Declarative Masking Policy Attachments in DCM Projects on Snowflake

DCM Projects now supports the ATTACH MASKING POLICY statement in its definition files. This allows you to declaratively manage the lifecycle of assigning masking policies to tables, Apache Iceberg tables, views, or dynamic tables during deployments.

Use cases

Imagine you need to enforce security rules on sensitive columns across multiple tables without managing those links manually in each environment. With this feature, you can:

• Associate masking policies with tables, views, and dynamic tables using project definition files.
• Automate the lifecycle of these attachments during deployments.
• Keep data governance in sync with your codebase versioning.

How to use

ATTACH MASKING POLICY my_mask_policy
  TO TABLE my_catalog.my_schema.my_table (my_column);

What happens in this code:

1. DCM identifies the attachment statement in the definition file.
2. The specified masking policy is bound to the target column during the deployment process.
3. The attachment lifecycle is now controlled by the project.

Limitations and requirements

• Available in Public Preview.
• Available to all accounts.
• DCM Projects manages the attachment, but the prior creation of the policy and table must be handled separately.