Linking Google Drive to DataDefender
Use this guide to complete the Google Drive connection setup inside your DataDefender organization.
Connecting your Google Drive environment allows DataDefender to safely inventory, analyze, and classify your organization’s drives and shared drives.
Before You Begin (Prerequisites)
Connecting Google Drive requires setup across three environments: GCP, Google Workspace, and DataDefender.
If your team hasn't completed the backend infrastructure deployment yet, start with Step 1 below.
If your Cloud and Workspace admins have already deployed the Terraform module and authorized delegation, skip directly to Step 2.
Step 1: Complete Prerequisites
Before filling out the form in DataDefender, ensure your team has completed the following:
AWS Account Connected: Your target scanning AWS Account must already be linked in DataDefender (Settings -> Cloud Connectivity). That account must have the
File Scanningfeature set enabled.GCP & Workspace Deployed: Your GCP Administrator and Workspace Super Admin must deploy the DataDefender Terraform module and authorize Domain-Wide Delegation in the Workspace Admin Console.
Need the infrastructure setup steps? Send your technical team our GCP & Google Workspace Integration Guide.
Step 2: Gather Required Values
Once Step 1 is complete, make sure you have the following details ready before filling out the connection form:
Workspace Details:
Google Workspace Customer ID
Impersonation Admin Email
Crawler User Email.
Terraform Outputs: The four specific values generated from your GCP deployment:
Backend_sa_email
Agent_sa_email
Backend_wif_audience
agent_wif_audience
Connection Instructions
When you have gathered your prerequisite values, follow these steps to configure your connection in DataDefender:
Step 1: Navigate to Cloud Connectivity
Log in to DataDefender.
In the left navigation menu, go to Settings -> Cloud Connectivity.
Click Add New Connection.
Select Google Drive from the provider options to open the Connect Google Drive page.
Step 2: Configure Connection Fields
Populate the form fields using your Google Workspace details and the values generated from your Terraform output.
1. Account Details
Google Workspace Customer ID: Your unique Google Workspace organization ID. (If you need help finding this, refer to Google's Customer ID Guide).
Account Name: Enter a friendly display name for this connection (e.g., Corporate Google Drive).
2. Google Workspace Settings
Customer GCP Project ID: The Google Cloud Project ID where your team deployed the DataDefender Terraform module.
Admin Impersonation Email: The email address of the dedicated Workspace user created for administrative discovery (e.g., datadefender-admin@yourdomain.com).
Crawler User Email: The email address of the dedicated standard Workspace user created for content scanning (e.g., datadefender-crawler@yourdomain.com).
3. Terraform Outputs
Enter these exact values from your terminal output (terraform output dwd_authorization_table):
Backend Service Account Email: Value corresponding to
backend_sa_email.Agent Service Account Email: Value corresponding to
agent_sa_email.Backend WIF Audience: Value corresponding to
backend_wif_audience.AWS Agent WIF Audience: Value corresponding to
agent_wif_audience.
4. Scanning Target
Scanning AWS Account: Select the linked AWS Account where DataDefender’s scanner agent tasks will be hosted.
Scanning Region: Select the specific AWS region where your scanner agent tasks will deployed.
Step 3: Save & Verify Connection
Review all entered fields for accuracy.
Click Connect & Verify.
DataDefender will perform an immediate automated handshake check to confirm that Workload Identity Federation (WIF) is active and that the service accounts have access to your Google Workspace environment.
Troubleshooting & Common Issues
Issue
Likely Cause
Resolution
Authentication Failed
Incorrect WIF Audience or SA Email
Verify the exact strings from your terraform output command and ensure no leading or trailing spaces were pasted into the form.
Domain-Wide Delegation Error
Missing OAuth Scopes in Workspace
Refer back to the GCP & Google Workspace Integration Guide and confirm both Client IDs and scopes are active in admin.google.com.
Access Denied Error
Impersonation or Crawler user missing
Ensure datadefender-admin and datadefender-crawler accounts exist and are active in your Google Workspace directory.
Last updated
