borghei Google Workspace CLI
Category: Engineering Domain: Google Workspace Administration
Overview
The Google Workspace CLI skill provides tools for auditing Google Workspace configurations, generating authentication setup documentation, and diagnosing common GWS issues. It helps IT administrators maintain secure, well-configured Workspace environments without needing to navigate complex admin consoles.
Clarify First
Before running, confirm these inputs. If any is unknown or vague, ASK — do not assume:
- Task — security audit, auth setup guide, or diagnostics (selects
workspace_audit.pyvsauth_setup_guide.pyvsgws_doctor.py) - Config export or auth method — the GWS config JSON to audit, or the auth method and scopes for a setup guide (sets
--configor--method/--scopes) - Output mode — human-readable vs JSON for automation (sets
--format json)
Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.
Quick Start
# Audit Workspace security configuration
python scripts/workspace_audit.py --config gws-config.json
# Generate auth setup guide
python scripts/auth_setup_guide.py --method oauth --scopes admin,drive
# Run diagnostics
python scripts/gws_doctor.py --check all
# JSON output for automation
python scripts/workspace_audit.py --config gws-config.json --format json
Tools Overview
workspace_audit.py
Audits Google Workspace configuration exports for security best practices.
| Feature | Description |
|---|---|
| 2FA enforcement | Checks if 2-step verification is required |
| Password policy | Validates password strength requirements |
| Sharing settings | Reviews external sharing configurations |
| App access | Checks third-party app access policies |
| Admin roles | Reviews admin role assignments |
| Mobile management | Checks device management policies |
| Drive settings | Validates Drive sharing and access controls |
auth_setup_guide.py
Generates step-by-step authentication setup documentation for GWS API access.
| Feature | Description |
|---|---|
| OAuth setup | Generates OAuth 2.0 configuration guide |
| Service account | Creates service account setup documentation |
| API scopes | Lists required scopes for each API |
| Domain delegation | Documents domain-wide delegation setup |
| Testing guide | Provides verification steps |
gws_doctor.py
Diagnostic tool for common Google Workspace configuration issues.
| Feature | Description |
|---|---|
| DNS checks | Validates MX, SPF, DKIM, DMARC records format |
| SSL/TLS | Checks certificate and transport security settings |
| Integration health | Validates common integration patterns |
| Config consistency | Checks for conflicting settings |
| Best practices | Compares against GWS recommended settings |
Workflows
Security Audit Workflow
- Export config - Export GWS settings to JSON via Admin SDK or manual export
- Audit - Run workspace_audit.py against the config file
- Review findings - Prioritize critical security gaps
- Remediate - Apply recommended settings in Admin Console
- Re-audit - Verify changes resolved findings
API Setup Workflow
- Plan - Determine which APIs and scopes are needed
- Generate guide - Run auth_setup_guide.py with desired method
- Follow steps - Create credentials in Google Cloud Console
- Configure - Set up domain delegation if needed
- Verify - Test API access with provided verification steps
Health Check Workflow
- Run diagnostics - Execute gws_doctor.py with all checks
- Review results - Check DNS, email, and integration health
- Fix issues - Address failures in priority order
- Re-check - Verify fixes pass diagnostics
Regular Maintenance
# Monthly security audit
python scripts/workspace_audit.py --config gws-export.json --format json > audit_$(date +%Y%m).json
# Weekly health check
python scripts/gws_doctor.py --check dns,email --format json
Reference Documentation
- GWS Admin Guide - Security settings, API configuration, DNS requirements
Common Patterns Quick Reference
Security Priorities
| Setting | Priority | Impact |
|---|---|---|
| 2FA enforcement | Critical | Prevents account takeover |
| Password policy | Critical | Reduces credential attacks |
| External sharing | High | Prevents data leakage |
| App access control | High | Limits third-party risk |
| Mobile management | Medium | Secures device access |
| Admin role review | Medium | Limits privilege exposure |
DNS Records for Email
| Record | Purpose | Example |
|---|---|---|
| MX | Email routing | ASPMX.L.GOOGLE.COM |
| SPF | Sender verification | v=spf1 include:_spf.google.com ~all |
| DKIM | Email signing | Domain-specific CNAME |
| DMARC | Policy enforcement | v=DMARC1; p=reject; rua=mailto:... |
API Scopes
| API | Scope | Purpose |
|---|---|---|
| Admin SDK | admin.directory.user |
User management |
| Drive | drive.readonly |
File listing |
| Gmail | gmail.settings.basic |
Email settings |
| Calendar | calendar.readonly |
Calendar access |
Common Issues
| Issue | Symptom | Fix |
|---|---|---|
| No 2FA | Account takeover risk | Enable 2FA enforcement |
| Weak passwords | Credential stuffing | Set 12+ char minimum |
| Open sharing | Data leakage | Restrict external sharing |
| No DMARC | Email spoofing | Add DMARC DNS record |
| Stale admins | Excessive privileges | Review admin roles quarterly |