Masking Policy

You can provide configuration to Snowflake Object Lifecycle Engine for the following operations with masking policy:

Manage the lifecycle of new and existing masking policies
Manage grants of masking policy

Usage

note

We have introduced SOLE for Data Products as a new framework for SOLE to help you easily build an ecosystem of data products. The major difference is in how you define Snowflake objects in the configuration file. Rather than having a grouped collection of objects, SOLE for Data Products goes for modular, self-describing, and explicit object definition.
Learn more about SOLE for Data Products, currently available as a private preview.

We have also introduced Data products as an extra layer on top of the data product platform capabilities making managing data products easier than ever. Learn more about Data Products, currently available as a private preview.

Default Configuration
Data Products Configuration

databases:
  <database-name>:
    schemas:
      <schema-name>:
        masking_policies:
          <masking-policy-name>:
            <configuration-key>: <value>
            grants:
              <privilege>:
                - <role-name>
                - <role-name>

- masking_policy:
    name: <masking-policy-name>
    database: rel(database.<database-name>)
    schema: rel(schema.<schema-name>)
    grants:
      <privilege>:
        - rel(role.<grant-name>)
        - rel(role.<grant-name>)

Supported parameters

The engine supports the parameters listed below.

Configuration Key	Required/Optional	Data Types and Values	Description
`masking_expression`	Required	String	Specifies the SQL expression that transforms the data
`return_data_type`	Required	String	Specifies the data type to return
`value_data_type`	Required	String	Specifies the data type to mask
`comment`	Optional	String	Specifies a comment for the masking policy
`deleted`	Optional	Boolean: `True` enables deletion prevention, `False` does nothing	Specifies what objects are allowed to be deleted
`grants`	Optional	Map: See Supported Masking Policy Grants to Roles	Lists Privileges and Roles to which privileges are granted on the current masking policy
`manage_mode`	Optional	String: `all` (default), `none`, `grants`	Configures what properties to manage for the masking policy. See Changing Manage Mode before changing the value.

Supported masking policy grants to roles

Following are the privileges you can grant to roles in the masking policy definition:

ALL PRIVILEGES
APPLY

ALL PRIVILEGES handling

When you define ALL PRIVILEGES in the SOLE configuration file, you grant all the privileges listed above to roles on this object. However, the management of ALL PRIVILEGES in SOLE differs from its handling in Snowflake. See Handling ALL PRIVILEGES in SOLE for more information.

Examples

Masking policy with masking expression in a single line

Default Configuration
Data Products Configuration

databases:
  SALES_RECORD:
    schemas:
      SALES:
        masking_policies:
          MASK_NUMBER:
            comment: "Number Masking Policy"
            value_data_type: NUMBER
            return_data_type: "NUMBER(38,0)"
            masking_expression: "CASE WHEN current_role() IN ('ACCOUNTADMIN') THEN val ELSE null END"

- masking_policy:
    name: MASK_NUMBER
    database: rel(database.SALES_RECORD)
    schema: rel(schema.SALES)
    comment: "Number Masking Policy"
    value_data_type: NUMBER
    return_data_type: "NUMBER(38,0)"
    masking_expression: "CASE WHEN current_role() IN ('ACCOUNTADMIN') THEN val ELSE null END"

Masking policy with masking expression in multiple lines

Default Configuration
Data Products Configuration

databases:
  SALES_RECORD:
    schemas:
      SALES:
        masking_policies:
          MASK_STRING:
            comment: "String Masking Policy"
            value_data_type: VARCHAR
            return_data_type: VARCHAR(16777216)
            masking_expression: >-
              CASE 
                WHEN current_role() IN ('ACCOUNTADMIN') THEN val 
                ELSE '*******' 
              END

- masking_policy:
    name: MASK_NUMBER
    database: rel(database.SALES_RECORD)
    schema: rel(schema.SALES)
    comment: "String Masking Policy"
    value_data_type: VARCHAR
    return_data_type: VARCHAR(16777216)
    masking_expression: >-
      CASE
        WHEN current_role() IN ('ACCOUNTADMIN') THEN val
        ELSE '*******'
      END

Usage​

Supported parameters​

Supported masking policy grants to roles​

Examples​

Masking policy with masking expression in a single line​

Masking policy with masking expression in multiple lines​