Licensing

• Introduction
• License types
  • File-based licenses
  • Free Trial license
  • Sandbox license
  • Foundation license
  • Structured license
  • Dynamic licenses
  • AWS permissions
  • Subsetting availability
  • Unstructured masking availability
• Connection limits
• License warnings in the web UI
• Selecting a license type
  • When you cannot switch license types
  • Selecting a license type on initial install (AWS Marketplace products only)
• More details about Dynamic licenses
  • AWS permissions
  • Cross-account licensing
  • Choosing an approach
  • Assume role setup
  • License grants setup
  • Troubleshooting cross-account setup
  • Automatic License Renewal
  • License units and dimensions
  • Units required on ECS
  • Units required on other platforms
  • Troubleshooting Dynamic licenses
• License breaches
  • License quota exceeded
  • License expiry
• Automated notification emails
  • Notification on license limit breach
  • License breach reminder notification
  • Expiry reminder notification
  • Summary of license usage
• License renewal and upgrade process

Introduction

In order to mask data with DataMasque, you require a license. You can obtain one by contacting the sales team: sales@datamasque.com.

You can view and configure the license at the top of the My Account page. Only admin users have permissions to edit the license information.

When no license is installed, you can still create connections and rulesets, but will not be able to mask any data. A Dynamic license without an active contract is more restricted; see Dynamic licenses.

License types

There are two types of licenses:

• File-based licenses, which are files with names ending in .lic. These can be uploaded through the My Account page.

• Dynamic licenses, where DataMasque connects to AWS License Manager to check out licenses.

In-Flight Masking is available with Enterprise and Premium Trial licenses only. This covers both masking through an endpoint and creating, updating or deleting endpoints.

The Unstructured Ruleset Builder does not require In-Flight Masking. It is not available with Ready To Run or Sandbox licenses.

File-based licenses

Free Trial and Sandbox licenses limit the rows masked in each table. Other license types that allow database masking have no row limit.

Free Trial license

Allows masking of up to 1,000 rows per table, or 5 files in a single run. All other data will be left unmasked.

In file runs, these limits apply to masking tasks only: the masking tasks in a ruleset share a single 5-file allowance, mask_file tasks skip non-tabular files larger than 1MB, and mask_tabular_file tasks truncate each file to 1,000 rows. run_file_data_discovery tasks are not limited, as scanning a file does not mask it.

A run that cuts a table short completes with warnings, and the run log names the table.

The same column exemption applies as under a Sandbox license, with the limit at 1,000 rows. See Sandbox license below.

Subsetting and Amazon Redshift are not available (see Subsetting availability).

Free Trial licenses expire after 30 days.

Sandbox license

Allows masking of up to 10,000 rows per table in a database run. All other rows in the table will be left unmasked. Each table is capped independently, so tables do not share an allowance.

The cap is a property of the license type, so it is not carried in the license file and cannot be raised by reissuing the license. It is shown as the Maximum row limit on the My Account page. Sandbox licenses carry an expiry date like any other customer license. A run that actually cuts a table short completes with warnings, and the run log names each table that was truncated.

A Sandbox license does not allow file masking, file data discovery, or in-flight masking. File Masking and the File Ruleset Generator are hidden from navigation, and a direct or bookmarked link to one of these pages takes you to the Database Masking dashboard instead. Subsetting is not available (see Subsetting availability). Amazon Redshift is not available: masking runs there do not support a row limit.

The cap bounds the mask_table scan, with one exception.

Some columns are masked in every row, past the cap. A column masked with imitate_unique, from_unique_imitate, imitate_uuid or imitate_nz_ird is always exempt: these replace a value with another from the set the column already holds, so masking only part of the column could produce a duplicate. A key column, or one another table references by foreign key, is exempt whenever its mask preserves uniqueness, including email. Rows in the referencing tables are masked in full, so stopping the parent at the cap would leave them pointing at values that were never masked.

An email mask anywhere else is bounded like any other column. It generates addresses rather than imitating the ones already in the column, so masking only part of it will not produce a duplicate.

The exemption is per column. Ordinary columns on the same table still stop at the cap, and the run log names both the truncation and the columns carried past it.

This means a ruleset built around these masks can mask more than 10,000 rows in a table. That is intended: a partly masked column of imitated values is worse than an unenforced cap.

mask_unique_key tasks are outside the cap altogether, as the key mapping has to cover every row for the tables referencing it to stay consistent.

A max_rows you set in your own run options is refused instead, not carried past, as the partial table is what you asked for.

Tasks that move or reshape data without masking it, such as run_sql, truncate_table and build_temp_table, are outside the cap's scope as well.

Foundation license

Allows database masking runs against at most 2 connections. A connection counts towards this limit the first time one of its runs finishes successfully (finished or finished_with_warnings). The license type sets the cap. The license file does not contain it, so reissuing the license does not raise it.

A run on a connection that does not yet count is refused with an HTTP 403 response once the count reaches the limit. The response names the cap, how many connections count, and the current license type. A connection that already counts can still run once the count reaches the limit. Once the count exceeds the limit, every run is refused.

Creating or duplicating a connection is refused with an HTTP 403 response when the number of connections reaches the limit, whether or not they have run. Deleting a connection frees its slot immediately, but deletion is refused for 90 days after the connection's first successful run — its protected settings (host, port, database, user, and similar) are locked for the same 90 days. Credentials, the connection name and a handful of other operational fields stay editable throughout. The exception: deletion stays available while the active connection count is above the limit — for example after downgrading to Foundation — even during the 90-day lock, so the account can get back under the cap. See Target freeze for the full rules and the read-only fields (target_frozen, frozen_target_fields, deletion_frozen) that report this state.

GET /api/connections/ reports whether each connection counts in its license_lock field. See Connection cap admission for the API contract.

A Foundation license does not allow file masking, file data discovery, or in-flight masking. File Masking, In-Flight Masking, the File Ruleset Generator and the Unstructured Ruleset Builder are hidden from navigation, along with existing file connections; a direct or bookmarked link to one of these pages takes you to the Database Masking dashboard instead, with a warning that the page is not available under your license. Existing file connections are kept and become usable again if the license changes to one that allows file masking. A Foundation license also hides the subsetting summary on the confirm-run screen.

Structured license

Like Foundation, a Structured license does not allow file masking, file data discovery, or in-flight masking, and hides the same pages and existing file connections from the UI in the same way. Unlike Foundation, a Structured license has no connection limit, so it has no 90-day edit/delete lock, and it keeps the subsetting summary on the confirm-run screen.

Dynamic licenses

Dynamic licenses are specifically designed for use within the AWS ecosystem, and are currently only supported on AWS. Instead of using a traditional license file, DataMasque checks out a contract license directly from your AWS account. This requires an active AWS contract license for DataMasque products to be present in your AWS account.

To use a Dynamic license:

• Obtain a Dynamic license by purchasing a contract-based DataMasque product through AWS.
• Ensure that you have a valid contract license in your AWS account.
• Use the My Account page to select the correct license type (Business or Enterprise).
• DataMasque will then handle the license checkout process directly with AWS.

Until a contract is active, a Dynamic license allows no masking, and neither connections nor In-Flight Masking endpoints can be created, updated or deleted. Automation and the Unstructured Ruleset Builder are unavailable too. Once a contract is active, the contract's license type decides what is available.

Subsetting availability

The license type shown on the My Account page decides whether subsetting is available.

License type	Subsetting
Free Trial	Not included
Premium Trial	Included
Ready To Run	Included
Sandbox	Not included
On Demand	Not included
Foundation	Not included
Structured	Included
Enterprise	Included
Business DB	Included
Business File	Not applicable
Guidewire	Included
Restricted	Not applicable
Dynamic	Follows the contract license type

To use subsetting on a license type that does not include it, upgrade to a Structured or Enterprise license. A Dynamic license follows the license type of the contract it checks out.

Unstructured masking availability

The license type shown on the My Account page decides whether unstructured masking is available.

License type	Unstructured masking
Free Trial	Included (other limits apply)
Premium Trial	Included
Ready To Run	Included (other limits apply)
Sandbox	Included (other limits apply)
On Demand	Not included
Foundation	Not included
Structured	Not included
Enterprise	Included
Business DB	Included
Business File	Included
Guidewire	Included
Restricted	Not applicable
Dynamic	Follows the contract license type

To use unstructured masking on a license type that does not include it, upgrade to an Enterprise license. A Dynamic license follows the license type of the contract it checks out.

Connection limits

A license type may come with a maximum number of connections. Like the row limit, this maximum is a property of the license type, so it is not carried in the license file and cannot be raised by reissuing the license.

A connection counts towards this maximum once it completes its first successful run. Creating or testing a connection does not, and neither does a run that fails. Creating a connection is refused when the number of connections reaches the maximum, whether they have run or not, and Add connection is disabled until a connection is deleted. Only a connection the license can use counts: a file connection does not count under a database-only license, which can neither run nor delete it.

When the license sets a maximum, the My Account page shows your usage against it as Connections in use, for example "Connections in use: 2 of 2". It shows your actual usage, so if more connections are in use than the license allows — for instance after moving to such a license from one with no maximum — the real number is shown, such as "Connections in use: 3 of 2". To raise the maximum, upgrade to a Structured or Enterprise license, which do not set a connection maximum.

License warnings in the web UI

A ruleset or library that uses a feature your license does not include is still valid, and can still be saved.

These features cause a warning:

• A subset task.
• An unstructured_text mask.
• The mask_type of the ruleset: Database Masking or File Masking.

For example, under a Foundation license a ruleset that contains an unstructured_text mask shows "Foundation license does not allow Unstructured Masking. Upgrade to Enterprise."

DataMasque marks the ruleset or library in these places:

• The Ruleset Editor and the library editor show a warning at the top of the page, naming each feature not covered by the license.
• The Status indicator in both editors shows an orange warning symbol in place of the green tick.
• The ruleset list and the library list show the same orange warning symbol beside the ruleset or library.
• The Library Help panel in the Ruleset Editor shows the same orange warning symbol beside the library.

Ruleset warnings include features brought in from a ruleset library as well as those written into the ruleset itself. They are shown once the ruleset has been validated. Validation occurs when the ruleset or library is saved. DataMasque checks the warnings against the current license each time it shows them, so a license upgrade clears them without saving the ruleset again.

A library warning blocks nothing by itself. DataMasque refuses a run of a ruleset that uses the feature through the library.

When previewing a run using a ruleset that uses features not covered by your license, the run preview shows the same warning, and the Start Run button is disabled.

Selecting a license type

DataMasque offers two methods for license acquisition: file-based and cloud-based (AWS Contract License). In general, when DataMasque is deployed to an AWS platform (EC2, EKS or ECS), you can choose which method DataMasque uses to obtain its license, offering flexibility depending on your deployment environment and licensing model.

To change the license type, use the Account License Information section of the My Account page:

• To upload a file license:

  • Select Use license file.
  • Click Configure next to License File.
  • In the panel that opens, drag and drop a license file or click to browse and select one.
  • If the license file is invalid, you will see an error message.
  • Otherwise, click Save to apply the license.

  

• To use a Dynamic license:

  • Select AWS Contract License.
  • Click Configure next to AWS Contract License.
  • In the configure panel:
    • AWS Identity: If your contract is in a different AWS account, check Assume role for license check out and enter the billing account role ARN. See Cross-account licensing for setup instructions.
    • Checkout Mode: Choose how DataMasque selects a license product:
    • Automatic (recommended): tries available products in order until one checks out successfully.
    • Specific product: select a specific product from the discovered list. Use this if you have multiple DataMasque subscriptions and want this installation to use a particular one.
    • Disable checkout: checks in any currently held licenses and prevents automatic checkout. Masking runs cannot be executed until checkout is re-enabled.
    • Plan: Select Business or Enterprise to match your contract type. (Hidden when Disable checkout is selected.)
  • Click Save.
  • DataMasque will check out the license in the background and update the status in the Account License Information section.
  • If checkout fails, an error will be shown. Refer to Troubleshooting Dynamic licenses for possible fixes.

  

When you cannot switch license types

When DataMasque is deployed on a non-AWS platform, or you are using a consumption-based (e.g. hourly) AWS product, only a file-based license is supported. You are not able to replace this license file.

When using a DataMasque Contract Product from AWS Marketplace, you will only see the option to use Dynamic licenses.

Selecting a license type on initial install (AWS Marketplace Contract Product only)

Refer to the AWS Installation page.

You can always change the selected contract license type through the My Account page, as described above.

More details about Dynamic licenses

AWS permissions

To use Dynamic licenses, the IAM role attached to the EC2, EKS cluster, or ECS task must include the following permissions:

{
    "Sid": "DataMasqueLicenseCheckInAndOut",
    "Effect": "Allow",
    "Action": [
        "license-manager:CheckoutLicense",
        "license-manager:CheckInLicense",
        "license-manager:ExtendLicenseConsumption"
    ],
    "Resource": "*"
}

license-manager:ExtendLicenseConsumption lets DataMasque refresh a near-expiry checkout in place instead of checking it in and out again.

Note: "Resource": "*" is required. AWS License Manager does not support resource-level restrictions for CheckoutLicense, CheckInLicense, or ExtendLicenseConsumption. Scoping the Resource to a specific license ARN will cause an AuthorizationException even when the ARN is correct.

The following permissions are optional. If granted, DataMasque will display additional metadata on the My Account page when using a Dynamic license:

{
    "Sid": "DataMasqueLicenseMetadata",
    "Effect": "Allow",
    "Action": [
        "license-manager:GetLicense",
        "license-manager:GetLicenseUsage",
        "aws-marketplace:SearchAgreements"
    ],
    "Resource": "*"
}

• license-manager:GetLicense — enables display of the Product Name and Contract Expiry date.
• license-manager:GetLicenseUsage — enables display of consumed and available entitlement counts in the AWS Contract License configure panel when using Specific product checkout mode.
• aws-marketplace:SearchAgreements — enables display of the Agreement ID with a link to the AWS Marketplace console. Grant this on the DataMasque instance role for same-account deployments, or on the billing account cross-account role when using assume role (see Cross-account licensing).

If these permissions are not granted, license checkout will still work normally. The product name, contract expiry, agreement ID, and entitlement counts will simply not be shown.

Cross-account licensing

If your AWS Marketplace contract is in a different AWS account from where DataMasque is deployed — for example, a centralised billing account holds the contract while DataMasque runs in a separate production account — you need to give DataMasque access to the license across accounts.

See the Cross-Account Licensing Setup guide for full AWS IAM setup instructions for both approaches below.

Choosing an approach

Approach	How it works	Recommended
Assume role	DataMasque temporarily assumes an IAM role in the billing account when performing license operations.	✓
License grants	The billing account uses AWS License Manager to grant the license directly to the deployment account. DataMasque checks it out from there without needing cross-account credentials.

Assume role is recommended for most deployments because it does not require modifying the license grant and gives fine-grained control over which accounts and roles can access the license.

Assume role setup

DataMasque in the deployment account temporarily assumes an IAM role in the billing account when performing license operations. Setup involves creating a cross-account IAM role in the billing account, granting sts:AssumeRole to the DataMasque instance role in the deployment account, and entering the role ARN in the DataMasque UI.

For full setup instructions, see the Cross-Account Licensing Setup guide.

License grants setup

Note: Assume role is the recommended approach. Use license grants only if your organisation already uses or prefers the AWS License Manager grants workflow.

AWS License Manager allows the billing account to grant license usage directly to another AWS account. Once the deployment account accepts the grant, DataMasque can check out the license without any assume role configuration or role ARN in the UI.

For full setup instructions, see the Cross-Account Licensing Setup guide.

Troubleshooting cross-account setup

• AccessDenied when checking out a license — Verify that the DataMasque instance role has license-manager:CheckoutLicense, license-manager:CheckInLicense, and license-manager:ExtendLicenseConsumption. If using assume role, also confirm the role has sts:AssumeRole permission for the billing account role.

• AccessDenied when assuming the role — Check that the trust policy on the billing account role references the correct deployment account role ARN, and that the deployment account policy targets the correct billing account role ARN.

• No products shown in Specific checkout mode — The billing account role may be missing license-manager:ListReceivedLicenses. Add this permission to the role's policy.

• Role ARN field is greyed out or Save is disabled — The ARN field only becomes active after checking Assume role for license check out. Ensure the value is a valid IAM role ARN (arn:aws:iam::<account-id>:role/<role-name>) before saving.

You can verify assume role is correctly configured using the AWS CLI from an instance that uses the same IAM role as DataMasque:

aws sts assume-role \
    --role-arn arn:aws:iam::<billing-account-id>:role/DataMasqueLicenseRole \
    --role-session-name datamasque-verify-session

If this returns temporary credentials, the IAM setup is correct.

On ECS, DataMasque also requires the following permissions to read information about the ECS task under which DataMasque is deployed:

{
    "Sid": "DataMasqueQueryTasks",
    "Effect": "Allow",
    "Action": [
        "ecs:ListTasks",
        "ecs:DescribeTasks"
    ],
    "Resource": "*"
}

Automatic License Renewal

By default, cloud licenses are automatically checked out or renewed in the background approximately every 5 minutes while the DataMasque instance is running. This ensures that your DataMasque instance always has a valid license.

To disable automatic license checkout, click Configure next to AWS Contract License on the My Account page, set Checkout Mode to Disable checkout, and click Save. When checkout is disabled:

• All active licenses are immediately checked in to AWS License Manager.
• DataMasque will not automatically check out licenses.
• Masking runs cannot be executed until checkout is reconfigured and re-enabled.

License units and dimensions

DataMasque's licensing model is based around three product dimensions. For a Business-type Dynamic license, the available dimensions are:

• business_lic (base license)
• business_sup (additional license with support plan)
• business_add (additional license)

Likewise, for enterprise, the dimensions are enterprise_lic, enterprise_sup, and enterprise_add.

All the above dimensions are granted in single Count units. When you purchase a Dynamic license, you might purchase varying numbers of different dimensions, and each will grant one unit.

You can view the dimensions with the maximum number of units, and number of units currently in use, in the AWS License Manager console. Under the granted license, select the License details tab. The Entitlements table shows the dimensions, the maximum number of units, and the number currently in use.

The total number of units is the sum of those across all relevant dimensions (either business or enterprise according to what is selected in the DataMasque UI, but not both). For example, if business_lic shows a Max count of 3, and business_sup shows 2, the total number of available units is five.

The number of units required to use DataMasque depends on the platform, as described below.

Units required on ECS

When DataMasque is deployed on an ECS platform and using a Dynamic license, the number of units required is the larger of the number of agent containers and in-flight-containers that are currently running, with a minimum of one unit.

For example:

Agent containers running	In-Flight Masking containers running	Units required
0	0	1
1	1	1
4	1	4
2	3	3

Units required on other platforms

On other platforms (EC2 and EKS), one unit is required.

Troubleshooting Dynamic licenses

• Ensure the IAM role attached to the EC2, EKS cluster or ECS task has the IAM permissions listed above (license-manager:CheckoutLicense, license-manager:CheckInLicense, and license-manager:ExtendLicenseConsumption).
• On ECS, ensure the task IAM role also has the ecs:ListTasks and ecs:DescribeTasks permissions, and that there is no firewall blocking traffic to the ECS Task Metadata endpoint, which is typically an IP address in the 169.254.172.0/22 CIDR block.
• On EC2 and EKS, ensure that the IMDS (Instance Metadata Service) configuration is correct and that there is no firewall blocking traffic to IMDS.
• Use the AWS License Manager console to verify that the granted license is visible and not already in use. If the license is in use but DataMasque is not running, it will automatically be checked in within one hour, whereupon it should display as no longer in use and you can try again.
• Ensure you have the correct contract license type (Business or Enterprise) set in the Configure panel for AWS Contract License.

Errors when upgrading from v2.29 or below to v2.30 or higher on EKS

Prior to v2.29, DataMasque used the EKS node instance ID to check out licenses, which led to licensing errors when containers were scheduled on different nodes.

As of version 2.30, DataMasque checks out licenses using a consistent ID for the whole cluster, thus fixing this issue. When upgrading to 2.30, any licenses checked out prior to upgrade will still be incorrectly using the node's instance ID, and as a result you may see an error on the My Account page regarding Dynamic licensing. To fix the error, temporarily disable Dynamic licensing, then re-enable it. To do this, click Configure next to AWS Contract License, set Checkout Mode to Disable checkout, and click Save. Then reopen the panel, set Checkout Mode back to Automatic, and click Save.

License breaches

License quota exceeded

When starting a masking run, if your accumulated usage exceeds the quota of your license:

• If the target database has been masked previously, and has not increased markedly in size, a license breach will be registered, and the masking run will be started as usual. A warning will be displayed in the DataMasque interface and a notification email will be sent to all active admin users of your DataMasque instance.
• If the target database has not been masked previously, or has increased markedly in size, the masking run will not start.

In the event that you exceed your license quota, you will be unable to mask any new database instances. Contact the DataMasque sales team (sales@datamasque.com) to upgrade your license quota.

License expiry

After license expiry, you will no longer be able to run any data masking tasks. You can however continue to log in and use the rest of the DataMasque web interface as normal.

Automated notification emails

The following email notifications will be sent using the configured SMTP settings as reminders.

• License breach reminder notification and Expiry reminder notification are automatically scheduled to be sent on the 1st day of applicable months.
• Summary of license usage is automatically scheduled to be sent weekly for the first month from the start date of the license, then monthly thereafter.

Notification on license limit breach

License limit breaches will trigger email notifications to all active admin users. Once a breach notification email has been sent, subsequent breaches within the following 30 days will not trigger additional notification emails.

License breach reminder notification

An email is sent monthly to all active admin users containing a summary of the license breaches that happened during the last calendar month. If no breach occurred during the last month, this email will not be sent.

Expiry reminder notification

During the last 3 months of the license subscription period, a monthly email notification will be sent to all active admin users with a reminder that the DataMasque license will expire soon. You may also see a reminder message at the bottom left of the screen when logging in to DataMasque.

Summary of license usage

An email is sent every 3 months to usage@datamasque.com containing a summary of the license usage report. This email is also bcc'd to all active admin users.

Note: admin users are bcc'd in License breach reminder notification and Expiry reminder notification emails.

License renewal and upgrade process

Contact the DataMasque sales team: sales@datamasque.com for license renewal or upgrade.