Mask Fields Produce: Mask a field before it reaches the cluster - Policy

Mask a field before it reaches the clusterv1.3+

Redact an SSN field before Event Gateway writes the record to the backend cluster.

The keep_chars strategy keeps the first character and the last two characters, and replaces the middle with ***. The phrase has a fixed length, so the masked value doesn’t reveal the length of the original.

This change is irreversible. Use the produce phase when no client, and no operator of the backend cluster, can see the original value.

Prerequisites

A Schema Validation Produce policy that parses the record value.

Environment variables

PARENT_POLICY_ID: The UUID of the parent Schema Validation policy.

Set up the policy

curl -X POST https://{region}.api.konghq.com/v1/event-gateways/{eventGatewayId}/virtual-clusters/{virtualClusterId}/produce-policies \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "mask-ssn-produce",
      "type": "mask_fields",
      "parent_policy_id": "'$PARENT_POLICY_ID'",
      "config": {
        "failure_mode": "reject",
        "mask_fields": [
          {
            "paths": [
              {
                "match": "user.ssn"
              }
            ],
            "strategy": {
              "type": "keep_chars",
              "first": 1,
              "last": 2,
              "phrase": "***"
            }
          }
        ]
      }
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
virtualClusterId: The id of the Virtual Cluster.
eventGatewayId: The id of the Event Gateway.
eventGatewayListenerId: The id of the Event Gateway Listener.

See the Konnect Event Gateway API reference to learn about region-specific URLs and personal access tokens.

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect-beta = {
      source  = "kong/konnect-beta"
    }
  }
}

provider "konnect-beta" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration:

resource "konnect_event_gateway_produce_policy_mask_fields" "my_virtual_cluster_policy_mask_fields" {
  provider = konnect-beta
  type = "mask_fields"
  parent_policy_id = var.parent_policy_id
  config = {
    failure_mode = "reject"
    mask_fields = [
      {
        paths = [
          {
            match = "user.ssn"
          }        ]

        strategy = {
          type = "keep_chars"
          first = 1
          last = 2
          phrase = "***"
        }
      }    ]
  }


  virtual_cluster_id = konnect_event_gateway_virtual_cluster.my_virtual_cluster.id

  gateway_id = konnect_event_gateway.my_event_gateway.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "parent_policy_id" {
  type = string
}

Copied!

The following example creates a new mask_fields policy.

kongctl

event_gateway_policy.yaml

Copied!

event_gateways:
  - ref: eventGatewayName
    name: eventGatewayName
    virtual_clusters:
    - ref: virtualClusterName
      name: virtualClusterName
      produce_policies:
      - ref: mask-ssn-produce
        type: mask_fields
        mask_fields:
          name: mask-ssn-produce
          parent_policy_id: !env PARENT_POLICY_ID
          config:
            failure_mode: reject
            mask_fields:
            - paths:
              - match: user.ssn
              strategy:
                type: keep_chars
                first: 1
                last: 2
                phrase: "***"

Make sure to replace the following placeholders with your own values:

eventGatewayName: The name of your Event Gateway.
virtualClusterName: The name of the Virtual Cluster.

Mask Fields Produce

Mask a field before it reaches the clusterv1.3+

Prerequisites

Environment variables

Set up the policy

Help us make these docs great!

Still need help?