DataWorks:Create a data masking scenario

Level-2 scenario constraints

Data development / Data map display desensitization

Masks sensitive data that users query in DataStudio and Data Map, and masks results from the SQL Query feature in DataAnalysis. Applies to MaxCompute and EMR engines.

Usage notes:

• Masking rules take effect only after you enable data masking for the workspace. Exception: EMR engine Data Map masking rules take effect immediately, regardless of the workspace setting.

• The workspace data masking setting is shared between this scenario and the Data analysis and display desensitization scenario. Changing the setting in one also changes it in the other.

• Hologres data is not supported in DataStudio and Data Map masking.

Data analysis and display desensitization

Masks sensitive data in results from the SQL Notes feature in DataAnalysis. Applies to the MaxCompute engine only.

Layer masking of the MaxCompute engine

Masks data at the presentation layer when users query from the MaxCompute command line, the odpscmd client, or Logview. The underlying data in the storage layer is not changed. Applies to the OPS data engine.

This scenario complements application-layer masking — it does not replace it. To activate engine-layer masking for a field, you must also configure a data masking rule for that field. If no rule is configured, the application-layer masking rules apply.

For a practical walkthrough, see Best practices: Use underlying data masking in MaxCompute.

Hologres layer masking

Masks sensitive data when users query Hologres data in DataStudio. Applies to the Hologres engine. Only one level-2 scenario is supported, and you can only edit the default one — creating new level-2 scenarios is not supported.

Static desensitization of data integration

Masks offline data during data integration. Sensitive data is identified and transformed based on the configured rules before it is stored, and the masked result is written to the specified database location. Level-2 scenario configuration is not supported for this scenario.

Prerequisites

Before you begin, ensure that you have one of the roles listed in Access control with permission to add scenarios.

Navigate to Data Masking Management

1. Log on to the DataWorks console. In the top navigation bar, select the target region. In the left-side navigation pane, choose Data Development and O&M > Data Development. Select the target workspace and click Go to Data Development.

2. Click the icon in the upper-left corner, then choose All Products > Data Governance > Data Security Guard. On the page that appears, click Try Now.

   Note

   If your account already has the required permissions, you are taken directly to the Data Security Guard homepage. If not, you are redirected to the authorization page first.

3. In the left navigation pane, click Rule Configuration > Data Masking Management.

4. In the Masking Scene section on the left, click Create Scenario.

Configure the scenario

In the New Data Masking Scenario dialog box, configure the following parameters:

1. Select a primary scenario and name the secondary scenario. Choose a level-1 scenario from the list, then enter a name for the new level-2 scenario. The name can contain any characters and must be 1–30 characters long.

2. Select a data scope. Choose the workspaces to which the scenario applies. The masking rules take effect only for data in the selected workspaces.

3. (Optional) Select a user group scope. To restrict the scenario to specific users, select a user group. If left blank, the scenario applies to all users in the current tenant. For details on setting up user groups, see Configure a user group.

4. Click Confirm.