Description:

DigitalOcean Managed Databases should restrict incoming connections to only authorized resources or IP addresses. DigitalOcean provides Trusted Sources under the database's Network Access settings to control which Droplets, Kubernetes clusters, App Platform applications, tags, or IP addresses can connect to the database.


Rationale:

Allowing unrestricted access to a database increases the attack surface and can expose the database to unauthorized connection attempts, brute-force attacks, and exploitation of vulnerable database services.


Impact:

Restricting database access may prevent legitimate clients from connecting if their IP address or DigitalOcean resource is not included in the trusted sources.

For example:

  1. Allow only application Droplets or Kubernetes clusters to access the database.

  2. Allow only approved corporate or VPN IP addresses for administrative access.


Default Value:

DigitalOcean Managed Databases can accept connections through their network endpoints. Access should be explicitly restricted using Trusted Sources to limit which resources or IP addresses can connect.


Pre-Requisite:

  1. Log in to DigitalOcean with permission to manage Managed Databases.

  2. Identify the databases that require restricted access.

  3. Identify the approved Droplets, VPC CIDRs, Kubernetes clusters, or IP addresses that require access.

  4. Record the existing Trusted Sources for backout.


Remediation:

Configure the database's Trusted Sources to allow only authorized resources or IP addresses. Avoid unrestricted sources such as 0.0.0.0/0 and ::/0.

For stronger isolation, use the database's private VPC connection and allow the VPC CIDR as a trusted source. DigitalOcean recommends using VPC networking for database security.


Test Plan:

Via DigitalOcean Control Panel

  1. Log in to the DigitalOcean Control Panel.

  2. Go to Databases.

  3. Select the database cluster.

  4. Open the Network Access tab.

  5. Review the configured Trusted Sources.

  6. Verify that access is restricted to approved resources or IP addresses.

  7. Verify that there is no unrestricted rule such as:

    • 0.0.0.0/0

    • ::/0

The check passes when only approved sources are allowed to connect—digitalOcean documents Trusted Sources as the mechanism for restricting incoming database connections.

CLI

List the database firewall/trusted-source rules:

doctl databases firewalls list <database_cluster_id>

You can also inspect the database:

doctl databases get <database_cluster_id>

Review the firewall/trusted-source configuration and verify that unrestricted CIDRs are not present.

API

curl -s \
  -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
  -H "Content-Type: application/json" \
  "https://api.digitalocean.com/v2/databases/<database_id>/firewall"


Review the returned rules.


Implementation:

Via DigitalOcean Control Panel

  1. Go to Databases.

              

  1. Select the required database.

  1. Open Network Access.

  2. Click Add Trusted Sources (or)

  3. Add the required Droplets, Kubernetes clusters, App Platform applications, tags, or specific IP/CIDR ranges.

  1. Save the configuration.

  2. Test connectivity from an approved source and an unauthorized source.

DigitalOcean supports trusted sources based on resources and IP addresses.

CLI

Add an approved source:

doctl databases firewalls append <database_cluster_id> \
  --rule ip_addr:<approved_ip>

For a CIDR range:

doctl databases firewalls append <database_cluster_id> \
  --rule ip_addr:<approved_cidr>

DigitalOcean also supports resource-based trusted sources through the CLI.

API

Replace the existing firewall configuration with only approved sources:

curl -X PUT \
  -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "rules": [
      {
        "type": "ip_addr",
        "value": "<approved_ip>"
      }
    ]
  }' \
  "https://api.digitalocean.com/v2/databases/<database_id>/firewall"

For a private VPC architecture, use the VPC CIDR as the trusted source and connect applications using the database's private connection. DigitalOcean notes that VPC networks are inaccessible from the public internet.


Backout Plan:

If legitimate applications lose database connectivity:

  1. Go to Databases → Network Access.

  2. Identify the blocked application or source.

  3. Add its approved IP, CIDR, or DigitalOcean resource as a Trusted Source.

  4. Save the configuration.

  5. Verify application connectivity.

CLI example:

doctl databases firewalls append <database_cluster_id> \
  --rule ip_addr:<approved_ip>

Do not restore 0.0.0.0/0 or ::/0 simply to resolve connectivity problems. Add the specific required source instead.

References: