Protect sensitive data with dynamic data masking for Amazon Aurora PostgreSQL

This article announces dynamic data masking (DDM) for Amazon Aurora PostgreSQL, a new security feature enabling column-level data protection based on user roles.

• DDM uses pg_columnmask extension to mask sensitive data in real-time during query processing
• Maintains single data copy with no duplication, synchronization, or storage overhead
• Integrates with PostgreSQL row-level security for comprehensive granular access control
• Policy-based masking applies transformations based on user roles without application changes
• Supports weighted policies for role hierarchies; higher weights take precedence
• Available for Aurora PostgreSQL versions 16.10 and higher, and 17.6
• Includes built-in masking functions: mask_text, mask_email, mask_timestamp
• Operates at database rewrite stage, transparent to applications
• Helps meet compliance requirements: GDPR, HIPAA, PCI DSS

Aurora DDM provides enterprise-grade data protection by enabling role-based real-time masking while maintaining data utility for authorized users, eliminating traditional masking approach limitations.