Snowflake: Tag-Based Masking Policies

Atlas now manages tag-based masking on Snowflake: set masking policies on a tag, and every column that carries the tag is masked by the policy for its data type.

Atlas now manages Snowflake tag-based masking, the policies set on a tag with ALTER TAG ... SET MASKING POLICY. List them in the tag block's masking_policies attribute. Snowflake then masks every column that carries the tag with the policy for the column's data type, without a policy on each column.

Set a Masking Policy on a Tag

Declare the masking_policy and reference it from the tag:

schema "PUBLIC" {}
masking_policy "MASK_SSN" {  schema = schema.PUBLIC  arg "VAL" {    type = VARCHAR  }  return = VARCHAR  as     = "'***'"}
tag "PII" {  schema           = schema.PUBLIC  masking_policies = [masking_policy.MASK_SSN]}

Atlas creates both objects first, then sets the policy on the tag in a statement of its own:

-- Create masking policy "MASK_SSN"CREATE MASKING POLICY "MASK_SSN" AS ("VAL" VARCHAR) RETURNS VARCHAR -> '***' EXEMPT_OTHER_POLICIES = FALSE;-- Create tag "PII"CREATE TAG "PII";-- Modify tag "PII"ALTER TAG "PII" SET MASKING POLICY "MASK_SSN";

Tag a column as before. Snowflake masks it with MASK_SSN, as the column is a string:

table "CUSTOMERS" {  schema = schema.PUBLIC  column "SSN" {    type = VARCHAR(11)    tag {      ref   = tag.PII      value = "ssn"    }  }}

Swap a Policy

Snowflake allows one masking policy per data type on a tag. To swap MASK_SSN for a new policy of the same type, change the list:

tag "PII" {  schema           = schema.PUBLIC  masking_policies = [masking_policy.MASK_SSN_V2]}

Atlas swaps them in one FORCE statement, so the tagged columns are never left unmasked:

-- Create masking policy "MASK_SSN_V2"CREATE MASKING POLICY "MASK_SSN_V2" AS ("VAL" VARCHAR) RETURNS VARCHAR -> '***' EXEMPT_OTHER_POLICIES = FALSE;-- Modify tag "PII"ALTER TAG "PII" SET MASKING POLICY "MASK_SSN_V2" FORCE;

Remove a Policy or a Tag

Snowflake refuses to drop a tag or a masking policy while the policy is set on the tag. Remove them from the schema, and Atlas unsets the policy before it drops either one:

-- Modify tag "PII"ALTER TAG "PII" UNSET MASKING POLICY "MASK_SSN_V2";-- Drop masking policy "MASK_SSN_V2"DROP MASKING POLICY "MASK_SSN_V2";-- Drop tag "PII"DROP TAG "PII";

A masking policy body can query a table whose columns carry the same tag, such as a mapping table. Atlas creates the table and the policy before it sets the policy on the tag.

Getting Started

Turn on both policies and tags in the mode "snowflake" block of your env. Without both, Atlas does not read the policies set on a tag. The examples above use a schema-scoped URL, so their statements carry no schema name:

env "prod" {  // Schema scope: snowflake://<user>@<account>/DEMO_DB/PUBLIC?warehouse=DEMO_WH  url = getenv("SNOWFLAKE_URL")  // The same scope on an empty database: .../DEMO_DEV_DB/PUBLIC  dev = getenv("SNOWFLAKE_DEV_URL")  schema {    src = "file://schema.sf.hcl"    mode "snowflake" {      policies = true      tags     = true    }  }}

Snowflake support is part of Atlas Pro. Run atlas login to get started.