Overview
The DigitalOcean integration monitors your cloud infrastructure: Droplets, managed databases, block storage volumes, firewalls, Kubernetes clusters, and load balancers. LowerPlane uses read-only access via the DigitalOcean API v2 with OAuth 2.0.How to Connect
Authorize with DigitalOcean
You will be redirected to DigitalOcean. Sign in and review the requested permissions.
Permissions Requested
LowerPlane requests theread OAuth scope, which provides read-only access to:
| Resource | What LowerPlane Reads |
|---|---|
| Account | Account status and team information |
| Droplets | Instance metadata, IPs, region, monitoring status, backup configuration |
| Databases | Managed database clusters, encryption, backup, and SSL settings |
| Volumes | Block storage volumes, encryption status, and attachments |
| Firewalls | Firewall rules and Droplet assignments |
| Kubernetes | Cluster configuration and node pools |
| Load Balancers | Load balancer health checks and backend configuration |
| Domains | DNS records and domain configuration |
LowerPlane uses read-only access. It cannot create, modify, or delete any resources in your DigitalOcean account.
What LowerPlane Collects
Droplet Inventory
All Droplets with metadata: name, region, size, status, public/private IPs, VPC assignment, backup and monitoring status.
Firewall Coverage
Cloud Firewall rules and which Droplets have firewalls attached, identifying unprotected instances.
Database Security
Managed database clusters with encryption at rest status, backup configuration, and SSL enforcement.
Volume Encryption
Block storage volumes with encryption at rest verification.
Monitoring Alerts
CPU utilization alert policies and which Droplets have monitoring configured.
Kubernetes Clusters
Kubernetes cluster configuration, node pools, and version information.
Security Tests
LowerPlane runs automated tests against your DigitalOcean resources:| Test | Severity | Description |
|---|---|---|
| Droplet should have a firewall assigned | High | Verifies every Droplet has a Cloud Firewall attached |
| Droplet should be protected from direct internet traffic | Critical | Checks Droplets have firewall rules restricting public access |
| Droplet CPU utilization should be monitored | Medium | Ensures CPU monitoring alerts are configured |
| Database periodic backup should be enabled | High | Verifies managed databases have automated backups |
| Database should be encrypted | Critical | Confirms managed databases have encryption at rest |
| Volume should be encrypted | Critical | Verifies block storage volumes have encryption at rest |
| Spaces public listing should be disabled | Critical | Ensures Spaces do not allow public file listing |
Compliance Mapping
| Framework | Controls | What DigitalOcean Evidence Satisfies |
|---|---|---|
| SOC 2 | CC6.1, CC6.6, CC7.1 | Logical access controls, network security, system monitoring |
| ISO 27001 | A.9.1.1, A.10.1.1, A.12.4.1, A.13.1.1 | Access control, encryption, logging, network security |
| HIPAA | 164.312(a)(2)(iv) | Encryption of ePHI at rest |
Troubleshooting
OAuth authorization fails
OAuth authorization fails
Some Droplets are missing
Some Droplets are missing
LowerPlane syncs all Droplets accessible to the authenticated account. If you are part of multiple teams, only the team you authorized during OAuth will be synced. Connect each team separately.
Firewall status shows unprotected
Firewall status shows unprotected
A Droplet is marked as unprotected if it has no Cloud Firewall assigned. Note that DigitalOcean Cloud Firewalls are separate from OS-level firewalls (iptables/ufw) — LowerPlane checks Cloud Firewalls only.