Secure DigitalOcean with cnspec

Scan your DigitalOcean account to find security risks before they become incidents. cnspec evaluates Droplets, firewalls, Kubernetes clusters, managed databases, load balancers, VPCs, Spaces keys, and more, all without installing agents on your infrastructure.

New to cnspec? Read the Quickstart to install cnspec and run your first scan. To scan other platforms, see the cloud scanning overview.

Prerequisites

To scan DigitalOcean with cnspec, you must have:

• cnspec installed on your workstation
• A DigitalOcean account
• A DigitalOcean personal access token

Authenticate

Create a personal access token in DigitalOcean:

1. Log in to the DigitalOcean control panel.
2. In the left navigation, choose API.
3. On the Tokens tab, generate a new personal access token. Read scopes are sufficient for assessment.

You can pass the token on the command line with --token, or export it once and reuse it across commands:

export DIGITALOCEAN_TOKEN=your_token_here

Verify with a quick DigitalOcean check

Confirm that cnspec can reach your DigitalOcean account:

cnspec run digitalocean -c 'digitalocean.account.email != empty'

If cnspec connects, it prints your account's email and confirms the check passed.

Scan DigitalOcean

Scan your DigitalOcean account:

cnspec scan digitalocean

Or pass the token explicitly:

cnspec scan digitalocean --token YOUR_API_TOKEN

When the scan completes, cnspec prints each check with a pass or fail result and an overall risk score from 0 (no risk) to 100 (highest risk). To learn how to read a report in depth, see Understand Scan Results.

Discover resources during a scan

cnspec connects to your DigitalOcean account as a single asset and can expand it into child assets. Use the --discover flag to choose which resource types become their own assets:

cnspec scan digitalocean --discover all

Filter which resources cnspec scans

Use the --filters flag to narrow which objects become assets. The same filters apply to the corresponding MQL listings, so a filtered scan and a plain query return the same resources.

Repeat the flag to combine filters:

cnspec scan digitalocean --discover all --filters tags=production --filters exclude:regions=ams3

DigitalOcean tags are flat labels rather than key/value pairs, so the tag filters take a list of tag names. Two consequences are worth knowing:

• Cloud firewalls are account-global and have no region, so a region filter never drops them. A global firewall applies in every selected region.
• Spaces buckets cannot be tagged, so an include-tag filter such as tags=production excludes every bucket.

Scan with the Mondoo DigitalOcean Security policy

Mondoo maintains an out-of-the-box DigitalOcean Security policy that checks droplet configuration, firewall rules, SSH keys, database access, and more.

Mondoo Platform users: Enable the policy in your space. In the Mondoo App, go to Findings > Policies, search for "DigitalOcean", and add the policy. All future scans of your DigitalOcean account automatically evaluate against it. To learn more, read Manage policies in Mondoo Platform.

Open source users: Pass the policy bundle URL directly to cnspec:

cnspec scan digitalocean --token YOUR_API_TOKEN \
  --policy-bundle https://raw.githubusercontent.com/mondoohq/cnspec/refs/heads/main/content/mondoo-digitalocean-security.mql.yaml

You can also create your own policies to meet your specific requirements.

Explore and test checks interactively

Open a cnspec shell to discover resources and try out checks:

cnspec shell digitalocean

Retrieve account information

cnspec> digitalocean.account { email emailVerified status dropletLimit }

List Droplets

cnspec> digitalocean.droplets { name status region size memory vcpus }

Find Droplets without backups enabled

cnspec> digitalocean.droplets.where(backupsEnabled == false) { name region }

List firewalls and their rules

cnspec> digitalocean.firewalls { name status inboundRules outboundRules dropletIds }

List Kubernetes clusters

cnspec> digitalocean.kubernetesClusters { name version region status autoUpgrade ha }

List managed databases

cnspec> digitalocean.databases { name engine version numNodes region }

List load balancers

cnspec> digitalocean.loadBalancers { name status algorithm region redirectHttpToHttps }

List VPCs

cnspec> digitalocean.vpcs { name region ipRange default }

List SSH keys

cnspec> digitalocean.sshKeys { name fingerprint }

Learn more

• DigitalOcean Resource Pack Reference: every DigitalOcean resource and field cnspec can query
• Write Effective MQL: a guide to authoring checks and queries