apache/cassandra · error · InvalidRequestException

Cannot mask columns because dynamic data masking is not…

Error message

Cannot mask columns because dynamic data masking is not enabled. You can enable it with the dynamic_data_masking_enabled property on cassandra.yaml

What it means

Column masking (dynamic data masking) is an opt-in Cassandra feature. ColumnMask.ensureEnabled checks the DatabaseDescriptor flag dynamic_data_masking_enabled and throws this InvalidRequestException whenever masking functions are used in a schema (masked columns) while the feature is disabled in cassandra.yaml.

Solutions

Set dynamic_data_masking_enabled: true in cassandra.yaml and restart the node
Remove or replace masked column definitions if masking is not desired in this environment
Confirm the flag took effect via nodetool/JMX before retrying the CQL statement

Example fix

// before (cassandra.yaml)
# dynamic_data_masking_enabled not set
// after (cassandra.yaml)
dynamic_data_masking_enabled: true

Defensive patterns

Strategy: validation

Validate before calling

boolean maskingEnabled = DatabaseDescriptor.getDynamicDataMaskingEnabled(); // node-side; in app code, avoid masked-column DDL/DML unless flag confirmed true

Try / catch

try {
    session.execute("SELECT masked_col FROM t");
} catch (InvalidRequestException e) {
    if (e.getMessage().contains("dynamic data masking is not enabled")) {
        // surface config-fix instruction to the operator
    }
}

Prevention

Set dynamic_data_masking_enabled: true in every environment that will host masked schemas
Keep environment configs in sync when restoring schemas across clusters
Document the flag as a prerequisite wherever mask_* functions are used

When it happens

Trigger: Creating/altering a table with a masked column (e.g. mask_hash(...)) or selecting from an existing masked column while dynamic_data_masking_enabled is false (the default) in cassandra.yaml.

Common situations: Restoring a schema that contains masked columns onto a cluster without the feature flag set; upgrading environments where masking was enabled in test but not in production config; forgetting the flag after adding masking functions to CQL.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/9f4baa9a3c03ef70. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/cql3/functions/masking/ColumnMask.java:175

        private Masker(ProtocolVersion version, FunctionContext context, ScalarFunction function, ByteBuffer[] partialArgumentValues)
        {
            this.function = function;
            arguments = function.newArguments(context);
            for (int i = 0; i < partialArgumentValues.length; i++)
                arguments.set(i + 1, partialArgumentValues[i]);
        }

        public ByteBuffer mask(ByteBuffer value)
        {
            arguments.set(0, value);
            return function.execute(arguments);
        }
    }

    public static void ensureEnabled()
    {
        if (!DatabaseDescriptor.getDynamicDataMaskingEnabled())
            throw new InvalidRequestException(DISABLED_ERROR_MESSAGE);
    }

    @Override
    public boolean equals(Object o)
    {
        if (this == o)
            return true;
        if (o == null || getClass() != o.getClass())
            return false;
        ColumnMask mask = (ColumnMask) o;
        return function.name().equals(mask.function.name())
               && Arrays.equals(partialArgumentValues, mask.partialArgumentValues);
    }

    @Override
    public int hashCode()
    {
        return Objects.hash(function.name(), Arrays.hashCode(partialArgumentValues));

View on GitHub (pinned to 88fd0f6a0e)