{"record":{"id":"9f4baa9a3c03ef70","repo":"apache/cassandra","slug":"cannot-mask-columns-because-dynamic-data-masking-i","errorCode":null,"errorMessage":"Cannot mask columns because dynamic data masking is not enabled. You can enable it with the dynamic_data_masking_enabled property on cassandra.yaml","messagePattern":"Cannot mask columns because dynamic data masking is not enabled\\. You can enable it with the dynamic_data_masking_enabled property on cassandra\\.yaml","errorType":"validation","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/functions/masking/ColumnMask.java","lineNumber":175,"sourceCode":"        private Masker(ProtocolVersion version, FunctionContext context, ScalarFunction function, ByteBuffer[] partialArgumentValues)\n        {\n            this.function = function;\n            arguments = function.newArguments(context);\n            for (int i = 0; i < partialArgumentValues.length; i++)\n                arguments.set(i + 1, partialArgumentValues[i]);\n        }\n\n        public ByteBuffer mask(ByteBuffer value)\n        {\n            arguments.set(0, value);\n            return function.execute(arguments);\n        }\n    }\n\n    public static void ensureEnabled()\n    {\n        if (!DatabaseDescriptor.getDynamicDataMaskingEnabled())\n            throw new InvalidRequestException(DISABLED_ERROR_MESSAGE);\n    }\n\n    @Override\n    public boolean equals(Object o)\n    {\n        if (this == o)\n            return true;\n        if (o == null || getClass() != o.getClass())\n            return false;\n        ColumnMask mask = (ColumnMask) o;\n        return function.name().equals(mask.function.name())\n               && Arrays.equals(partialArgumentValues, mask.partialArgumentValues);\n    }\n\n    @Override\n    public int hashCode()\n    {\n        return Objects.hash(function.name(), Arrays.hashCode(partialArgumentValues));","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/functions/masking/ColumnMask.java#L157-L193","documentation":"Column masking (dynamic data masking) is an opt-in Cassandra feature. ColumnMask.ensureEnabled checks the DatabaseDescriptor flag dynamic_data_masking_enabled and throws this InvalidRequestException whenever masking functions are used in a schema (masked columns) while the feature is disabled in cassandra.yaml.","triggerScenarios":"Creating/altering a table with a masked column (e.g. mask_hash(...)) or selecting from an existing masked column while dynamic_data_masking_enabled is false (the default) in cassandra.yaml.","commonSituations":"Restoring a schema that contains masked columns onto a cluster without the feature flag set; upgrading environments where masking was enabled in test but not in production config; forgetting the flag after adding masking functions to CQL.","solutions":["Set dynamic_data_masking_enabled: true in cassandra.yaml and restart the node","Remove or replace masked column definitions if masking is not desired in this environment","Confirm the flag took effect via nodetool/JMX before retrying the CQL statement"],"exampleFix":"// before (cassandra.yaml)\n# dynamic_data_masking_enabled not set\n// after (cassandra.yaml)\ndynamic_data_masking_enabled: true","handlingStrategy":"validation","validationCode":"boolean maskingEnabled = DatabaseDescriptor.getDynamicDataMaskingEnabled(); // node-side; in app code, avoid masked-column DDL/DML unless flag confirmed true","typeGuard":null,"tryCatchPattern":"try {\n    session.execute(\"SELECT masked_col FROM t\");\n} catch (InvalidRequestException e) {\n    if (e.getMessage().contains(\"dynamic data masking is not enabled\")) {\n        // surface config-fix instruction to the operator\n    }\n}","preventionTips":["Set dynamic_data_masking_enabled: true in every environment that will host masked schemas","Keep environment configs in sync when restoring schemas across clusters","Document the flag as a prerequisite wherever mask_* functions are used"],"tags":["cassandra","data-masking","configuration"],"backgroundTag":"feature-not-enabled","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}