القائمة
Apply Row Level Security (RLS) and Column Level Security (CLS) policies
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Manage GizmoSQL processes: start, stop, list, and stop-all DuckLake-backed SQL servers
Create or modify database connections in application.sl.yml
Manage Quack DuckDB query servers exposing DuckLake over a thin remote protocol — serve (foreground), start/stop/list/stop-all (background)
Automatically infer schemas and load data from the incoming directory
Data quality expectations syntax, built-in macros, and validation patterns
Run SQL or Python transformation tasks
| name | secure |
| description | Apply Row Level Security (RLS) and Column Level Security (CLS) policies |
Applies Row Level Security (RLS) and Column Level Security (CLS) policies defined in your table configurations. Security policies control which users or groups can see which rows and columns.
starlake secure [options]
--domains <value>: Comma-separated list of domains to apply security (default: all)--tables <value>: Comma-separated list of tables to apply security (default: all)--accessToken <value>: Access token for authentication (e.g. GCP)--options k1=v1,k2=v2: Substitution arguments--scheduledDate <value>: Scheduled date for the job, format: yyyy-MM-dd'T'HH:mm:ss.SSSZ--reportFormat <value>: Report output format: console, json, or htmlSecurity policies are defined in table configuration files:
Filter rows based on user/group membership:
# In table.sl.yml
table:
rls:
- name: "USA only"
predicate: "country = 'USA'"
grants:
- "group:usa_team"
- name: "Recent data"
predicate: "order_date > CURRENT_DATE - INTERVAL 90 DAY"
grants:
- "user:analyst@domain.com"
Restrict access to sensitive columns:
# In table.sl.yml
table:
attributes:
- name: "email"
type: "string"
accessPolicy: "PII"
- name: "credit_card"
type: "string"
accessPolicy: "SENSITIVE"
Grant table-level permissions:
# In table.sl.yml
table:
acl:
- role: "roles/bigquery.dataViewer"
grants:
- "user:user@domain.com"
- "group:analytics_team@domain.com"
- "serviceAccount:sa@project.iam.gserviceaccount.com"
Privacy transformations are applied during data loading to protect sensitive fields. Configure per attribute:
attributes:
- name: "ssn"
type: "string"
privacy: "HIDE" # Never stored: column is dropped
- name: "email"
type: "string"
privacy: "SHA256" # One-way hash
- name: "ip_address"
type: "string"
privacy: "MD5" # Anonymize
- name: "phone"
type: "string"
privacy: "AES" # Reversible encryption
| Type | Description | Reversible |
|---|---|---|
HIDE | Column is completely removed from output | N/A |
MD5 | MD5 hash of the value | No |
SHA1 | SHA-1 hash of the value | No |
SHA256 | SHA-256 hash of the value | No |
SHA512 | SHA-512 hash of the value | No |
AES | AES encryption (requires encryption key) | Yes |
Configure Column-Level Security policies at the application level for BigQuery:
# metadata/application.sl.yml
application:
accessPolicies:
apply: true
location: EU
taxonomy: RGPD
This enables BigQuery Data Catalog policy tags. Attributes with accessPolicy will be tagged accordingly, restricting column access to authorized users.
starlake secure
starlake secure --domains starbake
starlake secure --domains starbake --tables customers,orders