Snowflake Object Tagging Practical Guide: Classification, Governance, and Tag-based Masking

Object Tagging is a feature for attaching key-value metadata tags to Snowflake database objects (tables, views, columns, schemas, databases, and more). It is used for data classification (PII, sensitivity levels, etc.), cost allocation, and compliance management. Combined with Tag-based Masking / Row Access Policy, it enables automatic data protection based on tag values. Available in Enterprise Edition or higher.

Creating Tags

-- 基本的なタグの作成
CREATE TAG governance.data_classification;

-- 許可値を制限したタグの作成
CREATE TAG governance.pii_level
  ALLOWED_VALUES 'HIGH', 'MEDIUM', 'LOW', 'NONE';

-- コスト配分用タグ
CREATE TAG governance.cost_center
  ALLOWED_VALUES 'ENGINEERING', 'MARKETING', 'FINANCE', 'HR';

-- タグにコメントを追加
CREATE TAG governance.data_owner
  COMMENT = 'データオーナーの部門名を管理するタグ';

Setting Tags (on Tables and Columns)

-- テーブルにタグを設定
ALTER TABLE hr.employees
  SET TAG governance.data_classification = 'CONFIDENTIAL';

-- 列にタグを設定
ALTER TABLE hr.employees
  ALTER COLUMN ssn
  SET TAG governance.pii_level = 'HIGH';

ALTER TABLE hr.employees
  ALTER COLUMN email
  SET TAG governance.pii_level = 'MEDIUM';

ALTER TABLE hr.employees
  ALTER COLUMN department
  SET TAG governance.pii_level = 'NONE';

-- スキーマにタグを設定（配下のオブジェクトに継承される）
ALTER SCHEMA hr
  SET TAG governance.data_owner = 'HR_DEPARTMENT';

-- データベースにタグを設定
ALTER DATABASE analytics
  SET TAG governance.cost_center = 'ENGINEERING';

-- ウェアハウスにタグを設定
ALTER WAREHOUSE compute_wh
  SET TAG governance.cost_center = 'ENGINEERING';

-- タグの値を変更
ALTER TABLE hr.employees
  ALTER COLUMN ssn
  SET TAG governance.pii_level = 'MEDIUM';

-- タグの解除
ALTER TABLE hr.employees
  ALTER COLUMN ssn
  UNSET TAG governance.pii_level;

Tag-based Masking Integration

Tag-based Masking is a mechanism that automatically applies a Masking Policy or Row Access Policy based on tag values. Once you associate a policy with a tag, the policy is automatically applied to any column where that tag is set. Because applying a policy is as simple as adding a tag to a column, governance management scales efficiently in environments with large numbers of tables and columns.

-- PII HIGH用のMasking Policy
CREATE OR REPLACE MASKING POLICY mask_pii_high
  AS (val VARCHAR) RETURNS VARCHAR ->
  CASE
    WHEN IS_ROLE_IN_SESSION('DATA_STEWARD') THEN val
    WHEN IS_ROLE_IN_SESSION('COMPLIANCE') THEN val
    ELSE '********'
  END;

-- PII MEDIUM用のMasking Policy
CREATE OR REPLACE MASKING POLICY mask_pii_medium
  AS (val VARCHAR) RETURNS VARCHAR ->
  CASE
    WHEN IS_ROLE_IN_SESSION('DATA_STEWARD') THEN val
    ELSE CONCAT(LEFT(val, 2), '****')
  END;

-- タグにMasking Policyを紐づけ
ALTER TAG governance.pii_level
  SET MASKING POLICY mask_pii_high;

-- タグの値ごとに異なるポリシーを紐づけることも可能
-- （ただし1つのタグに対してデータ型ごとに1つのポリシー）

-- これにより、pii_level = 'HIGH' のタグが設定された
-- 全ての列に自動的にmask_pii_highが適用される

Auditing with the TAG_REFERENCES Function

-- 特定テーブルに設定されたタグを確認
SELECT *
FROM TABLE(
  INFORMATION_SCHEMA.TAG_REFERENCES('hr.employees', 'TABLE')
);

-- 特定列に設定されたタグを確認
SELECT *
FROM TABLE(
  INFORMATION_SCHEMA.TAG_REFERENCES('hr.employees.ssn', 'COLUMN')
);

-- テーブル内の全列のタグを一括確認
SELECT *
FROM TABLE(
  INFORMATION_SCHEMA.TAG_REFERENCES_ALL_COLUMNS('hr.employees', 'TABLE')
);

-- Account Usageビューでアカウント全体のタグ使用状況を確認
SELECT
  tag_name,
  tag_value,
  object_name,
  column_name,
  domain  -- TABLE, COLUMN, SCHEMA, DATABASE, WAREHOUSE等
FROM SNOWFLAKE.ACCOUNT_USAGE.TAG_REFERENCES
WHERE tag_name = 'PII_LEVEL'
ORDER BY object_name;

-- 特定タグの値ごとのオブジェクト数を集計
SELECT
  tag_value,
  domain,
  COUNT(*) AS object_count
FROM SNOWFLAKE.ACCOUNT_USAGE.TAG_REFERENCES
WHERE tag_name = 'PII_LEVEL'
GROUP BY tag_value, domain
ORDER BY tag_value;

Tag Lineage (Inheritance)

When you set a tag directly on a lower-level object, that value takes precedence over inherited values. For example, if you set pii_level = 'LOW' on a schema and pii_level = 'HIGH' on a specific column,'HIGH' is the effective value for that column.

Required Privileges

-- タグの作成権限
GRANT CREATE TAG ON SCHEMA governance TO ROLE tag_admin;

-- タグの適用権限
GRANT APPLY TAG ON ACCOUNT TO ROLE tag_admin;

-- Tag-based Masking Policyの設定に必要な追加権限
GRANT APPLY MASKING POLICY ON ACCOUNT TO ROLE tag_admin;

-- タグの一覧確認
SHOW TAGS IN SCHEMA governance;

-- タグの詳細確認
DESCRIBE TAG governance.pii_level;

Check Your Understanding

Frequently Asked Questions