Back to Checks
googleworkspace

Publishing Drive files to the web is disabled

drive_publishing_files_disabled
Service: driveSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

The domain-wide Drive and Docs default prevents users from publishing files to the web or making them visible to the world as public or unlisted. Publishing a file to the web exposes its content to anyone on the internet, often without any audit trail, making it one of the highest-impact misconfigurations available to end users.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Allowing users to publish Drive files to the web creates a path for unbounded data exposure. Sensitive documents, intellectual property, customer data, or internal communications can be made publicly accessible — and indexed by search engines — with a single click, often unintentionally.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks drive_publishing_files_disabled

Recommendation

Disable the ability for users to publish Drive files to the web or make them visible to anyone with the link. This eliminates the most direct path to unintentional public data exposure through Drive.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Drive and Docs**
3Click **Sharing settings** > **Sharing options**
4Under **Sharing outside of <Company>**, **uncheck** *When sharing outside of <Company> is allowed, users in <Company> can make files and published web content visible to anyone with the link*
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.drive.drive_client import drive_client


class drive_publishing_files_disabled(Check):
    """Check that publishing Drive files to the web is disabled

    This check verifies that the domain-level Drive and Docs policy prevents
    users from publishing files to the web or making them visible to anyone
    with the link, blocking unintended public exposure of organizational
    content.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if drive_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=drive_client.policies,
                resource_id="drivePolicies",
                resource_name="Drive Policies",
                customer_id=drive_client.provider.identity.customer_id,
            )

            allow_publishing = drive_client.policies.allow_publishing_files

            if allow_publishing is False:
                report.status = "PASS"
                report.status_extended = (
                    f"Publishing files to the web is disabled in domain "
                    f"{drive_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                if allow_publishing is None:
                    report.status_extended = (
                        f"Publishing files to the web is not explicitly configured "
                        f"in domain {drive_client.provider.identity.domain}. "
                        f"Users should not be able to publish files to the web or make them public."
                    )
                else:
                    report.status_extended = (
                        f"Publishing files to the web is enabled in domain "
                        f"{drive_client.provider.identity.domain}. "
                        f"Users should not be able to publish files to the web or make them public."
                    )

            findings.append(report)

        return findings

References