topic Re: Restricting file upload to DBFS in Data Engineering

Restricting file upload to DBFS

RicksDB — Wed, 02 Feb 2022 19:00:45 GMT

Hi,

Is it possible to restrict upload files to dfbs root (Since everyone has access) ? The idea is to force users to use an ADLS2 mnt with credential passthrough for security reasons.

Also, right now users use azure blob explorer to interact with ADLS2. Is it possible to use the native databricks upload feature to send data to the mnt instead of the DBFS root? This would be the ideal solution for us.

Thanks

Re: Restricting file upload to DBFS

Hubert-Dudek — Wed, 02 Feb 2022 20:00:22 GMT

Enable workspace object access control will allow to set permissions on folders (so user can have no permission to root and only to mnt).

Regarding native upload feature I don't think there is much can be done about it. I think azure explorer with correctly specify access rights is better. Some non technical users can prefer some simple cloud storage like folder on OneDrive so then we can set trigger in Azure logic apps when file is created and then set to copy it to ADLS2.

Re: Restricting file upload to DBFS

RicksDB — Wed, 02 Feb 2022 22:37:25 GMT

Thanks for the quick answer Hubert.

We currently have workspace object access control enabled on our workspace. Although, we can use it to add ACL on workspaces ACL folders that store notebooks, we haven't seen anyway to secure DBFS root itself.

Are there any options available in the portal to add ACLs on dbfs folders or do we need to use something else such as the command line do to it?

Thanks

Re: Restricting file upload to DBFS

User16764241763 — Fri, 18 Mar 2022 15:49:27 GMT

Hello @E H

You can disable DBFS file browser in the workspace, if users directly upload from there. This will prevent uploads to DBFS.

https://docs.databricks.com/administration-guide/workspace/dbfs-browser.html

Please let us know if this solution works.