Back to Checks
googleworkspace

Internal apps can access Google Workspace APIs

security_internal_apps_trusted
Service: securitySeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:NotDefined

The domain-level API controls configuration trusts internal domain-owned apps to access restricted Google Workspace APIs. This avoids the need to individually trust each internal app.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

When internal apps are not trusted, legitimate organization-built applications cannot access restricted Google Workspace API scopes, potentially breaking internal workflows and forcing administrators to trust each app individually, which increases administrative overhead.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks security_internal_apps_trusted

Recommendation

Enable trust for internal domain-owned apps so organization-built applications can access restricted Google Workspace APIs without individual trust configuration.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Security** > **Access and Data Control** > **API Controls**
3Click **App access control** > **Settings**
4Check **Trust internal, domain-owned apps**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.security.security_client import (
    security_client,
)


class security_internal_apps_trusted(Check):
    """Check that internal apps can access Google Workspace APIs.

    This check verifies that the domain-level policy trusts internal
    domain-owned apps, allowing them to access restricted Google Workspace
    APIs without requiring individual trust configuration.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if security_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=security_client.policies,
                resource_id="securityPolicies",
                resource_name="Security Policies",
                customer_id=security_client.provider.identity.customer_id,
            )

            trust_internal = security_client.policies.trust_internal_apps

            if trust_internal is True:
                report.status = "PASS"
                report.status_extended = (
                    f"Internal domain-owned apps are trusted to access "
                    f"Google Workspace APIs "
                    f"in domain {security_client.provider.identity.domain}."
                )
            elif trust_internal is None:
                report.status = "PASS"
                report.status_extended = (
                    f"Internal domain-owned apps use Google's secure default "
                    f"configuration (trusted) "
                    f"in domain {security_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Internal domain-owned apps are not trusted to access "
                    f"Google Workspace APIs "
                    f"in domain {security_client.provider.identity.domain}. "
                    f"Internal apps should be trusted to access restricted APIs."
                )

            findings.append(report)

        return findings

References