Restricting file types in Jira Cloud: what works and what doesn't

Why Jira Cloud does not restrict file types

The request is not new. Under JRACLOUD-61024 ("Allowlist and Blocklist attachment type in Jira"), customers asked Atlassian for exactly this feature. On 31 July 2024, Atlassian closed the ticket as "Won't Fix", saying other suggestions had priority. So don't expect a built-in solution any time soon.

What you can do without an app

Turn off attachments with permissions

In the permission scheme, the "Create Attachments" permission decides who can attach files. If you remove it, nobody in that project can attach anything, harmless files included. It is all or nothing. For teams that work with screenshots, quotes or log files, that is rarely an option.

Delete attachments with automation

With Jira Automation you can build a rule that checks the file name of new attachments against a regular expression and deletes matching files. Atlassian describes this approach itself in its knowledge base . In practice, it has limits:

• The rule only sees the file name. A renamed file, such as an .exe with a .pdf extension, gets through.

• Deleted means deleted. Atlassian points out that deleted attachments cannot be recovered. There is no step in between where someone can approve a file.

• The patterns are regular expressions that need careful testing and maintenance.

• A note on the work item and a record of why a file disappeared are up to you to add.

What a good file type rule should do

From our Jira projects, we see the same requirements again and again:

• Three levels instead of yes or no: allowed, only after approval, blocked.

• One rule for the whole site, with exceptions for single spaces.

• A check right after upload.

• Traceability: a note on the work item and a log of who uploaded which file and when.

• A look at the file's content, not just its extension.

• A clear note in the customer portal on which files customers may send.

How REGULIT solves it

Because we kept running into this gap in client projects, we at MESKRU built our own app for it: REGULIT , a Forge app for Jira Cloud and Jira Service Management.

• Every file type gets a category: Allowed, Needs approval or Blocked. The rules apply to the whole site, with exceptions per space.

• REGULIT checks every attachment right after upload. Files that are not allowed are removed from the work item, a comment explains why, and a log records file, type, rule, person and time.

• Files that need approval wait in your own storage, in Amazon S3, Google Cloud Storage or Azure Blob Storage, until someone approves them. No data leaves your cloud.

• Optionally, REGULIT compares the first bytes of a file with its extension and type. That catches renamed files, such as an .exe uploaded as a .pdf.

• In the Jira Service Management customer portal, a banner shows which file types are allowed.

To be clear: REGULIT controls which file types stay in Jira. It does not replace a virus scanner. REGULIT is available for Jira Cloud only, not for Data Center or Server.

Try REGULIT

You can try REGULIT free for 30 days on the Atlassian Marketplace or book a demo . Learn more on regulit.app .