Quanlong Huang created IMPALA-9352:
--------------------------------------
Summary: Impala doc: Document Impala Column Masking Support
Key: IMPALA-9352
URL: https://issues.apache.org/jira/browse/IMPALA-9352
Project: IMPALA
Issue Type: Documentation
Reporter: Quanlong Huang
Assignee: Kris Hahn
Impala supports Ranger column masking in the comming release version
(Impala-3.4). The feature is disabled by default. It can be turned on by adding
--enable_column_masking flag to all coordinators.
The behavior is the same as Hive column masking. All builtin mask types are
supported:
|*Type*|*Name*|*Description*|*Transformer*|
|MASK|Redact|Replace lowercase with 'x', uppercase with 'X', digits with
'0'|mask(\{col})|
|MASK_SHOW_LAST_4|Partial mask: show last 4|Show last 4 characters; replace
rest with 'x'|mask_show_last_n(\{col}, 4, 'x', 'x', 'x', -1, '1')|
|MASK_SHOW_FIRST_4|Partial mask: show first 4|Show first 4 characters; replace
rest with 'x'|mask_show_first_n(\{col}, 4, 'x', 'x', 'x', -1, '1')|
|MASK_HASH|Hash|Hash the value|mask_hash(\{col})|
|MASK_NULL|Nullify|Replace with NULL| |
|MASK_NONE|Unmasked (retain original value)|No masking| |
|MASK_DATE_SHOW_YEAR|Date: show only year|Date: show only year|mask(\{col},
'x', 'x', 'x', -1, '1', 1, 0, -1)|
|CUSTOM|Custom|Custom| |
For more about column masking policies, see
[https://cwiki.apache.org/confluence/display/RANGER/Row-level+filtering+and+column-masking+using+Apache+Ranger+policies+in+Apache+Hive]
Known issues:
* Column masking policies on tables containing nested types would fail to
apply (IMPALA-9329, IMPALA-9230).
* Column masking policies require users to have SELECT privileges for all
columns of a masked table (IMPALA-9223).
* Ranger audits for applying column masking policies are not produced
(IMPALA-9350).
The work for fixing these issues is on-going. It's possible that some of them
be fixed before the release then we can remove them.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
