Feedback please! Consistant data masking with faker

[Mac-lp3]

Problem

Devs should use masked PII in the lower environment.

The current SDK uses faker to generate masked values. However, the code generates a new masked value each time. Eg:

fake.seed(faker_config.seed)
fake.first_name() # Tony
fake.first_name() # Mark
fake.first_name() # Debra
fake.first_name() # Alison

This inconsistency can cause issues when performing SQL joins:

SELECT * FROM tbl1
LEFT JOIN tbl2
WHERE tbl1.first_name == tbl2.first_name

If luck was not on the developer's side, they may see very different results in the lower environment vs production, depending on the random values generated.

This is a very simple example, but imagine a highly-targeted join that relies on multiple address fields. Even with large data sets, there is a chance no records in tbl1 will match any in tbl2.

This is actually something that happened to me once, and we were unable to test the business logic in the lower environment due to inconsistent masked data. The join returned 0 rows in dev, but over 12k in prod).

Solution

Give developers the option to enable masking consistency (first name MIKE is always masked to TONY).

This is possible with Faker. The seed just needs to be reapplied each time:

fake.seed("idk lol")
fake.first_name() # Tony
fake.first_name() # Mark
fake.first_name() # Debra

fake.seed("idk lol")
fake.first_name() # Tony
fake.seed("idk lol")
fake.first_name() # Tony
fake.seed("idk lol")
fake.first_name() # Tony

Thus, if the seed is the original value of the column, we can ensure the same first name is always mapped to the same masked value:

fake.seed(record["first_name"])
fake.first_name()

Proposal 1

Add a new property to the faker_config called always_reseed:

- name: glob
  config:
    stream_maps:
      "*":
        first_name: first_name
      faker_config:
        seed: "record['first_name']"
        always_reseed: true # defaults to false

Then update the _eval function in mapper.py to reseed the faker instance before calling the expression evaluator.

Proposal 2

Expressions are evaluated with simpleeval, which only allows a single statement:

- name: glob
  config:
    stream_maps:
      "*":
        first_name: fake.seed(_.first_name); fake.first_name() # throws an exception

Let devs specify a list of commands which are run in sequence. The value returned by the last one will be used:

- name: glob
  config:
    stream_maps:
      "*":
        first_name: 
          - fake.seed(_.first_name) 
          - fake.first_name()

[edgarrmondragon]

This will available via #2578 in the v0.40.0 :)

Thanks @Mac-lp3!