Licensing

• Introduction
• License types
  • File-based licenses
  • Free Trial license
  • Sandbox license
  • Foundation license
  • Structured license
  • Enterprise license
  • Dynamic licenses
  • AWS permissions
  • Subsetting availability
  • Unstructured masking availability
  • Parallel tasks availability
  • On Demand worker limit
• Connection limits
• Upgrade prompts
• License warnings in the web UI
• Selecting a license type
  • When you cannot switch license types
  • Selecting a license type on initial install (AWS Marketplace products only)
• More details about Dynamic licenses
  • AWS permissions
  • Cross-account licensing
  • Choosing an approach
  • Assume role setup
  • License grants setup
  • Troubleshooting cross-account setup
  • Automatic License Renewal
  • License units and dimensions
  • Units required on ECS
  • Units required on other platforms
  • Troubleshooting Dynamic licenses
• License breaches
  • License quota exceeded
  • License expiry
• Automated notification emails
  • Notification on license limit breach
  • License breach reminder notification
  • Expiry reminder notification
• License renewal and upgrade process

Introduction

In order to mask data with DataMasque, you require a license. You can obtain one by contacting the sales team: sales@datamasque.com.

You can view and configure the license at the top of the My Account page. Only admin users have permissions to edit the license information.

When no license is installed, you can still create connections and rulesets, but will not be able to mask any data. A Dynamic license without an active contract is more restricted; see Dynamic licenses.

License types

There are two types of licenses:

• File-based licenses, which are files with names ending in .lic. These can be uploaded through the My Account page.

• Dynamic licenses, where DataMasque connects to AWS License Manager to check out licenses.

In-Flight Masking is available with Enterprise, Premium Trial and Sandbox licenses only. This covers both masking through an endpoint and creating, updating or deleting endpoints. A Sandbox license is limited to 6 mask requests per minute; see Sandbox license.

The Unstructured Ruleset Builder does not require In-Flight Masking. The license types that include it are listed in Unstructured masking availability.

File-based licenses

Free Trial and Sandbox licenses limit the rows masked in each table. Other license types that allow database masking have no row limit.

Free Trial license

Allows masking of up to 1,000 rows per table, or 5 files in a single run. All other data will be left unmasked.

In file runs, these limits apply to masking tasks only:

• The masking tasks in a ruleset share a single 5-file allowance. A run that skips files due to this limit reports them in the run log and the run report. Unmasked files are not written to the destination.
• mask_file tasks skip non-tabular files larger than 1MB. Unmasked files are not written to the destination.
• mask_tabular_file tasks truncate each file to 1,000 rows. Rows past that limit are left out of the output file entirely. This differs from a Sandbox license, which writes them through unmasked.

run_file_data_discovery tasks are not limited, as scanning a file does not mask it.

A run that only partially masks a table completes with warnings, and the run log names the table.

The same column exemption applies as under a Sandbox license, with the limit at 1,000 rows. See Sandbox license below.

In-Flight Masking, subsetting and Amazon Redshift are not available (see Subsetting availability).

Free Trial licenses expire after 30 days. On AWS Marketplace, the 30 days start when DataMasque is installed.

Sandbox license

Allows masking of up to 10,000 rows per table in a database run. All other rows in the table will be left unmasked. Each table is capped independently, so tables do not share an allowance.

The cap is a property of the license type, so it is not carried in the license file and cannot be raised by reissuing the license. It is shown as the Maximum row limit on the My Account page. Sandbox licenses carry an expiry date like any other customer license. A run that actually cuts a table short completes with warnings, and the run log names each table that was truncated.

In-flight masking is limited to 6 mask requests per minute for each in-flight masking container, shared across all users, tokens and ruleset plans. Requests past the limit receive a 429 response with a Retry-After header, and the limit frees up as earlier requests age out of the one-minute window. The limit cannot be changed with the in-flight rate limiting environment variables.

A JWT access token keeps the in-flight masking access and rate of the license it was issued under for its whole 12-hour lifetime. After uploading a Sandbox license, or replacing one with another license type, log in again or refresh to get a new access token under the new license, and stop using any access token issued before the change.

A subset task runs, at 0.01% retention, whatever percentage the ruleset asks for. The run log says the license set it. A table the subset starts from retains about that percentage, give or take, and keeps at least one row even where the percentage would round down to nothing. Foreign keys still resolve, though a dependent table may keep only one row for each kept row it references, and a table with no rows referencing a kept row comes back empty.

No table keeps more than the 10,000 rows the license masks, so a subset never leaves rows the run cannot mask. The run log names each table trimmed to that limit and how many rows it dropped.

Put the subset task before the masking tasks. The row cap applies to each masking task as it runs, so masking a table before it is subsetted spends the cap on rows the subset then discards, and the rows that remain come back unmasked.

In file runs, a Sandbox license masks up to 10,000 files, and mask_tabular_file tasks mask the first 10,000 rows of each file. The rows past that limit are written to the output file unmasked, so the file comes back whole rather than cut short. As in a database run, each file is capped independently rather than sharing a row allowance. The masking tasks in a ruleset share the single 10,000-file allowance. Files past it are not processed. The run log gives the count and names up to five of them, and the run report lists every one.

File data discovery is not capped. It runs over as many files as the connection holds, with no file-count limit and no truncation warning, because it only reads a bucket to report what is in it and masks nothing. The limits above apply to masking tasks rather than to the run, so a run_file_data_discovery task inside a masking ruleset is likewise uncapped and does not spend the file allowance the masking tasks share.

mask_file tasks mask the first 10,000 values of each JSON or XML file. The values past that limit are written to the output file unmasked, as the rows past a tabular file's limit are. A value here is one masked value rather than one path, so a path that matches many values spends one for each of them, and the values a ruleset does not mask are not counted at all.

In a JSON file a value is one value a transform replaces. In an XML file it is the text of an element, one attribute, or an element name, each counting as one.

The run log names each file the limit stopped and says how many of its values were written through unmasked, and the run report lists every one.

A transform using force_consistency is consistent only within the allowance. Its matches share one value up to the limit; the matches past it keep their original content, so the same source value can appear both masked and unmasked in one file.

The allowance belongs to the file, not to the document inside it. NDJSON and Avro files hold many records, and all of them draw on the one 10,000 value allowance that file was given; a file holding a single document is the same rule with one record. Each file is capped independently of every other.

There is no file size limit, unlike the Free Trial. The value limit does not apply to PDF, DOCX, PPTX or other generic files. Each is masked as a single item rather than as a document with values to count, so the file count is what bounds them, however many replacements a mask makes inside one.

A run that partly masks a file completes with warnings, and the run log names the file. A dry run reports the same cap as a projection without warnings, as nothing is written.

The cap bounds the mask_table scan, with one exception.

Some columns are masked in every row, past the cap. A column masked with imitate_unique, from_unique_imitate, imitate_uuid or imitate_nz_ird is always exempt: these replace a value with another from the set the column already holds, so masking only part of the column could produce a duplicate. A key column, or one another table references by foreign key, is exempt whenever its mask preserves uniqueness, including email. Rows in the referencing tables are masked in full, so stopping the parent at the cap would leave them pointing at values that were never masked.

An email mask anywhere else is bounded like any other column. It generates addresses rather than imitating the ones already in the column, so masking only part of it will not produce a duplicate.

The exemption is per column. Ordinary columns on the same table still stop at the cap, and the run log names both the truncation and the columns carried past it.

On Amazon Redshift the exemption applies to the whole table. In a table with any exempt column, ordinary columns are also masked in every row.

This means a ruleset built around these masks can mask more than 10,000 rows in a table. That is intended: a partly masked column of imitated values is worse than an unenforced cap.

mask_unique_key tasks are outside the cap altogether, as the key mapping has to cover every row for the tables referencing it to stay consistent.

A max_rows you set in your own run options is refused instead, not carried past, as the partial table is what you asked for.

Tasks that move or reshape data without masking it, such as run_sql, truncate_table and build_temp_table, are outside the cap's scope as well.

Foundation license

Allows database masking runs against at most 2 connections. A connection counts towards this limit the first time one of its runs finishes successfully (finished or finished_with_warnings). The license type sets the cap. The license file does not contain it, so reissuing the license does not raise it.

A run on a connection that does not yet count is refused with an HTTP 403 response once the count reaches the limit. The response names the cap, how many connections count, and the current license type. A connection that already counts can still run once the count reaches the limit. Once the count exceeds the limit, every run is refused.

Creating or duplicating a connection is refused with an HTTP 403 response when the number of connections reaches the limit, whether or not they have run. Deleting a connection frees its slot immediately, but deletion is refused for 90 days after the connection's first successful run — its protected settings (host, port, database, user, and similar) are locked for the same 90 days. Credentials, the connection name and a handful of other operational fields stay editable throughout. The exception: deletion stays available while the number of connections holding a slot is above the limit — for example after downgrading to Foundation — even during the 90-day lock, so the account can get back under the cap. The read-only fields that report this state (target_frozen, frozen_target_fields, deletion_frozen) are described in the API reference.

GET /api/connections/ shows a locked connection's lock date in its license_lock field. A connection that no run has locked yet does not count against your limit and has no lock date.

Once a connection has been locked by a successful run, it keeps counting against your limit until you delete it, or change a protected setting once its 90-day lock has expired; the 90-day lock expiring does not by itself free the slot, and editing the admin database directly does not remove it from the count. If the stored lock record is invalid, the connection still counts towards the limit, and the license page flags it. A flagged connection keeps counting: a later successful run clears the flag by re-locking it (the connection still counts, now as a valid slot), and deleting it is possible only while you are over your limit — otherwise a flagged connection is frozen against deletion, like a connection still within its 90-day lock.

A Foundation license excludes file masking, file data discovery, in-flight masking, unstructured masking and subsetting. File Masking, In-Flight Masking, the File Ruleset Generator and the Unstructured Ruleset Builder stay in navigation. Opening one of them, including from a bookmarked link, shows the upgrade prompt. Closing the prompt returns you to the previous page, or to the home page when there is none. To upgrade, see License renewal and upgrade process. Existing file connections are kept and become usable again if the license changes to one that allows file masking. On the Preview and confirm run screen, a ruleset with a subset task shows its subsetting summary, but the run cannot start.

Structured license

A Structured license does not allow file masking, file data discovery, in-flight masking or unstructured masking. Like Foundation, it shows the same upgrade prompt for those pages. Unlike Foundation, a Structured license has no connection limit, so it has no 90-day edit/delete lock. The Structured license allows subsetting.

Enterprise license

An Enterprise license allows every DataMasque feature. It has no connection limit, row limit or file size limit.

Dynamic licenses

Dynamic licenses are specifically designed for use within the AWS ecosystem, and are currently only supported on AWS. Instead of using a traditional license file, DataMasque checks out a contract license directly from your AWS account. This requires an active AWS contract license for DataMasque products to be present in your AWS account.

To use a Dynamic license:

• Obtain a Dynamic license by purchasing a contract-based DataMasque product through AWS.
• Ensure that you have a valid contract license in your AWS account.
• Use the My Account page to select the correct license type (Business or Enterprise).
• DataMasque will then handle the license checkout process directly with AWS.

Until a contract is active, a Dynamic license allows no masking, and neither connections nor In-Flight Masking endpoints can be created, updated or deleted. Automation and the Unstructured Ruleset Builder are unavailable too. Once a contract is active, the contract's license type decides what is available.

Subsetting availability

The license type shown on the My Account page decides whether subsetting is available.

License type	Subsetting
Free Trial	Not included
Premium Trial	Included
Ready To Run	Included
Sandbox	Included (0.01% of each table)
On Demand	Not included
Foundation	Not included
Structured	Included
Enterprise	Included
Business DB	Included
Business File	Not applicable
Guidewire	Included
Restricted	Not applicable
Dynamic	Follows the contract license type

To use subsetting on a license type that does not include it, upgrade to a Structured or Enterprise license. A Dynamic license follows the license type of the contract it checks out.

Unstructured masking availability

The license type shown on the My Account page decides whether unstructured masking is available.

License type	Unstructured masking	Unstructured Ruleset Builder
Free Trial	Included (other limits apply)	Included
Premium Trial	Included	Included
Ready To Run	Included (other limits apply)	Not included
Sandbox	Included (other limits apply)	Not included
On Demand	Included	Included
Foundation	Not included	Not included
Structured	Not included	Not included
Enterprise	Included	Included
Business DB	Included	Included
Business File	Included	Included
Guidewire	Not included	Not included
Restricted	Not applicable	Not applicable
Dynamic	Follows the contract license type	Follows the contract license type

To use unstructured masking or the Unstructured Ruleset Builder on a license type that does not include it, upgrade to an Enterprise license. A Dynamic license follows the license type of the contract it checks out.

Parallel tasks availability

The license type shown on the My Account page decides whether parallel tasks are available. A run is refused if its ruleset contains a parallel task, at any depth, and the license type does not include parallel tasks.

License type	Parallel tasks
Free Trial	Included
Premium Trial	Included
Ready To Run	Included
Sandbox	Included
On Demand	Not included
Foundation	Included
Structured	Included
Enterprise	Included
Business DB	Included
Business File	Included
Guidewire	Included
Restricted	Not applicable
Dynamic	Follows the contract license type

To use parallel tasks on a license type that does not include them, upgrade to a Structured or Enterprise license. A Dynamic license follows the license type of the contract it checks out.

On Demand worker limit

An On Demand license runs each mask_table task and each run_file_data_discovery task on one worker, so a large run takes longer. Other license types do not lower workers.

When a run starts, DataMasque lowers the workers setting of each of these tasks to one. This includes the workers setting in the files section of a discovery configuration. If the ruleset sets a higher value, the run log records that the On Demand license type lowered it. A task that takes workers but is not listed above, such as mask_file, keeps the value in the ruleset.

Connection limits

A license type may come with a maximum number of connections. Like the row limit, this maximum is a property of the license type, so it is not carried in the license file and cannot be raised by reissuing the license.

A connection counts towards this maximum once it completes its first successful run. Creating or testing a connection does not, and neither does a run that fails. Creating a connection is refused when the number of connections reaches the maximum, whether they have run or not. Add connection then opens the upgrade prompt until a connection is deleted. Only a connection the license can use counts: a file connection does not count under a database-only license, which can neither run nor delete it.

When the license sets a maximum, the My Account page shows your usage against it as Connections in use, for example "Connections in use: 2 of 2". It shows your actual usage, so if more connections are in use than the license allows — for instance after moving to such a license from one with no maximum — the real number is shown, such as "Connections in use: 3 of 2". To raise the maximum, upgrade to a Structured or Enterprise license, which do not set a connection maximum.

Upgrade prompts

With a Foundation, Structured or Ready To Run license, a section that the license does not include stays visible, and opening it shows an upgrade prompt. So does an action the license does not allow, such as adding a connection. The prompt names your license type and the license types that add the feature, and lists what else they include. With a Ready To Run license, the prompt offers the free trial sign-up instead. To upgrade, see License renewal and upgrade process. The prompt does not change which runs are allowed: a run that uses a feature the license does not include is refused.

With any other license type, the navigation shows only the sections that the license includes.

License warnings in the web UI

A ruleset or library that uses a feature your license does not include is still valid, and can still be saved.

These features cause a warning:

• A subset task.
• A parallel task.
• An unstructured_text mask.
• The mask_type of the ruleset: Database Masking or File Masking.

For example, under a Foundation license a ruleset that contains an unstructured_text mask shows "Unstructured Masking is unavailable with the Foundation license type. It is available with an Enterprise license."

DataMasque marks the ruleset or library in these places:

• The Ruleset Editor and the library editor show a warning at the top of the page, naming each feature not covered by the license.
• The Status indicator in both editors shows an orange warning symbol in place of the green tick.
• The ruleset list and the library list show the same orange warning symbol beside the ruleset or library.
• The Library Help panel in the Ruleset Editor shows the same orange warning symbol beside the library.

Ruleset warnings include features brought in from a ruleset library as well as those written into the ruleset itself. They are shown once the ruleset has been validated. Validation occurs when the ruleset or library is saved. DataMasque checks the warnings against the current license each time it shows them, so a license upgrade clears them without saving the ruleset again.

A library warning blocks nothing by itself. DataMasque refuses a run of a ruleset that uses the feature through the library.

When previewing a run using a ruleset that uses features not covered by your license, the run preview shows the same warning, and the Start Run button is disabled.

Selecting a license type

DataMasque offers two methods for license acquisition: file-based and cloud-based (AWS Contract License). In general, when DataMasque is deployed to an AWS platform (EC2, EKS or ECS), you can choose which method DataMasque uses to obtain its license, offering flexibility depending on your deployment environment and licensing model.

To change the license type, use the Account License Information section of the My Account page:

• To upload a file license:

  • Select Use license file.
  • Click Configure next to License File.
  • In the panel that opens, drag and drop a license file or click to browse and select one.
  • If the license file is invalid, you will see an error message.
  • Otherwise, click Save to apply the license.

  

• To use a Dynamic license:

  • Select AWS Contract License.
  • Click Configure next to AWS Contract License.
  • In the configure panel:
    • AWS Identity: If your contract is in a different AWS account, check Assume role for license check out and enter the billing account role ARN. See Cross-account licensing for setup instructions.
    • Checkout Mode: Choose how DataMasque selects a license product:
    • Automatic (recommended): tries available products in order until one checks out successfully.
    • Specific product: select a specific product from the discovered list. Use this if you have multiple DataMasque subscriptions and want this installation to use a particular one.
    • Disable checkout: checks in any currently held licenses and prevents automatic checkout. Masking runs cannot be executed until checkout is re-enabled.
    • Plan: Select Business or Enterprise to match your contract type. (Hidden when Disable checkout is selected.)
  • Click Save.
  • DataMasque will check out the license in the background and update the status in the Account License Information section.
  • If checkout fails, an error will be shown. Refer to Troubleshooting Dynamic licenses for possible fixes.

  

When you cannot switch license types

When DataMasque is deployed on a non-AWS platform, or you are using an On Demand (hourly) AWS product, only a file-based license is supported. You are not able to replace this license file.

When using a DataMasque Contract Product from AWS Marketplace, you will only see the option to use Dynamic licenses.

Selecting a license type on initial install (AWS Marketplace Contract Product only)

Refer to the AWS Installation page.

You can always change the selected contract license type through the My Account page, as described above.

More details about Dynamic licenses

AWS permissions

To use Dynamic licenses, the IAM role attached to the EC2, EKS cluster, or ECS task must include the following permissions:

{
    "Sid": "DataMasqueLicenseCheckInAndOut",
    "Effect": "Allow",
    "Action": [
        "license-manager:CheckoutLicense",
        "license-manager:CheckInLicense",
        "license-manager:ExtendLicenseConsumption"
    ],
    "Resource": "*"
}

license-manager:ExtendLicenseConsumption lets DataMasque refresh a near-expiry checkout in place instead of checking it in and out again.

Note: "Resource": "*" is required. AWS License Manager does not support resource-level restrictions for CheckoutLicense, CheckInLicense, or ExtendLicenseConsumption. Scoping the Resource to a specific license ARN will cause an AuthorizationException even when the ARN is correct.

The following permissions are optional. If granted, DataMasque will display additional metadata on the My Account page when using a Dynamic license:

{
    "Sid": "DataMasqueLicenseMetadata",
    "Effect": "Allow",
    "Action": [
        "license-manager:GetLicense",
        "license-manager:GetLicenseUsage",
        "aws-marketplace:SearchAgreements"
    ],
    "Resource": "*"
}

• license-manager:GetLicense — enables display of the Product Name and Contract Expiry date.
• license-manager:GetLicenseUsage — enables display of consumed and available entitlement counts in the AWS Contract License configure panel when using Specific product checkout mode.
• aws-marketplace:SearchAgreements — enables display of the Agreement ID with a link to the AWS Marketplace console. Grant this on the DataMasque instance role for same-account deployments, or on the billing account cross-account role when using assume role (see Cross-account licensing).

If these permissions are not granted, license checkout will still work normally. The product name, contract expiry, agreement ID, and entitlement counts will simply not be shown.

Cross-account licensing

If your AWS Marketplace contract is in a different AWS account from where DataMasque is deployed — for example, a centralised billing account holds the contract while DataMasque runs in a separate production account — you need to give DataMasque access to the license across accounts.

See the Cross-Account Licensing Setup guide for full AWS IAM setup instructions for both approaches below.

Choosing an approach

Approach	How it works	Recommended
Assume role	DataMasque temporarily assumes an IAM role in the billing account when performing license operations.	✓
License grants	The billing account uses AWS License Manager to grant the license directly to the deployment account. DataMasque checks it out from there without needing cross-account credentials.

Assume role is recommended for most deployments because it does not require modifying the license grant and gives fine-grained control over which accounts and roles can access the license.

Assume role setup

DataMasque in the deployment account temporarily assumes an IAM role in the billing account when performing license operations. Setup involves creating a cross-account IAM role in the billing account, granting sts:AssumeRole to the DataMasque instance role in the deployment account, and entering the role ARN in the DataMasque UI.

For full setup instructions, see the Cross-Account Licensing Setup guide.

License grants setup

Note: Assume role is the recommended approach. Use license grants only if your organisation already uses or prefers the AWS License Manager grants workflow.

AWS License Manager allows the billing account to grant license usage directly to another AWS account. Once the deployment account accepts the grant, DataMasque can check out the license without any assume role configuration or role ARN in the UI.

For full setup instructions, see the Cross-Account Licensing Setup guide.

Troubleshooting cross-account setup

• AccessDenied when checking out a license — Verify that the DataMasque instance role has license-manager:CheckoutLicense, license-manager:CheckInLicense, and license-manager:ExtendLicenseConsumption. If using assume role, also confirm the role has sts:AssumeRole permission for the billing account role.

• AccessDenied when assuming the role — Check that the trust policy on the billing account role references the correct deployment account role ARN, and that the deployment account policy targets the correct billing account role ARN.

• No products shown in Specific checkout mode — The billing account role may be missing license-manager:ListReceivedLicenses. Add this permission to the role's policy.

• Role ARN field is greyed out or Save is disabled — The ARN field only becomes active after checking Assume role for license check out. Ensure the value is a valid IAM role ARN (arn:aws:iam::<account-id>:role/<role-name>) before saving.

You can verify assume role is correctly configured using the AWS CLI from an instance that uses the same IAM role as DataMasque:

aws sts assume-role \
    --role-arn arn:aws:iam::<billing-account-id>:role/DataMasqueLicenseRole \
    --role-session-name datamasque-verify-session

If this returns temporary credentials, the IAM setup is correct.

On ECS, DataMasque also requires the following permissions to read information about the ECS task under which DataMasque is deployed:

{
    "Sid": "DataMasqueQueryTasks",
    "Effect": "Allow",
    "Action": [
        "ecs:ListTasks",
        "ecs:DescribeTasks"
    ],
    "Resource": "*"
}

Automatic License Renewal

By default, cloud licenses are automatically checked out or renewed in the background approximately every 5 minutes while the DataMasque instance is running. This ensures that your DataMasque instance always has a valid license.

To disable automatic license checkout, click Configure next to AWS Contract License on the My Account page, set Checkout Mode to Disable checkout, and click Save. When checkout is disabled:

• All active licenses are immediately checked in to AWS License Manager.
• DataMasque will not automatically check out licenses.
• Masking runs cannot be executed until checkout is reconfigured and re-enabled.

License units and dimensions

DataMasque's licensing model is based around three product dimensions. For a Business-type Dynamic license, the available dimensions are:

• business_lic (base license)
• business_sup (additional license with support plan)
• business_add (additional license)

Likewise, for enterprise, the dimensions are enterprise_lic, enterprise_sup, and enterprise_add.

All the above dimensions are granted in single Count units. When you purchase a Dynamic license, you might purchase varying numbers of different dimensions, and each will grant one unit.

You can view the dimensions with the maximum number of units, and number of units currently in use, in the AWS License Manager console. Under the granted license, select the License details tab. The Entitlements table shows the dimensions, the maximum number of units, and the number currently in use.

The total number of units is the sum of those across all relevant dimensions (either business or enterprise according to what is selected in the DataMasque UI, but not both). For example, if business_lic shows a Max count of 3, and business_sup shows 2, the total number of available units is five.

The number of units required to use DataMasque depends on the platform, as described below.

Units required on ECS

When DataMasque is deployed on an ECS platform and using a Dynamic license, the number of units required is the larger of the number of agent containers and in-flight-containers that are currently running, with a minimum of one unit.

For example:

Agent containers running	In-Flight Masking containers running	Units required
0	0	1
1	1	1
4	1	4
2	3	3

Units required on other platforms

On other platforms (EC2 and EKS), one unit is required.

Troubleshooting Dynamic licenses

• Ensure the IAM role attached to the EC2, EKS cluster or ECS task has the IAM permissions listed above (license-manager:CheckoutLicense, license-manager:CheckInLicense, and license-manager:ExtendLicenseConsumption).
• On ECS, ensure the task IAM role also has the ecs:ListTasks and ecs:DescribeTasks permissions, and that there is no firewall blocking traffic to the ECS Task Metadata endpoint, which is typically an IP address in the 169.254.172.0/22 CIDR block.
• On EC2 and EKS, ensure that the IMDS (Instance Metadata Service) configuration is correct and that there is no firewall blocking traffic to IMDS.
• Use the AWS License Manager console to verify that the granted license is visible and not already in use. If the license is in use but DataMasque is not running, it will automatically be checked in within one hour, whereupon it should display as no longer in use and you can try again.
• Ensure you have the correct contract license type (Business or Enterprise) set in the Configure panel for AWS Contract License.

Errors when upgrading from v2.29 or below to v2.30 or higher on EKS

Prior to v2.29, DataMasque used the EKS node instance ID to check out licenses, which led to licensing errors when containers were scheduled on different nodes.

As of version 2.30, DataMasque checks out licenses using a consistent ID for the whole cluster, thus fixing this issue. When upgrading to 2.30, any licenses checked out prior to upgrade will still be incorrectly using the node's instance ID, and as a result you may see an error on the My Account page regarding Dynamic licensing. To fix the error, temporarily disable Dynamic licensing, then re-enable it. To do this, click Configure next to AWS Contract License, set Checkout Mode to Disable checkout, and click Save. Then reopen the panel, set Checkout Mode back to Automatic, and click Save.

License breaches

License quota exceeded

When starting a masking run, if your accumulated usage exceeds the quota of your license:

• If the target database has been masked previously, and has not increased markedly in size, a license breach will be registered, and the masking run will be started as usual. A warning will be displayed in the DataMasque interface and a notification email will be sent to all active admin users of your DataMasque instance.
• If the target database has not been masked previously, or has increased markedly in size, the masking run will not start.

In the event that you exceed your license quota, you will be unable to mask any new database instances. Contact the DataMasque sales team (sales@datamasque.com) to upgrade your license quota.

License expiry

After license expiry, you will no longer be able to run any data masking tasks. You can however continue to log in and use the rest of the DataMasque web interface as normal.

Automated notification emails

The following email notifications will be sent using the configured SMTP settings as reminders.

• License breach reminder notification and Expiry reminder notification are automatically scheduled to be sent on the 1st day of applicable months.

Notification on license limit breach

License limit breaches will trigger email notifications to all active admin users. Once a breach notification email has been sent, subsequent breaches within the following 30 days will not trigger additional notification emails.

License breach reminder notification

An email is sent monthly to all active admin users containing a summary of the license breaches that happened during the last calendar month. If no breach occurred during the last month, this email will not be sent.

Expiry reminder notification

During the last 3 months of the license subscription period, a monthly email notification will be sent to all active admin users with a reminder that the DataMasque license will expire soon. You may also see a reminder message at the bottom left of the screen when logging in to DataMasque.

License renewal and upgrade process

Contact the DataMasque sales team: sales@datamasque.com for license renewal or upgrade.