Data Management (DMS) lets you embed a watermark in exported files or extract a watermark from an external file based on your business requirements. Use watermarks to trace data during its spread and distribution, and when a leak is detected, extract the watermark to identify who exported the file and when.
Prerequisites
Before you begin, ensure that you have:
Sensitive data protection enabled for the target database instance. See Enable the sensitive data protection feature.
Watermark types
DMS supports two watermark types with different visibility and use cases:
| Type | Visibility | Description |
|---|---|---|
| Data watermark | Imperceptible to viewers | Identification information is embedded directly into data values, leaving no visible trace |
| File watermark | Visible to viewers | Identification information is embedded as visible markings in the exported file |
The embedded watermark contains the username and the export time. After extracting a watermark, these two fields identify who exported the data and when.
Constraints
For reliable embedding, export more than 200 data entries. Watermark extraction may fail for files with fewer entries.
When extracting a watermark, the file must contain more than 200 data entries.
Embed watermarks
DMS provides two ways to embed watermarks in exported SQL result sets:
Global configuration (recommended): Enable watermarks tenant-wide via Configuration Management. All SQL result set exports within the tenant automatically include a watermark.
Per-ticket configuration: Enable watermarks when creating an individual SQL Result Set Export ticket.
Enable watermarks globally
Global configuration applies watermarks automatically to all SQL result set exports, without requiring individual ticket configuration. The watermark consists of the username and the export time. By default, the exported result sets are Excel files.
After you enable global watermarks, the Embed Watermark parameter is no longer displayed when creating a SQL Result Set Export ticket.
Log on to the DMS console V5.0.
In the top navigation bar, choose O&M > Configuration Management.
In simple mode, move the pointer over the
icon in the upper-left corner and choose All Features > O&M > Configuration Management.Enter a keyword in the search box and click the search icon.

Find the Watermark for Exported SQL Result Sets parameter and click Change in the Actions column.
In the Change Parameter Configuration dialog box, enter Y in the Value field and click Confirm Change.
Embed a watermark when creating a ticket
Use this approach to embed a watermark on a specific export without enabling global watermarks.
Log on to the DMS console V5.0.
In the top navigation bar, choose Database Development > Data Export > SQL Result Set Export.
On the SQL Result Set Export tab, configure the following parameters.
Parameter Required Description Database Name Yes The database from which to export the SQL result set. You must have export permissions for this database. See View owned permissions. Reason Category Yes The reason for this export. Used to locate the ticket in subsequent operations. Business Background Yes The purpose or objective of this export. Reduces unnecessary communication. Affected Rows Yes The estimated number of rows to export. To get the actual count, run COUNTon the SQL statements in SQLConsole. DMS displays the actual number in the Precheck step for your review.Skip Validation No Whether to skip row count validation. If selected, specify the reason. WarningSkipping validation means DMS will not check the number of rows affected. Use with caution for large exports.
Stakeholder No Users who can view the ticket and participate in approval. Users not listed (except DMS administrators and DBAs) cannot access the ticket. Export Statement Yes The SQL statements to execute. Only SELECTstatements are supported. DMS validates syntax on submission.Embed Watermark Yes Whether to embed a watermark in the exported file. Select Yes to enable. Embedding Method Yes How the watermark is embedded. Valid values: Data Watermark (imperceptible to viewers) or File Watermark (visible to viewers). Data Watermark Message or File Watermark Message Yes The identification information to embed as the watermark. Embedded Field No The field into which the watermark is embedded. If left blank, DMS selects a field automatically. Primary key / Unique Key No One or more primary or unique keys, separated by commas (,). Specifying this parameter makes watermark extraction more reliable. Attachments No Images or files that provide additional context for this export. Click Submit. DMS runs a precheck on the SQL statements. Wait for the precheck to complete.
Click Submit for Approval and wait for approval. Track approval progress in the Approval step on the Ticket Details page.
After the ticket is approved, export the file within 24 hours. After this window expires, the ticket can no longer be used and you must create a new SQL Result Set Export ticket.
If the database is managed in Security Collaboration mode, you can adjust this window. Go to the security rule set Details page, click Data Export in the left-side bar, and edit the Period for Performing Export after Export Request of SQL Result Set Is Approved configuration item.
In the Execute/Automatic Execution step, click Export.
In the Export Settings dialog box, configure the following parameters.
Parameter Required Description Format Yes The file format. Valid values: CSV, EXCEL, SQL, JSON. JSON is available only for NoSQL databases. Set this to EXCEL when embedding a watermark. Character Set Yes The character set of the exported file. Valid values: Default Character Set, GBK, UTF-8, ISO-8859-1. Execution Strategy Yes When to export the file. Running immediately starts the export right away. Schedule exports the file at a specified time—useful for off-peak hours. Configurations cannot be changed after selecting Schedule. Export Mode Yes Speed Mode: The export cannot be stopped before it completes. Ordinary Mode: The export can be stopped during execution. Export Time No The timeout period for the export task, in seconds. Valid values: 0 to 2,147,483. If not specified, the instance-level timeout applies. If the task exceeds this period without completing, it fails. See Register an Alibaba Cloud database instance for instance-level timeout settings. Add Field Comment No Available only for MySQL databases with CSV format. When enabled, DMS adds field comments in the row next to the field names. After the file is exported, click Download Exported File to save it to your device.
Extract watermarks
Use watermark extraction to verify whether a file contains an embedded watermark and to retrieve the identification information it contains.
Log on to the DMS console V5.0.
In the top navigation bar, choose Security and Specifications > Data Watermark.
On the Data Watermark tab, click Data Watermark in the upper-right corner to open the Data Watermark Tickets page.
Configure the following parameters.
Parameter Required Description File Type Yes The type of file to extract from. Valid values: CSV, EXCEL. File Yes Click File to upload the file. Only XLSX and CSV files are supported. Business Background Yes The purpose of this extraction. Helps reduce unnecessary communication. Database Name No The database from which the uploaded file was originally exported. Primary key / Unique Key No The same primary or unique keys specified when embedding the watermark. Using the same keys ensures extraction accuracy. Embedded Field No The field into which the watermark was embedded. Click Submit.
After the ticket is approved, click Execute in the Execute/Automatic Execution step.
After execution completes, view the extraction status and the details of the extracted watermark—including the username and export time that were embedded in the file.