Back to Checks
googleworkspace

Shared drive managers cannot override shared drive settings

drive_shared_drive_managers_cannot_override
Service: driveSeverity: medium
OfficialBuilt-inVerified
Resource Type:NotDefined

The domain-wide default prevents members with manager access to a shared drive from overriding the shared drive settings established by administrators. This ensures that security controls — such as external access, member-only access, and download restrictions — cannot be relaxed at the individual shared drive level.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

If shared drive managers can override organizational defaults, unauthorized data exposure can occur when a manager intentionally or accidentally weakens a shared drive's security posture (for example, allowing external members or enabling download for viewers).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks drive_shared_drive_managers_cannot_override

Recommendation

Prevent shared drive managers from overriding organizationally established shared drive settings. This ensures that security controls remain consistent across all shared drives and cannot be relaxed by non-administrators.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Drive and Docs**
3Click **Sharing settings** > **Shared drive creation**
4*Uncheck** *Allow members with manager access to override the settings below*
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.drive.drive_client import drive_client


class drive_shared_drive_managers_cannot_override(Check):
    """Check that shared drive managers cannot override shared drive settings

    This check verifies that the domain-level Drive and Docs policy prevents
    members with manager access from overriding the shared drive settings
    configured by administrators, ensuring that security controls cannot be
    relaxed at the shared drive level.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if drive_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=drive_client.policies,
                resource_id="drivePolicies",
                resource_name="Drive Policies",
                customer_id=drive_client.provider.identity.customer_id,
            )

            allow_override = drive_client.policies.allow_managers_to_override_settings

            if allow_override is False:
                report.status = "PASS"
                report.status_extended = (
                    f"Shared drive managers in domain "
                    f"{drive_client.provider.identity.domain} cannot override "
                    f"shared drive settings."
                )
            else:
                report.status = "FAIL"
                if allow_override is None:
                    report.status_extended = (
                        f"Manager override of shared drive settings is not "
                        f"explicitly configured in domain "
                        f"{drive_client.provider.identity.domain}. "
                        f"Managers should not be allowed to override shared drive settings."
                    )
                else:
                    report.status_extended = (
                        f"Shared drive managers in domain "
                        f"{drive_client.provider.identity.domain} are allowed to "
                        f"override shared drive settings. "
                        f"Managers should not be allowed to override shared drive settings."
                    )

            findings.append(report)

        return findings

References