# Ensure Managed Databases Have A Defined Maintenance Window - Source: https://support.icompaas.com/support/solutions/articles/ensure-managed-databases-have-a-defined-maintenance-window - Section: [Solutions](https://support.icompaas.com/support/solutions) › [DigitalOcean Cloud](https://support.icompaas.com/support/solutions/c_do_cloud) › [DigitalOcean Rules](https://support.icompaas.com/support/solutions/folders/digitalocean-rules) - Last updated: 2026-08-13 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ## Description This rule checks that a maintenance window is defined for each Managed Database cluster. The maintenance window is the day and start time during which DigitalOcean applies OS-level and database-engine updates; updates may begin at any point in the 4-hour period after the window's start time, and while updates run without downtime there can be brief periods of latency. DigitalOcean assigns a default maintenance window when a cluster is created, and it can be changed. The rule confirms a window is set and recommends aligning it with the workload's lowest-traffic period so any brief maintenance latency lands outside peak hours. - Clusters whose maintenance window falls during peak business hours - Clusters where the window has not been reviewed against the workload's traffic pattern ## Rationale Maintenance operations can cause brief latency or reconnects. If the window sits during peak business hours, those brief interruptions hit the most users; scheduling it during the quietest period minimizes customer impact. An explicitly chosen and communicated window also lets application owners plan for transient reconnects, rather than being surprised by platform maintenance at an arbitrary time. ## Impact Pros: - Maintenance-related latency lands during the lowest-traffic period - Predictable timing lets application owners plan around brief reconnects - No downtime for updates; only short latency during the window Cons: - Requires knowing the workload's true low-traffic period across time zones - The window is a 4-hour range, not an exact minute, so timing is approximate - Global workloads may have no universally quiet hour ## Default Value DigitalOcean assigns a default maintenance window when a cluster is created; you can change the day and start time, and updates run during the 4-hour period after the start time. ## Pre-Requisite - DigitalOcean Control Panel access with a role that can edit the maintenance window - Knowledge of the workload's lowest-traffic day and hour - A channel to communicate the window to application owners - Optional: a DigitalOcean API token or doctl authenticated (doctl auth init) ## Remediation ### Test Plan Using the DigitalOcean Control Panel: 1. In the Control Panel, open Databases and click the cluster name. 2. Open the Settings tab and review the Maintenance Window section for the configured day and start time. 3. Pass: A maintenance window is set to a low-traffic day and time for the workload. 4. Fail: No window is configured, or the window falls during peak business hours. Using doctl or the API: Read the cluster's maintenance window. doctl databases maintenance-window get curl -s -X GET "https://api.digitalocean.com/v2/databases/" -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" | jq '.database.maintenance\_window' Pass if the maintenance\_window object is present with a day and hour set to a low-traffic period. Fail if it is absent or set to a peak-hours slot. ### Implementation Steps Using the DigitalOcean Control Panel: 1. On the cluster's Settings tab, open the Maintenance Window section. 2. Choose the day of the week and the start time for the 4-hour window, picking the workload's lowest-traffic period. 3. Click Save. 4. Communicate the scheduled window to application owners. Using doctl or the API: Set the maintenance window with doctl or the maintenance endpoint. doctl databases maintenance-window update --day tuesday --hour 16:00 curl -s -X PUT "https://api.digitalocean.com/v2/databases//maintenance" -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" -H "Content-Type: application/json" -d '{"day":"tuesday","hour":"16:00"}' ### Backout Plan: 1. Re-run doctl databases maintenance-window update (or PUT /maintenance) with the previous day and hour to restore the earlier schedule. 2. The window can be changed at any time and takes effect for subsequent maintenance. ## References: 1. [How to Schedule Automatic Software Updates for PostgreSQL Database Clusters](https://docs.digitalocean.com/products/databases/postgresql/how-to/schedule-updates/) 2. [doctl databases maintenance-window update](https://docs.digitalocean.com/reference/doctl/reference/databases/maintenance-window/update/) 3. [doctl databases maintenance-window](https://docs.digitalocean.com/reference/doctl/reference/databases/maintenance-window/) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.