rclone backup google workspace drive folders, including shared drives, and shared with me

drive-to-backup.sh

#!/bin/sh

# needs RCLONE_CONFIG env set

DRIVE_USERS="[email protected] [email protected]"
ADMIN_USER="[email protected]"
REMOTE_SRC="drive:"
REMOTE_DEST="b2-crypt:"

RCLONE_CONFIG_DIR=$(mktemp -d)

cp -av "$(dirname "$RCLONE_CONFIG")/." "$RCLONE_CONFIG_DIR/"

cat "$RCLONE_CONFIG" > "$RCLONE_CONFIG_DIR/rclone.conf"

rclone backend drives --drive-impersonate=$ADMIN_USER -o config "$REMOTE_SRC" >> "$RCLONE_CONFIG_DIR/rclone.conf"

export RCLONE_CONFIG="$RCLONE_CONFIG_DIR/rclone.conf"

for u in $DRIVE_USERS; do
  rclone sync "$REMOTE_SRC" --inplace --ignore-checksum --drive-impersonate=$u "$REMOTE_DEST/user/$u/My Drive" $@
  
  rclone sync "$REMOTE_SRC" --inplace --ignore-checksum --drive-shared-with-me --drive-impersonate=$u "$REMOTE_DEST/user/$u/Shared with me" $@
done

if grep -E '^upstreams ?= ?["A-Za-z0-9]+' "$RCLONE_CONFIG"; then
  rclone sync 'AllDrives:' --inplace --ignore-checksum --drive-impersonate=$ADMIN_USER "$REMOTE_DEST/shared-drives" $@
else
  echo No Shared Drives to Sync
fi

rclone.conf

[drive]
type = drive
scope = drive.metadata.readonly,drive.readonly
service_account_file = ${RCLONE_CONFIG_DIR}/sa/backup-sa.json
skip_shortcuts = true
acknowledge_abuse = true

[b2-crypt]
type = crypt
remote = b2:example-bucket
filename_encryption = off
suffix = .encrypted
# password was passed through rclone obscure
password = blah

[b2-crypt-versions]
type = crypt
remote = b2-versions:xrks-drive-backups
filename_encryption = off
suffix = .encrypted
# password was passed through rclone obscure
password = blah

[b2]
type = b2
account = blah_id
key = blah_key

[b2-versions]
type = b2
account = blah_id
key = blah_key
versions = true

I run this application as a Google Cloud Run Job, see screenshots below for configuration details

Google Drive Service Account was set-up following instructions at https://rclone.org/drive/#service-account-support