# Ensure Droplets Have Recent Snapshots Configured For Data Recovery

- Source: https://support.icompaas.com/support/solutions/articles/ensure-droplets-have-recent-snapshots-configured-for-data-recovery
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [DigitalOcean Cloud](https://support.icompaas.com/support/solutions/c_do_cloud) › [DigitalOcean Rules](https://support.icompaas.com/support/solutions/folders/digitalocean-rules)
- Last updated: 2026-08-13
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## Description

This rule checks that each Droplet has a recent snapshot available for point-in-time recovery. A DigitalOcean snapshot is an on-demand, full copy of a Droplet's disk that can be used to create a new Droplet. Snapshots complement automated backups: they are ideal for capturing a known-good state immediately before a risky change such as a major upgrade.

iCompaas inspects the snapshots associated with each Droplet and flags Droplets that have no snapshot, or none within an expected recency window. DigitalOcean does not natively schedule Droplet snapshots (automated Backups fill that role), so recurring snapshots are typically produced by an external scheduler (for example cron calling doctl or the API).

Remediation is to establish a recurring snapshot process for critical Droplets and, additionally, to take an on-demand snapshot immediately before any significant planned change.

-   Droplets with no snapshot at all.
    
-   Droplets whose most recent snapshot is older than the expected interval.
    
-   Critical Droplets changed recently with no pre-change snapshot.
    

## Rationale

A snapshot captures a precise, restorable moment in time that you control, which is exactly what you want before a migration, kernel/OS upgrade, or configuration overhaul. If the change goes wrong, you can rebuild from the snapshot rather than trying to reverse individual steps.

Snapshots provide a recovery path that is independent of and complementary to the automated backup schedule, giving defense-in-depth for data recovery and reducing the blast radius of a failed change.

-   Pre-change snapshots make risky maintenance reversible.
    
-   Snapshots are a recovery layer distinct from the backup rotation.
    

## Impact

Pros:

-   Provides an operator-controlled, point-in-time restore image.
    
-   Enables fast rollback of a bad upgrade by rebuilding from the snapshot.
    
-   Snapshots can seed new Droplets for testing or scaling.
    

Cons:

-   Snapshots consume storage that is billed per GB for as long as they are retained.
    
-   DigitalOcean does not schedule Droplet snapshots natively, so recurring snapshots require external automation.
    
-   Taking a snapshot is recommended with the Droplet powered off for consistency, which can mean brief downtime.
    

## Default Value

New Droplets have no snapshots by default; snapshots are created manually on demand and DigitalOcean does not automatically schedule Droplet snapshots (use Backups for scheduled recovery points).

## Pre-Requisite

-   A DigitalOcean Control Panel account with a role that can create Droplet snapshots.
    
-   A DigitalOcean API token, or doctl authenticated via 'doctl auth init'.
    
-   For recurring snapshots, an external scheduler (for example cron) that runs doctl or calls the API.
    
-   An agreed snapshot interval/retention for each critical Droplet.
    

## Remediation

### Test Plan

Using the DigitalOcean Control Panel:

1.  Log in to cloud.digitalocean.com and open Droplets.
    
2.  Select a Droplet and choose Snapshots from the left menu.
    
3.  Review the list of snapshots and their creation dates (or open Images > Snapshots to view all Droplet snapshots).
    
4.  Compare the most recent snapshot date against your expected interval.
    
5.  Pass: The Droplet has a snapshot within the expected recency window.
    
6.  Fail: The Droplet has no snapshot, or its newest snapshot is older than the expected interval.
    

Using doctl or the API:

List Droplet snapshots and check their creation dates.

doctl compute droplet snapshots <droplet-id> --format ID,Name,CreatedAt

doctl compute snapshot list --resource droplet --format Name,ID,ResourceId,CreatedAt

curl -s -X GET 'https://api.digitalocean.com/v2/snapshots?resource\_type=droplet' -H 'Authorization: Bearer $DIGITALOCEAN\_TOKEN' | jq '.snapshots\[\] | {name, resource\_id, created\_at}'

Pass: a snapshot exists for the Droplet's id with a created\_at inside the expected window. Fail: no snapshot is returned for the Droplet, or the newest created\_at is older than the expected interval.

### Implementation Steps

Using the DigitalOcean Control Panel:

1.  Open the Droplet in the Control Panel and choose Snapshots from the left menu.
    
2.  Optionally power off the Droplet first for a fully consistent snapshot.
    
3.  Enter a snapshot name and click Take Snapshot.
    
4.  For recurring coverage, schedule an external job (for example cron) that calls doctl/API on your chosen interval, and prune old snapshots per your retention policy.
    
5.  Always take an on-demand snapshot immediately before any major planned change.
    

Using doctl or the API:

Take a snapshot with doctl or the Droplet actions API; schedule recurrence with your own cron/automation.

doctl compute droplet-action snapshot <droplet-id> --snapshot-name "pre-upgrade-$(date +%F)"

curl -s -X POST 'https://api.digitalocean.com/v2/droplets/<droplet-id>/actions' -H 'Authorization: Bearer $DIGITALOCEAN\_TOKEN' -H 'Content-Type: application/json' -d '{"type":"snapshot","name":"pre-upgrade-2026-08-13"}'

### Backout Plan:

1.  Snapshots are additive and do not change the running Droplet, so no rollback of the snapshot action itself is needed.
    
2.  To reclaim storage, delete unneeded snapshots: 'doctl compute snapshot delete <snapshot-id>', or DELETE /v2/snapshots/<snapshot-id>.
    
3.  If a recurring snapshot job causes cost or performance concerns, disable the external scheduler.
    

## References:

1.  [Snapshots overview](https://docs.digitalocean.com/products/snapshots/)
    
2.  [How to Create Snapshots of Droplets](https://docs.digitalocean.com/products/snapshots/how-to/snapshot-droplets/)
    
3.  [doctl compute snapshot list](https://docs.digitalocean.com/reference/doctl/reference/compute/snapshot/list/)
    
4.  [doctl compute droplet-action](https://docs.digitalocean.com/reference/doctl/reference/compute/droplet-action/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.