A masking policy is a schema-level Snowflake object that transforms sensitive column values at query runtime. Authorized roles receive the original value; other roles receive masked, partially masked, or obfuscated output. section 10.3
Apply a masking policy through an incremental governance workflow:
- Grant a role privileges to create masking policies on a schema and apply them at the account level. section 10.3
- Create a policy with a typed column argument, a return type, and a conditional masking function based on CURRENT_ROLE(). section 10.3
- Attach the policy to the sensitive column with ALTER VIEW ... MODIFY COLUMN ... SET MASKING POLICY. section 10.3
- Query the protected object with functional roles to verify that authorized users see source values while unauthorized users see masked output. section 10.3
use role DATA_ENGINEER;
use warehouse BAKERY_WH;
use database BAKERY_DB;
use schema DG;
create masking policy ADDRESS_MASK
as (addr varchar)
returns varchar ->
case
when current_role() in ('DATA_ENGINEER') then addr
else '***'
end;
The executable definition preserves HOME_ADDRESS for DATA_ENGINEER and returns three asterisks for other roles. section 10.3
