CIS DigitalOcean Benchmark

This recommendation verifies that two-factor authentication is enabled for all team members on the DigitalOcean cloud infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the DigitalOcean cloud infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check team members and roles:
doctl account get

# List team members via API:
curl -s -H "Authorization: Bearer $DO_TOKEN" \
  https://api.digitalocean.com/v2/account | jq .

# Enable two-factor authentication:
# Cloud Console > Account > Security > Enable 2FA

# Use team-based access:
# Cloud Console > Settings > Team
# Add members with appropriate roles (Admin, Billing, Member)

This recommendation verifies that API tokens follow least privilege and are rotated on the DigitalOcean cloud infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the DigitalOcean cloud infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List API tokens:
curl -s -H "Authorization: Bearer $DO_TOKEN" \
  https://api.digitalocean.com/v2/tokens | jq '.[].name'

# Check token scopes:
doctl auth list

# Create read-only tokens for monitoring:
# Cloud Console > API > Tokens > Generate New Token
# Select: Read scope only

# Rotate tokens regularly:
# Revoke old tokens and generate new ones
# Use short-lived tokens where possible

This recommendation verifies that Droplets are deployed within a VPC on the DigitalOcean cloud infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the DigitalOcean cloud infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List all Droplets and their networking:
doctl compute droplet list --format ID,Name,PublicIPv4,PrivateIPv4,VPCId

# Check VPC configuration:
doctl vpcs list --format ID,Name,IPRange,Default

# Create VPC for network isolation:
doctl vpcs create --name production-vpc \
  --region nyc1 --ip-range 10.10.0.0/16

# Create Droplet in VPC:
doctl compute droplet create web-01 \
  --region nyc1 --size s-2vcpu-4gb \
  --image ubuntu-24-04-x64 \
  --vpc-uuid $VPC_UUID

This recommendation verifies that Cloud Firewalls are applied with restrictive rules on the DigitalOcean cloud infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the DigitalOcean cloud infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List Cloud Firewalls:
doctl compute firewall list --format ID,Name,Status

# Get firewall rules:
doctl compute firewall get $FW_ID --format InboundRules,OutboundRules

# Create Cloud Firewall with restrictive rules:
doctl compute firewall create \
  --name production-fw \
  --inbound-rules 'protocol:tcp,ports:22,address:10.10.0.0/16 protocol:tcp,ports:443,address:0.0.0.0/0' \
  --outbound-rules 'protocol:tcp,ports:all,address:0.0.0.0/0 protocol:udp,ports:53,address:0.0.0.0/0' \
  --droplet-ids $DROPLET_ID

This recommendation ensures that SSH key authentication is enforced on the DigitalOcean cloud infrastructure platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the DigitalOcean cloud infrastructure platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# List Droplets and check SSH keys:
doctl compute droplet list --format ID,Name

# List registered SSH keys:
doctl compute ssh-key list --format ID,Name,FingerPrint

# Add SSH key and create Droplet with key-only access:
doctl compute ssh-key create my-key \
  --public-key "$(cat ~/.ssh/id_ed25519.pub)"

# Create Droplet with SSH key:
doctl compute droplet create secure-vm \
  --region nyc1 --size s-1vcpu-1gb \
  --image ubuntu-24-04-x64 \
  --ssh-keys $KEY_FINGERPRINT

# Disable password authentication on Droplet:
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart sshd

This recommendation verifies that monitoring and alerting are enabled on the DigitalOcean cloud infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the DigitalOcean cloud infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Droplet monitoring agent:
doctl compute droplet list --format ID,Name,Status

# Check monitoring via API:
curl -s -H "Authorization: Bearer $DO_TOKEN" \
  https://api.digitalocean.com/v2/monitoring/alerts | jq '.policies[].type'

# Enable monitoring on Droplet creation:
doctl compute droplet create monitored-vm \
  --region nyc1 --size s-2vcpu-4gb \
  --image ubuntu-24-04-x64 \
  --enable-monitoring

# Create alert policy:
curl -s -X POST -H "Authorization: Bearer $DO_TOKEN" \
  -H 'Content-Type: application/json' \
  https://api.digitalocean.com/v2/monitoring/alerts \
  -d '{
    "alerts": {"email": ["admin@example.com"]},
    "description": "High CPU",
    "compare": "GreaterThan",
    "value": 80,
    "window": "5m",
    "type": "v1/insights/droplet/cpu",
    "entities": ["'$DROPLET_ID'"]
  }'

This recommendation verifies that Spaces are configured with private ACLs on the DigitalOcean cloud infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the DigitalOcean cloud infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List Spaces (S3-compatible object storage):
doctl compute cdn list 2>/dev/null

# Check Space permissions via s3cmd:
s3cmd info s3://my-space --access_key=$DO_SPACES_KEY \
  --secret_key=$DO_SPACES_SECRET \
  --host=nyc3.digitaloceanspaces.com \
  --host-bucket='%(bucket)s.nyc3.digitaloceanspaces.com'

# Create private Space:
curl -s -X PUT -H "Authorization: Bearer $DO_TOKEN" \
  https://api.digitalocean.com/v2/spaces/my-private-space \
  --data '{"region": "nyc3", "acl": "private"}'

# Set CORS policy:
# Spaces Settings > CORS Configuration
# Restrict origins to your domain only

This recommendation verifies that managed databases use VPC and firewall rules on the DigitalOcean cloud infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the DigitalOcean cloud infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List managed databases:
doctl databases list --format ID,Name,Engine,Version,Status

# Check database firewall rules:
doctl databases firewalls list $DB_ID

# Create managed database in VPC:
doctl databases create prod-db \
  --engine pg --version 16 \
  --region nyc1 --size db-s-2vcpu-4gb \
  --num-nodes 2 --private-network-uuid $VPC_UUID

# Add firewall rules:
doctl databases firewalls append $DB_ID \
  --rule droplet:$DROPLET_ID

This recommendation verifies that Kubernetes clusters use auto-upgrade and HA on the DigitalOcean cloud infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the DigitalOcean cloud infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List Kubernetes clusters:
doctl kubernetes cluster list --format ID,Name,Version,AutoUpgrade

# Check node pool configuration:
doctl kubernetes cluster node-pool list $CLUSTER_ID

# Create secure Kubernetes cluster:
doctl kubernetes cluster create prod-k8s \
  --region nyc1 --version latest \
  --auto-upgrade --surge-upgrade \
  --node-pool 'name=worker;size=s-4vcpu-8gb;count=3;auto-scale=true;min-nodes=2;max-nodes=5'

# Enable HA control plane:
doctl kubernetes cluster update $CLUSTER_ID --ha

This recommendation verifies that container registry uses garbage collection on the DigitalOcean cloud infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the DigitalOcean cloud infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check container registry:
doctl registry get 2>/dev/null

# List repositories:
doctl registry repository lv

# Create container registry:
doctl registry create my-registry --region nyc1

# Enable garbage collection:
doctl registry garbage-collection start $REGISTRY_NAME \
  --include-untagged-manifests

# Integrate with Kubernetes:
doctl registry kubernetes-manifest | kubectl apply -f -

This recommendation verifies that load balancers enforce HTTPS with TLS termination on the DigitalOcean cloud infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the DigitalOcean cloud infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List load balancers:
doctl compute load-balancer list --format ID,Name,IP,Algorithm,Status

# Check SSL configuration:
doctl compute load-balancer get $LB_ID --format ForwardingRules

# Create HTTPS load balancer:
doctl compute load-balancer create \
  --name prod-lb --region nyc1 \
  --forwarding-rules 'entry_protocol:https,entry_port:443,target_protocol:http,target_port:80,certificate_id:$CERT_ID' \
  --health-check 'protocol:http,port:80,path:/health,check_interval_seconds:10,response_timeout_seconds:5,healthy_threshold:3,unhealthy_threshold:3' \
  --droplet-ids $DROPLET_IDS \
  --redirect-http-to-https

This recommendation verifies that DNS records include CAA and SPF on the DigitalOcean cloud infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the DigitalOcean cloud infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check domain configuration:
doctl compute domain list

# List DNS records:
doctl compute domain records list example.com

# Configure DNS with DNSSEC:
doctl compute domain create example.com

# Add CAA record to restrict certificate issuance:
doctl compute domain records create example.com \
  --record-type CAA --record-name @ \
  --record-data '0 issue letsencrypt.org' --record-ttl 3600

# Add SPF record:
doctl compute domain records create example.com \
  --record-type TXT --record-name @ \
  --record-data 'v=spf1 include:_spf.digitalocean.com ~all' --record-ttl 3600

This recommendation verifies that automated backups and snapshots are enabled on the DigitalOcean cloud infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the DigitalOcean cloud infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List snapshots:
doctl compute snapshot list --format ID,Name,ResourceType,CreatedAt

# Check backup status:
doctl compute droplet list --format ID,Name,Features

# Enable automated backups:
doctl compute droplet-action enable-backups $DROPLET_ID

# Create manual snapshot:
doctl compute droplet-action snapshot $DROPLET_ID \
  --snapshot-name "pre-deploy-$(date +%Y%m%d)"

# Enable volume snapshots:
doctl compute volume snapshot $VOL_ID \
  --snapshot-name "vol-backup-$(date +%Y%m%d)"

This recommendation verifies that resources are organized by project and environment on the DigitalOcean cloud infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the DigitalOcean cloud infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check project structure:
doctl projects list --format ID,Name,Environment

# List project resources:
doctl projects resources list $PROJECT_ID

# Organize resources by project and environment:
doctl projects create --name production \
  --environment Production --purpose 'Web Application'

doctl projects create --name staging \
  --environment Staging --purpose 'Testing'

# Move resources to appropriate project:
doctl projects resources assign $PROD_PROJECT_ID \
  --resource=do:droplet:$DROPLET_ID \
  --resource=do:loadbalancer:$LB_ID