Security update for Google Drive

Google is implementing a security update to Google Drive that will apply to some Drive files stored in Cardinal Mail Google Workspace. The security update will make these Google Drive files more secure by updating the URL used to find them to include a resource key, and may lead to some new file access requests.

Google is notifying owners of affected files starting on July 26, 2021.

Google's enforcement of the new resource key does not begin until September 13, 2021; Google expects to finish rolling out enforcement to Drive files by the end of September.

Scope of impact

Google has informed us of the following regarding which Drive files are impacted by this security update.

  • Google Docs, Sheets, Slides, and Forms aren’t impacted. Other file types may be impacted.

  • Any file shared since November 2017 is not impacted.

  • There is no impact for users and Groups with whom an affected file is explicitly shared; it only impacts people with whom the file has not been shared and who are accessing it via its link.

What file owners should do before enforcement begins

Review your list of affected files.

  1. On your computer, go to drive.google.com/drive/my-drive.

  2. At the top, find the security update banner (as shown above)and click See files.

  3. If you have multiple Drives with impacted files, click on one of your Drives, like My Drive, to see all impacted files in that Drive.

Any file listed as having the Security Update Applied has the updated URL containing the resource key.

If the file URL has been published, for example, on the University website, the file Owner should update the published URL with the new link before Sep 13. This may involve working with the person in your division responsible for the publication or website content.

Important: do not remove the resourcekey parameter from the URL when updating it or passing the link to others.

What happens after enforcement takes effect

Once the security update is enforced on an affected file, a resource key included in the URL will be required to access the file. Users who previously accessed or viewed the file won’t need the resource key in the URL. Only people who haven’t previously accessed the file will need the resource key to gain access. If they don’t have the URL with the resource key, they’ll need to request access to the file.

The file owner is notified of the request by email, and can send the requester a new link with the resource key so that they can gain access.

More Information

Security update for Google Drive (Google)

Note: Affected Cardinal Mail Google Workspace users will not have the option to exclude their impacted files from the security update. Google recommends applying the security update to enhance the security of file-sharing links.

Share a link to a Drive file (Google)