Dynamic data masking lets you control which database accounts can see sensitive column values without modifying the underlying data. This document explains how to create, enable, disable, modify, and delete data masking rules in the PolarDB console.
Prerequisites
Before you begin, ensure that you have:
A PolarDB proxy version of 2.4.12 or later. To check and upgrade your proxy version, see Minor version update.
Limitations
| Limitation | Details |
|---|---|
| Endpoint scope | Dynamic data masking applies only to cluster endpoints, including default cluster endpoints and customized cluster endpoints. Queries through a primary endpoint are not masked. To view or apply for a cluster endpoint, see View the endpoint and port number. |
| Row size limit | If a query returns masked data and a single row in the result exceeds 16 MB, the query session is closed. For example, if a rule masks the name column in the Person table and the description column contains rows larger than 16 MB, running SELECT name, description FROM person closes the session. |
| Function parameters | If a masked column is used as a function argument, masking is not applied. For example, if a rule masks the name column, SELECT CONCAT(name, '') FROM person still returns the actual value. |
| UNION operator | If a masked column appears in a UNION query, masking is not applied. For example, if a rule masks the name column, SELECT hobby FROM person UNION SELECT name FROM person still returns the actual value. |
Create a data masking rule
Log on to the PolarDB console.
In the upper-left corner, select the region where your cluster is deployed.
Find the cluster and click its ID.
In the left-side navigation pane, choose Settings and Management > Security.
On the Dynamic Data Masking/Encryption tab, click Add in the upper-left corner.
In the Create Rule dialog box, configure the following parameters.
Parameter Required Description Rule Name Yes Name of the masking rule. Maximum length: 30 characters. Description No Description of the rule. Maximum length: 64 characters. Enable/Disable N/A Whether the rule is active. The switch is turned on by default when you create a rule. Endpoint Yes The cluster endpoint to which the rule applies. Database Account Name No The database accounts the rule applies to. Options: All Accounts (leave the text box blank), Include (specify accounts), or Exclude (exclude specified accounts). Separate multiple account names with commas (,). Account names support the following formats: user,user@10.1.1.1,user@10.1.1.%,user@%.1.1.1,user@1.%.1, oruser@10.1.1.0/255.255.255.0.Database Name No The databases the rule applies to. Options: All Databases (leave the text box blank) or Include (specify databases). Separate multiple database names with commas (,). Table Name No The tables the rule applies to. Options: All tables (leave the text box blank) or Include (specify tables). Separate multiple table names with commas (,). Column Name Yes The columns to mask. Separate multiple column names with commas (,). Click OK.
Enable or disable a data masking rule
Log on to the PolarDB console.
In the upper-left corner, select the region where your cluster is deployed.
Find the cluster and click its ID.
In the left-side navigation pane, choose Settings and Management > Security.
On the Dynamic Data Masking/Encryption tab, find the rule and turn the Enable/Disable switch on or off.
To enable or disable multiple rules at once, select them in the list and click Enable or Disable at the bottom of the list. Disabled rules are not deleted and can be re-enabled at any time.
In the message that appears, click OK.
Modify a data masking rule
Log on to the PolarDB console.
In the upper-left corner, select the region where your cluster is deployed.
Find the cluster and click its ID.
In the left-side navigation pane, choose Settings and Management > Security.
On the Dynamic Data Masking/Encryption tab, find the rule and click Modify in the Actions column.
You can modify the Description and all parameters in the Configurations section. The Rule Name cannot be changed after the rule is created. For more information about the parameters, see Configure data masking rule parameters.
Update the parameters, then click OK.
Delete a data masking rule
Log on to the PolarDB console.
In the upper-left corner, select the region where your cluster is deployed.
Find the cluster and click its ID.
In the left-side navigation pane, choose Settings and Management > Security.
On the Dynamic Data Masking/Encryption tab, find the rule and click Delete in the Actions column.
To delete multiple rules at once, select them in the list and click Delete at the bottom of the list.
In the message that appears, click OK.
API reference
| Operation | Description |
|---|---|
| DescribeMaskingRules | Queries the data masking rules for a PolarDB cluster or the details of a specified rule. |
| ModifyMaskingRules | Modifies or adds a data masking rule. |
| DeleteMaskingRules | Deletes a data masking rule. |