Description
This rule verifies that every Droplet classified as critical has DigitalOcean's automated Backups feature enabled with a recurring schedule, rather than relying on manual, ad hoc snapshots that are easily forgotten.
DigitalOcean Backups are system-level images taken automatically on a schedule you configure (a plan and interval). The rule cross-references the critical-Droplet inventory against Droplets whose feature set includes backups, flagging any critical Droplet without automated backups.
Remediation is to enable backups with an interval appropriate to each Droplet's recovery objectives and to alert whenever a scheduled backup does not complete.
Critical Droplets whose feature list does not include "backups".
Droplets relying only on occasional manual snapshots instead of a recurring schedule.
Rationale
Automated scheduling removes the human dependency that is the most common cause of backup gaps — a manual routine fails silently the first time someone forgets, and the gap is only discovered when a restore is actually needed. System-level backups capture the whole Droplet, giving a reliable restore or rebuild point after corruption, compromise, or accidental deletion.
A defined interval bounds the recovery point objective and makes recovery expectations auditable.
Impact
Pros:
Removes reliance on people remembering to back up.
Whole-Droplet, system-level recovery point for fast rebuild or restore.
Configurable interval bounds worst-case data loss.
Cons:
Backups add to the Droplet's cost (billed per DigitalOcean's backups pricing).
Restoring from a backup reboots or replaces the running Droplet.
Backup images count toward account image limits and the configured retention window.
Default Value
New Droplets have automated Backups disabled by default; backups are an opt-in, paid add-on you enable per Droplet.
Pre-Requisite
Account role that can enable backups and initiate Droplet actions.
doctl authenticated or an API token.
A defined inventory of which Droplets are critical and their required backup interval.
Remediation
Test Plan
Using the DigitalOcean Control Panel:
Sign in at cloud.digitalocean.com and open the Droplet from the Droplets list.
In the Droplet's left menu, click Backups.
Confirm Backups are enabled and a backup schedule/plan is shown (rather than a prompt to enable them).
Repeat for each critical Droplet.
Pass: every critical Droplet shows Backups enabled with a schedule.
Fail: a critical Droplet shows Backups disabled or not enabled.
Using doctl or the API:
A Droplet with backups enabled lists "backups" in its features array; you can also list its stored backups.
doctl compute droplet get <droplet-id> --format ID,Name,Features
curl -s -X GET -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" "https://api.digitalocean.com/v2/droplets/<droplet-id>/backups"
Pass: the Droplet's features array contains "backups" (and backups are listed). Fail: "backups" is absent from features and the backups list is empty.
Implementation Steps
Using the DigitalOcean Control Panel:
Open the Droplet at cloud.digitalocean.com and click Backups in its menu.
Click Enable Backups.
Choose the backup plan/interval (for example weekly or daily, from the available intervals) to match the Droplet's RPO.
Save, and set up alerting so a failed or missed backup is surfaced.
Using doctl or the API:
Enable backups via a Droplet action; optionally include a backup_policy to set the plan, weekday, and hour.
doctl compute droplet-action enable-backups <droplet-id> --backup-policy-plan weekly --backup-policy-weekday SUN --backup-policy-hour 4
curl -s -X POST -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" -H "Content-Type: application/json" -d '{"type":"enable_backups","backup_policy":{"plan":"weekly","weekday":"SUN","hour":4}}' "https://api.digitalocean.com/v2/droplets/<droplet-id>/actions"
Backout Plan:
To disable, open the Droplet's Backups menu and choose Disable Backups, or run doctl compute droplet-action disable-backups <droplet-id> (API: POST /v2/droplets/<droplet-id>/actions with {"type":"disable_backups"}).
Note: disabling backups deletes the Droplet's existing automatic backups.