DataMasque Portal

Read-Only Database Connections

When you configure a connection to a database, there is the option to restrict the connection to be read-only.

Setting a Database Connection as Read-Only

You can establish read-only connections through the UI by selecting the Read-only connection checkbox on the Add/Edit Connection page when creating a new connection or modifying an existing one, and then saving the connection.

Alternatively, you can also set a database connection as read-only using the DataMasque API. To do this, update the target database connection configuration to include the key-value pair:
"is_read_only": true

NOTE: To ensure safety, we strongly recommend you create a database user with only read privileges and specify this user in the connection configuration.

Read-Only Connection Icon

A read-only connection shows a pencil-with-a-slash icon next to its name in the Connections panel of the Database Masking Dashboard. This icon is unaffected by license type. It is distinct from the padlock icon a connection can also show under a license type with a connection limit — see View and edit connection for that icon.

Databases Supporting Read-Only Database Connections

Read-only database connections are supported on the following database types:

  • Amazon Redshift
  • Databricks Lakebase
  • Databricks SQL Warehouse
  • IBM Db2 for i
  • IBM Db2 LUW
  • IBM Informix
  • MariaDB
  • Microsoft SQL Server
  • MySQL
  • Oracle
  • PostgreSQL
  • Snowflake

If you set a connection to a database of any other type as read-only, all tasks executed against that connection will fail.

Task Types Runnable with Read-Only Database Connections

Only the following task types can be used with read-only database connections.

  • serial
  • parallel
  • run_data_discovery
  • run_schema_discovery

All other task types will fail.

Dry Runs

When you execute a dry run against a read-only connection, all task types will be runnable. This is because dry runs are non-writable by default.

Run History

When you execute a masking run against a read-only connection, DataMasque does not write a run history entry to the target database.