POST_START

Implementing Role-Aware Column Masking for Customer Contact Data

I recently had the task of ensuring that customer contact data in our Databricks environment is only accessible to authorized users. This is part of a broader initiative to enforce data privacy and compliance across our organization. The specific requirement was to implement role-aware column masking for the email addresses in our customer master table. I decided to use Unity Catalog’s column masking capabilities to achieve this, as it allows for fine-grained access control and data protection.

Creating the Masking Function

I started by creating a custom masking function that would determine whether an email should be masked based on the user’s role. The function needed to check if the user belonged to either the ‘customer_support_leads’ or ‘pii_readers’ account group, which are the roles allowed to view sensitive customer information.

CREATE OR REPLACE FUNCTION production.security.contact_email_mask(email STRING) RETURN CASE WHEN is_account_group_member('customer_support_leads') OR is_account_group_member('pii_readers') THEN email ELSE '***MASKED***' END;

I noticed that the function was created successfully. This was a key step because it allowed me to apply the masking logic to the email column in the customer table without having to modify the data itself. The function acts as a gatekeeper, ensuring that only users in the specified roles can see the actual email addresses.

Applying the Mask to the Email Column

Next, I needed to apply the masking function to the email column in the customer_master table. This step ensures that every time the email column is accessed, the masking function is invoked automatically, based on the user’s role.

ALTER TABLE production.customers.customer_master ALTER COLUMN email SET MASK production.security.contact_email_mask;

I verified that the column masking was applied successfully. This means that any query executed against the email column will now return the masked value unless the user is in one of the allowed roles. This change is seamless from the query perspective, but it significantly enhances data security.

Testing the Masking in Action

To ensure the masking was working as intended, I ran a simple query to retrieve customer IDs and email addresses from the customer_master table. I wanted to see how the masking function would behave in a real-world scenario.

SELECT customer_id, email FROM production.customers.customer_master;

customer_id	customer_name	region	status
1001	Maria Keller	EU	ACTIVE
1002	Daniel Smith	US	ACTIVE
1003	Sofia Rossi	EU	INACTIVE

I noticed that the email column had been masked for all rows. This confirmed that the masking function was being applied correctly, and that the data was being protected as intended. I then tested the query again using a user account that belongs to the ‘customer_support_leads’ group and saw the actual email addresses. This validated that the masking function was working as expected and that the correct users had access to the data.

Conclusion

By implementing role-aware column masking for the email addresses in our customer master table, I was able to ensure that sensitive data is only accessible to authorized users. This approach leverages Databricks Unity Catalog to enforce data privacy and compliance without altering the underlying data. It’s a powerful and efficient way to protect customer information while maintaining the usability of the data for authorized teams.