Ranger Tag-Based Masking in BigQuery¶

This guide explains how to configure and use Ranger tag-based masking in the BigQuery Connector. It applies to Ranger-managed tags (not service tags), where Privacera/Ranger serves as the single source of truth.

BigQuery supports two approaches for tag-based masking:

• Service Tags: Tags are created and managed directly in BigQuery and automatically synchronized with Privacera. This approach requires manual configuration in BigQuery and offers limited flexibility compared to Ranger-managed tags.

• Ranger Tags: Tags are created and managed entirely within Privacera. The connector automatically handles BigQuery policy tag creation, taxonomy management, and column associations. This approach provides full control and eliminates the need for manual configuration in BigQuery.

Overview¶

Introduction¶

Ranger tag-based masking with Privacera allows administrators to define and manage tags directly in Privacera, while the connector automatically synchronizes them with BigQuery. This ensures that Privacera/Ranger remains the single source of truth for masking and access control policies, providing centralized governance and consistency.

Key benefits:

• Maintain full control over tag definitions in Privacera.
• Automatically create BigQuery policy tags, taxonomy, and column associations.
• Simplify management by eliminating manual setup in BigQuery.

Comparison: Service Tags vs. Ranger Tags¶

Configuration Requirements¶

By default, the BigQuery connector is configured to use service tags (USE_SERVICE_TAGS=true). To enable Ranger tag-based masking, you must disable service tags by setting USE_SERVICE_TAGS=false. The exact configuration steps depend on your deployment type.

Configuration Steps¶

Prerequisites¶

• BigQuery connector installed and running.
• Service tags disabled (USE_SERVICE_TAGS=false). See Configuration Requirements for setup instructions.
• Row filter and masking setup completed Native Row Filter and Tag Masking Setup.
• BigQuery Policy Tag Taxonomy: A policy tag taxonomy must exist in BigQuery before creating Ranger tags. The connector will create policy tags within this taxonomy automatically, but the taxonomy itself must be pre-created in BigQuery.

Tag Naming Requirements¶

When creating Ranger tags for BigQuery, follow these naming conventions:

• Tag names must be unique within your Privacera environment
• Use descriptive names that clearly identify the purpose (e.g., customer_pii_tag, financial_data_tag)
• Avoid special characters that might cause issues with BigQuery policy tag creation
• Consider including project context in the name for better organization (e.g., project_name_data_type_tag)

Required Fields for BigQuery Tag Creation¶

When creating Ranger tags for BigQuery, you must configure the following required fields:

Use Cases¶

Applying Ranger Tag-Based Masking Policy for End User¶

This guide outlines the steps to create Ranger tag-based masking policies in Privacera using traditional Ranger tags with custom attributes.

Scenario

• Project: forward-camera-182345
• Dataset: test_db
• Table: test_data
• Policy Tag Taxonomy ID: 12345678 (sample ID - see Required Fields for details)
• Tag Name: forward_camera_182345_priv_tag_id (sample name)
• Users:
  • test_user1 (masked access),
  • test_user2 (unmasked access)

Step 1: Create Tag Definition¶

1. In Privacera Portal, navigate to Access Management → Tag Management then click Create Tag.
2. Configure the tag:
   • Tag Name: forward_camera_182345_priv_tag_id
   • Add Tag Attribute Definitions:
     • taxonomyId (int): BigQuery policy tag taxonomy ID where the policy tag will be created. This must be a valid taxonomy ID from your BigQuery project.
     • project (string): BigQuery project name where the taxonomy exists. This should match the project where your BigQuery connector is configured.
3. Click SAVE.

Step 2: Create Tag Resource Mapping¶

1. In Tag Management, go to RANGER TAGGED RESOURCES → Tag Resource.

2. Configure the following settings:

   • Service: privacera_bigquery
   • Tag: forward_camera_182345_priv_tag_id
   • Resource Type: Select the appropriate resource type, then specify values for project, dataset, table, and column.
   • taxonomyId: 12345678 (must match the taxonomyId from Step 1)

   • project: forward-camera-182345 (must match the project from Step 1)

     Note

     Ensure that both taxonomyId and project values match those defined in Step 1 and correspond to the same project location where the BigQuery connector is configured. The connector will create policy tags under the specified taxonomy in the specified project.

3. Click SAVE.

Step 3: Create Resource-Based Access Policies¶

Job Creation Policy¶

1. Login to Privacera Portal.
2. Navigate to Access Management → Resource Policies → BigQuery connector.
3. Under Access tab, click on ADD NEW POLICY.
4. Create Resource-Based Policy:
   • Policy Type: Access Policy
   • Policy Name: Provide name for the access policy e.g. Job Create for Users.
   • Project ID: Provide project id e.g. forward-camera-182345.
   • Dataset Name: Select as none.
   • Select User: Assign appropriate users e.g. test_user1, test_user2.
   • Permissions: Provide Job Create permission.
5. Click SAVE.

Query Access Policy¶

Create another resource-based policy for Query permission on table resource.

• Policy Type: Access Policy
• Policy Name: Provide name for the access policy e.g. Table Level Select.
• Project ID: Provide project name e.g. forward-camera-182345
• Dataset Name: test_db
• Table Name: customer_data
• Select User: Assign appropriate users e.g. test_user1, test_user2.
• Permissions: Provide Query permission.
• Click SAVE.

Step 4: Create Tag-Based Masking Policy¶

1. In Privacera Portal, navigate to Access Management → Tag Policies → privacera_tag.
2. Under MASKING tab, click ADD NEW POLICY.
3. Configure masking policy:
   • Policy Type: Masking
   • Policy Name: Provide name for the masking policy e.g. Tag based masking policy.
   • TAG: Select required tag from the drop-down e.g.forward_camera_182345_priv_tag_id.
   • Select User: Assign appropriate user e.g. test_user1.
   • Component Permissions: bigquery
   • Select Masking Option: Select desired masking option e.g. Nullify.
4. Click SAVE.

Step 5: Create Tag-Based Access Policy¶

Create another tag-based access policy for Query permission.

1. In Tag Policies, under ACCESS tab, click ADD NEW POLICY.
2. Configure access policy:
   • Policy Type: Tag-Based Access Policy
   • Policy Name: Provide name for the access policy e.g. Tag based column access policy.
   • Tag: forward_camera_182345_priv_tag_id
   • Select User: Assign appropriate user e.g. test_user2.
   • Component Permissions: Select component as bigquery and permissions as query.
3. Click SAVE.

Limitations¶

1. Access Denied After Tag Resource Mapping:

   • Users cannot query tagged columns unless they are explicitly granted access through a tag-based masking policy or a tag-based access policy for the specific tag.

     Note

     Tag-based policies control access to the tagged column specifically, not the table itself. Without either tag-based policy, all users will receive access denied errors when querying tables with tagged columns, even if they have resource-based access to the table.

   • Refer BigQuery Column-Level Security for more details.

2. Service Tags Compatibility:

   • Ranger tag-based masking and service tags cannot be used together.
   • Ensure USE_SERVICE_TAGS=false is configured.
   • Switching between Service tags and Ranger tags requires connector restart.

3. Tag Attribute Management:

   • Custom tag attributes like taxonomyId and project must be accurate.
   • Incorrect values may cause policy sync failures.

4. Location Support in Connector's Configuration:

   • BigQuery resources and taxonomies can be created across various locations. However, the PolicySync connector currently supports access control management for resources within a single location.
   • The connector does not support the management of resources across multiple locations concurrently.
   • Ensure that your BigQuery taxonomy and all resources you want to tag are in the same location as your connector configuration.