Dynamic Tables Masking Policies

[kokorin]

SnowDDL doc says regarding references property in masking policy:

Parameter references is deprecated since 0.33.0. Use policy reference parameters directly in TABLE or VIEW configs instead.

We want to apply masking/row policy on Dynamic Table.

Should we use legacy references property of masking policy or is there any other way to apply it using SnowDDL?

[littleK0i]

Try version 0.53.0+.

Added policy references for dynamic tables: https://docs.snowddl.com/basic/yaml-configs/dynamic-table

We still have some work to do which is related to "intention cache". For example, if dynamic table is about to be replaced AND we do not have --apply-unsafe, SnowDDL will generate REPLACE command, but not policy reference updates.

Make sure to run SnowDDL twice to make sure re-created objects are actually covered by policies.

Snowflake policies are finicky, prone to race conditions and sudden changes. Downtime, access restrictions and additional testing are pretty much required with the current implementation. Otherwise you risk suddenly exposing some data to end users if something goes wrong.

I would generally suggest to avoid using policies and prioritise secure views for access control.