Skip to content

Enable Native Support

Privacera supports native column masking and row-level filtering policies for Snowflake Connector. This feature allows you to enforce data access policies directly within the Snowflake, leveraging its built-in capabilities. Additionally, it includes support for strict row filter role matching evaluation. For more information, refer to the Strict Row Filter Role Matching Evaluation section.

Configuration

Note

Native column masking and row filter policies are enabled by default.

  1. Navigate to Settings → Applications in the Self-Managed Portal.

  2. From the list of Connected Applications, select Snowflake.

  3. Click on the application name or the icon to edit. Then, go to the Access Management tab.

  4. Under ADVANCED tab, ensure the following options are enabled:

    • Enforce snowflake native masking: Enables native column masking. Enabled by default.
    • Enforce snowflake native row filter: Enables native row-level filtering. Enabled by default.

  5. Under ADVANCED tab, ensure the following secure view options are disabled:

    • Enforce masking policies using secure views: Disable this option if you want to use native masking instead of secure views.
    • Enforce row filter policies using secure views: Disable this option if you want to use native row filter instead of secure views.
    • Create secure view for all tables/views: Disable this option if you want to use native instead of secure view for all tables and views.

  6. Set default masking values:

    • Default masked defaultValue for numeric datatype columns: Defaults to 0.
    • Default masked defaultValue for text/varchar/string datatype columns: Defaults to <MASKED>.

  7. Under Add New Custom Properties, add following properties:

    Bash
    1
    ranger.policysync.connector.0.use.current.user.for.row.filter.and.masking.policy=true

  8. Click SAVE to apply the changes.

  1. SSH to the instance where Privacera Manager is installed.

  2. Run the following command to open the .yml file to be edited.

    If you have multiple connectors, then replace instance1 with the appropriate connector instance name.

    Bash
    1
    vi ~/privacera/privacera-manager/config/custom-vars/connectors/snowflake/instance1/vars.connector.snowflake.yml

  3. Enable native support by setting the following properties to true:

    YAML
    1
2
    CONNECTOR_SNOWFLAKE_ENABLE_ROW_FILTER: "true"
CONNECTOR_SNOWFLAKE_ENABLE_MASKING: "true"

  4. Ensure the following secure view options are disabled:

    YAML
    1
2
3
    CONNECTOR_SNOWFLAKE_ENABLE_VIEW_BASED_MASKING: "false"
CONNECTOR_SNOWFLAKE_ENABLE_VIEW_BASED_ROW_FILTER: "false"
CONNECTOR_SNOWFLAKE_SECURE_VIEW_CREATE_FOR_ALL: "false"

  5. Define default masking values:

    YAML
    1
2
    CONNECTOR_SNOWFLAKE_MASKED_NUMBER_VALUE: "<MASKED_NUMBER_VALUE>"
CONNECTOR_SNOWFLAKE_MASKED_TEXT_VALUE: "<MASKED_TEXT_VALUE>"

  6. Configure current user context for row filter and masking policies:

    YAML
    1
    CONNECTOR_SNOWFLAKE_USE_CURRENT_USER_FOR_ROW_FILTER_AND_MASKING_POLICY: "true"

  7. Once the properties are configured, run the following commands to update your Privacera Manager platform instance:

    Step 1 - Setup which generates the helm charts. This step usually takes few minutes.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh setup
    Step 2 - Apply the Privacera Manager helm charts.
    Bash
    1
2
    cd ~/privacera/privacera-manager
./pm_with_helm.sh upgrade
    Step 3 - (Optional) Post-installation step which generates Plugin tar ball, updates Route 53 DNS and so on. This step is not required if you are updating only connector properties.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh post-install

Note

Native column masking and row filter policies are enabled by default.

  1. In PrivaceraCloud portal, navigate to Settings -> Applications.

  2. On the Connected Applications screen, select Snowflake.

  3. Click on the application name or the icon to edit. Then, go to the Access Management tab.

  4. Under ADVANCED tab, ensure the following options are enabled:

    • Enforce snowflake native masking: Enables native column masking. Enabled by default.
    • Enforce snowflake native row filter: Enables native row-level filtering. Enabled by default.

  5. Under ADVANCED tab, ensure the following secure view options are disabled:

    • Enforce masking policies using secure views: Disable this option if you want to use native masking instead of secure views.
    • Enforce row filter policies using secure views: Disable this option if you want to use native row filter instead of secure views.
    • Create secure view for all tables/views: Disable this option if you want to use native instead of secure view for all tables and views.

  6. Set default masking values:

    • Default masked value for numeric datatype columns: Defaults to 0.
    • Default masked value for text/varchar datatype columns: Defaults to <MASKED>.

  7. Under Add New Custom Properties, add following property:

    Bash
    1
    ranger.policysync.connector.0.use.current.user.for.row.filter.and.masking.policy=true

  8. Click SAVE to apply the changes.

Configure Role Evaluation Method for Masking and RLF

These properties control how PolicySync checks a user's Snowflake roles in role-based masking and row-level filter (RLF) policies. The property to use depends on your Privacera release:

Release 9.2.48.1 and later

The role.evaluation.mode property selects how roles are evaluated.

Breaking change from Privacera release 9.2.48.1

The role.evaluation.mode property replaces ranger.policysync.connector.0.use.current.available.roles, which the connector no longer reads.

  • PrivaceraCloud: If you had set use.current.available.roles=false, add ranger.policysync.connector.0.role.evaluation.mode=ROLE_IN_SESSION before the upgrade to keep the same behavior. Otherwise the connector uses the default AVAILABLE_ROLES. Keep the old property as well: earlier connector versions read only use.current.available.roles. This applies in particular if you set false because Omni and PBAC are both enabled.
  • Self-Managed (YAML configuration): Privacera Manager no longer reads CONNECTOR_SNOWFLAKE_USE_CURRENT_AVAILABLE_ROLES. If you had set it to "false", set CONNECTOR_SNOWFLAKE_ROLE_EVALUATION_MODE: "ROLE_IN_SESSION" before the upgrade. If you had set use.current.available.roles=false in a custom properties file instead, add ranger.policysync.connector.0.role.evaluation.mode=ROLE_IN_SESSION there. If the variable was "true" or not set, no action is needed.
  • Data Plane: If you had set CONNECTOR_SNOWFLAKE_USE_CURRENT_AVAILABLE_ROLES: "false" in Privacera Manager, set CONNECTOR_SNOWFLAKE_ROLE_EVALUATION_MODE: "ROLE_IN_SESSION" before the upgrade. If you had set use.current.available.roles=false as a custom property in the portal, add ranger.policysync.connector.0.role.evaluation.mode=ROLE_IN_SESSION.
  • Self-Managed (portal configuration): If you had set use.current.available.roles=false as a custom property, add ranger.policysync.connector.0.role.evaluation.mode=ROLE_IN_SESSION. Keep the old property for earlier connector versions.
  • Existing Snowflake masking and row access policies keep their old role check until they are re-applied. See Apply a change of role evaluation mode.

Behavior

Value Snowflake function When a role's policy item applies
AVAILABLE_ROLES (default) current_available_roles() The role is granted to the user, directly or through another role, whether or not it is active in the session.
ROLE_IN_SESSION is_role_in_session() The role is the user's primary role, one of the active secondary roles, or a role inherited through them.
CURRENT_ROLE current_role() The role is the user's primary role in the session, that is, the role set with USE ROLE. Secondary roles and inherited roles are not considered.

When CURRENT_ROLE is set:

  • ranger.policysync.connector.0.use.current.user.for.row.filter.and.masking.policy must be true. The configuration steps below include it. If it is not true, the connector logs an error and uses AVAILABLE_ROLES instead.
  • Only role policy items use current_role(). User policy items match on current_user(), and group policy items use current_available_roles().
  • current_role() is compared with the Snowflake role that PolicySync creates for the Ranger role, not with the Ranger role name. That name includes the configured role prefix and postfix (the Privacera Manager default prefix is priv_role_) and keeps its configured letter case. Users must switch to that Snowflake role with USE ROLE, quoting the name if it is not upper case, for the policy item to apply.
  • Column access masks are not affected. In PBAC policies, the role check for users expanded from roles and groups keeps is_role_in_session(); direct role policy items use current_role(). When Omni and PBAC are both enabled, use ROLE_IN_SESSION (see the note below).
  • A user's masking and row filter can change when they switch roles. For example, a user with roles ANALYST and SUPPORT sees a column masked after switching to the SUPPORT role and unmasked after switching to the ANALYST role, if only SUPPORT has a masking policy item. If a mask must apply no matter which role the user is using, add a user or group policy item for it. As with primary role policy enforcement, users can change what they see by switching roles.
  • If role.name.persist.case.sensitivity is true, the role name is compared with its exact case.
  • Values are AVAILABLE_ROLES, ROLE_IN_SESSION, and CURRENT_ROLE. Any other value is ignored with a warning in the connector log, and AVAILABLE_ROLES is used.

Row filters with CURRENT_ROLE

A user who matches no row filter policy item, by active role, user, or group, sees all rows. With CURRENT_ROLE, a user can switch to a role that is not in the row filter policy and see all rows. To restrict such users, add a user or group policy item, or a row filter item for every role they can use.

Apply a change of role evaluation mode

Changing role.evaluation.mode does not update existing Snowflake masking and row access policies, even after the connector restarts. The connector rewrites a Snowflake policy only when the policy items of its Ranger policy change. Re-apply the affected policies after changing the mode. Policies that are created or changed after the change use the new mode.

For Omni + PBAC

When Omni and PBAC both are enabled for the Snowflake connector, set this property to ROLE_IN_SESSION. For more details about PBAC, refer to Purpose-Based Access Control (PBAC) for Snowflake Connector and Configuring Purpose Based Access Control behaviour for Snowflake Connector.

Configuration

  1. Navigate to Settings → Applications in the Self-Managed Portal.

  2. From the list of Connected Applications, select Snowflake.

  3. Select the application name or the icon to edit. Then, go to the Access Management tab.

  4. Under Add New Custom Properties, add the following property. Set the value to AVAILABLE_ROLES, ROLE_IN_SESSION, or CURRENT_ROLE:

    Bash
    1
    ranger.policysync.connector.0.role.evaluation.mode=CURRENT_ROLE

    For CURRENT_ROLE, also add:

    Bash
    1
    ranger.policysync.connector.0.use.current.user.for.row.filter.and.masking.policy=true

  5. Select SAVE to apply the changes.

  1. SSH to the instance where Privacera Manager is installed.

  2. Run the following command to open the .yml file to be edited.

    If you have multiple connectors, then replace instance1 with the appropriate connector instance name.

    Bash
    1
    vi ~/privacera/privacera-manager/config/custom-vars/connectors/snowflake/instance1/vars.connector.snowflake.yml

  3. Add the following property. Set the value to AVAILABLE_ROLES, ROLE_IN_SESSION, or CURRENT_ROLE:

    YAML
    1
    CONNECTOR_SNOWFLAKE_ROLE_EVALUATION_MODE: "CURRENT_ROLE"

    For CURRENT_ROLE, also add:

    YAML
    1
    CONNECTOR_SNOWFLAKE_USE_CURRENT_USER_FOR_ROW_FILTER_AND_MASKING_POLICY: "true"

    If CONNECTOR_SNOWFLAKE_ROLE_EVALUATION_MODE is not set, the default AVAILABLE_ROLES is used. CONNECTOR_SNOWFLAKE_USE_CURRENT_AVAILABLE_ROLES is no longer read.

  4. Once the property is configured, run the following commands to update your Privacera Manager platform instance:

    Step 1 - Setup which generates the helm charts. This step usually takes few minutes.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh setup
    Step 2 - Apply the Privacera Manager helm charts.
    Bash
    1
2
    cd ~/privacera/privacera-manager
./pm_with_helm.sh upgrade
    Step 3 - (Optional) Post-installation step which generates Plugin tar ball, updates Route 53 DNS and so on. This step is not required if you are updating only connector properties.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh post-install

  1. In PrivaceraCloud portal, navigate to Settings -> Applications.

  2. On the Connected Applications screen, select Snowflake.

  3. Select the application name or the icon to edit. Then, go to the Access Management tab.

  4. Under Add New Custom Properties, add the following property. Set the value to AVAILABLE_ROLES, ROLE_IN_SESSION, or CURRENT_ROLE:

    Bash
    1
    ranger.policysync.connector.0.role.evaluation.mode=CURRENT_ROLE

    For CURRENT_ROLE, also add:

    Bash
    1
    ranger.policysync.connector.0.use.current.user.for.row.filter.and.masking.policy=true

  5. Select SAVE to apply the changes.

Releases before 9.2.48.1

The use.current.available.roles property controls which Snowflake function is used to evaluate roles for masking and RLF conditions.

Behavior

  • When set to true: Uses current_available_roles() function for masking and RLF condition evaluation.
  • When set to false: Uses is_role_in_session() function for masking and RLF condition evaluation.
  • Default value: true

For Omni + PBAC

When Omni and PBAC both are enabled for the Snowflake connector, set this property to false. For more details about PBAC, refer to Purpose-Based Access Control (PBAC) for Snowflake Connector and Configuring Purpose Based Access Control behaviour for Snowflake Connector.

Configuration

  1. Navigate to Settings → Applications in the Self-Managed Portal.

  2. From the list of Connected Applications, select Snowflake.

  3. Click on the application name or the icon to edit. Then, go to the Access Management tab.

  4. Under Add New Custom Properties, add the following property:

    Bash
    1
    ranger.policysync.connector.0.use.current.available.roles=false

  5. Click SAVE to apply the changes.

  1. SSH to the instance where Privacera Manager is installed.

  2. Run the following command to open the .yml file to be edited.

    If you have multiple connectors, then replace instance1 with the appropriate connector instance name.

    Bash
    1
    vi ~/privacera/privacera-manager/config/custom-vars/connectors/snowflake/instance1/vars.connector.snowflake.yml

  3. Add the following property:

    YAML
    1
    CONNECTOR_SNOWFLAKE_USE_CURRENT_AVAILABLE_ROLES: "false"

  4. Once the property is configured, run the following commands to update your Privacera Manager platform instance:

    Step 1 - Setup which generates the helm charts. This step usually takes few minutes.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh setup
    Step 2 - Apply the Privacera Manager helm charts.
    Bash
    1
2
    cd ~/privacera/privacera-manager
./pm_with_helm.sh upgrade
    Step 3 - (Optional) Post-installation step which generates Plugin tar ball, updates Route 53 DNS and so on. This step is not required if you are updating only connector properties.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh post-install

  1. In PrivaceraCloud portal, navigate to Settings -> Applications.

  2. On the Connected Applications screen, select Snowflake.

  3. Click on the application name or the icon to edit. Then, go to the Access Management tab.

  4. Under Add New Custom Properties, add the following property:

    Bash
    1
    ranger.policysync.connector.0.use.current.available.roles=false

  5. Click SAVE to apply the changes.