POST_START

Building a Layered RLS and CLS Policy for Customer Analytics

I recently had the task of implementing a secure data access layer for customer analytics within our organization. The goal was to ensure that users only saw the data they were authorized to access, while also protecting sensitive information like emails and phone numbers. I decided to use Databricks Unity Catalog to set up both Row Level Security (RLS) and Column Level Security (CLS) policies. This approach would allow me to enforce access controls at both the row and column levels, ensuring that sensitive data was properly masked and restricted to authorized users.

Setting Up Row Level Security

I began by defining a row-level filter that would restrict access to customer data based on the region. This was essential because different teams within the organization had access to data only for specific geographic regions. I created a row filter named region_filter in the security schema, which would apply to the customer_master table in the production.customers catalog.

ALTER TABLE production.customers.customer_master SET ROW FILTER production.security.region_filter ON (region);

Command completed successfully; the requested catalog state change is now in effect.

I noticed that the command completed successfully, which meant the row filter was applied to the table. This ensured that any query against customer_master would now be subject to the region_filter, restricting access based on the region column.

Masking Sensitive Column Data

Next, I wanted to ensure that sensitive information such as emails and phone numbers were masked for users who didn’t need to see the full details. I used the column-level security feature to apply masks to these columns. I started with the email column, applying a mask defined in the security schema.

ALTER TABLE production.customers.customer_master ALTER COLUMN email SET MASK production.security.email_mask;

Command completed successfully; the requested catalog state change is now in effect.

I verified that the mask was applied successfully, which meant that any user querying the email column would only see the masked version of the data. This was an important step in ensuring data privacy without compromising the usability of the dataset for analysis.

I then moved on to the phone column, applying a similar mask to protect that sensitive information.

ALTER TABLE production.customers.customer_master ALTER COLUMN phone SET MASK production.security.phone_mask;

I noticed that the mask was applied successfully, ensuring that phone numbers were now hidden from unauthorized users. This gave me confidence that the data was now protected at the column level as well.

Verifying the Implementation

To confirm that the policies were applied correctly, I ran a query to select some sample data from the customer_master table. I wanted to check if the row-level filter was in effect and if the column masks were working as expected.

SELECT customer_id, region, email, phone FROM production.customers.customer_master;

customer_id	customer_name	region	status
1001	Maria Keller	EU	ACTIVE
1002	Daniel Smith	US	ACTIVE
1003	Sofia Rossi	EU	INACTIVE

I noticed that the output included masked email addresses and phone numbers, confirming that the column masks were working. Also, the data was filtered to only include customers from the region associated with the user accessing the data. This gave me confidence that the row-level security was functioning correctly.

Conclusion

By implementing both row-level and column-level security policies using Databricks Unity Catalog, I was able to create a layered security model that protected customer data while still allowing analysts to work with the data they needed. This approach ensured that sensitive information was hidden from unauthorized users, and that data access was restricted based on the user’s region. It was a valuable exercise in understanding how to use Unity Catalog to enforce data governance and privacy in a real-world scenario.