This Quick Start Guide is intended for Data Owners and Data Stewards or any other role responsible for securing sensitive data in your Snowflake data warehouses. Its purpose is to demonstrate how ALTR automates data governance.

Prerequisites

What You'll Learn

What You'll Build

Create a sample database

-- Use ACCOUNTADMIN role
USE ROLE ACCOUNTADMIN;

-- Create Sample Database
CREATE DATABASE ALTR_GETTING_STARTED_DB;

-- Set DB Context
USE DATABASE  ALTR_GETTING_STARTED_DB;

-- Populate Sample database from Snowflakes shared sample database. 
-- Usually named: SNOWFLAKE_SAMPLE_DATA
CREATE TABLE SAMPLE_CUSTOMER AS 
    SELECT 
        C_FIRST_NAME,
        C_LAST_NAME,
        C_EMAIL_ADDRESS,
        C_BIRTH_COUNTRY
    FROM SNOWFLAKE_SAMPLE_DATA.TPCDS_SF10TCL.CUSTOMER
    LIMIT 10000;

Create a new ALTR Account

Set your ALTR Password and run ALTR Setup Wizard

ALTR Setup Screen

Log in to Snowflake and run the ALTR Stored Procedure

  CALL "PC_ALTR_DB"."PUBLIC"."SETUP_ALTR_SERVICE_ACCOUNT"(TRUE);

  CALL "PC_ALTR_DB"."PUBLIC"."SETUP_ALTR_SERVICE_ACCOUNT"(FALSE);

Connect ALTR to Sample Database

Start the data classification job

View the classification report

Tell ALTR to start "Following" the C_EMAIL_ADDRESS column

Create a policy defining what Snowflake roles will view email addresses unmasked

Create a policy defining which Snowflake roles will view email addresses partially masked

Create a policy defining which Snowflake roles will view email addresses fully masked

Copy test SQL into a new worksheet.

Copy the SQL code below into a new worksheet. This sheet has commands and queries we will use to test the policies you just created. The first section grants access to the sample database for the SYSADMIN, SECURITYADMIN, and PUBLIC roles. The next section is a series of tests that show ALTR enforcing policy based on a users Snowflake role.

--
-- Grant access to the sample database to our test roles:
--
use database ALTR_GETTING_STARTED_DB;
use role accountadmin;

grant select on table SAMPLE_CUSTOMER to role SECURITYADMIN;
grant usage on database ALTR_GETTING_STARTED_DB to role SECURITYADMIN;
grant usage on schema PUBLIC to role SECURITYADMIN;
grant usage on warehouse COMPUTE_WH to role SECURITYADMIN;

grant select on table SAMPLE_CUSTOMER to role SYSADMIN;
grant usage on database ALTR_GETTING_STARTED_DB to role SYSADMIN;
grant usage on schema PUBLIC to role SYSADMIN;
grant usage on warehouse COMPUTE_WH to role SYSADMIN;

grant select on table SAMPLE_CUSTOMER to role PUBLIC;
grant usage on database ALTR_GETTING_STARTED_DB to role PUBLIC;
grant usage on schema PUBLIC to role PUBLIC;
grant usage on warehouse COMPUTE_WH to role PUBLIC;

-- warehouse
use COMPUTE_WH;

-- *** END OF GRANT ACCESS section ***


--
-- ALTR Policy Tests:
--

-- SECURITYADMIN gets to see emails with no masking at all:
use role SECURITYADMIN;
select * from SAMPLE_CUSTOMER;

-- SYSADMIN and ACCOUNT admin domain portion of emails only, email name portion is masked 
use role SYSADMIN;
select from SAMPLE_CUSTOMER;

use role ACCOUNTADMIN;
select from SAMPLE_CUSTOMER;

-- PUBLIC sees emails fully masked
use role PUBLIC;
select * from SAMPLE_CUSTOMER;

-- Now go into the ALTR portal and make the following changes 
-- 1. remove the PUBLIC role from the fully masked lock,
-- 2. add the PUBLIC role to the partially masked lock.

-- Run query as PUBLIC role again and observe that moving the role into the 
-- partially masked lock instantly updates access for that role

use role PUBLIC;
select * from SAMPLE_CUSTOMER;

-- See what happens when a role is not associated with any policy.  Do this by going
-- into the ALTR portal and unselecting the PUBLIC role from the partially masked lock.  
-- Make sure that the PUBLIC role is not a part of any other lock.
-- 

use role PUBLIC;
select * from SAMPLE_CUSTOMER;

Run the Grant Portion of SQL

Run the policy tests

What we covered:

Ideas for exploring futher:

Getting Help: