Dynamic Data Masking: Securing Amazon Aurora PostgreSQL Data

Voiced by Amazon Polly

Securing sensitive data is one of the most important responsibilities of modern data teams. Whether you’re building customer-facing applications or operating analytics pipelines, preventing unauthorized access to personal or confidential information is essential and not just for compliance, but for trust.

Dynamic Data Masking (DDM) is one of the most effective techniques for protecting sensitive information in real-time. When combined with Amazon Aurora PostgreSQL, it allows you to enforce data-level security without changing your underlying applications.

In this blog, we explore how dynamic data masking works in Aurora PostgreSQL, its significance and how to implement it with practical examples.

Freedom Month Sale — Upgrade Your Skills, Save Big!

Up to 80% OFF AWS Courses
Up to 30% OFF Microsoft Certs
Ends August 31

Act Fast!

What Is Dynamic Data Masking?

Dynamic Data Masking (DDM) is a technique that hides sensitive data at query time based on user permissions. Instead of altering the actual data stored in the database, DDM ensures that unauthorized users see masked or obfuscated values, while authorized users can access the original data.

For example, columns like email, SSN or credit card numbers can be displayed in a masked format, such as:

Example of dynamic data masking showing masked email, SSN and credit card number for unauthorized users.

Dynamic Data Masking hides sensitive data for unauthorized users.

Dynamic Data Masking in Aurora PostgreSQL

While PostgreSQL does not include a built-in DDM feature (unlike SQL Server), Amazon Aurora PostgreSQL makes dynamic masking possible through PostgreSQL’s advanced security features, such as:

Security-definer functions
Row-level Security (RLS)
Views and logical abstraction layers
Policy-based access control
Extensions like pgcrypto (for encryption)

By combining these tools, Aurora PostgreSQL can implement highly flexible and performant masking logic.

Why Use Dynamic Data Masking in Aurora PostgreSQL?

Protect Sensitive Data

Mask personal, financial or healthcare data without modifying source tables.

Support Compliance

DDM helps meet GDPR, HIPAA, PCI-DSS and other privacy requirements by enforcing data-access boundaries.

Reduce Application Complexity

Masking rules reside in the database layer; therefore, there is no need to update every application that touches the data.

Enable Safe Analytics

Analysts, developers and data scientists can use masked data without exposure to sensitive details.

Implementing Dynamic Data Masking in Aurora PostgreSQL

Below is a simple, practical example of implementing masking using:

Row-Level Security (RLS)
Views
Masking functions

Step 1: Create a demo table

CREATE TABLE customers (

    id SERIAL PRIMARY KEY,

    full_name TEXT,

    email TEXT,

    ssn TEXT,

    created_at TIMESTAMP DEFAULT now()

);

CREATE TABLE customers (

id SERIAL PRIMARY KEY,

full_name TEXT,

email TEXT,

ssn TEXT,

created_at TIMESTAMP DEFAULT now()

);

Step 2: Insert sample data

INSERT INTO customers (full_name, email, ssn) VALUES

('Alice Carter', 'alice@example.com', '123-45-6789'),

('Bob Smith', 'bob@example.com', '987-65-4321');

INSERT INTO customers (full_name, email, ssn) VALUES

('Alice Carter', 'alice@example.com', '123-45-6789'),

('Bob Smith', 'bob@example.com', '987-65-4321');

Step 3: Create a masking function

CREATE OR REPLACE FUNCTION mask_email(email TEXT)

RETURNS TEXT LANGUAGE plpgsql AS $$

BEGIN

    RETURN regexp_replace(email, '(^.).+(@.*$)', '\1****\2');

END;

$$;




CREATE OR REPLACE FUNCTION mask_ssn(ssn TEXT)

RETURNS TEXT LANGUAGE plpgsql AS $$

BEGIN

    RETURN 'XXX-XX-' || right(ssn, 4);

END;

$$;

CREATE OR REPLACE FUNCTION mask_email(email TEXT)

RETURNS TEXT LANGUAGE plpgsql AS $$

BEGIN

RETURN regexp_replace(email, '(^.).+(@.*$)', '\1****\2');

END;

$$;

CREATE OR REPLACE FUNCTION mask_ssn(ssn TEXT)

RETURNS TEXT LANGUAGE plpgsql AS $$

BEGIN

RETURN 'XXX-XX-' || right(ssn, 4);

END;

$$;

Step 4: Create a masked view

CREATE OR REPLACE VIEW customers_masked AS

SELECT

    id,

    full_name,

    CASE

        WHEN current_user = 'admin_user' THEN email

        ELSE mask_email(email)

    END AS email,

    CASE

        WHEN current_user = 'admin_user' THEN ssn

        ELSE mask_ssn(ssn)

    END AS ssn,

    created_at

FROM customers;

CREATE OR REPLACE VIEW customers_masked AS

SELECT

id,

full_name,

CASE

WHEN current_user = 'admin_user' THEN email

ELSE mask_email(email)

END AS email,

CASE

WHEN current_user = 'admin_user' THEN ssn

ELSE mask_ssn(ssn)

END AS ssn,

created_at

FROM customers;

Step 5: Grant access to the masked view

GRANT SELECT ON customers_masked TO reporting_user;

1	GRANT SELECT ON customers_masked TO reporting_user;

Performance Considerations

Dynamic masking can introduce overhead, depending on:

Complexity of masking functions
Query frequency
Whether masking occurs on large datasets

Recommendations:

Precompute simple masks via generated columns if possible
Limit masking to sensitive columns only
Use indexed unmasked data for joins and filters

Securing Data Dynamically

Dynamic Data Masking in Amazon Aurora PostgreSQL provides a practical and efficient way to secure sensitive information without changing your application logic. By leveraging PostgreSQL’s security features and Aurora’s managed environment, you can implement robust masking strategies that meet compliance requirements and protect data integrity.

Whether you’re enabling analytics, supporting customer operations or preparing for audits, DDM ensures that the right users see the right data at the right time.

Freedom Month Sale — Discounts That Set You Free!

Up to 80% OFF AWS Courses
Up to 30% OFF Microsoft Certs
Ends August 31

Act Fast!

About CloudThat

CloudThat is an award-winning company and the first in India to offer cloud training and consulting services worldwide. As a Microsoft Solutions Partner, AWS Advanced Tier Training Partner, and Google Cloud Platform Partner, CloudThat has empowered over 850,000 professionals through 600+ cloud certifications winning global recognition for its training excellence including 20 MCT Trainers in Microsoft’s Global Top 100 and an impressive 12 awards in the last 8 years. CloudThat specializes in Cloud Migration, Data Platforms, DevOps, IoT, and cutting-edge technologies like Gen AI & AI/ML. It has delivered over 500 consulting projects for 250+ organizations in 30+ countries as it continues to empower professionals and enterprises to thrive in the digital-first world.

WRITTEN BY Sindhu Priya M

Sindhu Priya M is a Technical Lead at CloudThat, specializing in Development, Infra-Management and DevOps. With 6+ years of experience in training and consulting, she has trained over 1000+ professionals to upskill in Architecture, Development and DevOps. Known for simplifying complex concepts, hands-on teaching, and industry insights, she brings deep technical knowledge and practical application into every learning experience. Sindhu's passion for development technology reflects in her unique approach to learning and development.