Description

This rule checks that the trusted-source rules attached to a Managed Database cluster (called firewall rules in the API and doctl) limit inbound connections to specific, known application or administrative hosts rather than broad ranges. On DigitalOcean, trusted sources are the only network access control for a managed cluster, and a cluster may hold up to 100 rules.

The rule enumerates the cluster's trusted-source set and flags entries that grant more access than necessary — for example a wide CIDR block where a single Droplet or host would suffice, or a rule opening the cluster to all addresses — and recommends binding rules to specific Droplets, Kubernetes clusters, apps, tags, or single IPs.

  • Trusted-source rules using broad CIDR ranges (for example /16 or /8) where a single host is sufficient

  • A 0.0.0.0/0 or ::/0 rule that permits the entire internet

  • Stale rules referencing decommissioned Droplets, tags, or IP addresses

Rationale

Overly permissive firewall rules widen the set of hosts that can even attempt authentication against the database. Even inside a private network, a broad rule allows lateral movement — a single compromised host in a permitted subnet can reach the database directly.

Scoping each rule to a specific resource or host follows least privilege: only the systems that must talk to the database can, and removing a decommissioned host immediately revokes its access.

Impact

Pros:

  • Minimizes the number of hosts that can reach the database

  • Limits lateral movement from a compromised neighbor inside the same network

  • Resource-based rules (Droplet/tag) auto-track the resource instead of a brittle IP

Cons:

  • More granular rules mean more entries to maintain as infrastructure changes

  • Tightening a rule incorrectly can break a legitimate connection until corrected

  • The 100-rule limit requires consolidating with tags for large fleets

Default Value

New clusters have no trusted sources and accept connections from any source that can reach them; a cluster supports up to 100 firewall rules.

Pre-Requisite

  • DigitalOcean Control Panel access with a role that can edit Trusted Sources

  • An accurate inventory of which resources and IPs must connect, and which are obsolete

  • Preference for Droplet / Kubernetes / tag rules over raw IP ranges where possible

  • Optional: a DigitalOcean API token or doctl authenticated (doctl auth init)

Remediation

Test Plan

Using the DigitalOcean Control Panel:

  1. In the Control Panel, open Databases and click the cluster name.

  2. On the Settings tab, review every entry in the Trusted Sources section.

  3. Identify any rule broader than necessary (a large CIDR, or 0.0.0.0/0) and any entry pointing at a resource that no longer exists.

  4. Pass: Every trusted source is scoped to a specific resource or single host and there are no broad or stale entries.

  5. Fail: One or more rules use an over-broad range, open the cluster to all addresses, or reference decommissioned resources.

Using doctl or the API:

List the firewall (trusted-source) rules for review.

doctl databases firewalls list <database-cluster-id>
curl -s -X GET "https://api.digitalocean.com/v2/databases/<database-cluster-uuid>/firewall" -H "Authorization: Bearer $DIGITALOCEAN_TOKEN"

Pass if every rule targets a specific resource (droplet, k8s, app, tag) or a single-host IP and no rule is an over-broad CIDR or 0.0.0.0/0. Fail if any rule grants access wider than operationally necessary.

Implementation Steps

Using the DigitalOcean Control Panel:

  1. On the cluster's Settings tab, open Trusted Sources.

  2. Replace broad CIDR entries with specific Droplets, Kubernetes clusters, apps, tags, or single-host IPs.

  3. Delete any rule referencing a resource that is no longer in use.

  4. Save and confirm legitimate applications still connect.

Using doctl or the API:

Tighten rules with doctl append/replace or the firewall endpoint.

doctl databases firewalls append <database-cluster-id> --rule tag:app-servers
doctl databases firewalls replace <database-cluster-id> --rules droplet:<droplet-id>,ip_addr:<admin-ip>
curl -s -X PUT "https://api.digitalocean.com/v2/databases/<database-cluster-uuid>/firewall" -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" -H "Content-Type: application/json" -d '{"rules":[{"type":"tag","value":"app-servers"},{"type":"ip_addr","value":"<admin-ip>"}]}'

Backout Plan:

  1. Re-run doctl databases firewalls replace (or PUT /firewall) with the previously captured rule set to restore prior access.

  2. If a connection breaks, re-add the specific source as a trusted source and verify before narrowing again.

References:

  1. doctl databases firewalls

  2. doctl databases firewalls append

  3. How to Secure PostgreSQL Managed Database Clusters