Trying to leverage BigQuery Data Protection features (policy tags, dynamic masking) with Dataform, but hitting two major issues:
1. Policy Tags: Dataform can’t apply policy tags. So if a table is dropped/recreated, tags need to be re-applied separately (e.g., via Cloud Function). Feels brittle and risky.
2. Service Account Access: Dataform execution SA can be selected by anyone in the project. If that SA has access to protected data, users can bypass masking by choosing it.
Has anyone successfully implemented a secure setup? Would appreciate any insights.
LinkedIn
Twitter
