Skip to main content

DigitalOcean

Connect your DigitalOcean account to Ciphrix using a DigitalOcean Personal Access Token (PAT) for automated compliance monitoring of your cloud infrastructure.

Capabilities​

The DigitalOcean integration provides the following capabilities:

✅ Compliance Checks​

Automatically verify security configurations and compliance controls across your DigitalOcean infrastructure including:

  • Cloud firewall attachment to Droplets
  • SSH exposure to the internet
  • Database port exposure to the internet
  • Managed database trusted sources
  • Managed database SSL requirements
  • Automatic Droplet backups
  • Managed database backups
  • Latest security scan status
  • Load balancer HTTP-to-HTTPS redirection
  • Monitoring alert configuration

🔄 Import Asset​

Import and track DigitalOcean Droplets, firewalls, managed databases, load balancers, and related account, monitoring, and security resources as assets in your Ciphrix inventory.

How to Connect DigitalOcean​

Prerequisites​

Before connecting DigitalOcean, ensure you have:

  • A DigitalOcean account with access to the team and resources you want to monitor
  • Permission to create a Personal Access Token
  • A team role that can read the infrastructure, database, monitoring, and security settings you want to assess
  • Access to the DigitalOcean Control Panel

Important API Token Notes​

Ciphrix uses the DigitalOcean API for this integration.

  • Use a DigitalOcean Personal Access Token with Read Only access.
  • Do not use Spaces access keys, a database password, or a Droplet SSH key.
  • Create the token in the team that owns the resources you want to monitor.
  • The token's access is limited by the permissions of the team member who creates it.
  • Ciphrix discovers resources across the regions available to the token.
  • The Connection Identifier is a label in Ciphrix. It does not restrict scanning to a particular DigitalOcean project.

Connection Instructions​

Step 1: Create a DigitalOcean Personal Access Token​

  1. Log in to DigitalOcean

    • Go to https://cloud.digitalocean.com
    • Sign in with the account that has access to the resources you want Ciphrix to monitor
    • Select the team that owns those resources

  2. Open API Settings

    • In the main menu, click Account, then API
    • On the Applications & API page, open the Tokens tab
    • Find the Personal access tokens section

  3. Generate a New Token

    • Click Generate New Token
    • Enter a descriptive token name such as Ciphrix Compliance Monitoring
    • Choose an expiration date
    • Under Scopes, select Read Only
    • Click Generate Token

  4. Copy and Store the Token Securely

    • Copy the token value immediately
    • DigitalOcean only shows the token value once
    • Store it securely until you add it to Ciphrix

Step 2: Initiate DigitalOcean Connection in Ciphrix​

You have two options to initiate the DigitalOcean connection:

  1. Navigate to Integration Library

    • Log in to ciphrix.app
    • Go to Integrations in the sidebar
    • Go to the Integration Library tab
    • Search for or browse to DigitalOcean

  2. Connect DigitalOcean

    • Click the Connect button on the DigitalOcean integration tile
    • A connection form will appear
Option B: From Create Connection​

  1. Navigate to Create Connection

    • Log in to ciphrix.app
    • Go to Integrations in the sidebar
    • Click Create Connection

  2. Select DigitalOcean

    • From the connection provider dropdown, select DigitalOcean
    • A connection form will appear

Step 3: Fill Connection Details​

  1. Enter Connection Information

    • Connection Name: Enter a friendly name for this connection
      • Example: "Production DigitalOcean"
      • Example: "Engineering Cloud Infrastructure"
    • Connection Identifier: Enter a clear label for this DigitalOcean connection
      • Example: your team name or production-digitalocean
      • This label does not limit which projects or regions are scanned
    • Credential Name: Enter a name to identify the saved credential
      • Example: "Ciphrix DigitalOcean Token"
    • Access Token: Paste the DigitalOcean Personal Access Token created in Step 1
    • Select Items: Keep DigitalOcean Security Checks selected. Select DigitalOcean Assets if you want to import asset information

  2. Create Connection

    • Click Create Connection
    • Wait for the credentials to be saved and the connection to be created

Step 4: Verify Connection​

  1. Check Connection Status

    • Open the new connection in Integrations
    • Status should show Active after the credentials are saved
    • A successful scan confirms that the token has the required provider access

  2. Initial Scan

    • Ciphrix scans your environment once a week on its scheduled scan day
    • The first scheduled scan collects DigitalOcean configuration and runs the compliance checks
    • You can contact support@ciphrix.com to know your next scan date

  3. View Results

    • Navigate to Monitoring
    • Filter by DigitalOcean to view check results and findings
    • If asset import is enabled, navigate to Assets to view imported DigitalOcean assets

Permissions and Data Access​

Choose Read Only when generating the DigitalOcean PAT. This grants the api:read scope, which provides read access to resources allowed by your team role.

ScopeRequired For
api:readRead account and project inventory, Droplets, firewalls, managed databases, backup settings, load balancers, monitoring alerts, and security scan information

The api:read scope has no additional required scopes. Full Access is not required for this integration.

Ciphrix uses this access to review resource configuration and metadata. It does not connect to Droplets through SSH, query application database rows, start security scans, or change your DigitalOcean configuration.

Read access still depends on your team role. If a resource is unavailable to the token owner, a Read Only token won't make it available.

Managing the Integration​

Rotating the Personal Access Token​

To rotate the token used by Ciphrix:

  1. Create a new DigitalOcean Personal Access Token with Read Only access in the same team
  2. Go to Integrations in Ciphrix
  3. Open the existing DigitalOcean connection
  4. Replace the saved Access Token
  5. Click Update Credentials
  6. Delete the old token in DigitalOcean after confirming a scan succeeds with the new token

Revoking Access​

To revoke Ciphrix's access to DigitalOcean:

  1. Open Account > API > Tokens in DigitalOcean
  2. Find the token created for Ciphrix
  3. Open its … menu and delete the token
  4. In Ciphrix, disable or delete the DigitalOcean connection

Note: Deleting the PAT will prevent future DigitalOcean scans from completing successfully.

Troubleshooting​

Connection Failed​

Issue: Credentials cannot be saved or DigitalOcean scans cannot authenticate

  • Confirm you pasted a DigitalOcean Personal Access Token
  • Confirm the token has not expired or been deleted
  • Ensure there are no extra spaces when copying the token
  • Create a new token and update the connection if the value may have been copied incorrectly

Permission Errors​

Issue: A scan returns permission errors or HTTP 403 responses

  • Confirm the PAT was created with Read Only access (api:read)
  • If using a custom-scoped token, confirm it covers every resource type being assessed, or create a Read Only token
  • Confirm the token owner's team role allows access to the required resources
  • Confirm the token was created in the correct team

No Resources Found​

Issue: The connection is active but expected DigitalOcean resources are missing

  • Confirm the resources belong to the team in which the token was created
  • Confirm the token owner can see those resources in DigitalOcean
  • Confirm the resources are still active
  • Changing the Ciphrix connection identifier does not change the token's team access

Security Scan Information Unavailable​

Issue: The security scanning check cannot read the latest scan information

  • Confirm security scanning is available and configured for your DigitalOcean team
  • Confirm the token owner has access to security information
  • Review the latest scan status in DigitalOcean
  • Ciphrix reads the reported status; it does not start a DigitalOcean security scan

No Compliance Data Appearing​

Issue: Integration connected but no compliance data is visible for more than 7 days

  • Confirm the connection status is Active in Ciphrix
  • Confirm the DigitalOcean PAT is still valid
  • Contact Ciphrix Support at support@ciphrix.com

Token Was Exposed​

Issue: The DigitalOcean PAT may have been shared or exposed

  • Delete the token in DigitalOcean API settings
  • Create a new Read Only PAT
  • Update the DigitalOcean connection in Ciphrix with the new token

Support​

Need help with DigitalOcean integration?