Map every store that holds personal data

How to do it

Include databases, file buckets, caches, search indexes, queues, logs, backups, analytics, the email service, the support desk and every AI provider. Give each store a stable ID that the other registers refer to. Generate the list of stores from your infrastructure code, such as Terraform state, and compare it with the map in the build. The personal data columns rule lists the columns inside each database.

Example

- id: orders-db
  kind: database
  provider: hosting-eu
  region: eu-north-1
  data: [name, email, address, order history]
  subjects: [customers]
  owner: maria.lind
- id: support-desk
  kind: processor
  provider: helpdesk-us
  region: us-east
  data: [name, email, message text]
  subjects: [customers, prospects]
  owner: jonas.berg

import { readFileSync } from 'node:fs';
import { parse } from 'yaml';

const mapped = new Set(parse(readFileSync('compliance/data-map.yaml', 'utf8')).map(store => store.id));
const state = JSON.parse(readFileSync('terraform-show.json', 'utf8'));
const STORE_TYPES = ['aws_db_instance', 'aws_s3_bucket', 'aws_elasticache_cluster', 'aws_opensearch_domain'];
const unmapped = state.values.root_module.resources
  .filter(resource => STORE_TYPES.includes(resource.type))
  .map(resource => resource.values.tags?.data_map_id ?? resource.address)
  .filter(id => !mapped.has(id));
if (unmapped.length) { console.error(`Stores missing from the data map: ${unmapped.join(', ')}`); process.exit(1); }

import json, sys, yaml

mapped = {store["id"] for store in yaml.safe_load(open("compliance/data-map.yaml"))}
state = json.load(open("terraform-show.json"))
STORE_TYPES = {"aws_db_instance", "aws_s3_bucket", "aws_elasticache_cluster", "aws_opensearch_domain"}
unmapped = [
    (r["values"].get("tags") or {}).get("data_map_id", r["address"])
    for r in state["values"]["root_module"]["resources"] if r["type"] in STORE_TYPES
]
missing = [store_id for store_id in unmapped if store_id not in mapped]
sys.exit(f"Stores missing from the data map: {', '.join(missing)}" if missing else None)

How to check

The build compares the stores defined in infrastructure code and the external hostnames the app calls with the data map. It fails on any store or host missing from the map.