Masking Policy

You can provide configuration to Snowflake Object Lifecycle Engine for the following operations with masking policy:

• Manage the lifecycle of new and existing masking policies
• Manage grants of masking policy

Usage

Classic Configuration

databases:
  <database-name>:
    schemas:
      <schema-name>:
        masking_policies:
          <masking-policy-name>:
            <configuration-key>: <value>
            grants:
              <privilege>:
                - <role-name>
                - <role-name>

Data Products Configuration

- masking_policy:
    name: <masking-policy-name>
    database: rel(database.<database-name>)
    schema: rel(schema.<schema-name>)
    grants:
      <privilege>:
        - rel(role.<grant-name>)
        - rel(role.<grant-name>)

Supported parameters

The engine supports the parameters listed below.

Configuration Key	Required/Optional	Data Types and Values	Description
masking_expression	Required	String	Specifies the SQL expression that transforms the data
return_data_type	Required	String	Specifies the data type to return
arguments	Required	Object	The signature for the masking policy; Specifies the input columns and data types to evaluate at query runtime
comment	Optional	String	Specifies a comment for the masking policy
deleted	Optional	Boolean: True enables deletion prevention, False does nothing	Specifies what objects are allowed to be deleted
grants	Optional	Map: See Supported Masking Policy Grants to Roles	Lists Privileges and Roles to which privileges are granted on the current masking policy
manage_mode	Optional	String: all (default), none, grants	Configures what properties to manage for the masking policy. See Changing Manage Mode before changing the value.

Supported masking policy grants to roles

Following are the privileges you can grant to roles in the masking policy definition:

• ALL PRIVILEGES
• APPLY

ALL PRIVILEGES handling

When you define ALL PRIVILEGES in the SOLE configuration file, you grant all the privileges listed above to roles on this object. However, the management of ALL PRIVILEGES in SOLE differs from its handling in Snowflake. See Handling ALL PRIVILEGES in SOLE for more information.

Examples

Masking policy with masking expression in a single line

Classic Configuration

databases:
  SALES_RECORD:
    schemas:
      SALES:
        masking_policies:
          MASK_NUMBER:
            comment: "Number Masking Policy"
            arguments:
              VAL:
                type: NUMBER
            return_data_type: "NUMBER(38,0)"
            masking_expression: "CASE WHEN current_role() IN ('ACCOUNTADMIN') THEN val ELSE null END"

Data Products Configuration

- masking_policy:
    name: MASK_NUMBER
    database: rel(database.SALES_RECORD)
    schema: rel(schema.SALES)
    comment: "Number Masking Policy"
    arguments:
      VAL:
        type: NUMBER
    return_data_type: "NUMBER(38,0)"
    masking_expression: "CASE WHEN current_role() IN ('ACCOUNTADMIN') THEN val ELSE null END"

Masking policy with masking expression in multiple lines

Classic Configuration

databases:
  SALES_RECORD:
    schemas:
      SALES:
        masking_policies:
          MASK_STRING:
            comment: "String Masking Policy"
            arguments:
              VAL:
                type: VARCHAR
            return_data_type: VARCHAR(16777216)
            masking_expression: >-
              CASE 
                WHEN current_role() IN ('ACCOUNTADMIN') THEN val 
                ELSE '*******' 
              END

Data Products Configuration

- masking_policy:
    name: MASK_NUMBER
    database: rel(database.SALES_RECORD)
    schema: rel(schema.SALES)
    comment: "String Masking Policy"
    arguments:
      VAL:
        type: VARCHAR
    return_data_type: VARCHAR(16777216)
    masking_expression: >-
      CASE
        WHEN current_role() IN ('ACCOUNTADMIN') THEN val
        ELSE '*******'
      END