The initial feedback from a security review of the API key request is that the permissions outlined in the dispatch docs are too permissive, which I think is fair. The dispatch documentation guides through the process of creating an API key with domain-wide delegation, which AIUI means root level access to all resources within the domain. Within the context of gmail and drive that's far more access than should be needed.

I've logged a bug with the project about this https://github.com/Netflix/dispatch/issues/2408 asking that minimal permissions required be clarified, and at the same time will experiment in my lab setup to see if I can land on a set of minimal permissions to get the drive, docs and gmail plugins up and running.

It also appears that the dispatchdev config has been partially erased and is now throwing database errors when attempting to configure plugins. I'll work on fixing that as well.

In T313231#8148872, @herron wrote:

The initial feedback from a security review of the API key request is that the permissions outlined in the dispatch docs are too permissive, which I think is fair. The dispatch documentation guides through the process of creating an API key with domain-wide delegation, which AIUI means root level access to all resources within the domain. Within the context of gmail and drive that's far more access than should be needed.

As it turns out, for the purposes of managing a google drive folder, and populating docs a service account and API key can be self served via the gcp console. This has now been done, and is confirmed to be working (new folder and gdoc created from template upon new incident) in my wmcs dispatch lab instance.