Custom WHERE Clause Functions
Last updated
Last updated
The Immuta policy builder allows you to use custom functions that reference important Immuta metadata from within your where clause. These custom functions can be seen as utilities that help you create policies easier. Using the Immuta Policy Builder, you can include these functions in your policy queries by choosing where in the sub-action drop-down menu.
@attributeValuesContains()
FunctionThis function returns true
for a given row if the provided column evaluates to an attribute value for which the querying user has a corresponding attribute value. This function requires two arguments and accepts no more than three arguments.
# | Parameter | Type | Required | Description |
---|---|---|---|---|
@columnTagged()
FunctionThis function returns the column name with the specified tag.
If this function is used in a Global Policy and the tag doesn't exist on a data source, the policy will not be applied.
# | Parameter | Type | Required | Description |
---|---|---|---|---|
@groupsContains()
FunctionThis function returns true
for a given row if the provided column evaluates to a group to which the querying user belongs. This function requires at least one argument.
@hasAttribute()
FunctionThis function returns a boolean indicating if the current user has the specified attribute name and value combination. If the specified attribute name or attribute value has a single quote, you will need to escape it using a \'\'
expression within a custom WHERE
policy.
@iam
FunctionThis function returns the IAM ID for the current user.
None.
@interpolatedComparison()
FunctionDeprecation notice
Support for this function has been deprecated.
The Interpolated Comparison function is perhaps the most complex custom WHERE clause function. It essentially generates chained WHERE clauses. As opposed to the rest of the custom WHERE
clause functions, its output is not a list of values or a boolean, but rather the comparison itself.
The @interpolatedComparison() function does not work with Immuta's database integrations.
¹ A custom function will not accept a placeholder argument when used inside @interpolatedComparison
.
The following invocation of interpolatedComparison()
:
WHERE @interpolatedComparison("group", "=", "upper('##')", "##", @groupsContains, "OR")
is equivalent to writing the following SQL WHERE
clause, given that a user belongs to two groups called founders and engineers:
WHERE ((group = upper('founders')) or (group = upper('engineers')))
@isInGroups()
FunctionThis function returns a boolean indicating if the current user is a member of all of the specified groups. If any of the specified groups has a single quote, you will need to escape it using a \'\'
expression within a custom WHERE
policy.
@isUsingPurpose()
FunctionThis function returns a boolean indicating if the current user is using the specified purpose. If the specified purpose has a single quote, you will need to escape it using a \'\'
expression within a custom WHERE
policy.
@purposesContains()
FunctionThis function returns true
for a given row if the provided column evaluates to a purpose under which the querying user is currently acting. This function requires at least one argument and accepts no more than two arguments.
@username
FunctionThis function returns the current user's user name.
None.
# | Parameter | Type | Required | Description |
---|---|---|---|---|
# | Parameter | Type | Required | Description |
---|---|---|---|---|
# | Parameter | Type | Required | Description |
---|---|---|---|---|
# | Parameter | Type | Required | Description |
---|---|---|---|---|
# | Parameter | Type | Required | Description |
---|---|---|---|---|
# | Parameter | Type | Required | Description |
---|---|---|---|---|