Back to Checks
googleworkspace

Only internal users can distribute content outside the organization

drive_internal_users_distribute_content
Service: driveSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

The domain-wide default restricts distributing organizational content to shared drives owned by another organization to eligible internal users only. This prevents external collaborators with manager access to internal shared drives from moving content out of the organization.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

If external users can move files from internal shared drives into shared drives owned by another organization, the organization loses authoritative control over its own data. This is a frequently overlooked path for unintentional or malicious data exfiltration through shared drive collaboration.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks drive_internal_users_distribute_content

Recommendation

Restrict the ability to distribute content to shared drives owned by another organization to internal users only. This preserves authoritative control over organizational data and closes a common shared-drive exfiltration path.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Drive and Docs**
3Click **Sharing settings** > **Sharing options**
4Under **Distributing content outside of <Company>**, select **Only users in <Company>**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.drive.drive_client import drive_client


class drive_internal_users_distribute_content(Check):
    """Check that only internal users can distribute content externally

    This check verifies that the domain-level Drive and Docs policy restricts
    distributing content to shared drives owned by another organization to
    eligible internal users only, preventing external collaborators from
    moving organizational content out of the domain.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if drive_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=drive_client.policies,
                resource_id="drivePolicies",
                resource_name="Drive Policies",
                customer_id=drive_client.provider.identity.customer_id,
            )

            allowed = drive_client.policies.allowed_parties_for_distributing_content

            if allowed in ("ELIGIBLE_INTERNAL_USERS", "NONE"):
                report.status = "PASS"
                report.status_extended = (
                    f"Distributing content outside the organization in domain "
                    f"{drive_client.provider.identity.domain} is restricted to "
                    f"{allowed}."
                )
            else:
                report.status = "FAIL"
                if allowed is None:
                    report.status_extended = (
                        f"Allowed parties for distributing content externally is not "
                        f"explicitly configured in domain "
                        f"{drive_client.provider.identity.domain}. "
                        f"Only internal users should be allowed to distribute content externally."
                    )
                else:
                    report.status_extended = (
                        f"Distributing content outside the organization in domain "
                        f"{drive_client.provider.identity.domain} is set to {allowed}. "
                        f"Only internal users should be allowed to distribute content externally."
                    )

            findings.append(report)

        return findings

References