Data classification and tagging in Snowflake - Deep Dive

Overview - Data classification and tagging

What is it?

Data classification and tagging is the process of labeling data based on its type, sensitivity, or purpose. It helps organize data so that users and systems know how to handle it properly. In Snowflake, this means attaching tags to data objects like tables or columns to identify their characteristics. This makes managing and protecting data easier and more effective.

Why it matters

Without data classification and tagging, organizations risk mishandling sensitive information, leading to data breaches or compliance failures. It solves the problem of knowing what data is sensitive, who can access it, and how it should be protected. This helps keep data safe, supports legal rules, and improves data management across teams.

Where it fits

Before learning data classification and tagging, you should understand basic Snowflake concepts like databases, tables, and roles. After mastering tagging, you can explore data governance, access control, and auditing in Snowflake. This topic is a key step toward managing data securely and responsibly.

Mental Model

Core Idea

Data classification and tagging is like putting clear labels on your files so everyone knows what they contain and how to treat them.

Think of it like...

Imagine a library where every book has a colored sticker showing if it’s a children’s book, a reference book, or a rare manuscript. This helps librarians and readers handle each book correctly. Data tags work the same way for data in Snowflake.

┌───────────────┐
│   Data Object │
│ (Table/Column)│
└──────┬────────┘
       │
       ▼
┌───────────────┐
│     Tag(s)    │
│ (e.g., PII,   │
│  Confidential)│
└───────────────┘

Build-Up - 6 Steps

1

Foundation

Understanding Data Objects in Snowflake

Concept: Learn what data objects are in Snowflake and their role.

Snowflake stores data in objects like databases, schemas, tables, and columns. Each object holds data in a structured way. For example, a table contains rows and columns, where columns hold specific types of data like names or dates.

Result

You can identify where data lives in Snowflake and what types of objects you can tag.

Knowing the structure of data objects is essential before you can classify or tag them effectively.

2

Foundation

What is Data Classification and Tagging?

Concept: Introduce the idea of labeling data to describe its sensitivity or purpose.

Data classification means sorting data into categories like public, internal, or confidential. Tagging is the act of attaching labels (tags) to data objects to mark these categories. In Snowflake, tags are metadata that describe data properties.

Result

You understand why tagging helps organize and protect data.

Recognizing that tags are metadata helps you see how they add meaning without changing the data itself.

3

Intermediate

Creating and Applying Tags in Snowflake

🤔Before reading on: Do you think tags are created globally or per table? Commit to your answer.

Concept: Learn how to create tags and assign them to data objects in Snowflake.

In Snowflake, you create tags using the CREATE TAG command. Tags can have values like 'PII' or 'Confidential'. After creating a tag, you assign it to tables or columns using the ALTER command. For example: CREATE TAG sensitive_data; ALTER TABLE customers SET TAG sensitive_data = 'PII';

Result

You can label data objects with meaningful tags to classify data.

Understanding tag creation and assignment empowers you to organize data systematically.

4

Intermediate

Using Tags for Access Control and Compliance

🤔Before reading on: Can tags directly restrict access to data, or do they only help identify it? Commit to your answer.

Concept: Explore how tags support security and compliance by informing policies.

Tags themselves do not restrict access but help identify sensitive data. Security teams use tags to build access policies or audits. For example, a policy might allow only certain roles to query columns tagged as 'Confidential'. This helps enforce rules without hardcoding permissions on every object.

Result

You see how tagging fits into broader data governance and security.

Knowing tags are metadata that guide policies helps separate data labeling from enforcement.

5

Advanced

Managing Tag Inheritance and Overriding

🤔Before reading on: Do you think tags on a table automatically apply to all its columns? Commit to your answer.

Concept: Understand how tags behave when applied at different object levels and how to override them.

In Snowflake, tags can be applied at the table or column level. Tags on a table do not automatically apply to columns; columns need their own tags if classification differs. You can override tags on columns even if the table has a tag. This allows fine-grained classification.

Result

You can classify data precisely at multiple levels.

Understanding tag scope prevents misclassification and ensures accurate data labeling.

6

Expert

Automating Tagging and Integrating with Data Catalogs

🤔Before reading on: Do you think tagging is always manual, or can it be automated? Commit to your answer.

Concept: Learn how to automate tagging using scripts or integrate with external data catalogs.

In large environments, manual tagging is slow and error-prone. Snowflake supports automation via SQL scripts or APIs to assign tags based on data scanning or metadata rules. Integration with data catalogs can sync tags, ensuring consistent classification across tools. This improves accuracy and saves time.

Result

You can implement scalable, consistent data classification in production.

Knowing automation options helps maintain data quality and governance at scale.

Under the Hood

Tags in Snowflake are stored as metadata linked to data objects. When you create a tag, Snowflake records its name and optional values. Assigning a tag attaches this metadata to the object without changing the data itself. This metadata is stored in Snowflake's internal metadata store and can be queried or used by policies. Tags do not affect data storage or query performance directly.

Why designed this way?

Snowflake designed tagging as metadata to keep data and classification separate. This allows flexible labeling without altering data structure or content. It supports evolving classification needs and integrates with governance tools. Alternatives like embedding classification in data would be rigid and error-prone.

┌───────────────┐       ┌───────────────┐
│   Data Object │──────▶│   Metadata    │
│ (Table/Column)│       │ (Tags stored) │
└───────────────┘       └───────────────┘
         ▲                      ▲
         │                      │
         │                      │
  User assigns tags       Governance tools
         │                      │
         ▼                      ▼
┌───────────────┐       ┌───────────────┐
│   Query/Data  │       │ Access Policies│
│   Operations  │       │  use tags info │
└───────────────┘       └───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Do tags in Snowflake automatically block unauthorized users from accessing data? Commit to yes or no.

Common Belief: Tags automatically enforce security by blocking access to sensitive data.

Reality: Tags only label data; they do not enforce access control by themselves. Access control requires separate policies that use tags as input.

Why it matters: Assuming tags enforce security can lead to data leaks if policies are not properly set up.

Quick: Do tags applied to a table automatically apply to all its columns? Commit to yes or no.

Common Belief: Tagging a table means all columns inherit the same tags automatically.

Reality: Tags on tables do not cascade to columns. Columns need individual tags if classification differs.

Why it matters: Misunderstanding tag inheritance can cause incorrect data classification and compliance risks.

Quick: Is tagging data always a manual process? Commit to yes or no.

Common Belief: You must manually tag every data object to classify it.

Reality: Tagging can be automated using scripts, APIs, or integrated with data catalogs for large environments.

Why it matters: Believing tagging is only manual limits scalability and increases errors in big data systems.

Quick: Does tagging change the actual data stored in Snowflake? Commit to yes or no.

Common Belief: Tags modify the data content or structure.

Reality: Tags are metadata only and do not alter the data itself.

Why it matters: Confusing tags with data changes can cause unnecessary data migrations or schema changes.

Expert Zone

1

Tags can have multiple values and can be combined to represent complex classifications, but managing these combinations requires careful planning.

2

Tag metadata is queryable via Snowflake's INFORMATION_SCHEMA, enabling dynamic reporting and auditing of data classification.

3

Tagging strategy should align with organizational policies and compliance frameworks to avoid inconsistent or conflicting classifications.

When NOT to use

Tagging is not suitable for enforcing real-time access control by itself; use Snowflake's role-based access control (RBAC) and masking policies for enforcement. Also, avoid over-tagging which can create management overhead; use tags strategically for meaningful classification.

Production Patterns

In production, organizations automate tagging during data ingestion pipelines, integrate Snowflake tags with enterprise data catalogs, and use tags to drive dynamic masking policies and audit reports. Tags also help in cost allocation by identifying sensitive or high-value data.

Connections

Metadata Management

Data classification and tagging is a subset of metadata management.

Understanding tagging deepens knowledge of how metadata organizes and governs data assets.

Role-Based Access Control (RBAC)

Tags inform RBAC policies but do not replace them.

Knowing the difference helps design secure systems where tags guide but roles enforce access.

Library Science

Both use classification systems to organize and protect resources.

Seeing data tagging like library cataloging reveals universal principles of organizing information.

Common Pitfalls

#1 Assuming tags enforce security directly.

Wrong approach:

CREATE TAG sensitive;
ALTER TABLE customers SET TAG sensitive = 'PII';
-- Then no access control policies applied

Correct approach:

CREATE TAG sensitive;
ALTER TABLE customers SET TAG sensitive = 'PII';
CREATE MASKING POLICY pii_mask AS ...;
GRANT SELECT ON TABLE customers TO role;
-- Use tags in policies to enforce access

Root cause:

Confusing metadata labeling with access enforcement.

#2 Tagging only tables and ignoring columns.

Wrong approach:

ALTER TABLE orders SET TAG confidential = 'yes';
-- No tags on columns even if some contain sensitive data

Correct approach:

ALTER TABLE orders SET TAG confidential = 'yes';
ALTER TABLE orders ALTER COLUMN credit_card SET TAG confidential = 'PII';

Root cause:

Misunderstanding tag scope and granularity.

#3 Manually tagging large datasets without automation.

Wrong approach:

-- Manually running ALTER commands for thousands of tables and columns

Correct approach:

-- Use scripts or Snowflake APIs to automate tagging based on metadata scans

Root cause:

Underestimating scale and complexity of data environments.

Key Takeaways

Data classification and tagging in Snowflake is about labeling data objects with metadata to describe their sensitivity or purpose.

Tags do not enforce security by themselves but support governance by informing access policies and audits.

Tagging can be applied at multiple levels, such as tables and columns, and understanding scope is critical to accurate classification.

Automation of tagging is essential in large environments to maintain consistency and reduce errors.

Effective tagging strategies integrate with broader data governance, security, and compliance frameworks.

Practice

1. What is the main purpose of data classification and tagging in Snowflake?

easy

A. To speed up query performance by indexing data

B. To convert data into different file formats

C. To automatically delete old data after a set time

D. To organize and protect data by labeling it with tags

Solution

1. Step 1: Understand data classification and tagging

   Data classification and tagging help label data to organize and protect it.

2. Step 2: Identify the purpose in Snowflake context

   Tags are used to mark data for governance and security, not for performance or deletion.

3. Final Answer:

   To organize and protect data by labeling it with tags -> Option D

4. Quick Check:

   Data classification = Organize and protect data [OK]

Hint: Tags label data to organize and protect it [OK]

Common Mistakes:

• Confusing tagging with indexing for performance
• Thinking tags delete data automatically
• Assuming tags change data format

2. Which of the following is the correct syntax to create a tag in Snowflake?

easy

A. CREATE TAG tag_name COMMENT = 'description';

B. CREATE TAG tag_name WITH 'description';

C. MAKE TAG tag_name COMMENT 'description';

D. NEW TAG tag_name SET COMMENT = 'description';

Solution

1. Step 1: Recall Snowflake tag creation syntax

   The correct syntax uses CREATE TAG followed by the tag name and COMMENT clause.

2. Step 2: Compare options with syntax

   Only CREATE TAG tag_name COMMENT = 'description'; matches the correct syntax: CREATE TAG tag_name COMMENT = 'description';

3. Final Answer:

   CREATE TAG tag_name COMMENT = 'description'; -> Option A

4. Quick Check:

   CREATE TAG ... COMMENT = ... is correct syntax [OK]

Hint: Use CREATE TAG with COMMENT = 'text' [OK]

Common Mistakes:

• Using MAKE or NEW instead of CREATE
• Missing equal sign in COMMENT clause
• Using WITH instead of COMMENT

3. Given the following commands, what will be the result of querying the tags on the customers table?

CREATE TAG pii COMMENT = 'Personally Identifiable Information';
ALTER TABLE customers SET TAG pii = 'true';
SHOW TAGS ON TABLE customers;

medium

A. It will show the tag 'pii' with value 'true' assigned to the customers table

B. It will show an error because tags cannot be set on tables

C. It will show the tag 'pii' but with no value assigned

D. It will show no tags because SHOW TAGS is invalid syntax

Solution

1. Step 1: Understand tag creation and assignment

   The tag 'pii' is created and then assigned to the 'customers' table with value 'true'.

2. Step 2: Check SHOW TAGS syntax and output

   SHOW TAGS ON TABLE customers; lists tags assigned to the table, showing 'pii' = 'true'.

3. Final Answer:

   It will show the tag 'pii' with value 'true' assigned to the customers table -> Option A

4. Quick Check:

   SHOW TAGS ON TABLE shows assigned tags [OK]

Hint: SHOW TAGS ON TABLE lists assigned tags and values [OK]

Common Mistakes:

• Thinking tags cannot be assigned to tables
• Assuming SHOW TAGS syntax is invalid
• Expecting tags without values to appear

4. You run the following command but get an error:

ALTER TABLE orders SET TAG sensitive = 'yes';

What is the most likely cause of the error?

medium

A. ALTER TABLE cannot be used to set tags

B. The value 'yes' is not allowed for tags

C. The tag 'sensitive' was not created before assigning it

D. Tags can only be assigned to columns, not tables

Solution

1. Step 1: Check if tag exists before assignment

   Tags must be created with CREATE TAG before assigning to tables or columns.

2. Step 2: Analyze error cause

   If 'sensitive' tag was not created, assigning it causes an error.

3. Final Answer:

   The tag 'sensitive' was not created before assigning it -> Option C

4. Quick Check:

   Tags must exist before assignment [OK]

Hint: Create tags before assigning them [OK]

Common Mistakes:

• Assuming any value is invalid
• Thinking ALTER TABLE can't set tags
• Believing tags only apply to columns

5. You want to classify columns in a payments table as either 'confidential' or 'public' using tags. Which approach correctly applies tags to columns and supports data governance?

hard

A. Create tags and assign them to database schemas instead of columns

B. Create tags 'confidential' and 'public', then assign them to each column with ALTER TABLE ... ALTER COLUMN ... SET TAG

C. Use column comments instead of tags to classify data sensitivity

D. Create tags and assign them only to the table, not columns, to simplify management

Solution

1. Step 1: Understand tagging granularity

   Tags can be assigned to columns to classify data precisely, supporting governance.

2. Step 2: Identify correct tagging method

   Using ALTER TABLE ... ALTER COLUMN ... SET TAG applies tags to columns, enabling classification.

3. Final Answer:

   Create tags 'confidential' and 'public', then assign them to each column with ALTER TABLE ... ALTER COLUMN ... SET TAG -> Option B

4. Quick Check:

   Column-level tags enable precise data classification [OK]

Hint: Tag columns directly for precise classification [OK]

Common Mistakes:

• Tagging only tables loses column-level detail
• Using comments instead of tags for governance
• Assigning tags to schemas instead of columns