AWS AmazonRDS: Add predicate_allow_list, RENAME_MASKING_POLICY, views to masking docs
Summary
Documents new pg_columnmask capabilities: the predicate_allow_list argument for CREATE/ALTER_MASKING_POLICY (columns permitted in predicates/filters even when masked), the new RENAME_MASKING_POLICY procedure, the pgcolumnmask.ddm_policies administrative view, and quoting rules for mixed-case/reserved-word identifiers plus a note on role-name quoting behavior changes in Aurora PostgreSQL 16.11/17.7.
Security assessment
This is documentation for the pg_columnmask dynamic data masking (access-control) feature. The predicate_allow_list argument explicitly widens what masked users may filter on, and the note that 'predicate executes against the masked values' plus the role-quoting behavior change ('role names are only quoted when explicitly enclosed in double quotes') are configuration details with direct authorization/masking-bypass implications, so the doc is security-relevant hardening guidance rather than a fix for a named vulnerability.
Evidence
+`predicate_allow_list` | NAME[] | An array of column names that may be referenced in predicates, join conditions, and other filter expressions even when masked by this policy. Without this setting, predicates on masked columns raise an error. When a column is in the allow list, the predicate executes against the masked values.
Diff
diff --git a/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Security.DynamicMasking.Procedures.md b/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Security.DynamicMasking.Procedures.md index 97ba68bb8..a42a28f3e 100644 --- a//AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Security.DynamicMasking.Procedures.md +++ b//AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Security.DynamicMasking.Procedures.md @@ -7 +7 @@ -CREATE_MASKING_POLICYALTER_MASKING_POLICYDROP_MASKING_POLICY +CREATE_MASKING_POLICYALTER_MASKING_POLICYDROP_MASKING_POLICYRENAME_MASKING_POLICYAdministrative viewsQuoted identifiers @@ -45 +45,6 @@ The following procedure creates a new masking policy for a user table: - weight) + weight, + predicate_allow_list) + +###### Note + +The `predicate_allow_list` argument requires `pg_columnmask` extension version 1.1 or later, available in Aurora PostgreSQL 16.11 and higher, and 17.7 and higher. To update the extension, run `ALTER EXTENSION pg_columnmask UPDATE;`. For more information, see [ALTER EXTENSION](https://www.postgresql.org/docs/current/sql-alterextension.html) in the PostgreSQL documentation. @@ -55 +60,2 @@ Parameter | Datatype | Description -`weight` | INT | Weight of the masking policy. When multiple policies are applicable to a given user's query, the policy with the highest weight (higher integer number) will be applied to each masked column. Default is 0. No two masking policies on the table can have the same wieght. +`weight` | INT | Weight of the masking policy. When multiple policies are applicable to a given user's query, the policy with the highest weight (higher integer number) will be applied to each masked column. Default is 0. No two masking policies on the table can have the same weight. +`predicate_allow_list` | NAME[] | An array of column names that may be referenced in predicates, join conditions, and other filter expressions even when masked by this policy. Without this setting, predicates on masked columns raise an error. When a column is in the allow list, the predicate executes against the masked values. @@ -76 +82 @@ None -This procedure modifies an existing masking policy. `ALTER_MASKING_POLICY` can modify the policy masking expressions, set of roles to which the policy applies and the weight of the masking policy. When one of those parameters is omitted, the corresponding part of the policy is unchanged. +This procedure modifies an existing masking policy. `ALTER_MASKING_POLICY` can modify the policy masking expressions, set of roles to which the policy applies, the weight, and the predicate allow list of the masking policy. When one of those parameters is omitted, the corresponding part of the policy is unchanged. @@ -86 +92,6 @@ This procedure modifies an existing masking policy. `ALTER_MASKING_POLICY` can m - weight) + weight, + predicate_allow_list) + +###### Note + +The `predicate_allow_list` argument requires `pg_columnmask` extension version 1.1 or later, available in Aurora PostgreSQL 16.11 and higher, and 17.7 and higher. To update the extension, run `ALTER EXTENSION pg_columnmask UPDATE;`. For more information, see [ALTER EXTENSION](https://www.postgresql.org/docs/current/sql-alterextension.html) in the PostgreSQL documentation. @@ -96,0 +108 @@ Parameter | Datatype | Description +`predicate_allow_list` | NAME[] | The new array of column names permitted in predicates and filter expressions, or NULL to leave unchanged. @@ -152,0 +165,78 @@ None +## RENAME_MASKING_POLICY + +This procedure renames an existing masking policy. + +**Syntax** + + + rename_masking_policy( + policy_name, + table_name, + new_policy_name) + +**Arguments** + +Parameter | Datatype | Description +---|---|--- +`policy_name` | NAME | The current name of the masking policy. +`table_name` | REGCLASS | The qualified/unqualified name or oid of the table containing the masking policy. +`new_policy_name` | NAME | The new name for the masking policy. Must be unique per table. + +## Administrative views + +The `pgcolumnmask.ddm_policies` view shows masking policies on tables that you own or have management privileges on. + +Column name | Data type | Description +---|---|--- +schemaname | NAME | The schema of the table to which the policy applies. +tablename | NAME | The name of the table to which the policy applies. +policyname | NAME | The name of the masking policy. +roles | TEXT[] | The roles to which the policy applies. +masked_columns | TEXT[] | The columns masked by the policy. +masking_functions | TEXT[] | The masking functions applied to the masked columns. +weight | INT | The weight of the policy. +predicate_allow_list | NAME[] | An array of column names permitted in predicates and filter expressions even when masked by the policy. + +## Quoted identifiers in masking policies + +Mixed-case or reserved-word identifiers require double-quote escaping in policy name, schema, table, column, and role arguments. Inside JSON strings, escape double quotes with a backslash. Role names must exactly match `pg_roles` including case. + +###### Example – quoted and unquoted identifiers + +Lowercase identifiers (no quoting needed): + + + CALL pgcolumnmask.create_masking_policy( + 'ssn_policy', + 'public.employees', + JSON_BUILD_OBJECT('ssn', 'public.mask_ssn(ssn)')::JSONB, + ARRAY['analyst'], + 10 + ); + +The same policy with mixed-case identifiers (quoting required): + + + CALL pgcolumnmask.create_masking_policy( + '"SSN_Policy"', + '"Public"."Employees"', + JSON_BUILD_OBJECT('"SSN"', 'public."Mask_SSN"("SSN")')::JSONB, + ARRAY['"Analyst"'], + 10 + ); + +Both policies in `pgcolumnmask.ddm_policies`: + + + SELECT schemaname, tablename, policyname, roles, weight + FROM pgcolumnmask.ddm_policies + ORDER BY tablename, weight; + schemaname | tablename | policyname | roles | weight + ------------+-----------+------------+-----------+-------- + Public | Employees | SSN_Policy | {Analyst} | 10 + public | employees | ssn_policy | {analyst} | 10 + +###### Note + +In versions before Aurora PostgreSQL 16.11 and 17.7, the extension automatically quoted role names. In Aurora PostgreSQL 16.11 and 17.7 and later, role names are only quoted when explicitly enclosed in double quotes. + @@ -161 +251 @@ Getting started -Escape identifiers +Data masking functions