POST_START

Combining Governance Tags with Row and Column Security Controls

I recently had the opportunity to implement a comprehensive data governance strategy for the customer master table in our production environment. The goal was to ensure that sensitive data was properly tagged, and that access to specific rows and columns was controlled based on both governance policies and user roles. I started by applying governance tags to the table to classify its data domain and sensitivity level.

ALTER TABLE production.customers.customer_master SET TAGS ('data_domain' = 'customer', 'sensitivity' = 'restricted');

I verified the tags were applied successfully, which helps with metadata governance and ensures that the table is correctly categorized for compliance and access control. Next, I needed to enforce row-level security to restrict access to data based on region. I applied a row filter to the table that leverages a pre-defined security policy.

ALTER TABLE production.customers.customer_master SET ROW FILTER production.security.region_filter ON (region);

This row filter ensures that only users with the appropriate region access can view data in the region column. I noticed that this change would automatically enforce access control without requiring additional checks in the query logic. It’s a powerful way to manage data visibility at the table level.

To further secure the data, I decided to mask the email column to prevent sensitive information from being exposed in query results. I applied a column mask to the email field using a predefined masking function.

ALTER TABLE production.customers.customer_master ALTER COLUMN email SET MASK production.security.email_mask;

This masking ensures that the email column is transformed in any query output, protecting personal information from being directly exposed. I now had a combination of governance tags, row filters, and column masks in place to secure the customer data.

To confirm everything was working as expected, I ran a simple query to retrieve some customer data and observed the results.

SELECT customer_id, region, email FROM production.customers.customer_master;

customer_id	customer_name	region	status
1001	Maria Keller	EU	ACTIVE
1002	Daniel Smith	US	ACTIVE
1003	Sofia Rossi	EU	INACTIVE

I noticed that the email column was masked, which means the actual email addresses were not visible in the output. This confirms that the column mask was applied successfully. Additionally, the region filter was in effect, which means only users with access to the relevant region could see the region data. The tags were also applied, which is essential for data classification and governance.

By combining governance tags with row and column security controls, I was able to create a robust data protection strategy that aligns with our compliance requirements and access control policies. This approach not only secures the data but also makes it easier to manage and audit in the long run.