Back to Checks
googleworkspace

Viewers and commenters cannot download, print, or copy shared drive files

drive_shared_drive_disable_download_print_copy
Service: driveSeverity: medium
OfficialBuilt-inVerified
Resource Type:NotDefined

The domain-wide default prevents viewers and commenters of files stored in shared drives from downloading, printing, or copying the file contents. They can only read and comment on the existing content, preventing bulk extraction of sensitive material from shared drives.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

When viewers and commenters can download, print, or copy shared drive files, they can bulk-extract sensitive content — including intellectual property, personally identifiable information, and confidential business documents — using nothing more than read access. This is one of the most direct paths to data exfiltration through Drive.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks drive_shared_drive_disable_download_print_copy

Recommendation

Restrict download, print, and copy actions in shared drives to editors or managers only. This prevents bulk data exfiltration by users who only need read or comment access to the underlying content.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Drive and Docs**
3Click **Sharing settings** > **Shared drive creation**
4*Uncheck** *Allow viewers and commenters to download, print, and copy files*
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.drive.drive_client import drive_client


class drive_shared_drive_disable_download_print_copy(Check):
    """Check that download/print/copy is disabled for viewers and commenters

    This check verifies that the domain-level Drive and Docs policy prevents
    viewers and commenters of shared drive files from downloading, printing,
    or copying their contents — limiting them to read and comment actions
    only and reducing the risk of bulk data exfiltration.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if drive_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=drive_client.policies,
                resource_id="drivePolicies",
                resource_name="Drive Policies",
                customer_id=drive_client.provider.identity.customer_id,
            )

            allowed = drive_client.policies.allowed_parties_for_download_print_copy

            if allowed in ("EDITORS_ONLY", "MANAGERS_ONLY"):
                report.status = "PASS"
                report.status_extended = (
                    f"Download, print, and copy in shared drives in domain "
                    f"{drive_client.provider.identity.domain} is restricted to "
                    f"{allowed}."
                )
            elif allowed is None:
                report.status = "PASS"
                report.status_extended = (
                    f"Download, print, and copy restrictions for shared drives use "
                    f"Google's secure default configuration (disabled for viewers "
                    f"and commenters) "
                    f"in domain {drive_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Download, print, and copy in shared drives in domain "
                    f"{drive_client.provider.identity.domain} is set to {allowed}. "
                    f"These actions should be restricted to editors or managers only."
                )

            findings.append(report)

        return findings

References