How to Hide Schemas From Users in Redshift

Today, the activity of any organization is associated with the operation of a large amount of information, access to which has a wide range of people. Consequently, the complexity of ensuring the confidentiality of sensitive data increases, along with the growth of the volume of data processed in companies. Therefore, the protection of data from unauthorized access, from unauthorized modification or simply from destruction is one of the priorities. Data masking is one of the effective methods of protecting important information from unauthorized access.

The Hide Rows option of the Data Sunrise Dynamic Masking allows you to create certain rules to hide part of the data from a certain group of users, preserving the general information structure and leaving available that part of the data that is necessary for work. As an example, consider how Dynamic Masking rules with the Hide Rows option can be used to hide specific schemas in the Redshift database from a group of users.

The information about the schemas in DB is contained in the system table <your_database>.pg_catalog.pg_namespace. Thus, by applying appropriate conditions to the columns of this table, you can hide some of the schemas from specific users.

Imagine you have schemas “test1” and “test2” and you want only these 2 schemas to be visible for “user1”, “user2” and “user3”. Below is a step-by-step guide on how to implement this scenario:

• Navigate to Masking –> Dynamic Masking Rules then click on Add Rule.
• In the Rule Details page, fill up the required fields such as Name, Database Type and Instance. Enable Log Event in Storage checkbox to see events in the Dynamic Masking Events section. Other fields are optional and can be filled up as necessary or required.
• In the Filter Sessions, add a condition for which the rule should be applied, example DB User if the rule is applicable for specific users or DB User Group for a set of users within the group.
• In the Masking Settings, click on Select in the Tables to Hide rows in, the Check Columns modal window will appear.
• In the Check Columns modal window left portion, (a) enter the Database(s) name for which the rule should be applied, (b) enter “pg_catalog” in the Find Schemas field, (c) enter “pg_namespace” in the Find Tables field then click on the Filter button. The filter will be applied to the Object Explorer menu, tick the checkbox beside the “pg_namespace” table then click Done.
• In the column condition field, enter nspname LIKE ‘%test%’ then Save the rule.
• Connect to Redshift database via proxy on behalf of “user1” specified in Dynamic Masking rule.
• When connecting to the database, this “user1” will see only “test1” and “test2” schemas.
• To hide all schemas except of public from “user3” specify the following condition nspowner = 1 and nspname = ‘public’.
• Only the “public” schema will be visible to user3 in such case.
• To hide all schemas use condition nspowner is NULL, which is false by default

• In this case, users included in the DB User Group will not see any scheme at all when connecting to the database via proxy.