Service Account Creation

Create the access key

Log in to the admin account on your workspace management platform and navigate to the developer’s console:

https://console.developers.google.com

Select the top left panel to access various administrative features.

Create Project

From the top left panel, go to "IAM & Admin" and select "Create Project."

Fill out the project details, such as name, organization, and location, then click "CREATE."Create a service account

Create a service account

Navigate to "IAM & Admin" and then to "Service Accounts."

Click "CREATE SERVICE ACCOUNT" in the service accounts dashboard.

Provide a name for the service account and proceed by clicking "CREATE AND CONTINUE."

Assign a role (e.g., Basic -> Owner) to the service account and click "CONTINUE."

Optionally, grant user access and finalize by clicking "DONE."

In the service account details, use the action button (three vertical dots) to manage keys.

Choose "ADD KEY" and then "Create new key," selecting JSON format, which will be downloaded to your desktop.

Note: If there is an issue generating a key, follow additional troubleshooting steps provided: GWS Enable Service Account Key Creation

Copy OAuth 2 Client ID - this will be required

Enabling API Services

Navigate to the APIs & Services dashboard from the top left panel.

Click "ENABLE APIS AND SERVICES" and search for the required APIs in the API library. Enable as needed.

The table below gives the list of APIs required to be enabled for different data source

Data source

API

Google Drive API

Full email messages and metadata

Email attachments

Custom labels and organization

Account settings and filters

Email history changes

Gmail API

User account activities

Security settings

Domain settings

Mobile device management

Chrome OS device information

Role assignments and definitions

Admin SDK API

File creation and deletion events

Document editing history

Sharing and permission changes

File access logs

Comments and collaborations

Drive Activity API

Export logs and details

Google Vault API

Permissions and access reasons for resources

Policy Troubleshooter API

Enable Domain-Wide Delegation

Log in to the admin account and go to the security settings.

https://admin.google.com

Navigate to "API controls"

Select MANAGE DOMAIN WIDE DELEGATION

Click "Add new" and input the Client ID copied earlier.

Provide OAuth scopes for the necessary APIs and authorize.

Note: All these scopes can be used together in a comma-delimited list to provide comprehensive access permissions for a cloud forensic investigation.

Full Scopes:

https://www.googleapis.com/auth/gmail.readonly,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.reports.audit.readonly,https://www.googleapis.com/auth/drive.readonly,https://www.googleapis.com/auth/drive.metadata.readonly,https://www.googleapis.com/auth/drive.activity.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,https://www.googleapis.com/auth/admin.directory.domain.readonly,https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly,https://www.googleapis.com/auth/admin.directory.device.mobile.readonly,https://www.googleapis.com/auth/gmail.settings.basic,https://www.googleapis.com/auth/gmail.settings.sharing

Scope

Key Data Collected

https://www.googleapis.com/auth/gmail.readonly

Access to read all user email messages and metadata

https://www.googleapis.com/auth/gmail.settings.basic

Access to manage basic Gmail settings such as filters and forwarding

https://www.googleapis.com/auth/gmail.settings.sharing

Access to manage Gmail delegate settings

https://www.googleapis.com/auth/admin.directory.user.readonly

Access to read user information in your domain

https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly

Access to read roles and permissions assigned to users

https://www.googleapis.com/auth/admin.directory.domain.readonly

Access to read domain settings and configurations

https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly

Access to read Chrome OS device information in your domain

https://www.googleapis.com/auth/admin.directory.device.mobile.readonly

Access to read mobile device information in your domain

https://www.googleapis.com/auth/admin.reports.audit.readonly

Access to read audit logs of activities within your domain

https://www.googleapis.com/auth/drive.readonly

Access to read all files a user can access in Google Drive

https://www.googleapis.com/auth/drive.metadata.readonly

Access to read metadata of all files in Google Drive

https://www.googleapis.com/auth/drive.activity.readonly

Access to read historical file activities in Google Drive

Last updated

Was this helpful?