The test-data module creates S3 buckets filled with synthetic personal data, so you can check a new deployment against data whose contents you know. Nothing in it is real: the values are checksum-valid but unissued identifiers, or published test values such as test card numbers. Everything it creates is tagged tigergate:purpose = dspm-test-data, tigergate:cleanup = true and tigergate:data = synthetic. terraform destroy removes it all, objects included, and objects also expire on their own after expire_after_days (default 30).
Use it in a test account. Never load real personal data into a test bucket or tenant.

​
Run a test on AWS

1

Deploy the scanner

Follow Deploy on AWS in the same account.
2

Create the test data

module "dspm_test_data" {
  source = "https://releases.tigergate.dev/dspm/<version>/tigergate-dspm-test-data.zip"

  create_kms_bucket     = true                                     # exercise the KMS decrypt path
  denied_principal_arns = [module.tigergate_dspm.scanner_role_arn] # expect access_denied, not clean
}
Then run terraform apply.
3

Run a scan

Select Run now on the deployment, or run the scanner module’s run_now_command.
4

Compare the results

Compare the findings and the classes on the Data page with the module’s expected output and its fixtures/MANIFEST.json, which lists every file with the classes it contains.

​
What it uploads

About 300 files (around 450 KB):
FolderFormatsContent
structured/CSV, TSV, JSON, NDJSON, XML, YAML, SQL, Parquet, Avro, SQLite120 customer records (names, emails, phones, dates of birth, IBANs, test card numbers and a national identifier from about 60 countries), plus every identifier type the dataset has.
documents/DOCX, XLSX, PPTX, PDFAn onboarding letter, a customer sheet, a slide deck and an intake form.
text/<language>/TXTForms and prose per country in 39 languages, OCR text and code snippets.
logs/LOGApplication log lines with identifiers.
archives/ZIP, tar.gz, gzipStructured files inside archives.
negative/TXT, CSVValues shaped like identifiers that must not be reported. A finding here is a false positive.
These objects check that failures are reported as failures:
ObjectExpected result
archived/customers.csv (GLACIER storage class)Unreadable without a restore: reported as an error, never as clean. Set archived_object = false to skip it.
structured/customers.sqliteA format with no reader: reported as not classified, never as clean.
The -denied- bucket (with denied_principal_arns)access_denied for the denied principals.
The -kms- bucket (with create_kms_bucket)Readable through the scanner’s KMS grant.

​
Azure and Google Cloud

The bundle’s test-data/azure and test-data/gcp modules upload the same files to a new storage account and container, or a new Cloud Storage bucket: 
module "dspm_test_data_gcp" {
  source     = "https://releases.tigergate.dev/dspm/<version>/tigergate-dspm-test-data.zip//gcp"
  project_id = "my-test-project"
}

​
Cost and cleanup

A few hundred small objects cost well under a cent a month. The GLACIER object is billed for Glacier’s 90-day minimum, a fraction of a cent. The optional KMS key costs about 1 USD a month until its 7-day deletion window ends. Run terraform destroy when you are done.