Back to Checks
googleworkspace

Shared drive file access is restricted to members only

drive_shared_drive_members_only_access
Service: driveSeverity: medium
OfficialBuilt-inVerified
Resource Type:NotDefined

The domain-wide default restricts shared drive file access to explicit members only. Non-members cannot be added to individual files inside the drive, preserving the shared drive's membership boundary as the authoritative access control surface.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

If non-members can be added to files inside a shared drive, the drive's membership becomes meaningless as a security control. Sensitive content scoped to a specific team can be silently extended to users who were never granted access to the drive itself, leading to unintended information disclosure.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks drive_shared_drive_members_only_access

Recommendation

Restrict shared drive file access to explicit shared drive members. This preserves the drive membership as the authoritative access boundary and prevents silent expansion of access to non-members.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Drive and Docs**
3Click **Sharing settings** > **Shared drive creation**
4*Uncheck** *Allow people who aren't shared drive members to be added to files*
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.drive.drive_client import drive_client


class drive_shared_drive_members_only_access(Check):
    """Check that shared drive file access is restricted to members only

    This check verifies that the domain-level Drive and Docs policy prevents
    people who are not shared drive members from being added to files within
    a shared drive, restricting file access to that drive's explicit
    membership.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if drive_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=drive_client.policies,
                resource_id="drivePolicies",
                resource_name="Drive Policies",
                customer_id=drive_client.provider.identity.customer_id,
            )

            allow_non_member = drive_client.policies.allow_non_member_access

            if allow_non_member is False:
                report.status = "PASS"
                report.status_extended = (
                    f"Shared drive file access in domain "
                    f"{drive_client.provider.identity.domain} is restricted to "
                    f"shared drive members only."
                )
            else:
                report.status = "FAIL"
                if allow_non_member is None:
                    report.status_extended = (
                        f"Shared drive non-member access is not explicitly "
                        f"configured in domain {drive_client.provider.identity.domain}. "
                        f"Shared drive file access should be restricted to members only."
                    )
                else:
                    report.status_extended = (
                        f"Shared drive file access in domain "
                        f"{drive_client.provider.identity.domain} allows non-members "
                        f"to be added to files. "
                        f"Shared drive file access should be restricted to members only."
                    )

            findings.append(report)

        return findings

References