Data Masking on Snowflake

Data Masking on Snowflake requires connecting a tag or column to ALTR before it can carry a masking policy. Connecting is a separate step from creating the policy: connecting brings the tag or column under ALTR’s management on Snowflake and sets how masking is enforced, and the policy itself then maps roles to masking types.

Connect a Tag or Column

When you connect a Snowflake object tag or column to ALTR, you choose one of four protection types:

• Default masking (external function) — ALTR creates a Snowflake masking policy that calls ALTR’s cloud-hosted policy evaluation service at query time. This is the default protection type.
• Native masking (pushdown) — ALTR creates a native Snowflake masking policy with no external function call.
• Tokenization — default masking plus an additional external function that handles detokenization at query time.
• Format-Preserving Encryption (FPE) — default masking plus an additional external function that handles key retrieval, with decryption performed locally in Snowflake through a UDF.

The protection type is chosen in ALTR when you connect the tag or column, not configured separately in Snowflake.

Note

Tokenization and FPE protection types don’t tokenize or encrypt data automatically — they add automatic detokenization or decryption at query time for data you’ve already tokenized or encrypted using ALTR’s tokenization or encryption functions or API. Based on masking policy, roles receive tokens/ciphertext, detokenized/decrypted plaintext, or masked plaintext. See Advanced Data Protection for tokenization and FPE mechanics.

Native vs. External-Function Masking

Native masking executes entirely inside Snowflake, which gives it a performance benefit over external-function masking, particularly for smaller queries. Native masking is available only to tag connections; column connections always use an external-function protection type (default masking, tokenization, or FPE) and never native masking. Skipping the external function call means the Snowflake policy behind native masking must be redeployed whenever its rules change, and it doesn’t generate Database Activity Monitoring records. See Masking Types for which masking types each protection type supports. For the equivalent mechanism on Databricks, see Data Masking on Databricks.

Customizing ALTR Masking Behavior on Snowflake

You can customize the specific string replacement ALTR returns for masking through the ALTR_HOOK_POST function. Connecting a database’s first column or tag to ALTR creates this user-defined function (UDF) in the ALTR_DSAAS schema of that database. Every masking policy on that database’s columns references this function at query time. By default, ALTR_HOOK_POST returns NULL, which tells ALTR to apply the default replacement value for the masking type it determined. Replacing the function body with custom logic changes the value returned for query results — for example, applying a different string replacement, or calling a third-party decryption function. ALTR_HOOK_POST is available for default masking (external function) connections only, and is removed automatically when the database is disconnected from ALTR.

Danger

Modifying ALTR_HOOK_POST can produce undefined or inconsistent query results. ALTR does not manage or guarantee the behavior of custom masking logic.

You can also customize the role values sent to ALTR for policy evaluation through the use of ALTR_ROLE_SET, a second, optional UDF that changes which roles ALTR evaluates when determining a masking type, rather than changing the masking type itself. By default, ALTR evaluates only the querying user’s current active Snowflake role. Enabling ALTR_ROLE_SET lets you customize the function to return a different set of roles — for example, all of the user’s available roles, or a custom-defined set — using Snowflake context functions such as CURRENT_ROLE, CURRENT_AVAILABLE_ROLES, or CURRENT_SECONDARY_ROLES. ALTR evaluates masking rules against every role returned and applies the most permissive masking type found across them. ALTR_ROLE_SET is available for both default masking (external function) and pushdown (native masking) connections, and supports up to 500 roles per evaluation; a query that returns more than 500 roles causes ALTR to return an exception to Snowflake.

For column connections, enabling ALTR_ROLE_SET requires an ALTR-side organization variable; contact ALTR Support to enable it. For tag connections, it’s set with an optional flag at connection time.

ALTR User Group to Snowflake Role Mapping

ALTR evaluates Snowflake masking policies against ALTR-managed user groups. Although these typically map to roles, they may drift over time, especially if you are using the ALTR_ROLE_SET function. ALTR automatically creates user groups based on your Snowflake roles when connecting a Snowflake database, and creates new user groups as new roles are encountered on Snowflake queries. New user groups can also be manually created on the User Groups page.

Where to Connect Tags and Columns

To connect a tag or column, see Manage Tags or Manage Columns. Once connected, create the masking policy — see Tag-Based Masking or Column-Based Masking.