A financial services company uses BigQuery for analytics and needs to implement column-level security such that users with the role 'data_scientist' can see the last four digits of credit card numbers, while the full number is visible only to 'data_owner'. What approach should they use?
Trap 1: Set an IAM condition on the table that filters the column based on…
IAM conditions cannot filter columns.
Trap 2: Use row-level security to restrict rows based on role.
Row-level security controls rows, not columns.
Trap 3: Create two separate BigQuery tables (one with masked data, one with…
While possible, it is not the recommended approach; policy tags are more manageable and scalable.
- A
Use a policy tag with a data masking rule that masks the full number except last four digits, and grant UNMASKED access to data_owner and MASKED access to data_scientist.
This is the correct method for column-level masking.
- B
Set an IAM condition on the table that filters the column based on the user's role.
Why wrong: IAM conditions cannot filter columns.
- C
Use row-level security to restrict rows based on role.
Why wrong: Row-level security controls rows, not columns.
- D
Create two separate BigQuery tables (one with masked data, one with full data) and grant access based on role.
Why wrong: While possible, it is not the recommended approach; policy tags are more manageable and scalable.