Description

This rule checks that each Droplet has a recent snapshot available for point-in-time recovery. A DigitalOcean snapshot is an on-demand, full copy of a Droplet's disk that can be used to create a new Droplet. Snapshots complement automated backups: they are ideal for capturing a known-good state immediately before a risky change such as a major upgrade.

iCompaas inspects the snapshots associated with each Droplet and flags Droplets that have no snapshot, or none within an expected recency window. DigitalOcean does not natively schedule Droplet snapshots (automated Backups fill that role), so recurring snapshots are typically produced by an external scheduler (for example cron calling doctl or the API).

Remediation is to establish a recurring snapshot process for critical Droplets and, additionally, to take an on-demand snapshot immediately before any significant planned change.

  • Droplets with no snapshot at all.

  • Droplets whose most recent snapshot is older than the expected interval.

  • Critical Droplets changed recently with no pre-change snapshot.

Rationale

A snapshot captures a precise, restorable moment in time that you control, which is exactly what you want before a migration, kernel/OS upgrade, or configuration overhaul. If the change goes wrong, you can rebuild from the snapshot rather than trying to reverse individual steps.

Snapshots provide a recovery path that is independent of and complementary to the automated backup schedule, giving defense-in-depth for data recovery and reducing the blast radius of a failed change.

  • Pre-change snapshots make risky maintenance reversible.

  • Snapshots are a recovery layer distinct from the backup rotation.

Impact

Pros:

  • Provides an operator-controlled, point-in-time restore image.

  • Enables fast rollback of a bad upgrade by rebuilding from the snapshot.

  • Snapshots can seed new Droplets for testing or scaling.

Cons:

  • Snapshots consume storage that is billed per GB for as long as they are retained.

  • DigitalOcean does not schedule Droplet snapshots natively, so recurring snapshots require external automation.

  • Taking a snapshot is recommended with the Droplet powered off for consistency, which can mean brief downtime.

Default Value

New Droplets have no snapshots by default; snapshots are created manually on demand and DigitalOcean does not automatically schedule Droplet snapshots (use Backups for scheduled recovery points).

Pre-Requisite

  • A DigitalOcean Control Panel account with a role that can create Droplet snapshots.

  • A DigitalOcean API token, or doctl authenticated via 'doctl auth init'.

  • For recurring snapshots, an external scheduler (for example cron) that runs doctl or calls the API.

  • An agreed snapshot interval/retention for each critical Droplet.

Remediation

Test Plan

Using the DigitalOcean Control Panel:

  1. Log in to cloud.digitalocean.com and open Droplets.

  2. Select a Droplet and choose Snapshots from the left menu.

  3. Review the list of snapshots and their creation dates (or open Images > Snapshots to view all Droplet snapshots).

  4. Compare the most recent snapshot date against your expected interval.

  5. Pass: The Droplet has a snapshot within the expected recency window.

  6. Fail: The Droplet has no snapshot, or its newest snapshot is older than the expected interval.

Using doctl or the API:

List Droplet snapshots and check their creation dates.

doctl compute droplet snapshots <droplet-id> --format ID,Name,CreatedAt
doctl compute snapshot list --resource droplet --format Name,ID,ResourceId,CreatedAt
curl -s -X GET 'https://api.digitalocean.com/v2/snapshots?resource_type=droplet' -H 'Authorization: Bearer $DIGITALOCEAN_TOKEN' | jq '.snapshots[] | {name, resource_id, created_at}'

Pass: a snapshot exists for the Droplet's id with a created_at inside the expected window. Fail: no snapshot is returned for the Droplet, or the newest created_at is older than the expected interval.

Implementation Steps

Using the DigitalOcean Control Panel:

  1. Open the Droplet in the Control Panel and choose Snapshots from the left menu.

  2. Optionally power off the Droplet first for a fully consistent snapshot.

  3. Enter a snapshot name and click Take Snapshot.

  4. For recurring coverage, schedule an external job (for example cron) that calls doctl/API on your chosen interval, and prune old snapshots per your retention policy.

  5. Always take an on-demand snapshot immediately before any major planned change.

Using doctl or the API:

Take a snapshot with doctl or the Droplet actions API; schedule recurrence with your own cron/automation.

doctl compute droplet-action snapshot <droplet-id> --snapshot-name "pre-upgrade-$(date +%F)"
curl -s -X POST 'https://api.digitalocean.com/v2/droplets/<droplet-id>/actions' -H 'Authorization: Bearer $DIGITALOCEAN_TOKEN' -H 'Content-Type: application/json' -d '{"type":"snapshot","name":"pre-upgrade-2026-08-13"}'

Backout Plan:

  1. Snapshots are additive and do not change the running Droplet, so no rollback of the snapshot action itself is needed.

  2. To reclaim storage, delete unneeded snapshots: 'doctl compute snapshot delete <snapshot-id>', or DELETE /v2/snapshots/<snapshot-id>.

  3. If a recurring snapshot job causes cost or performance concerns, disable the external scheduler.

References:

  1. Snapshots overview

  2. How to Create Snapshots of Droplets

  3. doctl compute snapshot list

  4. doctl compute droplet-action