Restricting file upload to DBFS

[RicksDB]

Hi,

Is it possible to restrict upload files to dfbs root (Since everyone has access) ? The idea is to force users to use an ADLS2 mnt with credential passthrough for security reasons.

Also, right now users use azure blob explorer to interact with ADLS2. Is it possible to use the native databricks upload feature to send data to the mnt instead of the DBFS root? This would be the ideal solution for us.

Thanks

[Hubert-Dudek]

Enable workspace object access control will allow to set permissions on folders (so user can have no permission to root and only to mnt).

Regarding native upload feature I don't think there is much can be done about it. I think azure explorer with correctly specify access rights is better. Some non technical users can prefer some simple cloud storage like folder on OneDrive so then we can set trigger in Azure logic apps when file is created and then set to copy it to ADLS2.

[RicksDB]

Thanks for the quick answer Hubert.

We currently have workspace object access control enabled on our workspace. Although, we can use it to add ACL on workspaces ACL folders that store notebooks, we haven't seen anyway to secure DBFS root itself.

Are there any options available in the portal to add ACLs on dbfs folders or do we need to use something else such as the command line do to it?

Thanks

[User16764241763 · Accepted solution]

Hello @E H​ 

You can disable DBFS file browser in the workspace, if users directly upload from there. This will prevent uploads to DBFS.

https://docs.databricks.com/administration-guide/workspace/dbfs-browser.html

 

Please let us know if this solution works.