Skip to content

Conversation

@ecmadao
Copy link
Collaborator

@ecmadao ecmadao commented Aug 25, 2025

Support multiple columns, members and actions

resource "bytebase_policy" "masking_exception_policy" {
  depends_on = [
    bytebase_project.sample_project,
    bytebase_instance.test,
    bytebase_user.project_developer,
    bytebase_user.workspace_dba
  ]

  parent              = bytebase_project.sample_project.name
  type                = "MASKING_EXCEPTION"
  enforce             = true
  inherit_from_parent = false

  masking_exception_policy {
    exceptions {
      database = "instances/test-sample-instance/databases/employee"
      table    = "salary"
      columns  = ["amount", "emp_no"]
      members = [
        format("user:%s", bytebase_user.project_developer.email),
        format("user:%s", bytebase_user.workspace_dba.email),
      ]
      actions = ["QUERY", "EXPORT"]
      reason  = "Grant access"
    }

    exceptions {
      database = "instances/test-sample-instance/databases/employee"
      table    = "employee"
      columns  = ["emp_no"]
      members = [
        format("user:%s", bytebase_user.workspace_dba.email),
      ]
      actions = ["EXPORT"]
      reason  = "Grant access"
    }

    exceptions {
      members = [
        format("user:%s", bytebase_user.project_developer.email),
      ]
      actions        = ["QUERY"]
      reason         = "Grant query access"
      raw_expression = "resource.instance_id == \"test-sample-instance\" && resource.database_name == \"employee\" && resource.table_name == \"employee\" && resource.column_name in [\"first_name\", \"last_name\", \"gender\"]"
    }
  }
}

@ecmadao ecmadao requested a review from d-bytebase August 25, 2025 09:29
@ecmadao
Copy link
Collaborator Author

ecmadao commented Aug 25, 2025

Do not merge

Copy link
Contributor

@d-bytebase d-bytebase left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a do not merge comment

@ecmadao ecmadao merged commit ca3f099 into main Aug 25, 2025
3 checks passed
@ecmadao ecmadao deleted the chore/BYT-7934 branch August 25, 2025 09:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants