Solved. The parens in the

Name

tag are invalid, at least in some contexts. They’re allowed on EC2 tag names, for example. Still odd that Pulumi marks the bucket as updated. It also doesn’t add the tag. https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/allocation-tag-restrictions.html