {
  type        = string
  description = "aws-apn-id tag value in the format pc:<product-code>."
  default     = "pc:dp9c56sw1n8t10q5s4pxlgl3x"
}

resource "aws_db_instance" "masked" {
  engine            = "postgres"
  instance_class    = "db.t3.medium"
  allocated_storage = 20

  # copy_tags_to_snapshot makes the auditing tags propagate to every snapshot of this
  # instance, so the masked-data signal survives the snapshot/restore chain.
  copy_tags_to_snapshot = true

  tags = {
    "datamasque:masked" = "true"
    "aws-apn-id"        = var.apn_id_tag_value
  }
}

How the tags reach snapshots

With CopyTagsToSnapshot (CloudFormation) / copy_tags_to_snapshot (Terraform) enabled on the instance, the auditing tags copy automatically from the instance to its snapshots, and from a snapshot to any instance restored from it. This is the snapshot-only path: tag the instance once, and the tags follow it through the snapshot/restore chain with no further action.

There is one rule to keep this working: do not pass an explicit tag set on the snapshot or restore operation. Supplying explicit tags on create-db-snapshot or restore-db-instance-from-db-snapshot (including the Tags property on an AWS::RDS::DBInstance restored from a snapshot in CloudFormation, or tags on a restored aws_db_instance in Terraform) overrides AWS tag inheritance and drops the auditing tags. If you must set tags on a restored resource, include the auditing tags in that explicit set. See Preserving tags through RDS snapshot and restore for the restore-side snippets.

Verifying the tags

After deploying, confirm the tags are present:

aws rds list-tags-for-resource --resource-name <db-instance-arn>
aws rds describe-db-instances --db-instance-identifier <id> \
  --query 'DBInstances[0].CopyTagsToSnapshot'   # expect: true

Take a snapshot without an explicit tag set and confirm the tags inherited:

aws rds create-db-snapshot \
  --db-instance-identifier <id> \
  --db-snapshot-identifier <snapshot-id>

aws rds describe-db-snapshots --db-snapshot-identifier <snapshot-id> \
  --query 'DBSnapshots[0].TagList'   # expect datamasque:masked and aws-apn-id present

Related pages

• AWS Resource Tagging - the protection tag set DataMasque applies automatically after a masking run, the required IAM permissions, the RDS snapshot/restore restore-side snippets, and finding masked resources with AWS Config.
• DataMasque AWS RDS masking blueprint - the full snapshot/restore/mask/re-snapshot Step Functions stack, which applies these tags for you.