Skip to content

Commit d7731b3

Browse files
author
garenshi
committed
[Feature] add data mask policy docs
1 parent a92ce9f commit d7731b3

File tree

9 files changed

+372
-2
lines changed

9 files changed

+372
-2
lines changed

‎docs/admin-manual/auth/authorization/data.md‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,22 @@ Data masking is a method to protect sensitive data by modifying, replacing, or h
5252

5353
For example, administrators can choose to replace part or all of the digits of sensitive fields such as credit card numbers or ID numbers with asterisks * or other characters, or replace real names with pseudonyms.
5454

55-
Starting from version 2.1.2, data masking is supported through Apache Ranger's Data Masking to set masking policies for certain columns, currently only through [Apache Ranger](ranger.md).
55+
Currently, data masking policies can be configured in two ways:
56+
57+
### 1. Doris Built-in Data Masking Policies
58+
### Related Commands
59+
- Create a data masking policy [CREATE DATA MASK POLICY](../../../sql-manual/sql-statements/data-governance/CREATE-DATA-MASK-POLICY)
60+
- View data masking policies [SHOW DATA MASK POLICY](../../../sql-manual/sql-statements/data-governance/SHOW-DATA-MASK-POLICY)
61+
- Drop a data masking policy [DROP DATA MASK POLICY](../../../sql-manual/sql-statements/data-governance/DROP-DATA-MASK-POLICY)
62+
### Data Masking Policy Example
63+
1. Apply the MASK_HASH policy to the t1.c1 column for the test user
64+
65+
```sql
66+
CREATE DATA MASK POLICY test_policy_1 ON t1.c1
67+
TO test USING MASK_HASH;
68+
```
69+
### 2. External Configuration via Apache Ranger
70+
71+
Starting from version 2.1.2, data masking policies can be configured for specific columns through Apache Ranger Data Masking. For details, refer to： [Apache Ranger](./ranger)
5672

5773
> Data Masking settings for admin/root users will not take effect.

‎docs/sql-manual/sql-statements/data-governance/CREATE-DATA-MASK-POLICY.md‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
---
2+
{
3+
"title": "CREATE DATA MASK POLICY",
4+
"language": "en",
5+
"description": "Explain can view the rewritten execution plan."
6+
}
7+
---
8+
9+
## Description
10+
11+
Explain can view the rewritten execution plan.
12+
13+
## Syntax
14+
15+
```sql
16+
CREATE DATA MASK POLICY [ IF NOT EXISTS ] <policy_name>
17+
ON <col_name>
18+
TO { <user_name> | ROLE <role_name> }
19+
USING <mask_type> [LEVEL <priority>];
20+
```
21+
## Required Parameters
22+
23+
**<policy_name>**
24+
25+
> column data mask policy name
26+
27+
**<col_name>**
28+
29+
> column name
30+
31+
## Optional Parameters
32+
33+
**<user_name>**
34+
35+
> User name, cannot be created for root and admin users
36+
37+
**<role_name>**
38+
39+
> Role name
40+
41+
**<mask_type>**
42+
43+
> Data mask type. see MASK_TYPE list
44+
45+
## Access Control Requirements
46+
47+
The user executing this SQL command must have at least the following privileges:
48+
49+
| Privilege | Object | Notes |
50+
| ------------------------ | ------ | ----- |
51+
| ADMIN_PRIV or GRANT_PRIV | Global | |
52+
53+
## MASK_TYPE
54+
55+
| Name | Meaning | Expression |
56+
|:--------------------|:----------------------------------------------------------------|:-------------------------------------------------------------------------------------------------|
57+
| MASK_REDACT | Replace lowercase with 'x', uppercase with 'X', digits with '0' | regexp_replace(regexp_replace(regexp_replace({col},'([A-Z])', 'X'),'([a-z])','x'),'([0-9])','0') |
58+
| MASK_SHOW_LAST_4 | Show last 4 characters; replace rest with 'X' | LPAD(RIGHT({col}, 4), CHAR_LENGTH({col}), 'X') |
59+
| MASK_SHOW_FIRST_4 | Show first 4 characters; replace rest with 'X' | RPAD(LEFT({col}, 4), CHAR_LENGTH({col}), 'X') |
60+
| MASK_HASH | Hash the value of a varchar with sha256 | hex(sha2({col}, 256)) |
61+
| MASK_NULL | Replace with NULL | NULL |
62+
| MASK_DATE_SHOW_YEAR | Date: show only year | date_trunc({col}, 'year') |
63+
| MASK_DEFAULT | Replace with data type default | |
64+
| MASK_NONE | Keep it as it is | |
65+
66+
67+
## Examples
68+
69+
1. Create a set of data mask policies
70+
71+
```sql
72+
CREATE DATA MASK POLICY test_policy_1 ON internal.test.t1.c1
73+
TO jack USING MASK_HASH;
74+
75+
CREATE DATA MASK POLICY test_policy_2 ON internal.test.t1.c2
76+
TO Role r1 USING MASK_NULL;
77+
78+
CREATE DATA MASK POLICY test_policy_3 ON internal.test.t1.c1
79+
TO jack USING MASK_NONE LEVEL 1;
80+
```

‎docs/sql-manual/sql-statements/data-governance/DROP-DATA-MASK-POLICY.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
{
3+
"title": "DROP DATA MASK POLICY",
4+
"language": "en",
5+
"description": "Delete data mask policy. For details about data mask policies, please refer to the \"Security Policies\" chapter"
6+
}
7+
---
8+
9+
## Description
10+
11+
Delete data mask policy. For details about data mask policies, please refer to the "Security Policies" chapter
12+
13+
14+
## Syntax
15+
16+
```sql
17+
DROP DATA MASK POLICY [IF EXISTS] <policy_name>;
18+
```
19+
20+
## Required Parameters
21+
**<policy_name>**
22+
23+
> Data mask policy name
24+
25+
# Access Control Requirements (Access Control Requirements)
26+
27+
The user executing this SQL command must have at least the following privileges:
28+
29+
| Privilege | Object | Notes |
30+
| :------------------------- | :----- | :---- |
31+
| ADMIN_PRIV or *GRANT_PRIV* | Global | |
32+
33+
# Examples (Examples)
34+
35+
1. Delete the *policy1 data mask policy*
36+
37+
```sql
38+
DROP DATA MASK POLICY policy1
39+
```
40+

‎docs/sql-manual/sql-statements/data-governance/SHOW-DATA-MASK-POLICY.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
{
3+
"title": "SHOW DATA MASK POLICY",
4+
"language": "en",
5+
"description": "View data mask policies. For details on data mask policies, refer to the \"Security Policies\" chapter"
6+
}
7+
---
8+
9+
## Description
10+
11+
View data mask policies. For details on data mask policies, refer to the "Security Policies" chapter
12+
13+
## Syntax
14+
15+
```sql
16+
SHOW DATA MASK POLICY [ FOR { <user_name> | ROLE <role_name> } ];
17+
```
18+
## Optional Parameters
19+
20+
**<user_name>**
21+
22+
> User name
23+
24+
**<role_name>**
25+
26+
> Role name
27+
28+
## Access Control Requirements
29+
30+
The user executing this SQL command must have at least the following privileges:
31+
32+
| Privilege | Object | Notes |
33+
| :--------- | :----- | :---- |
34+
| ADMIN_PRIV | Global | |
35+
36+
## Examples
37+
38+
1. View all data mask policies
39+
40+
41+
```sql
42+
SHOW DATA MASK POLICY;
43+
```
44+
45+
1. Query by specifying a user name
46+
47+
```sql
48+
SHOW DATA MASK POLICY FOR user1;
49+
```
50+
51+
1. Query by specifying a role name
52+
53+
```sql
54+
SHOW DATA MASK POLICY for role role1;
55+
```

‎i18n/zh-CN/docusaurus-plugin-content-docs/current/admin-manual/auth/authorization/data.md‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,22 @@ GRANT Select_priv(col1,col2) ON ctl.db.tbl TO user1
4949

5050
例如，管理员可以选择将信用卡号、身份证号等敏感字段的部分或全部数字替换为星号 * 或其他字符，或者将真实姓名替换为假名。
5151

52-
从 2.1.2 版本开始，支持通过 Apache Ranger 的 Data Masking 来为某些列设置脱敏策略，目前仅支持通过 [Apache Ranger](./ranger)来设置
52+
目前可以通过两种方式设置数据脱敏策略
53+
54+
### 1. Doris 内置脱敏策略
55+
### 相关命令
56+
- 创建脱敏限策略 [CREATE DATA MASK POLICY](../../../sql-manual/sql-statements/data-governance/CREATE-DATA-MASK-POLICY)
57+
- 查看脱敏策略 [SHOW DATA MASK POLICY](../../../sql-manual/sql-statements/data-governance/SHOW-DATA-MASK-POLICY)
58+
- 删除脱敏策略 [DROP DATA MASK POLICY](../../../sql-manual/sql-statements/data-governance/DROP-DATA-MASK-POLICY)
59+
### 脱敏策略示例
60+
1. test 用户查询 t1.c1 列的时候使用 MASK_HASH 策略
61+
62+
```sql
63+
CREATE DATA MASK POLICY test_policy_1 ON t1.c1
64+
TO test USING MASK_HASH;
65+
```
66+
### 2. Apache Ranger 外部设置
67+
68+
从 2.1.2 版本开始，支持通过 Apache Ranger 的 Data Masking 来为某些列设置脱敏策略。详见： [Apache Ranger](./ranger)
5369

5470
> 为 admin/root 用户设置数据脱敏不会生效

‎i18n/zh-CN/docusaurus-plugin-content-docs/current/sql-manual/sql-statements/data-governance/CREATE-DATA-MASK-POLICY.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
{
3+
"title": "CREATE DATA MASK POLICY",
4+
"language": "zh-CN",
5+
"description": "创建列脱敏策略，Explain 可以查看改写后的执行计划。"
6+
}
7+
---
8+
9+
## 描述
10+
11+
创建列脱敏策略，Explain 可以查看改写后的执行计划。
12+
13+
## 语法
14+
15+
```sql
16+
CREATE DATA MASK POLICY [ IF NOT EXISTS ] <policy_name>
17+
ON <col_name>
18+
TO { <user_name> | ROLE <role_name> }
19+
USING <mask_type> [LEVEL <priority>];
20+
```
21+
22+
## 必选参数
23+
24+
1. `<policy_name>`: 列脱敏策略名称
25+
26+
2. `<col_name>`: 列名称
27+
28+
3. `<mask_type>`: 具体的脱敏类型，见：MASK_TYPE 列表
29+
30+
## 可选参数
31+
32+
1. `<user_name>`: 用户名称，不允许对 root 和 admin 用户创建
33+
34+
2. `<role_name>`: 角色名称
35+
36+
3. `<priority>`: 脱敏优先级，默认为 0，如果某个列有多个脱敏策略，值越大，优先级越高
37+
38+
## 权限控制
39+
40+
执行此 SQL 命令的用户必须至少具有以下权限：
41+
42+
| 权限（Privilege） | 对象（Object） | 说明（Notes） |
43+
| :------------------------- | :------------- | :------------ |
44+
| ADMIN_PRIV 或 *GRANT_PRIV* | 全局 | |
45+
46+
## MASK_TYPE
47+
| 名称 | 含义 | 表达式 |
48+
|:--------------------------|:------------------------------|:---------------------------------------------------------------------------------------------------|
49+
| MASK_REDACT | 写字母用 x 代替，大写字母用 X 代替，数字用 0 代替 | regexp_replace(regexp_replace(regexp_replace({col},'([A-Z])', 'X'),'([a-z])','x'),'([0-9])','0') |
50+
| MASK_SHOW_LAST_4 | 只显示最后4个字符，其他用 X 代替 | LPAD(RIGHT({col}, 4), CHAR_LENGTH({col}), 'X') |
51+
| MASK_SHOW_FIRST_4 | 只显示前4个字符，其他用 X 代替 | RPAD(LEFT({col}, 4), CHAR_LENGTH({col}), 'X') |
52+
| MASK_HASH | 使用 sha256 对值进行 hash | hex(sha2({col}, 256)) |
53+
| MASK_NULL | 使用 NULL 对值进行覆盖 | NULL |
54+
| MASK_DATE_SHOW_YEAR | 对日期类型，只显示年份 | date_trunc({col}, 'year') |
55+
| MASK_DEFAULT | 显示字段类型的默认值 | |
56+
| MASK_NONE | 保持原样 | |
57+
58+
## 示例
59+
60+
1. 创建一组行安全策略
61+
62+
```sql
63+
CREATE DATA MASK POLICY test_policy_1 ON internal.test.t1.c1
64+
TO jack USING MASK_HASH;
65+
66+
CREATE DATA MASK POLICY test_policy_2 ON internal.test.t1.c2
67+
TO Role r1 USING MASK_NULL;
68+
69+
CREATE DATA MASK POLICY test_policy_3 ON internal.test.t1.c1
70+
TO jack USING MASK_NONE LEVEL 1;
71+
72+
```

‎i18n/zh-CN/docusaurus-plugin-content-docs/current/sql-manual/sql-statements/data-governance/DROP-DATA-MASK-POLICY.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
{
3+
"title": "DROP DATA MASK POLICY",
4+
"language": "zh-CN",
5+
"description": "删除列脱敏策略。"
6+
}
7+
---
8+
9+
## 描述
10+
删除列脱敏策略。
11+
12+
## 语法
13+
14+
```sql
15+
DROP ROW POLICY [IF EXISTS] <policy_name>;
16+
```
17+
18+
## 必选参数
19+
20+
1. `<policy_name>`: 列脱敏策略名称
21+
22+
23+
## 权限控制
24+
25+
执行此 SQL 命令的用户必须至少具有以下权限：
26+
27+
| 权限（Privilege） | 对象（Object） | 说明（Notes） |
28+
| :------------------------- | :------------- | :------------ |
29+
| ADMIN_PRIV 或 *GRANT_PRIV* | 全局 | |
30+
31+
## 示例
32+
33+
1. 删除 *policy1 列脱敏策略*
34+
35+
```sql
36+
DROP DATA MASK POLICY policy1
37+
```

‎i18n/zh-CN/docusaurus-plugin-content-docs/current/sql-manual/sql-statements/data-governance/SHOW-DATA-MASK-POLICY.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
{
3+
"title": "SHOW DATA MASK POLICY",
4+
"language": "zh-CN",
5+
"description": "查看列脱敏策略。"
6+
}
7+
---
8+
9+
## 描述
10+
11+
查看列脱敏策略。
12+
13+
## 语法
14+
15+
```sql
16+
SHOW DATA MASK POLICY [ FOR { <user_name> | ROLE <role_name> } ];
17+
```
18+
19+
## 可选参数
20+
21+
1. `<user_name>`: 用户名称
22+
23+
2. `<role_name>`: 角色名称
24+
25+
## 权限控制
26+
27+
执行此 SQL 命令的用户必须至少具有以下权限：
28+
29+
| 权限（Privilege） | 对象（Object） | 说明（Notes） |
30+
| :---------------- | :------------- | :------------ |
31+
| ADMIN_PRIV | 全局 | |
32+
33+
## 示例
34+
35+
1. 查看所有安全策略
36+
37+
```sql
38+
SHOW DATA MASK POLICY;
39+
```
40+
41+
2. 指定用户名查询
42+
43+
```sql
44+
SHOW DATA MASK POLICY FOR user1;
45+
```
46+
47+
3. 指定角色名查询
48+
49+
```sql
50+
SHOW DATA MASK POLICY for role role1;
51+
```

0 commit comments

Comments
 (0)