Google Drive Access Control Auditor and Reporter - n8n Workflow

IT Security Professionals needing automated data access auditing.
Compliance Officers tracking external data sharing within cloud storage.
Power users concerned about data leakage and improving security posture.
Anyone looking for robust n8n templates for SecOps tasks.

Managing file permissions across numerous Google Drive documents can be challenging, often leading to files retaining overly permissive settings (like 'shared with anyone' or external invites) long after they are necessary. This automated n8n workflow addresses this critical security gap by running a daily audit.

This robust n8n workflow uses the n8n schedule trigger to initiate a daily scan of recently modified files. It specifically identifies documents, spreadsheets, and presentations that are either publicly accessible or shared outside the internal domain (defined here as 'example.com'). All sensitive findings are meticulously logged into a new Google Sheet for record-keeping and summarized in an immediate email report, ensuring that potential access control risks are promptly actioned. This is a crucial n8n template for access management.

This powerful n8n workflow operates in four main stages, starting with the n8n trigger:

1. Initiation and Setup: The n8n trigger, a Schedule Trigger, runs daily at 6 AM. The first action uses a Google Sheets n8n node to create a uniquely named audit sheet (e.g., audit-YYYYMMDD).


2. File Identification: The Google Drive n8n node queries for all documents, spreadsheets, and presentations modified within the last 24 hours. The subsequent Filter n8n node, 'Has Shared with External Users,' checks the fetched files. It flags items if they are shared with users whose emails do not end with the internal domain or if the permissions include the anyone type (public link).


3. Data Transformation: The workflow iterates through the flagged files. A Split Out n8n node converts each file's permissions array into separate items (rows). A subsequent Filter n8n node ensures that the file owner's permission is excluded from the report, focusing only on shared roles. Finally, a Set n8n node normalizes the data into standard columns (fileid, filename, user, role).


4. Logging and Reporting: The normalized results are aggregated, flattened, and appended to the Google Sheet created in step 1 using another Google Sheets n8n node. Following the data log, a Gmail n8n node executes once to send a summary audit report, including direct links to the full Google Sheet and a list of identified files, completing the daily security audit n8n workflow.

To utilize this n8n template, follow these setup steps:

1. Import: Copy the provided n8n workflow JSON code and import it directly into your n8n instance.


2. Google Drive Credentials: You need a Google Drive credential configured with the necessary permissions to read file metadata (specifically permissions). Assign this credential to the 'Get Recently Active Documents' n8n node.


3. Google Sheets Credentials: Configure and assign a Google Sheets credential to both the 'Create New Sheet' and 'Append to New Sheet' n8n nodes. Ensure this account has write access to the target audit document ID specified in the 'Create New Sheet' node parameters.


4. Gmail Credentials: Set up a Gmail credential with permission to send emails and assign it to the 'Send Email Report' n8n node. Update the sendTo parameter in this n8n node to your desired recipient email address.


5. Domain Customization: Crucially, modify the expression in the 'Has Shared with External Users' Filter n8n node (!item.emailAddress.endsWith('example.com')) to reflect your organization’s domain (e.g., replace example.com with mycompany.com).


6. Activation: Once credentials and customizations are set, activate the n8n workflow to begin scheduled auditing.

Schedule Trigger (n8n trigger): Initiates the entire n8n workflow daily at 6 AM. This acts as the backbone for automated security monitoring.
Google Sheets (Create New Sheet): Creates a new audit log sheet within a specified master Google Sheets document using an n8n node. The sheet name is dynamic, incorporating the current date (audit-{{ $now.format('yyyyMMdd') }}).
Google Drive (Get Recently Active Documents): This critical n8n node uses a query (modifiedTime > '{{ $now.minus({ 'days': 1 })}}') to fetch files active in the last 24 hours, ensuring the audit focuses on recent activity.
Filter (Has Shared with External Users): A core logic n8n node that uses advanced expressions to flag files that are shared externally (emails not matching the domain) or publicly shared (type === 'anyone').
Split Out (Permissions To Items): Transforms the array of permission objects associated with a single file into individual items, allowing each permission setting to be processed as a separate row in the audit report.
Set (Normalise Fields): A data manipulation n8n node that standardizes the file and permission data into clear columns (e.g., file_name, user, role), preparing it for insertion into Google Sheets.
Google Sheets (Append to New Sheet): Logs all identified high-risk permissions data into the audit sheet created at the start of the n8n workflow.
Gmail (Send Email Report (Execute Once)): Sends a summarized email report containing links to the full log and a plaintext list of publicly shared and externally shared documents, providing instant visibility into security risks.