mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-05-06 08:47:18 +00:00
Pablo Fernandez Guerra (PFE)
d23c2f3b53
Co-authored-by: Pablo F.G <pablo.fernandez@prowler.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
132 lines
4.8 KiB
Plaintext
132 lines
4.8 KiB
Plaintext
---
|
|
title: 'Getting Started With Google Workspace on Prowler'
|
|
---
|
|
|
|
import { VersionBadge } from "/snippets/version-badge.mdx"
|
|
|
|
Prowler for Google Workspace audits the organization's Google Workspace environment for security misconfigurations, including super administrator account hygiene, domain settings, and more.
|
|
|
|
## Prerequisites
|
|
|
|
Set up authentication for Google Workspace with the [Google Workspace Authentication](/user-guide/providers/googleworkspace/authentication) guide before starting either path:
|
|
|
|
- **Service Account:** Create a Service Account in a GCP project with Domain-Wide Delegation enabled.
|
|
- **OAuth Scopes:** Authorize the required read-only OAuth scopes in the Google Workspace Admin Console.
|
|
- **Customer ID:** Identify the Google Workspace Customer ID to use as the provider identifier.
|
|
- **Delegated User:** Have the email of a super administrator to use as the delegated user.
|
|
|
|
<CardGroup cols={2}>
|
|
<Card title="Prowler Cloud" icon="cloud" href="#prowler-cloud">
|
|
Onboard Google Workspace using Prowler Cloud
|
|
</Card>
|
|
<Card title="Prowler CLI" icon="terminal" href="#prowler-cli">
|
|
Onboard Google Workspace using Prowler CLI
|
|
</Card>
|
|
</CardGroup>
|
|
|
|
## Prowler Cloud
|
|
|
|
<VersionBadge version="5.21.0" />
|
|
|
|
### Step 1: Locate the Customer ID
|
|
|
|
1. Log into the [Google Workspace Admin Console](https://admin.google.com).
|
|
2. Navigate to "Account" > "Account Settings".
|
|
3. Find the **Customer ID** on the Account Settings page.
|
|
|
|
|
|
|
|
<Note>
|
|
The Customer ID starts with the letter "C" followed by alphanumeric characters (e.g., `C0xxxxxxx`). This value acts as the unique identifier for the Google Workspace account in Prowler Cloud.
|
|
</Note>
|
|
|
|
### Step 2: Open Prowler Cloud
|
|
|
|
1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app).
|
|
2. Navigate to "Configuration" > "Providers".
|
|
|
|
|
|
|
|
3. Click "Add Provider".
|
|
|
|
|
|
|
|
4. Select "Google Workspace".
|
|
|
|
|
|
|
|
### Step 3: Provide Credentials
|
|
|
|
1. Enter the **Customer ID** and an optional alias, then click "Next".
|
|
|
|
|
|
|
|
2. Paste the **Service Account JSON** credentials content.
|
|
3. Enter the "Delegated User Email" (a super administrator in the Google Workspace organization).
|
|
|
|
|
|
|
|
<Note>
|
|
The Service Account JSON is the full content of the key file downloaded when creating the Service Account. Paste the entire JSON object, not just the file path. For setup instructions, see the [Authentication guide](/user-guide/providers/googleworkspace/authentication).
|
|
</Note>
|
|
|
|
### Step 4: Check Connection
|
|
|
|
1. Click "Check Connection" to verify that the credentials and Domain-Wide Delegation are configured correctly.
|
|
2. Prowler will test the Service Account impersonation and Admin SDK access.
|
|
|
|
|
|
|
|
<Note>
|
|
If the connection test fails, verify that Domain-Wide Delegation is properly configured and that all required OAuth scopes are authorized. It may take a few minutes for delegation changes to propagate. See the [Troubleshooting](/user-guide/providers/googleworkspace/authentication#troubleshooting) section for common errors.
|
|
</Note>
|
|
|
|
### Step 5: Launch the Scan
|
|
|
|
1. Review the summary.
|
|
2. Click "Launch Scan" to start auditing Google Workspace.
|
|
|
|
|
|
|
|
---
|
|
|
|
## Prowler CLI
|
|
|
|
<VersionBadge version="5.19.0" />
|
|
|
|
### Step 1: Set Up Authentication
|
|
|
|
Set your Service Account credentials and delegated user email following the [Google Workspace Authentication](/user-guide/providers/googleworkspace/authentication) guide:
|
|
|
|
```console
|
|
export GOOGLEWORKSPACE_CREDENTIALS_FILE="/path/to/service-account-key.json"
|
|
export GOOGLEWORKSPACE_DELEGATED_USER="admin@yourdomain.com"
|
|
```
|
|
|
|
Alternatively, pass the credentials content directly as a JSON string:
|
|
|
|
```console
|
|
export GOOGLEWORKSPACE_CREDENTIALS_CONTENT='{"type": "service_account", ...}'
|
|
export GOOGLEWORKSPACE_DELEGATED_USER="admin@yourdomain.com"
|
|
```
|
|
|
|
### Step 2: Run the First Scan
|
|
|
|
Run a baseline scan after credentials are configured:
|
|
|
|
```console
|
|
prowler googleworkspace
|
|
```
|
|
|
|
Prowler authenticates as the delegated user and runs all available security checks against the Google Workspace organization.
|
|
|
|
### Step 3: Use a Custom Configuration (Optional)
|
|
|
|
Prowler uses a configuration file to customize provider behavior. To use a custom configuration:
|
|
|
|
```console
|
|
prowler googleworkspace --config-file /path/to/config.yaml
|
|
```
|
|
|
|
---
|