Back to Checks
googleworkspace

Drive Access Checker is configured to recipients only

drive_access_checker_recipients_only
Service: driveSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

The domain-wide Access Checker configuration ensures that when a user shares a Drive file via a Google product other than Drive itself (e.g. by pasting a link in Gmail), the suggestions never expand sharing to a wider audience or to anyone with the link. Access Checker is set to recipients only.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

If Access Checker suggests broader audiences or public visibility, users may inadvertently widen access to a file beyond the people they intended to share with. This is a common cause of unintentional internal or external over-sharing.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks drive_access_checker_recipients_only

Recommendation

Configure the Drive Access Checker to suggest sharing only with the explicit recipients of a link. This prevents accidental over-sharing through Gmail and other Google integrations.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Drive and Docs**
3Click **Sharing settings** > **Sharing options**
4Under **Access Checker**, select **Recipients only**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.drive.drive_client import drive_client


class drive_access_checker_recipients_only(Check):
    """Check that Access Checker is configured to recipients only

    This check verifies that the domain-level Drive and Docs Access Checker
    setting suggests granting access only to the explicit recipients of a
    shared link, rather than expanding access to wider audiences or making
    files publicly accessible.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if drive_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=drive_client.policies,
                resource_id="drivePolicies",
                resource_name="Drive Policies",
                customer_id=drive_client.provider.identity.customer_id,
            )

            access_checker = drive_client.policies.access_checker_suggestions

            if access_checker == "RECIPIENTS_ONLY":
                report.status = "PASS"
                report.status_extended = (
                    f"Drive and Docs Access Checker in domain "
                    f"{drive_client.provider.identity.domain} is restricted to "
                    f"recipients only."
                )
            else:
                report.status = "FAIL"
                if access_checker is None:
                    report.status_extended = (
                        f"Drive and Docs Access Checker is not explicitly "
                        f"configured in domain {drive_client.provider.identity.domain}. "
                        f"Access Checker should be set to recipients only."
                    )
                else:
                    report.status_extended = (
                        f"Drive and Docs Access Checker in domain "
                        f"{drive_client.provider.identity.domain} is set to "
                        f"{access_checker}. Access Checker should be set to recipients only."
                    )

            findings.append(report)

        return findings

References