The sensitive data access feature records every access to sensitive data, including operation time, operator, and operation content. Security administrators can use these records to evaluate and track each access event, ensuring that data access activities comply with your organization's security policies and compliance requirements.
Limitations
-
Applicable users: This feature is available in DataWorks Standard, Professional, and Enterprise editions for users with the new data security features enabled in Security Center.
-
Supported regions: China (Hangzhou), China (Shanghai), China (Beijing), China (Zhangjiakou), China (Ulanqab), China (Shenzhen), China (Chengdu), China (Hong Kong), Japan (Tokyo), Singapore, and Indonesia (Jakarta).
-
Supported compute engines: MaxCompute and Hologres.
Prerequisites
-
The account used to log on to DataWorks must have one of the following permissions or roles:
An account granted the AliyunDataWorksFullAccess policy.
An account assigned the DataWorks tenant security administrator role.
An account assigned the DataWorks tenant administrator role.
-
You have completed the instructions in Getting started.
Supported engines and latency
Sensitive data refers to the data identified by detection tasks in .
The Sensitive Data Access page provides tabs at the top for viewing access records of different data engines. The latency for each engine is as follows:
|
Data engine |
Latency |
|
MaxCompute |
T+1 |
|
Hologres |
T+2 |
|
EMR Hive |
Near real-time |
|
DLF |
Near real-time |
|
DLF Legacy |
Near real-time |
|
StarRocks |
Near real-time |
View sensitive data access
-
Log on to the DataWorks console. In the target region, click in the left-side navigation pane. On the page that appears, click Go to Security Center.
-
In the left-side navigation pane, choose .
-
At the top of the page, select the tab for the engine that you want to view.
-
Filter records as needed:
-
In the filter area at the top of the page, you can filter by the following criteria:
-
Operation object: Select the operation object in order of the engine hierarchy. For example: for MaxCompute, select project, table, and column; for Hologres, select instance, database, table, and column; for EMR Hive, select instance, table, and column; for DLF, select catalog, database, table, and column.
-
Involving data types: Perform a fuzzy search by sensitive data type name.
-
Operation time: Filter by the time range in which the access occurred.
-
-
Click the filter icon in the column header to further filter by Operator, Operation type, and Type of behavior.
-
-
View the access record list. The field descriptions are as follows:
Field
Description
Time
The date and time when the operator accessed the sensitive data.
Operator
The account used by the operator in the event, such as the logon account or the RAM user or Alibaba Cloud account specified as the default access identity for the data source.
Operation object
The sensitive data resource (such as project, table, or column) accessed in the event. The specific hierarchy depends on the selected engine.
Operation type
The type of operation performed by the operator on the sensitive data.
Involving data types
The types of sensitive data included in the access event.
Type of behavior
Valid values: System behavior and User Behavior. Data sampling performed during a sensitive data identification task is a System behavior.
Actions
Click Details to view details of the access record. For field descriptions, see View access record details below.
View access record details
In the sensitive data access list, click Details in the row of the target record to open the Sensitive Data Access Record Details dialog box and view the following fields:
-
Time: The date and time when the operator accessed the sensitive data.
-
Operator: The account information used by the operator.
-
Operation type: The type of operation performed by the operator on the sensitive data.
-
Operation content: The specific SQL statement executed by the operator.
The Sensitive data involved sub-table lists details of the sensitive data accessed in the operation:
|
Field |
Description |
|
Field Name |
The name of the column where the accessed sensitive data resides. |
|
Table Name |
The name of the table where the accessed sensitive data resides. |
|
Data type |
The name of the sensitive data type corresponding to the column. |
|
Engine type |
The engine to which the sensitive data belongs. |
Export sensitive data access records
Export filtered sensitive data access records to a file for offline archiving or analysis.
-
After you set the filter conditions, click Export in the upper-right corner of the page.
-
In the Create Export Task dialog box that appears, confirm the information and click Create. The system creates an export task based on the current filter conditions.
-
Click Export Tasks in the upper-right corner of the page. In the drawer that opens, view the export task status and download the export file.