AWS AmazonRDS: Document dynamic masking session and role limitations
Summary
Replaces the reconnect note with explicit guidance that masking applies only to sessions starting after extension install, and that masking is never applied for the table owner or rds_superuser.
Security assessment
This is security documentation for the pg_columnmask dynamic data masking feature; it clarifies that privileged roles (table owner, rds_superuser) bypass masking and that existing sessions see unmasked data until reconnected, which is important hardening/leak-prevention guidance for adopters.
Evidence
+ * Masking on a table is never applied for the table owner or `rds_superuser`.
Diff
diff --git a/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Security.DynamicMasking.GetStarted.md b/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Security.DynamicMasking.GetStarted.md index 4d66804c7..64132b263 100644 --- a//AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Security.DynamicMasking.GetStarted.md +++ b//AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Security.DynamicMasking.GetStarted.md @@ -26 +26,6 @@ This command installs the `pg_columnmask` extension, creates the necessary catal -Connections made before installing this extension will still show unmasked data. Close and reconnect to fix this. + * Masking policies take effect for sessions that start after you install the extension. Reconnect any existing sessions to apply masking. + + * Masking on a table is never applied for the table owner or `rds_superuser`. + + +