Masking Policies for Snowflake

Organizations face an immense challenge in adhering to policy enforcements issued by governance councils and using data responsibly for their business needs. Translating those documented policies all the way to data controls on the warehouses where data is consumed is a complex and dynamic task. OneTrust's Policy Orchestration solution helps data teams institute a methodology for orchestrating policy enforcement to monitor and take action on policy violations with confidence.

This article captures how data governance teams using Snowflake data warehouses can leverage OneTrust to mask data at the data source level and ensure only authorized users can view sensitive data. This is achieved by:

• Setting up a data source connection to Snowflake via a worker node

• Configuring a data policy with conditions to identify sensitive data that is unmasked

• Customizing and applying policy actions to mask (or unmask) data for select user groups

1. On the Data Discovery menu, select Setup > Data Sources. The Data Sources screen appears.

2. Click the Add Data Source button. The Data Discovery Gallery screen appears.

3. Select the Snowflake tile. The Establish Connection screen appears.

4. In the first section, choose an existing worker node.

   Note:

   For more information on creating and deploying a worker node, see Guided Worker Node Installation Overview.

   
   
   

5. In the second section, provide, you can create new data source credentials or choose from existing Snowflake credentials.

   Tip:

   Credentials can also be changed post setup in the Settings tab on the Data Source Details screen.

   
   
   

6. If creating new credentials, provide information for the fields:

   
   
   

   Field

   Description

   Credential name

   Provide a unique name for this credential.

   Description

   Provide a meaningful description of the credential's intended use and purpose.

   Reference key

   Define the path to save or locate the securely stored credentials within the vault, ensuring efficient and protected access to your data source.

   Example format: "/path/<key-name>"

   Standard: Key-Value Pair

   Input the credentials as key-value pairs, where the key represents the connection field and the value represents the corresponding information. Custom keys can be added or removed.

   Advanced: JSON

   Input the credentials as a JSON file, where the key represents the connection field, and the value represents the corresponding information.

   Add credentials to vault (optional)

   This option simplifies the configuration of data source credentials by automatically adding them to the vault associated with your worker node.

7. Click the Next button.

8. Provide a unique name for this new data source.

   
   
   

9. For the Set scan profile, you can either choose the system default profile (Snowflake: Full Catalog), choose an existing profile, or create a new one.

   
   
   
   
   

10. Click the Save button. The Data Source Details screen appears for the new data source.

11. Click the Activate button.

12. Start a scan for the new data source to begin ingesting data that has been classified by Databricks.

    Important:

    Due to the latency of Snowflake's ACCOUNT_USAGE schema, new tables and new tags may not be scanned for up to 3.5 hours after their creation. For additional information, see Snowflake's Account Usage article here.

1. You will need to create a data policy to detect violations on observed Snowflake data that is sensitive but not yet masked. Additional conditions can be used to narrow the scope of the data.

   • The classification tag you use to detect sensitive data can be any custom/unique value. Our example uses Sensitive Personal Data.

   • Recommended: The policy can include the Policy condition, where the operator is Is Empty. This identifies data that is not masked.

     Note:

     If this is not specified, then OneTrust masking policies will replace an existing masking policy that was previously applied to the column. A column in Snowflake can only have a single associated masking policy.

   
   
   
   Note:

   For more information on creating policies, see Creating & Managing Data Policies.

2. Navigate to the Violations tab in the given Data Policy's details screen.

3. Select one or more violations that represent columns which need to be masked.

   
   
   

4. With multiple violations selected, click the Actions button to select Apply policy action. A side pane appears to create and apply a policy action.

   
   
   

5. Provide a unique name for this action. This will generate the Data source policy identifier string. The Action type will default to Masking.

   Note:

   This name cannot be changed once the policy action is saved.

   
   
   

6. Provide an optional description for reference of what this policy action is masking.

7. Click the Next button to advance to the action rules.

8. Under Data policy conditions, define the masking value. The value supplied for the mask condition will replace the sensitive data value. This defaults to REDACTED but can be updated to any text.

   
   
   

9. Define inclusion/exclusion conditions on masking data for certain user groups:

   • Choose User groups except to specify which user types in Snowflake that are authorized to view this data. This masks the data for all unselected users.

     
     
     

   • Choose Including user groups to mask data for all selected user types. All unselected users will be able to view the data.

     
     
     

10. Click the Next button.

11. Take a moment to review all of the policy action details. Use the Back button to make changes as necessary.

    Note:

    The modal below uses the User groups except masking option. If you selected the Including user groups masking option, those conditions will be shown here for review.

    
    
    

12. Click the Save and apply button to activate the policy action. An application modal appears to show how many violations have been resolved.

    
    
    

13. This created policy action will be available in the Policy actions menu. Use the View policy action link to navigate to the details screen.

    
    
    

For additional information on how data is classified with Snowflake, see their Sensitive data classification article here.