[GCP] BigQuery Table CLS

若需針對特定使用者隱藏BigQuery資料表上的欄位, column level security (CLS), 則需使用Policy tag.

設定流程及對應服務如下:

Steps and Services

1. Define Policy tag

STEP 1. +Create Taxonomy

STEP 2. 輸入資料如下, 可參考 best practice: https://cloud.google.com/bigquery/docs/best-practices-policy-tags

建立完成後,

  • 若開啟Enforce access control會直接新增Fine-Grained Reader role於以下所有tag上。
  • 若先個別授權不同role在各個tag上再開啟Enforce access control,則不會接新增Fine-Grained Reader role於以下所有tag上。

此次範例則會之後再開啟Enforce access control

2. Assign to column

先將BigQuery 的資料表上兩個欄位個別給予HIGH跟LOW tag,以便後續測試。

STEP 1. 選資料表 >EDIT SCHEMA

STEP 2. 選一個欄位 >ADD POLICY TAG

STEP 3. 新增好HIGH跟LOW tag >SAVE

3. Manage access control

STEP 1. IAM & Admin > + CREATE ROLE

STEP 2. 輸入Title > add permissions select Fine-Grained Reader role > CREATE

STEP 3. 建立一個給LOW

STEP 4. 回去至policy tag頁面然後選擇 HIGH tag > SHOW INFO PANEL (on the top right corner)

STEP 5. + ADD PRINCIPAL > enter a new principle (這裡使用 user1 email) 並選擇Sensitivity-HIGH role, LOW tag也執行一樣的步驟, 但使用 user2 email

STEP 6. enable access control

RESULT

User 1: Sensitivity-HIGH role

No Phone_Number role

User 2: Sensitivity-LOW role

No ID column

以上使用者本身也需access至該BigQuery table/dataset的權限,policy tag為限制欄位上的查看權限(CLS)。

Other Reference:

Dynamic data masking (preview): https://cloud.google.com/bigquery/docs/column-data-masking

Introduction to CLS: https://cloud.google.com/bigquery/docs/column-level-security-intro

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store