Snowflake Object Tagging Practical Guide: Classification, Governance, and Tag-based Masking

Object Tagging is a feature for attaching key-value metadata tags to Snowflake database objects (tables, views, columns, schemas, databases, and more). It is used for data classification (PII, sensitivity levels, etc.), cost allocation, and compliance management. Combined with Tag-based Masking / Row Access Policy, it enables automatic data protection based on tag values. Available in Enterprise Edition or higher.

Creating Tags

-- Creating a basic tag
CREATE TAG governance.data_classification;

-- Creating a tag with allowed values
CREATE TAG governance.pii_level
  ALLOWED_VALUES 'HIGH', 'MEDIUM', 'LOW', 'NONE';

-- Tag used for cost allocation
CREATE TAG governance.cost_center
  ALLOWED_VALUES 'ENGINEERING', 'MARKETING', 'FINANCE', 'HR';

-- Add a comment to the tag
CREATE TAG governance.data_owner
  COMMENT = 'Tag that records the owning department for the data';

Setting Tags (on Tables and Columns)

-- Set a tag on a table
ALTER TABLE hr.employees
  SET TAG governance.data_classification = 'CONFIDENTIAL';

-- Set a tag on a column
ALTER TABLE hr.employees
  ALTER COLUMN ssn
  SET TAG governance.pii_level = 'HIGH';

ALTER TABLE hr.employees
  ALTER COLUMN email
  SET TAG governance.pii_level = 'MEDIUM';

ALTER TABLE hr.employees
  ALTER COLUMN department
  SET TAG governance.pii_level = 'NONE';

-- Set a tag on a schema (inherited by the objects beneath it)
ALTER SCHEMA hr
  SET TAG governance.data_owner = 'HR_DEPARTMENT';

-- Set a tag on a database
ALTER DATABASE analytics
  SET TAG governance.cost_center = 'ENGINEERING';

-- Set a tag on a warehouse
ALTER WAREHOUSE compute_wh
  SET TAG governance.cost_center = 'ENGINEERING';

-- Change a tag value
ALTER TABLE hr.employees
  ALTER COLUMN ssn
  SET TAG governance.pii_level = 'MEDIUM';

-- Unset a tag
ALTER TABLE hr.employees
  ALTER COLUMN ssn
  UNSET TAG governance.pii_level;

Tag-based Masking Integration

Tag-based Masking is a mechanism that automatically applies a Masking Policy or Row Access Policy based on tag values. Once you associate a policy with a tag, the policy is automatically applied to any column where that tag is set. Because applying a policy is as simple as adding a tag to a column, governance management scales efficiently in environments with large numbers of tables and columns.

-- Masking Policy for PII HIGH
CREATE OR REPLACE MASKING POLICY mask_pii_high
  AS (val VARCHAR) RETURNS VARCHAR ->
  CASE
    WHEN IS_ROLE_IN_SESSION('DATA_STEWARD') THEN val
    WHEN IS_ROLE_IN_SESSION('COMPLIANCE') THEN val
    ELSE '********'
  END;

-- Masking Policy for PII MEDIUM
CREATE OR REPLACE MASKING POLICY mask_pii_medium
  AS (val VARCHAR) RETURNS VARCHAR ->
  CASE
    WHEN IS_ROLE_IN_SESSION('DATA_STEWARD') THEN val
    ELSE CONCAT(LEFT(val, 2), '****')
  END;

-- Attach the Masking Policy to the tag
ALTER TAG governance.pii_level
  SET MASKING POLICY mask_pii_high;

-- You can attach a different policy per tag value
-- (though only one policy per data type for a given tag)

-- As a result, mask_pii_high is applied automatically to every column
-- tagged with pii_level = 'HIGH'

Auditing with the TAG_REFERENCES Function

-- Check the tags set on a specific table
SELECT *
FROM TABLE(
  INFORMATION_SCHEMA.TAG_REFERENCES('hr.employees', 'TABLE')
);

-- Check the tags set on a specific column
SELECT *
FROM TABLE(
  INFORMATION_SCHEMA.TAG_REFERENCES('hr.employees.ssn', 'COLUMN')
);

-- Check the tags on every column of a table at once
SELECT *
FROM TABLE(
  INFORMATION_SCHEMA.TAG_REFERENCES_ALL_COLUMNS('hr.employees', 'TABLE')
);

-- Check account-wide tag usage through the Account Usage views
SELECT
  tag_name,
  tag_value,
  object_name,
  column_name,
  domain  -- TABLE, COLUMN, SCHEMA, DATABASE, WAREHOUSE, and so on
FROM SNOWFLAKE.ACCOUNT_USAGE.TAG_REFERENCES
WHERE tag_name = 'PII_LEVEL'
ORDER BY object_name;

-- Count objects per value of a given tag
SELECT
  tag_value,
  domain,
  COUNT(*) AS object_count
FROM SNOWFLAKE.ACCOUNT_USAGE.TAG_REFERENCES
WHERE tag_name = 'PII_LEVEL'
GROUP BY tag_value, domain
ORDER BY tag_value;

Tag Lineage (Inheritance)

When you set a tag directly on a lower-level object, that value takes precedence over inherited values. For example, if you set pii_level = 'LOW' on a schema and pii_level = 'HIGH' on a specific column,'HIGH' is the effective value for that column.

Required Privileges

-- Privilege to create tags
GRANT CREATE TAG ON SCHEMA governance TO ROLE tag_admin;

-- Privilege to apply tags
GRANT APPLY TAG ON ACCOUNT TO ROLE tag_admin;

-- Extra privileges needed to set up Tag-based Masking Policies
GRANT APPLY MASKING POLICY ON ACCOUNT TO ROLE tag_admin;

-- List the tags
SHOW TAGS IN SCHEMA governance;

-- Tag details
DESCRIBE TAG governance.pii_level;

Check Your Understanding

Frequently Asked Questions