TMA-GWS-API-ACCESS-CONTROL

Ensure third-party app access to Google data is restricted

높음레벨 2수동 검토google-workspace

설명

Unreviewed OAuth apps can obtain persistent access to Gmail and Drive data. Admin console only; reported as manual.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Admin console > Security > Access and data control > API controls: confirm 'Settings' blocks or limits access to unconfigured third-party apps [e.g. 'Allow users to access third-party apps that only request basic info needed for Sign in with Google'], review App access control > Manage Third-Party App Access for Trusted/Limited/Blocked entries, and confirm Google services such as Gmail and Drive are Restricted. Also check Apps > Google Workspace Marketplace apps > Settings allows only allowlisted apps.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Admin console: API controls > App access control: mark required apps as Trusted, restrict high-risk Google services, and block unconfigured third-party apps.

속성

운영 체제: 모두
태그: google-workspaceapi-controls
참고 자료: CIS Google Workspace Foundations Benchmark v1.4.0 - Access and data control / API controls (verify section number for your release)