If you run the same Pulumi program twice, and LakeFormation itself doesn't do any weird stuff to the generated tags after deployment, that is probably a bug and you should report it here: https://github.com/pulumi/pulumi-aws/issues
You may be able to use