Snowflake is happy to announce the availability of the Object Tagging feature in public preview today! This feature makes it easier for enterprises to know and control their data by applying business context, such as tags that identify data objects as sensitive, PII, or belonging to a cost center. Object Tagging broadens Snowflake’s native data governance capabilities by adding to existing governance capabilities such as Snowflake’s Dynamic Data Masking and Row Access Policies.
Knowing where data resides is often the first step to protect it with appropriate access controls. For sensitive data such as tables with financial reports or columns with PII or PHI, knowing where data resides within your vast data estate is critical to satisfy regulatory compliance requirements.
How Object Tagging Works
Snowflake’s Object Tagging feature offers native capabilities to easily address these use cases by creating your own library of custom tags and associating tags to desired objects such as columns, tables/views, databases, warehouses, and more. A tag can be assigned a string value upon associating the tag to an object. For example, you can tag a column with PII such as a phone number with PII = "Phone Number" and another column containing email addresses with PII = "Email". In this example, PII is the tag and "Phone Number" or "Email" are tag values. Similarly, you can tag your warehouses with business attributes such as a cost center or department. For example, you can tag a warehouse that is dedicated to the sales department with Department = "Sales" and another warehouse dedicated to the finance department with Department = "Finance". As you can see, you can break down your credit consumption and usage based on the department for reporting purposes.
Example: Tagging Sensitive Data
Let’s look at the benefits of using the Object Tagging feature with the example of an administrator, Morgan, who is tasked with keeping track of tables that have confidential data and columns with PII. In this example, Morgan creates a centralized tag library for consistency across the data estate but relies on data owners such as Alex to provide input about the sensitivity of the data they own.
Morgan starts by creating a library of tags in a centralized schema called TAG_LIBRARY. This makes it easier to maintain a centralized taxonomy of tags that can be applied to account- and schema-level objects across the account. Morgan grants Alex the privilege to APPLY the tag to objects owned by Alex, as shown below.
Alex owns the Clients table. The Clients table is a confidential table and has a Phone column that contains PII. As soon as the table is created, Alex performs his duties as a data owner and tags the table and column with a corresponding tag, as follows.
With data owners such as Alex using centralized tags to assign the appropriate tags to sensitive data, Morgan can routinely perform reporting of PII data as well as apply masking policies to sensitive data. Morgan uses the new TAG_REFERENCES account usage view to track newly tagged objects. Morgan additionally uses the POLICY_REFERENCES account usage view to ensure that sensitive columns have a corresponding masking policy associated with them.
Example: Tagging Cost Center
The PII column tracking example illustrates how Object Tagging works, but it can be used to address other use cases. Knowing the cost center that consumes the data or warehouse credits is important to break down consumption for cost reporting and chargeback. The Tag_References account usage view can be used along with Warehouse_Metering_History to report warehouse credit consumption for each cost center tag, as shown in the example below.
You can review the Snowflake Summit data governance webinar for use cases, benefits, and demos of using Object Tagging along with other data governance capabilities such as Masking Policies, Row Access Policies, and Access History. Detailed documentation can be found here.
Object Tagging provides native tagging capabilities in Snowflake so that you can confidently track sensitive and PII data across all objects in Snowflake. Try the functionality today and share your feedback with us!