POST_START

Performing an Expert Security Rollback for Layered RLS and CLS Controls

I recently encountered a situation where I needed to roll back security controls on a table in Unity Catalog. The table, production.customers.customer_master, was protected by both Row-Level Security (RLS) and Column-Level Security (CLS) policies. My task was to perform a controlled rollback to a previous state, ensuring that all security layers were appropriately adjusted without compromising data integrity or access control.

Understanding the Current Security Configuration

I started by examining the current state of the production.customers.customer_master table. I ran the DESCRIBE TABLE EXTENDED command to gather metadata about the table and its security settings.

DESCRIBE TABLE EXTENDED production.customers.customer_master;

col_name	data_type	comment
customer_id	bigint	customer identifier
customer_name	string	customer display name
region	string	sales region

I noticed that the table included an email column that had been masked, and there was a row filter in place. This indicated that the table was protected at both column and row levels. My next step was to remove these security controls in a controlled manner.

Removing Column-Level Security (CLS) on Email

To begin the rollback, I decided to first address the column-level security on the email column. I executed the ALTER TABLE command to drop the mask from the email column.

ALTER TABLE production.customers.customer_master ALTER COLUMN email DROP MASK;

I verified that the mask had been removed by checking the table’s metadata again. This step was crucial to ensure that the email column was no longer obfuscated, which was necessary for the rollback to be complete.

Removing Row-Level Security (RLS) Filters

Next, I focused on the row-level security filters. I ran the DROP ROW FILTER command to remove the row filter from the table.

ALTER TABLE production.customers.customer_master DROP ROW FILTER;

After executing this command, I rechecked the table’s metadata to confirm that the row-level security had been successfully removed. This was an essential step to ensure that the table was now fully accessible according to the new security configuration.

Verifying the Final State

To ensure that the rollback was complete and that the security controls had been properly removed, I ran the DESCRIBE TABLE EXTENDED command once more.

DESCRIBE TABLE EXTENDED production.customers.customer_master;

col_name	data_type	comment
customer_id	bigint	customer identifier
customer_name	string	customer display name
region	string	sales region

I was satisfied with the results. The table no longer had any column-level or row-level security in place, and the metadata reflected the expected state. This allowed me to proceed with the next phase of the project, which involved re-evaluating access controls based on the new configuration.