Mask a field for consumers onlyv1.3+
Redact an email field for the client that reads it. The record in the backend cluster doesn’t change, so systems that are permitted to see the original value keep their access to it.
The email strategy applies a separate strategy to each part of the address.
This example keeps the first character of the local part and the whole domain, which is enough to recognize an account
without exposing the full address.
Prerequisites
- A Schema Validation Consume policy that parses the record value.
Environment variables
PARENT_POLICY_ID: The UUID of the parent Schema Validation policy.
curl -X POST https://{region}.api.konghq.com/v1/event-gateways/{eventGatewayId}/virtual-clusters/{virtualClusterId}/consume-policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "mask-email-consume",
"type": "mask_fields",
"parent_policy_id": "'$PARENT_POLICY_ID'",
"config": {
"failure_mode": "skip",
"mask_fields": [
{
"paths": [
{
"match": "user.email"
}
],
"strategy": {
"type": "email",
"local_part": {
"type": "keep_chars",
"first": 1,
"last": 0,
"phrase": "***"
},
"domain": {
"type": "keep_all"
}
}
}
]
}
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
virtualClusterId: Theidof the Virtual Cluster. -
eventGatewayId: Theidof the Event Gateway. -
eventGatewayListenerId: Theidof the Event Gateway Listener.
See the Konnect Event Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect-beta = {
source = "kong/konnect-beta"
}
}
}
provider "konnect-beta" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_event_gateway_consume_policy_mask_fields" "my_virtual_cluster_policy_mask_fields" {
provider = konnect-beta
type = "mask_fields"
parent_policy_id = var.parent_policy_id
config = {
failure_mode = "skip"
mask_fields = [
{
paths = [
{
match = "user.email"
} ]
strategy = {
type = "email"
local_part = {
type = "keep_chars"
first = 1
last = 0
phrase = "***"
}
domain = {
type = "keep_all"
}
}
} ]
}
virtual_cluster_id = konnect_event_gateway_virtual_cluster.my_virtual_cluster.id
gateway_id = konnect_event_gateway.my_event_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "parent_policy_id" {
type = string
}The following example creates a new mask_fields policy.
event_gateways:
- ref: eventGatewayName
name: eventGatewayName
virtual_clusters:
- ref: virtualClusterName
name: virtualClusterName
consume_policies:
- ref: mask-email-consume
type: mask_fields
mask_fields:
name: mask-email-consume
parent_policy_id: !env PARENT_POLICY_ID
config:
failure_mode: skip
mask_fields:
- paths:
- match: user.email
strategy:
type: email
local_part:
type: keep_chars
first: 1
last: 0
phrase: "***"
domain:
type: keep_allMake sure to replace the following placeholders with your own values:
-
eventGatewayName: Thenameof your Event Gateway. -
virtualClusterName: Thenameof the Virtual Cluster.