AWS AmazonRDS: Use BEGIN ATOMIC secure masking function in workflow example
Summary
The mask_ssn example function is changed from PL/pgSQL ($$ ... $$ LANGUAGE plpgsql) to a SQL-standard body function (LANGUAGE SQL IMMUTABLE PARALLEL SAFE STRICT BEGIN ATOMIC), with text explaining that BEGIN ATOMIC provides early binding semantics and linking to the 'Secure masking function development' best-practices topic; note added that PL/pgSQL functions remain supported.
Security assessment
The edit steers readers toward SQL-body (BEGIN ATOMIC) masking functions whose object references are resolved at creation time, avoiding runtime name-resolution/search_path hijacking of the masking logic — a hardening best practice for a data-masking feature. No specific vulnerability, advisory, or CVE is referenced, so it is documentation-level security guidance.
Evidence
+ 2. Create custom masking functions. The `mask_ssn` function uses `BEGIN ATOMIC` syntax for early binding semantics (see [Secure masking function development](./AuroraPostgreSQL.Security.DynamicMasking.BestPractices.html#AuroraPostgreSQL.Security.DynamicMasking.BestPractices.MaskingDevelopment)). PL/pgSQL functions are also supported, as shown with `mask_salary`:
Diff
diff --git a/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Security.DynamicMasking.WorkflowExample.md b/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Security.DynamicMasking.WorkflowExample.md index 64c8189c0..33a56f00f 100644 --- a//AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Security.DynamicMasking.WorkflowExample.md +++ b//AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Security.DynamicMasking.WorkflowExample.md @@ -27 +27 @@ This section demonstrates a complete implementation of `pg_columnmask` using a s - 2. Create custom masking functions: + 2. Create custom masking functions. The `mask_ssn` function uses `BEGIN ATOMIC` syntax for early binding semantics (see [Secure masking function development](./AuroraPostgreSQL.Security.DynamicMasking.BestPractices.html#AuroraPostgreSQL.Security.DynamicMasking.BestPractices.MaskingDevelopment)). PL/pgSQL functions are also supported, as shown with `mask_salary`: @@ -30,3 +30,5 @@ This section demonstrates a complete implementation of `pg_columnmask` using a s - RETURNS TEXT AS $$ - BEGIN - RETURN 'XXX-XX-' || RIGHT(ssn, 4); + RETURNS TEXT + LANGUAGE SQL + IMMUTABLE PARALLEL SAFE STRICT + BEGIN ATOMIC + SELECT 'XXX-XX-' || right(ssn, 4); @@ -34 +35,0 @@ This section demonstrates a complete implementation of `pg_columnmask` using a s - $$ LANGUAGE plpgsql;