Concepts

BigQuery Data Masking with OpenID Connect (OIDC)

Andrios Robert

Aug 25, 2022 • 2 min read

Data privacy and security are critical when accessing and utilizing sensitive data in BigQuery. Implementing data masking ensures that only authorized users see specific sensitive information, protecting it from misuse while maintaining functionality for analysis. OpenID Connect (OIDC) offers a seamless way to control user authentication and authorization, making it an excellent pairing with BigQuery for securing and masking data.

This article explores how to implement data masking in Google BigQuery using OIDC, providing a practical approach to safeguard sensitive information while maintaining organizational productivity.

Why Combine BigQuery Data Masking with OpenID Connect (OIDC)?

BigQuery is a powerful platform for analytics, but it needs fine-grained access controls to handle sensitive data effectively. Data masking helps protect sensitive data by allowing users to see only the level of detail they are authorized for, based on their roles or identities.

OIDC simplifies user authentication by letting you handle identity federation securely. By integrating OIDC with BigQuery, you can map identity claims, such as user roles or groups, to appropriate data masking policies. The result is a secure and dynamic access control mechanism.

Key Benefits of BigQuery Data Masking with OIDC

1. Protect Sensitive Information

Data masking ensures sensitive details like Personally Identifiable Information (PII) or financial data are hidden from users who don't need full visibility. For instance, a masked credit card number might appear as ****-****-****-1234.

2. Dynamic Access Control

OIDC enables an automated way to enforce access controls. Claims in the OIDC token can carry user-level metadata, such as roles or organization units, which BigQuery policies can use to determine access levels dynamically.

3. Enhanced Compliance

Whether it’s GDPR, HIPAA, or other regulatory standards, combining masking with precise access control supports security and compliance without manual intervention.

Step-by-Step Implementation Guide

Implementing data masking in BigQuery with OIDC involves the following steps:

Step 1: Set Up an OIDC Provider

Choose an OIDC-compliant identity provider like Google, Okta, or Auth0. Configure your identity provider to manage users, roles, and claims needed for access control.

Step 2: Configure Authentication for BigQuery

Set up OIDC authentication for your BigQuery project. Use Google Identity Federation to allow users to authenticate via your chosen OIDC provider.

Step 3: Define Data Masking Policies in BigQuery

Use BigQuery Data Policy Tags to define data masking levels. For example:

Plaintext: Full access to sensitive data.
Masked: Obfuscates sensitive information.
No Access: Completely hides the field.

Apply policies like:

CREATE POLICY TAG secure_data.mask_ssn;

CREATE DATA MASKING POLICY
 database.hr.employees.SSN AS
 CASE
 WHEN USER_ROLE = 'Admin' THEN SSN
 ELSE FORMAT("XXX-XX-%s", SUBSTR(SSN, 8, 4))
 END;

This example masks Social Security Numbers while allowing admins full visibility.

Step 4: Integrate OIDC Claims with BigQuery Policies

Bind OIDC claims (e.g., department, role) to roles or conditions for access in BigQuery. Map these claims in policies like:

GRANT USER_ROLE TO team_lead_123
WITH TAGS (secure_data.mask_ssn);

This allows your OIDC claims to dynamically enforce masking rules.

Step 5: Test Your Configuration

Run queries in BigQuery as different roles to confirm that masking is correctly applied. Ensure unauthorized roles or users cannot see sensitive data.

How This Works in Practice

When a user authenticates with OIDC, their token contains claims related to their identity. BigQuery picks up these claims and evaluates them against its data policies. If a user has permission to see sensitive data, they’ll view it unmasked. If not, they’ll see a masked version or be blocked altogether.

This dynamic approach removes the need for hardcoded or manual control, simplifying secure data access management at scale.

Secure Your BigQuery Data in Minutes

BigQuery and OIDC are better together for managing sensitive data securely. With data masking powered by OIDC claims, organizations can reduce risk and meet compliance requirements without sacrificing usability or efficiency.

Want to see it in action? Try configuring dynamic policies with Hoop.dev today. Experience how easily you can set up roles-based access and data masking for your BigQuery workloads—no weeks-long configurations required. Start building robust policies with real-time testing in minutes.