feat: generalized ABAC Terraform module for Genie Space onboarding

uc-quickstart/utils/abac/finance/0.1finance_abac_functions.sql

@@ -0,0 +1,260 @@
+-- =============================================
+-- DATABRICKS UNITY CATALOG ABAC MASKING FUNCTIONS - FINANCE DOMAIN
+-- Purpose: Attribute-Based Access Control (ABAC) utility functions for financial services data masking
+-- Compliance: PCI-DSS, AML/KYC, GDPR, SOX, GLBA
+-- Reference: https://docs.databricks.com/aws/en/data-governance/unity-catalog/abac/
+-- =============================================
+
+-- Set catalog and schema context
+USE CATALOG fincat;
+USE SCHEMA finance;
+
+-- =============================================
+-- MASKING FUNCTIONS (11 total)
+-- These transform/hide data values while preserving table structure
+-- =============================================
+
+-- =============================================
+-- 1. CREDIT CARD FULL MASKING FUNCTION
+-- Purpose: Complete masking of credit card numbers for PCI-DSS compliance
+-- Usage: Customer service representatives with basic clearance
+-- Input: Credit card number (e.g., 4532-1234-5678-9010)
+-- Output: Fully masked (XXXX-XXXX-XXXX-XXXX)
+-- =============================================
+CREATE OR REPLACE FUNCTION mask_credit_card_full(card_number STRING)
+RETURNS STRING
+COMMENT 'ABAC utility: Full credit card masking for PCI-DSS compliance'
+RETURN CASE 
+    WHEN card_number IS NULL OR card_number = '' THEN card_number
+    ELSE 'XXXX-XXXX-XXXX-XXXX'
+END;
+
+-- =============================================
+-- 2. CREDIT CARD LAST 4 DIGITS FUNCTION
+-- Purpose: Show only last 4 digits for customer service verification
+-- Usage: Customer service and fraud detection teams
+-- Input: Credit card number (e.g., 4532-1234-5678-9010)
+-- Output: Masked with last 4 visible (XXXX-XXXX-XXXX-9010)
+-- =============================================
+CREATE OR REPLACE FUNCTION mask_credit_card_last4(card_number STRING)
+RETURNS STRING
+COMMENT 'ABAC utility: Show last 4 digits of credit card for verification'
+RETURN CASE 
+    WHEN card_number IS NULL OR card_number = '' THEN card_number
+    WHEN LENGTH(REGEXP_REPLACE(card_number, '[^0-9]', '')) >= 4 THEN 
+        CONCAT('XXXX-XXXX-XXXX-', RIGHT(REGEXP_REPLACE(card_number, '[^0-9]', ''), 4))
+    ELSE 'XXXX-XXXX-XXXX-XXXX'
+END;
+
+-- =============================================
+-- 3. SSN MASKING FUNCTION
+-- Purpose: Mask Social Security Numbers while showing last 4 for verification
+-- Usage: Customer service and compliance teams
+-- Input: SSN (e.g., 123-45-6789)
+-- Output: Masked SSN (XXX-XX-6789)
+-- =============================================
+CREATE OR REPLACE FUNCTION mask_ssn(ssn STRING)
+RETURNS STRING
+COMMENT 'ABAC utility: Mask SSN showing only last 4 digits for GLBA compliance'
+RETURN CASE 
+    WHEN ssn IS NULL OR ssn = '' THEN ssn
+    WHEN LENGTH(REGEXP_REPLACE(ssn, '[^0-9]', '')) = 9 THEN 
+        CONCAT('XXX-XX-', RIGHT(REGEXP_REPLACE(ssn, '[^0-9]', ''), 4))
+    ELSE 'XXX-XX-XXXX'
+END;
+
+-- =============================================
+-- 4. ACCOUNT NUMBER TOKENIZATION FUNCTION
+-- Purpose: Deterministic masking of account numbers for analytics
+-- Usage: Data analysts and reporting teams
+-- Input: Account number (e.g., ACC123456)
+-- Output: Deterministic token (e.g., ACCT_a3f9c2...)
+-- =============================================
+CREATE OR REPLACE FUNCTION mask_account_number(account_id STRING)
+RETURNS STRING
+COMMENT 'ABAC utility: Deterministic account number tokenization for cross-table analytics'
+RETURN CASE 
+    WHEN account_id IS NULL OR account_id = '' THEN account_id
+    ELSE CONCAT('ACCT_', LEFT(SHA2(account_id, 256), 12))
+END;
+
+-- =============================================
+-- 5. EMAIL MASKING FOR FINANCE FUNCTION
+-- Purpose: Mask customer email addresses for privacy
+-- Usage: Marketing and customer service teams
+-- Input: Email (e.g., john.doe@example.com)
+-- Output: Masked email (****@example.com)
+-- =============================================
+CREATE OR REPLACE FUNCTION mask_email_finance(email STRING)
+RETURNS STRING
+COMMENT 'ABAC utility: Mask email local part while preserving domain for GDPR compliance'
+RETURN CASE 
+    WHEN email IS NULL OR email = '' THEN email
+    WHEN LOCATE('@', email) > 0 THEN 
+        CONCAT('****', SUBSTRING(email, LOCATE('@', email)))
+    ELSE '****'
+END;
+
+-- =============================================
+-- 6. CUSTOMER ID DETERMINISTIC MASKING FUNCTION
+-- Purpose: Hash customer IDs for referential integrity in analytics
+-- Usage: Data scientists and analysts performing cross-table joins
+-- Input: Customer ID (e.g., CUST00123)
+-- Output: Deterministic reference (e.g., REF_c8a9f...)
+-- =============================================
+CREATE OR REPLACE FUNCTION mask_customer_id_deterministic(customer_id STRING)
+RETURNS STRING
+COMMENT 'ABAC utility: Deterministic customer ID masking preserving join capability'
+RETURN CASE 
+    WHEN customer_id IS NULL OR customer_id = '' THEN customer_id
+    ELSE CONCAT('REF_', LEFT(SHA2(customer_id, 256), 10))
+END;
+
+-- =============================================
+-- 7. TRANSACTION AMOUNT ROUNDING FUNCTION
+-- Purpose: Round transaction amounts for aggregated reporting
+-- Usage: Marketing teams and external partners
+-- Input: Amount (e.g., 1234.56)
+-- Output: Rounded amount (1200.00)
+-- =============================================
+CREATE OR REPLACE FUNCTION mask_amount_rounded(amount DECIMAL(18,2))
+RETURNS DECIMAL(18,2)
+COMMENT 'ABAC utility: Round amounts to nearest hundred for aggregated analytics'
+RETURN CASE 
+    WHEN amount IS NULL THEN NULL
+    WHEN amount < 100 THEN ROUND(amount, -1)  -- Round to nearest 10
+    ELSE ROUND(amount, -2)  -- Round to nearest 100
+END;
+
+-- =============================================
+-- 8. PII STRING PARTIAL MASKING FUNCTION
+-- Purpose: Show only first and last characters of PII fields
+-- Usage: Customer names and addresses for partial visibility
+-- Input: String value (e.g., "John")
+-- Output: Partially masked string (e.g., "J**n")
+-- =============================================
+CREATE OR REPLACE FUNCTION mask_pii_partial(input STRING)
+RETURNS STRING
+COMMENT 'ABAC utility: Partial PII masking showing first and last characters for GDPR'
+RETURN CASE 
+    WHEN input IS NULL OR input = '' THEN input
+    WHEN LENGTH(input) <= 2 THEN REPEAT('*', LENGTH(input))
+    WHEN LENGTH(input) = 3 THEN CONCAT(LEFT(input, 1), '*', RIGHT(input, 1))
+    ELSE CONCAT(LEFT(input, 1), REPEAT('*', LENGTH(input) - 2), RIGHT(input, 1))
+END;
+
+-- =============================================
+-- ROW FILTER FUNCTIONS (Zero-argument for Unity Catalog ABAC)
+-- These control which rows are visible to users based on group membership
+-- Note: UC ROW FILTER policies require 0-argument functions
+-- =============================================
+
+-- =============================================
+-- 9. TRADING HOURS TIME-BASED FILTER
+-- Purpose: Restrict access to trading positions during market hours
+-- Usage: Prevent risk managers from accessing live positions during trading
+-- Input: None (uses current time)
+-- Output: Boolean indicating if access is allowed (outside trading hours 9:30 AM - 4:00 PM ET)
+-- =============================================
+CREATE OR REPLACE FUNCTION filter_trading_hours()
+RETURNS BOOLEAN
+COMMENT 'ABAC utility: Time-based access control for trading positions outside market hours'
+RETURN 
+    -- Allow access outside NYSE trading hours (9:30 AM - 4:00 PM ET)
+    -- Convert to UTC: 9:30 AM ET = 14:30 UTC, 4:00 PM ET = 21:00 UTC (EST)
+    -- Note: Adjust for daylight saving time in production
+    CASE
+        WHEN hour(current_timestamp()) < 14 OR hour(current_timestamp()) >= 21 THEN TRUE
+        ELSE FALSE
+    END;
+
+-- =============================================
+-- 10. INFORMATION BARRIER FILTER (Chinese Wall)
+-- Purpose: Block research analysts from trading data
+-- Usage: Enforce SEC/MiFID II Chinese wall for research analysts
+-- Input: None (checks current user group membership)
+-- Output: Boolean - FALSE blocks access for Research_Analyst group
+-- =============================================
+CREATE OR REPLACE FUNCTION filter_information_barrier()
+RETURNS BOOLEAN
+COMMENT 'ABAC utility: Chinese wall - block research analysts from trading positions'
+RETURN 
+    -- Research analysts are blocked (return FALSE to deny access)
+    -- This function is applied only to tables tagged with information_barrier
+    -- Risk managers and compliance have Neutral access (not blocked)
+    TRUE;  -- Default allow - policy applies this selectively via WHEN clause
+
+-- =============================================
+-- 11. AML CLEARANCE FILTER
+-- Purpose: Hide flagged/high-risk transactions from junior analysts
+-- Usage: Junior AML analysts cannot see flagged transactions
+-- Input: None (checks current user group membership)
+-- Output: Boolean - controls visibility of sensitive AML data
+-- =============================================
+CREATE OR REPLACE FUNCTION filter_aml_clearance()
+RETURNS BOOLEAN
+COMMENT 'ABAC utility: Hide flagged transactions from junior AML analysts'
+RETURN 
+    -- Junior analysts blocked from flagged transactions
+    -- Senior investigators and compliance see all
+    TRUE;  -- Default allow - policy WHEN clause controls application
+
+-- =============================================
+-- 12. REGIONAL DATA RESIDENCY FILTER - EU
+-- Purpose: Show only EU customer data to EU staff
+-- Usage: GDPR compliance - EU staff see EU data only
+-- Input: None (checks current user group membership)
+-- Output: Boolean indicating if row should be visible
+-- =============================================
+CREATE OR REPLACE FUNCTION filter_by_region_eu()
+RETURNS BOOLEAN
+COMMENT 'ABAC utility: GDPR - EU regional staff see EU customer data only'
+RETURN TRUE;  -- Applied via WHEN clause to customer_region='EU' tables
+
+-- =============================================
+-- 13. REGIONAL DATA RESIDENCY FILTER - US
+-- Purpose: Show only US customer data to US staff
+-- Usage: CCPA/GLBA compliance - US staff see US data only
+-- Input: None (checks current user group membership)
+-- Output: Boolean indicating if row should be visible
+-- =============================================
+CREATE OR REPLACE FUNCTION filter_by_region_us()
+RETURNS BOOLEAN
+COMMENT 'ABAC utility: CCPA/GLBA - US regional staff see US customer data only'
+RETURN TRUE;  -- Applied via WHEN clause to customer_region='US' tables
+
+-- =============================================
+-- 14. REGIONAL DATA RESIDENCY FILTER - APAC
+-- Purpose: Show only APAC customer data to APAC staff
+-- Usage: PDPA compliance - APAC staff see APAC data only
+-- Input: None (checks current user group membership)
+-- Output: Boolean indicating if row should be visible
+-- =============================================
+CREATE OR REPLACE FUNCTION filter_by_region_apac()
+RETURNS BOOLEAN
+COMMENT 'ABAC utility: PDPA - APAC regional staff see APAC customer data only'
+RETURN TRUE;  -- Applied via WHEN clause to customer_region='APAC' tables
+
+-- =============================================
+-- 15. TEMPORARY AUDITOR ACCESS FILTER
+-- Purpose: Grant access to external auditors (always allow within policy scope)
+-- Usage: SOX compliance - external auditors with temporary access
+-- Input: None (group membership determines access)
+-- Output: Boolean indicating if access is allowed
+-- =============================================
+CREATE OR REPLACE FUNCTION filter_audit_expiry()
+RETURNS BOOLEAN
+COMMENT 'ABAC utility: Temporary access control for external auditors (SOX compliance)'
+RETURN TRUE;  -- Applied via WHEN clause with audit_project tag
+
+-- =============================================
+-- VERIFICATION AND TESTING
+-- =============================================
+
+-- List all created functions
+SHOW FUNCTIONS IN finance LIKE 'mask*';
+SHOW FUNCTIONS IN finance LIKE 'filter*';
+
+SELECT '✅ Successfully created 15 finance ABAC functions (8 masking, 7 row filters)' as status;
+SELECT '📋 Row filter functions are zero-argument for Unity Catalog ABAC policies' as note;
+SELECT '🔐 Functions ready for: PCI-DSS, AML/KYC, GDPR, SOX, GLBA compliance' as compliance_frameworks;