Use advanced data masking for PolarDB-Data Management-阿里云帮助中心

This topic describes how to use the advanced data masking feature of PolarDB for MySQL.

Feature overview

To enhance the security of the PolarDB for MySQL engine, Alibaba Cloud integrates the data masking feature of the PolarDB for MySQL cluster proxy (Proxy) with the sensitive data protection feature of DMS. When DMS identifies sensitive data, it automatically masks the data based on masking rules and synchronizes these rules to the PolarDB proxy in real time. You can then query the masked data using applications or other tools. The advanced data masking feature provides the following capabilities:

Centralized management of sensitive data
Classification and grading of sensitive data
Periodic scanning for sensitive data
Proactive discovery of sensitive data

Use cases

Retrieve masked user data in real time from a production database for report generation, data analysis, and development and testing.

Prerequisites

You have added your PolarDB for MySQL cluster to DMS. For more information, see Add a database instance to DMS.
If you log on to the PolarDB console as a RAM user (sub-account), ensure the user has permissions to manage instances in the PolarDB console. For more information, see Authorize a RAM user to manage PolarDB by using a custom policy.
Your DMS system role is Administrator, DBA, or Security Administrator.

Billing

If you enable the sensitive data protection feature in DMS, fees apply. For more information about pricing, see Product types and pricing.

Usage notes

To use this feature, your Alibaba Cloud account must be on an allowlist. To be added, submit a ticket to contact technical support.
The PolarDB proxy performs the actual data masking operation. For more information, see How it works.
The advanced data masking feature does not support custom masking algorithms. For more information, see Overview.

Procedure

Step 1: Enable advanced data masking

Log on to the PolarDB console.
In the upper-left corner, select the region where the cluster is deployed.
Find the target cluster and click its ID.
In the left-side navigation pane, choose Configuration and Management > Security Management, and then click the Dynamic Data Masking tab.
Click Enable Now.
If the Enable Now label changes to Disable, it indicates that the advanced data masking feature is successfully enabled for the cluster.
Note
After you enable advanced data masking for a PolarDB for MySQL cluster that is added to DMS, the PolarDB for MySQL cluster provides the database proxy. The proxy type in DMS is set to dedicated mode.
In the Usage Guide section, on the Sensitive Data List tab, click Go to Sensitive Data Management.

Step 2: Enable sensitive data protection and scan

In the instance list, click Enable Now.

In the Enable Sensitive Data Protection dialog box, configure the following parameters and click Confirm.

Parameter	Description
Configure scan task now	This option is enabled by default. When enabled, DMS scans all databases in the instance.
Select a scan template	Select an existing scan template or create a new one. For information about how to create a template, see Create a classification and grading template.
Scan method	Note If Configure Scan Task Now is enabled, you must select a scan method. Specify when to start the scan task. Valid values: Immediate task (runs once immediately): Starts scanning the databases in the selected instance immediately. Scheduled task (runs once at a specified time): Starts scanning the databases in the selected instance at a specified time. Periodic task: Scans the databases in the selected instance repeatedly based on a schedule, such as hourly, daily, or monthly.
Scan result validity	Valid values: Yes: The results take effect immediately. No: The results do not take effect immediately. You must go to the Identification Results page to manually apply them. If the results take effect immediately, the identified fields are tagged with classification and grading labels.

In the success message that appears, click Confirm.
In the Instance List section, on the Enabled tab, click Task Details to view the identification results.
Switch to the PolarDB console to view the sensitive fields found by the scan.
You can view sensitive fields in a table view or field view.
Note
- Sensitivity levels depend on the security levels set in the DMS classification and grading template. For more information, see Manage classification and grading templates.
- Only sensitive fields marked for masking are automatically masked in query results.

Step 3: Query masked data with a client

Configure a database account in the PolarDB console, and then use a client to log on with that account to query data. The following steps show how to query data by using an application as an example:

In the PolarDB for MySQL instance console, in the Usage Guide section, on the Account List tab, click Configure Account.
Note
Data masking applies only to this account and takes effect approximately 2 minutes after you configure the account. If you use an unconfigured database account to query data, the query results are in plaintext.
Open your application and connect to the target database.
After you connect to the database, locate the target table, and then run a query against the table.
After the query runs successfully, the sensitive data in the table is masked.