Back to Checks
googleworkspace

Application access to Google services is restricted

security_app_access_restricted
Service: securitySeverity: high
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:NotDefined

The domain-level API controls configuration restricts third-party app access to at least one Google service. This check verifies that the administrator has configured API access controls rather than leaving all services at the unrestricted default. The CIS benchmark recommends restricting access to all applicable services, particularly high-risk scopes like Drive and Gmail.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

When application access to Google services is unrestricted, any third-party app that users consent to can access sensitive organizational data through Google APIs. This includes apps that may request broad OAuth scopes for Drive, Gmail, and other services, potentially leading to data exfiltration through unvetted applications.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks security_app_access_restricted

Recommendation

Restrict application access to Google services to trusted apps only, particularly for high-risk scopes like Drive and Gmail, to prevent unvetted third-party apps from accessing sensitive organizational data.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Security** > **Access and Data Control** > **API Controls**
3Click **App access control** > **MANAGE GOOGLE SERVICES**
4Select **ALL applicable Google Services**
5Click **Change access**
6Select **Restricted: Only trusted apps can access a service**
7Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.security.security_client import (
    security_client,
)


class security_app_access_restricted(Check):
    """Check that application access to Google services is restricted.

    This check verifies that at least one Google service has API access
    restricted for third-party apps, indicating that the administrator
    has reviewed and configured API access controls. The CIS benchmark
    recommends restricting access to all applicable services, particularly
    high-risk scopes like Drive and Gmail. This check serves as a signal
    that API access controls have been configured rather than left at the
    unrestricted default.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if security_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=security_client.policies,
                resource_id="securityPolicies",
                resource_name="Security Policies",
                customer_id=security_client.provider.identity.customer_id,
            )

            restricted = security_client.policies.google_services_restricted
            domain = security_client.provider.identity.domain

            if restricted is True:
                report.status = "PASS"
                report.status_extended = (
                    f"Application access to Google services is restricted "
                    f"in domain {domain}. At least one Google service has "
                    f"API access limited to trusted apps."
                )
            else:
                report.status = "FAIL"
                if restricted is None:
                    report.status_extended = (
                        f"Application access to Google services is not configured "
                        f"in domain {domain}. The default is unrestricted. "
                        f"API access should be restricted for all applicable "
                        f"Google services, particularly high-risk scopes."
                    )
                else:
                    report.status_extended = (
                        f"Application access to Google services is unrestricted "
                        f"in domain {domain}. "
                        f"API access should be restricted for all applicable "
                        f"Google services, particularly high-risk scopes."
                    )

            findings.append(report)

        return findings

References