AWS Builder Center

Builder Center

Protect sensitive data with dynamic data masking for Amazon Aurora PostgreSQL

Protect sensitive data with dynamic data masking for Amazon Aurora PostgreSQL

Amazon Aurora PostgreSQL has introduced dynamic data masking, a new security feature that enables column-level protection of sensitive data through policy-based rules. Using the pg_columnmask extension, administrators can control how different users see sensitive information - from partial account numbers for customer service to anonymized data for analysts - without modifying applications or duplicating data.

Ibrahim Emara

This show is featuring Keyur Diwan and Sameer Kumar discussing Amazon Aurora PostgreSQL's new dynamic data masking feature announced around re:Invent time.
The episode explores dynamic data masking as a critical security mechanism that protects sensitive information by obfuscating original data with modified content in real-time, without changing the underlying data. Unlike static data masking (which permanently alters data), dynamic masking applies policies based on user roles and permissions, showing different levels of data visibility to different users. Data masking is essential for regulatory compliance (GDPR, HIPAA, PCI DSS), preventing data breaches, maintaining customer trust, and enabling organizations to share data internally while protecting sensitive information. They distinguish data masking from encryption, noting that encryption protects data in transit and at rest, while masking controls what users see when accessing data.
Aurora PostgreSQL implements dynamic data masking through the pg_column_mask extension, which leverages PostgreSQL's native query rewrite hooks between the parse and optimization phases. The extension provides built-in masking functions (like mask_text) and allows custom function creation, with policies defined using SQL-based syntax that specifies which columns to mask, which roles the policies apply to, and what masking expressions to use. A key feature is the policy admin role, which can be configured via parameter groups to delegate policy management to security operations teams without granting them data access. The solution supports multiple policies on the same table with weighted priorities (higher weights take precedence), enabling nested role hierarchies where senior analysts might see partially masked data while junior analysts see fully masked data.
Extensive testing demonstrated negligible performance overhead, with most scenarios showing less than 5% impact. The extension performs best with built-in C-language functions and PostgreSQL catalog functions, while PL/pgSQL functions may introduce slightly more overhead. Critically, there's zero performance penalty on data insertion since masking only applies during SELECT queries. The solution requires no application code changes, maintains original data types in masked results, and integrates seamlessly with Aurora features like fast cloning. Customers can define flexible masking policies using JSON format to specify column-level transformations, from complete masking to partial visibility (like showing only last four digits of credit cards) or rounding numerical values for analytical purposes.
Key Highlights:
  • No application changes required - masking policies applied at database level through extension
  • Zero insertion overhead - data stored unmodified; masking only applies on SELECT queries
  • Flexible policy management - supports multiple policies per table with weighted priorities for role hierarchies
  • Built-in and custom functions - includes functions like  mask_text  plus ability to create custom masking logic
  • Negligible performance impact - less than 5% overhead in most scenarios when using optimized functions
  • Role-based access control - different users see different data based on their assigned roles
  • Complements Aurora features - works seamlessly with fast cloning without rewriting data
  • Centralized security management - policy admin role separates security operations from data access
  • Production-ready - customers already testing and deploying in production environments
  • Regulatory compliance - helps meet GDPR, HIPAA, PCI DSS requirements without complex workarounds


Hosts of the show 🎤

 Ibrahim Emara  - Database Specialist SA @AWS

Guests 🎤

 Sameer Kumar  - Principal Database Specialist @AWS
 Keyur Diwan  - Principal Product Manager @AWS
# amazon-aurora# security-and-compliance# encryption
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article