Back to Checks
googleworkspace

DLP policies for Google Drive are configured

security_dlp_drive_rules_configured
Service: securitySeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

At least one active Data Loss Prevention (DLP) rule targeting Google Drive file sharing is configured. DLP policies detect and prevent users from sharing sensitive information such as credit card numbers, identity numbers, and other regulated data through Drive.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Without DLP policies, users can freely share files containing sensitive information through Google Drive without any detection or prevention controls. This increases the risk of accidental data exposure, regulatory non-compliance, and data breaches through oversharing.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks security_dlp_drive_rules_configured

Recommendation

Configure DLP policies for Google Drive to detect and prevent sharing of sensitive information such as credit card numbers, identity numbers, and other regulated data.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Security** > **Access and Data Control** > **Data protection**
3Click **Manage Rules**
4Click **ADD RULE** and select **New rule** or **New rule from template**
5Set the rule name and scope
6Set triggers by checking **File modified** under **Google Drive**
7Add conditions (Field, Comparison Operator, Content to match)
8Under **Actions**, select the desired action for each incident
9Under **Alerting**, set severity and select **Send to alert center**
10Click **Create**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.security.security_client import (
    security_client,
)


class security_dlp_drive_rules_configured(Check):
    """Check that DLP policies for Google Drive are configured.

    This check verifies that at least one active Data Loss Prevention (DLP)
    rule targeting Google Drive file sharing exists, helping to prevent
    unintended exposure of sensitive information.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if security_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=security_client.policies,
                resource_id="securityPolicies",
                resource_name="Security Policies",
                customer_id=security_client.provider.identity.customer_id,
            )

            dlp_exists = security_client.policies.dlp_drive_rules_exist
            domain = security_client.provider.identity.domain

            if dlp_exists is True:
                report.status = "PASS"
                report.status_extended = (
                    f"DLP policies for Google Drive are configured "
                    f"in domain {domain}. At least one active DLP rule "
                    f"targeting Drive file sharing exists."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"No active DLP policies for Google Drive are configured "
                    f"in domain {domain}. DLP rules should be configured "
                    f"to detect and prevent sharing of sensitive information "
                    f"through Drive."
                )

            findings.append(report)

        return findings

References