POST_START

Auditing Security Function Ownership Used by Column Masks

I recently had to audit the security function ownership used by column masks in our Databricks Unity Catalog environment. The goal was to ensure that the functions used for data masking were properly secured and that only authorized users had access to them. I started by looking at the `production.security.mask_email` function, which is used to mask email addresses in our sensitive data.

I ran the `DESCRIBE FUNCTION EXTENDED` command to get a detailed description of the function and its input columns.

DESCRIBE FUNCTION EXTENDED production.security.mask_email;

I saw a representative result like this:

col_name         | data_type | comment
-----------------|----------|--------
customer_id      | bigint    | customer identifier
customer_name    | string    | customer display name
region           | string    | sales region

This showed me the columns that the `mask_email` function operates on. It was clear that the function was designed to work with customer data, and it was likely part of a broader data masking strategy to protect sensitive information.

Next, I wanted to check who had access to the function, as this is crucial for security auditing. I used the `SHOW GRANTS ON FUNCTION` command to see the permissions assigned to the `production.security.mask_email` function.

SHOW GRANTS ON FUNCTION production.security.mask_email;

I saw a representative result like this:

principal         | actionType | objectType
------------------|-----------|------------
data_analysts     | SELECT     | TABLE
data_engineers    | MODIFY     | TABLE

This output told me that the `data_analysts` group had SELECT access to the tables, while the `data_engineers` group had MODIFY access. It was important to note that the function itself was not directly granted permissions, but the tables it operated on were. This meant that the function’s usage was tied to the table-level access controls.

I verified that the function’s usage was consistent with the access controls in place. Since the function was used as part of a column mask, the security model needed to ensure that only authorized users could invoke it. I realized that while the function itself wasn’t a security object, its usage was subject to the permissions on the tables it operated on.

I concluded that the function’s security context was dependent on the underlying table access. This meant that any changes to the function’s usage or the table’s permissions would have a direct impact on who could apply the column mask. This was a critical point for maintaining data privacy and ensuring compliance with our internal data governance policies.