Next it will prompt you to add any other users in your organization to the service account. Since we aren’t using any Google Cloud resources, it needs no permissions on the project as it will strictly be using the Drive API. It will next prompt you for “service accounts permissions”. The easiest is the navigation menu in the upper left, IAM & Admin and then service accounts:Ĭlick create service account and give it a meaningful name and description:

There are multiple ways to get to the screen to create service accounts. Now we will need a service account and credentials. Search for “Drive” and click the “enable” button. Lets enable the Drive API by choosing “enable apis and services” from the “dashboard” menu for the project: In the cloud resource manager click “create new project” and give it a good, descriptive name: I recommend every security team in an org using G Suite have pre-prepared projects ready to go for investigations and incident response. Note that you’ll only need to do this project setup portion once and then you’ll be able to use the Drive API in all your investigation work within your organization. This impersonation allows us to peek into the files they have in Drive and correct any sharing settings. This project will be used to create credentials and scopes that will allow us to impersonate any user in our G Suite organization.

Specifically, we will begin with the cloud resource manager to create a new cloud project. While the G Suite console is useful, for this exercise we will need the flexibility of the Drive API. In this post I’ll take you through using jupyter notebooks to do an investigation of a Gsuite environment to find and fix a file that’s been incorrectly shared.

Unfortunately too often sharing controls are misused, or misunderstood which can result in data leaks and in some cases escalations leading to information system compromise. Now it’s as easy to share a doc as sending someone a link. Sharing documents between individuals used to mean email attachments, network drive mapping, etc. Realtime, web-based file systems like Google Drive have changed the way organizations operate and interface with each other. 7 April 2020 Incident response using the Google Drive API

How to enable the google drive api