-
Notifications
You must be signed in to change notification settings - Fork 420
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: masking policy application resource (#1739)
* Sort resources and datasources. * Render qualified names with double quotes. * Add qualified_name computed field to table resource. * Add table column masking policy manager. * Add table column masking policy application resource.
- Loading branch information
1 parent
338a19d
commit ce80f57
Showing
12 changed files
with
590 additions
and
61 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| --- | ||
| page_title: "snowflake_table_column_masking_policy_application Resource - terraform-provider-snowflake" | ||
| subcategory: "" | ||
| description: |- | ||
| Applies a masking policy to a table column. | ||
| --- | ||
|
|
||
| # snowflake_table_column_masking_policy_application (Resource) | ||
|
|
||
| Applies a masking policy to a table column. | ||
|
|
||
| Only one masking policy may be applied per table column, hence only one `snowflake_table_column_masking_policy_application` resources may be present per table column. | ||
| Using two or more `snowflake_table_column_masking_policy_application` resources for the same table column will result in the last one overriding any previously applied masking policies and unresolvable diffs in Terraform plan. | ||
|
|
||
| When using this resource to manage a table column's masking policy make sure to ignore changes to the column's masking policy in the table definition, otherwise the two resources would conflict. See example below. | ||
|
|
||
| ## Example Usage | ||
|
|
||
| ```terraform | ||
| # Default provider for most resources | ||
| provider "snowflake" { | ||
| role = "SYSADMIN" | ||
| } | ||
| # Alternative provider with masking_admin role | ||
| provider "snowflake" { | ||
| alias = "masking" | ||
| role = "MASKING_ADMIN" | ||
| } | ||
| resource "snowflake_masking_policy" "policy" { | ||
| provider = snowflake.masking # Create masking policy with masking_admin role | ||
| name = "EXAMPLE_MASKING_POLICY" | ||
| database = "EXAMPLE_DB" | ||
| schema = "EXAMPLE_SCHEMA" | ||
| value_data_type = "VARCHAR" | ||
| masking_expression = "case when current_role() in ('ANALYST') then val else sha2(val, 512) end" | ||
| return_data_type = "VARCHAR" | ||
| } | ||
| # Table is created by the default provider | ||
| resource "snowflake_table" "table" { | ||
| database = "EXAMPLE_DB" | ||
| schema = "EXAMPLE_SCHEMA" | ||
| name = "table" | ||
| column { | ||
| name = "secret" | ||
| type = "VARCHAR(16777216)" | ||
| } | ||
| lifecycle { | ||
| # Masking policy is managed by a standalone resource and shouldn't be changed by the table resource. | ||
| ignore_changes = [column[0].masking_policy] | ||
| } | ||
| } | ||
| resource "snowflake_table_column_masking_view_application" "application" { | ||
| provider = snowflake.masking # Apply masking policy with masking_admin role | ||
| table = snowflake_table.table.qualified_name | ||
| column = "age" | ||
| masking_policy = snowflake_masking_policy.policy.qualified_name | ||
| } | ||
| ``` | ||
|
|
||
| <!-- schema generated by tfplugindocs --> | ||
| ## Schema | ||
|
|
||
| ### Required | ||
|
|
||
| - `column` (String) The column to apply the masking policy to. | ||
| - `masking_policy` (String) Fully qualified name (`database.schema.policyname`) of the policy to apply. | ||
| - `table` (String) The fully qualified name (`database.schema.table`) of the table to apply the masking policy to. | ||
|
|
||
| ### Read-Only | ||
|
|
||
| - `id` (String) The ID of this resource. |
46 changes: 46 additions & 0 deletions
46
examples/resources/snowflake_table_column_masking_policy_application/resource.tf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| # Default provider for most resources | ||
| provider "snowflake" { | ||
| role = "SYSADMIN" | ||
| } | ||
|
|
||
| # Alternative provider with masking_admin role | ||
| provider "snowflake" { | ||
| alias = "masking" | ||
| role = "MASKING_ADMIN" | ||
| } | ||
|
|
||
| resource "snowflake_masking_policy" "policy" { | ||
| provider = snowflake.masking # Create masking policy with masking_admin role | ||
|
|
||
| name = "EXAMPLE_MASKING_POLICY" | ||
| database = "EXAMPLE_DB" | ||
| schema = "EXAMPLE_SCHEMA" | ||
| value_data_type = "VARCHAR" | ||
| masking_expression = "case when current_role() in ('ANALYST') then val else sha2(val, 512) end" | ||
| return_data_type = "VARCHAR" | ||
| } | ||
|
|
||
| # Table is created by the default provider | ||
| resource "snowflake_table" "table" { | ||
| database = "EXAMPLE_DB" | ||
| schema = "EXAMPLE_SCHEMA" | ||
| name = "table" | ||
|
|
||
| column { | ||
| name = "secret" | ||
| type = "VARCHAR(16777216)" | ||
| } | ||
|
|
||
| lifecycle { | ||
| # Masking policy is managed by a standalone resource and shouldn't be changed by the table resource. | ||
| ignore_changes = [column[0].masking_policy] | ||
| } | ||
| } | ||
|
|
||
| resource "snowflake_table_column_masking_view_application" "application" { | ||
| provider = snowflake.masking # Apply masking policy with masking_admin role | ||
|
|
||
| table = snowflake_table.table.qualified_name | ||
| column = "age" | ||
| masking_policy = snowflake_masking_policy.policy.qualified_name | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.