---
layout: default
navsection: admin
title: Restricting upload or download
...

{% comment %}
Copyright (C) The Arvados Authors. All rights reserved.

SPDX-License-Identifier: CC-BY-SA-3.0
{% endcomment %}

For some use cases, you may want to limit the ability of users to upload or download data from outside the cluster.  (By "outside" we mean from networks other than the cluster's own private network).  For example, this makes it possible to share restricted data sets with users so that they may run their own data analysis on the cluster, while preventing them from easily downloading the data set to their local workstation.

This feature exists in addition to the existing Arvados permission system.  Users can only download from collections they have @read@ access to, and can only upload to projects and collections they have @write@ access to.

There are two services involved in accessing data from outside the cluster.

h2. Keepproxy Permissions

Permitting @keeproxy@ makes it possible to use @arv-put@ and @arv-get@, and upload from Workbench 1.  It works in terms of individual 64 MiB keep blocks.  It prints a log each time a user uploads or downloads an individual block.

The default policy allows anyone to upload or download.

<pre>
    Collections:
      KeepproxyPermission:
        User:
          Download: true
          Upload: true
        Admin:
          Download: true
          Upload: true
</pre>

h2. WebDAV and S3 API Permissions

Permitting @WebDAV@ makes it possible to use WebDAV, S3 API, download from Workbench 1, and upload/download with Workbench 2.  It works in terms of individual files.  It prints a log each time a user uploads or downloads a file.  When @WebDAVLogEvents@ (default true) is enabled, it also adds an entry into the API server @logs@ table.

When a user attempts to upload or download from a service without permission, they will receive a @403 Forbidden@ response.  This only applies to file content.

Denying download permission does not deny access to access to XML file listings with PROPFIND.  As a side effect it does deny auto-generated HTML documents that have file listings.

Denying upload permission does not deny other operations that modify collections without directly accessing file content, such as MOVE and COPY.

The default policy allows anyone to upload or download.

<pre>
    Collections:
      WebDAVPermisison:
        User:
          Download: true
          Upload: true
        Admin:
          Download: true
          Upload: true
      WebDAVLogEvents: true
</pre>

h2. Shell node and container permissions

Be aware that even when upload and download from outside the network is not allowed, a user who has access to a shell node or runs a container still has internal access to Keep.  (This is necessary to be able to run workflows).  From the shell node or container, a user could send data outside the network by some other method, although this requires more intent than accidentally clicking on a link and downloading a file.  It is possible to set up a firewall to prevent shell and compute nodes from making connections to hosts outside the private network.  Exactly how to configure firewalls is out of scope for this page, as it depends on the specific network infrastructure of your cluster.

h2. Choosing a policy

This distinction between WebDAV and Keepproxy is important for auditing.  WebDAV records 'upload' and 'download' events on the API server that are included in the "User Activity Report":user-activity.html ,  whereas @keepproxy@ only logs upload and download of individual blocks, which require a reverse lookup to determine the collection(s) and file(s) a block is associated with.

You set separate permissions for @WebDAV@ and @Keepproxy@, with separate policies for regular users and admin users.

These policies apply to only access from outside the cluster, using Workbench or Arvados CLI tools.

The @WebDAVLogEvents@ option should be enabled if you intend to the run the "User Activity Report":user-activity.html .  If you don't need audits, or you are running a site that is mostly serving public data to anonymous downloaders, you can disable in to avoid the extra API server request.

h3. Audited downloads

For ease of access auditing, this policy prevents downloads using @arv-get@.  Downloads through WebDAV and S3 API are permitted, but logged.  Uploads are allowed.

<pre>
    Collections:
      WebDAVPermisison:
        User:
          Download: true
          Upload: true
        Admin:
          Download: true
          Upload: true

      KeepproxyPermission:
        User:
          Download: false
          Upload: true
        Admin:
          Download: false
          Upload: true
      WebDAVLogEvents: true
</pre>

h3. Disallow downloads by regular users

This policy prevents regular users (non-admin) from downloading data.  Uploading is allowed.  This supports the case where restricted data sets are shared users so that they may run their own data analysis on the cluster, while preventing them from downloading the data set to their local workstation.  Note that users won't be able to download the results of their analysis, either, requiring an admin in the loop or some other process to release results.

<pre>
    Collections:
      WebDAVPermisison:
        User:
          Download: false
          Upload: true
        Admin:
          Download: true
          Upload: true

      KeepproxyPermission:
        User:
          Download: false
          Upload: true
        Admin:
          Download: true
          Upload: true
      WebDAVLogEvents: true
</pre>

h3. Disallow uploads by regular users

This policy is suitable for an installation where data is being shared with a group of users who are allowed to download the data, but not permitted to store their own data on the cluster.

<pre>
    Collections:
      WebDAVPermisison:
        User:
          Download: true
          Upload: false
        Admin:
          Download: true
          Upload: true

      KeepproxyPermission:
        User:
          Download: true
          Upload: false
        Admin:
          Download: true
          Upload: true
      WebDAVLogEvents: true
</pre>