Ranger Tag and Omni Tag-Based Masking in BigQuery¶

This guide explains how to configure and use Ranger tag-based and Omni tag-based masking in the BigQuery Connector. It applies to Ranger-managed tags and Omni tags (not service tags), where Privacera/Ranger serves as the single source of truth.

BigQuery supports two approaches for tag-based masking:

• Service Tags: Tags are created and managed directly in BigQuery and automatically synchronized with Privacera. This approach requires manual configuration in BigQuery and offers limited flexibility compared to Ranger-managed tags.

• Ranger Tags or Omni Tags: Tags are created and managed entirely within Privacera (via Ranger Tag Management or Omni Governance Hub). The connector automatically handles BigQuery policy tag creation, taxonomy management, and column associations. This approach provides full control and eliminates the need for manual configuration in BigQuery.

Overview¶

Introduction¶

Ranger and Omni tag-based masking with Privacera allows administrators to define and manage tags directly in Privacera, while the connector automatically synchronizes them with BigQuery. This ensures that Privacera/Ranger remains the single source of truth for masking and access control policies, providing centralized governance and consistency.

Key benefits:

• Maintain full control over tag definitions in Privacera.
• Automatically create BigQuery policy tags, taxonomy, and column associations.
• Simplify management by eliminating manual setup in BigQuery.

Comparison: Service Tags vs. Ranger Tags vs. Omni Tags¶

Configuration Requirements¶

By default, the BigQuery connector is configured to use service tags (USE_SERVICE_TAGS=true). To enable Ranger tag-based masking or Omni tag-based masking, you must disable service tags by setting USE_SERVICE_TAGS=false. The exact configuration steps depend on your deployment type.

Configuration Steps¶

Prerequisites¶

• BigQuery connector installed and running.
• Service tags disabled (USE_SERVICE_TAGS=false). See Configuration Requirements for setup instructions.
• Row filter and masking setup completed Native Row Filter and Tag Masking Setup.
• BigQuery Policy Tag Taxonomy: A policy tag taxonomy must exist in BigQuery before creating Ranger or Omni tags. The connector will create policy tags within this taxonomy automatically, but the taxonomy itself must be pre-created in BigQuery.

Tag Naming Requirements¶

When creating Ranger or Omni tags for BigQuery, follow these naming conventions:

• Tag names must be unique within your Privacera environment
• Use descriptive names that clearly identify the purpose (e.g., customer_pii_tag, financial_data_tag)
• Avoid special characters that might cause issues with BigQuery policy tag creation
• Consider including project context in the name for better organization (e.g., project_name_data_type_tag)

Required Fields for BigQuery Tag Creation¶

When creating Ranger or Omni tags for BigQuery, you must configure the following required fields:

Use Cases¶

Applying Ranger Tag or Omni Tag-Based Masking Policy for End User¶

This guide outlines the steps to create Ranger tag-based or Omni tag-based masking policies in Privacera using Ranger tags or Omni tags with custom attributes.

Scenario

• Project: forward-camera-182345
• Dataset: test_db
• Table: test_data
• Policy Tag Taxonomy ID: 12345678 (sample ID - see Required Fields for details)
• Tag Name: forward_camera_182345_priv_tag_id (sample name)
• Users:
  • test_user1 (masked access),
  • test_user2 (unmasked access)

Step 1: Create Tag Definition¶

Step 2: Create Tag Resource Mapping¶

Step 3: Create Resource-Based Access Policies¶

Job Creation Policy¶

1. Login to Privacera Portal.
2. Navigate to Access Management → Resource Policies → BigQuery connector.
3. Under Access tab, click on ADD NEW POLICY.
4. Create Resource-Based Policy:
   • Policy Type: Access Policy
   • Policy Name: Provide name for the access policy e.g. Job Create for Users.
   • Project ID: Provide project id e.g. forward-camera-182345.
   • Dataset Name: Select as none.
   • Select User: Assign appropriate users e.g. test_user1, test_user2.
   • Permissions: Provide Job Create permission.
5. Click SAVE.

Query Access Policy¶

Create another resource-based policy for Query permission on table resource.

• Policy Type: Access Policy
• Policy Name: Provide name for the access policy e.g. Table Level Select.
• Project ID: Provide project name e.g. forward-camera-182345
• Dataset Name: test_db
• Table Name: customer_data
• Select User: Assign appropriate users e.g. test_user1, test_user2.
• Permissions: Provide Query permission.
• Click SAVE.

Step 4: Create Tag-Based Masking Policy¶

1. In Privacera Portal, navigate to Access Management → Tag Policies → privacera_tag.
2. Under MASKING tab, click ADD NEW POLICY.
3. Configure masking policy:
   • Policy Type: Masking
   • Policy Name: Provide name for the masking policy e.g. Tag based masking policy.
   • TAG: Select required tag from the drop-down e.g.forward_camera_182345_priv_tag_id.
   • Select User: Assign appropriate user e.g. test_user1.
   • Component Permissions: bigquery
   • Select Masking Option: Select desired masking option e.g. Nullify.
4. Click SAVE.

Step 5: Create Tag-Based Access Policy¶

Create another tag-based access policy for Query permission.

1. In Tag Policies, under ACCESS tab, click ADD NEW POLICY.
2. Configure access policy:
   • Policy Type: Tag-Based Access Policy
   • Policy Name: Provide name for the access policy e.g. Tag based column access policy.
   • Tag: forward_camera_182345_priv_tag_id
   • Select User: Assign appropriate user e.g. test_user2.
   • Component Permissions: Select component as bigquery and permissions as query.
3. Click SAVE.

Tag Resource Mapping Behavior¶

When you map the same Ranger tag to resources across different BigQuery taxonomies, the connector automatically applies policies to all associated policy tags.

Multi-Taxonomy Support¶

If a single Ranger tag is mapped to columns in different taxonomies (different taxonomyId values), the following behavior applies:

• Masking Policies: Tag-based masking policies are automatically applied to all policy tags across all taxonomies where the tag is mapped.
• Fine-Grained Reader Role: Tag-based access policies (fine-grained reader role) are automatically applied to all policy tags across all taxonomies.

Policy Application Behavior¶

When you update tag resource mapping for existing tags, the connector automatically applies masking and access policies to the new or changed mappings. If policies are already enabled, they are automatically applied once the tag resource mapping update is successfully completed.

This ensures consistent policy enforcement across all taxonomies where the tag is used, simplifying management and maintaining security posture.

Updating Tag Resource Mapping with New Taxonomy ID

When the same tag name is attached to multiple table columns and the tag resource mapping is updated with a new taxonomy ID, the tag will have multiple taxonomy IDs. The policy application behavior depends on the policy types configured:

• Tag Masking + Tag Access Policy: When both tag-based masking and tag-based access policies are applied to the tag, policies are automatically applied to the new taxonomy ID. Both masking and access permissions are synchronized across all taxonomy IDs.

• Tag Masking Only: When only tag-based masking policy is enabled, the masking policy is automatically applied to the new taxonomy ID. Masking permissions are synchronized across all taxonomy IDs.

• Tag Access Policy Only: When only tag-based access policy is enabled, policies are not automatically applied to the new taxonomy ID. Manual intervention is required—you can enable or disable the policy manually to apply access policies to the new taxonomy ID.

Initial Setup Sequence for Policy Application:

• Create the tag and tag resource mapping.
• Wait for the tag and mapping creation to complete successfully.
• Create or apply policies (masking and access policies).

Limitations¶

1. Access Denied After Tag Resource Mapping:

   • Users cannot query tagged columns unless they are explicitly granted access through a tag-based masking policy or a tag-based access policy for the specific tag.

     Note

     Tag-based policies control access to the tagged column specifically, not the table itself. Without either tag-based policy, all users will receive access denied errors when querying tables with tagged columns, even if they have resource-based access to the table.

   • Refer BigQuery Column-Level Security for more details.

2. Service Tags Compatibility:

   • Ranger and Omni tag-based masking and service tags cannot be used together.
   • Ensure USE_SERVICE_TAGS=false is configured.
   • Switching between Service tags and Ranger/Omni tags requires connector restart.

3. Tag Attribute Management:

   • Custom tag attributes like taxonomyId and project must be accurate.
   • Incorrect values may cause policy sync failures.

4. Location Support in Connector's Configuration:

   • BigQuery resources and taxonomies can be created across various locations. However, the PolicySync connector currently supports access control management for resources within a single location.
   • The connector does not support the management of resources across multiple locations concurrently.
   • Ensure that your BigQuery taxonomy and all resources you want to tag are in the same location as your connector configuration.