Control File Download from Data Explorer¶
Overview¶
By default, users can download the original file of a cloud object (Amazon S3, Google Cloud Storage and Azure ADLS) from the Privacera Portal. An administrator can turn this off for the whole instance with one System Configuration property. Users can still see what Discovery found in the file, such as tags, classifications and sample values, and a short preview of the file.
This is available from release 9.2.45.1.
Where the setting applies¶
When download is turned off, the original cloud file cannot be downloaded from these places in the Portal:
| Portal page | What changes |
|---|---|
| Data Explorer | Selecting a file opens Resource Detail. The Download icon is hidden for S3, GCS and ADLS files. |
| Alerts Dashboard | Opening a resource from an alert also opens Resource Detail, so the Download icon is hidden there too. The Export button for the alerts report is not affected. |
| Health Check (under Diagnostics) | When the Portal's file system is S3, GCS or ADLS, the Download icon in the file list is hidden. The View button still works. |
File Explorer is not affected. Its Download action and preview keep working whatever this property is set to. To restrict File Explorer, use its own feature setting or user roles.
Behavior when download is turned off¶
| Download turned on (default) | Download turned off | |
|---|---|---|
| Download icon | Shown | Hidden for S3, GCS and ADLS files |
| Download request sent directly to the Portal API | Returns the file | Refused with HTTP 403 |
| File preview | Shows the file | Shows the first 10 KB of the file |
| Tags, classifications, sample values and file path | Available | Available |
| HDFS and local files (for example scan logs and reports) | Can be downloaded | Can still be downloaded |
On the pages listed above, the setting applies to every S3, GCS and ADLS file. File Explorer is not covered.
Turn off file download¶
- Sign in to the Privacera Portal as an administrator.
- Go to Settings > System Configurations.
- Search for Enable Data Explorer File Download (
privacera.portal.ui.feature.data.explorer.download.enabled). - Clear the checkbox, then select Save and confirm.
The change takes effect without a restart, and the Portal refuses download requests immediately. Users who already have the Portal open must reload the page before the Download icons disappear.
Turn file download back on¶
In Settings > System Configurations, select the Enable Data Explorer File Download checkbox again, then select Save and confirm. The Download icons return after users reload the page, and download and full-length preview requests work again.
Limitations¶
- The setting applies to the whole instance. It applies to every user and cannot be limited to certain users, locations or applications.
- Only the Privacera Portal is covered. Users who have direct access to the cloud storage, for example through IAM roles or bucket policies, can still read the files there. Manage those permissions in your cloud account.
- File Explorer is out of scope. Users with access to File Explorer can still download files from it.
- Previous topic: Solr Collection Retention (TTL) for Privacera Discovery