Data masking not working within looker data studio according to provided access level

[chitranshu192]

I’m facing an issue with Looker Data Studio related to data masking in BigQuery.

I have a table in BigQuery: "kz-x-si.Looker.deposit_withdrawal_registration_metrics". My IAM roles include owner, masked_reader, and fine-grained_reader. I’ve applied a data policy to one of the columns (SHA-256 data masking policy tag for phone numbers) [refer SS below].

When I add this table to Looker Data Studio, I can see the phone numbers unmasked, which makes sense because I have both masked_reader and fine-grained_reader permissions [refer SS below].

However, I recently added a new user (new principal) to the IAM section of my project, giving them only masked_reader access (no fine-grained_reader), and then shared the Looker dashboard with them with view-only permissions. To my surprise, this user can also view the unmasked phone numbers, which contradicts my understanding of how data masking should work.

I expected that users with only masked_reader access would see the masked version of the phone numbers, not the unmasked data. Could anyone help explain why this might be happening or suggest how I can properly enforce the data masking?

[jagathkumar-stf]

Same issue, can anyone help resolve this promptly

[chitranshu192]

@HectorArturo  Can you please check this

[Mehdi_Oudjida]

@chitranshu192 

Just to be sure: Your Looker Studio data source uses the viewer credentials and not the owner credentials, right?

[chitranshu192]

I have owner's credential 

[Mehdi_Oudjida · Accepted solution]

@chitranshu192 

So the behavior makes sense. You need to switch to viewer credentials on the data source if you want to restrict the BQ access following the user. Otherwise, Looker Studio readers will see data following your access permissions.

I hope it helps.

[chitranshu192]

Got it. Thanks a lot. 

[chitranshu192]

I have owner's credential