See why hundreds of industry leaders trust Secoda to unlock their data's full potential.
See why hundreds of industry leaders trust Secoda to unlock their data's full potential.
Get the guideA masking policy in Snowflake is a robust security feature available in the Enterprise Edition or higher. It allows the creation, management, and application of rules to mask or tokenize sensitive data in table columns or views. This feature ensures that sensitive data is protected and only accessible based on predefined roles and conditions.
CREATE [ OR REPLACE ] MASKING POLICY [ IF NOT EXISTS ] <name>
AS ( <arg_name_to_mask> <arg_type_to_mask> [ , <arg_1> <arg_type_1> ... ] )
RETURNS <arg_type_to_mask> -> <body>
[ COMMENT = '<string_literal>' ]
[ EXEMPT_OTHER_POLICIES = { TRUE | FALSE } ]
This code snippet demonstrates the syntax for creating a masking policy in Snowflake. The policy defines rules and conditions under which data should be masked, ensuring sensitive information is protected.
Creating a masking policy involves defining rules and conditions under which data should be masked. The syntax for creating a masking policy is as follows:
CREATE OR REPLACE MASKING POLICY email_mask
AS (val string)
RETURNS string ->
CASE
WHEN current_role() IN ('ANALYST') THEN val
ELSE '*********'
END;
This example shows a masking policy that displays plain-text for the 'ANALYST' role and a masked value for others.
To create and manage masking policies, specific privileges are required:
To see the current definition of an existing masking policy, use the GET_DDL function or DESCRIBE MASKING POLICY command. It's essential to centralize mapping tables in the same database as the protected table. Notably, a column can be specified in either a masking policy or a row access policy, but not both simultaneously.
Tag-based masking policies allow users to combine tagging and masking policies, setting them at the TAG level using the ALTER command.
CREATE TAG sensitive_data;
CREATE MASKING POLICY email_mask AS (val string) RETURNS string -> CASE WHEN current_role() IN ('ANALYST') THEN val ELSE '*********' END;
ALTER TAG sensitive_data SET MASKING POLICY email_mask;
ALTER TABLE employee SET TAG sensitive_data;
This example demonstrates creating a tag, a masking policy, and assigning the policy to the tag and the tag to a table.
Follow these steps to implement tag-based masking policies:
CREATE TAG command.CREATE MASKING POLICY statement.ALTER command.ALTER command.INFORMATION_SCHEMA to validate the application of masking policies.Built for data teams, designed for everyone so you can get more from your data stack.
© 2024 Secoda, Inc. All rights reserved.
By using this website, you accept our Terms of Use and Privacy Policy.
