Description

This rule checks that each DigitalOcean Network File Storage (NFS) share has at least one recent snapshot, giving the file data a point-in-time recovery point. NFS snapshots are point-in-time, file-level images of the share.

DigitalOcean NFS snapshots are created on demand — there is no built-in recurring snapshot scheduler for shares — so a snapshot "policy" is an operator-run routine that calls the snapshot action on a cadence. The rule inspects each share for the presence and recency of snapshots against the expected schedule.

Remediation is to establish a recurring snapshot routine for every share holding production data and to verify snapshot success on an ongoing basis rather than relying on a single historical snapshot.

  • NFS shares with no snapshot at all.

  • Shares whose newest snapshot is older than the intended interval.

Rationale

NFS shares are frequently shared storage for several applications or teams, which multiplies the chance of an accidental deletion or corruption affecting many consumers at once. Without a snapshot, there is no recovery path for that shared data short of an external backup that may not exist. A recent snapshot lets you restore the share's files quickly.

A regular cadence bounds how much file data can be lost and keeps recovery points fresh, whereas a single old snapshot silently ages out of usefulness.

Impact

Pros:

  • Provides a file-level recovery point for shared data.

  • Bounds worst-case data loss for the share to the snapshot interval.

  • Enables quick restoration after accidental deletion or corruption.

Cons:

  • Snapshots consume storage that is billed and grows with retention.

  • DigitalOcean provides no native scheduler for NFS snapshots, so the cadence must be automated by the operator.

  • Snapshot names are limited to twenty characters or less, which constrains naming schemes.

Default Value

DigitalOcean creates no snapshots of a Network File Storage share automatically; snapshots are on-demand only, so a new share has no snapshot until you create one.

Pre-Requisite

  • Account role that can create and list NFS snapshots.

  • doctl authenticated or an API token, plus a scheduler (cron, DigitalOcean Functions, or CI) to run snapshots on a cadence.

  • Defined RPO and retention requirements for each share.

Remediation

Test Plan

Using the DigitalOcean Control Panel:

  1. Sign in at cloud.digitalocean.com and open Network File Storage.

  2. Open the share and review its snapshots (or open the NFS Snapshots view).

  3. Confirm at least one snapshot exists and that the newest is within the intended interval.

  4. Pass: the share has a recent snapshot within the intended interval.

  5. Fail: the share has no snapshot, or its newest snapshot is older than the intended interval.

Using doctl or the API:

List NFS snapshots and check the newest for each share against your intended cadence.

curl -s -X GET -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" "https://api.digitalocean.com/v2/nfs/snapshots"

Pass: at least one snapshot is returned for the share and its newest created_at is within the intended interval. Fail: no snapshot exists for the share, or the newest is older than the intended interval.

Implementation Steps

Using the DigitalOcean Control Panel:

  1. Open Network File Storage at cloud.digitalocean.com and select the share.

  2. Click the share's … menu and choose Take a Snapshot; name it (twenty characters or less) and confirm — this establishes an immediate baseline.

  3. Because the Control Panel cannot schedule snapshots, automate the snapshot action (below) on your chosen cadence and prune old snapshots per retention.

  4. Verify snapshot success on an ongoing basis (alert on failures).

Using doctl or the API:

Create snapshots on demand via the NFS snapshot action, and drive them on a schedule from your own automation — DigitalOcean has no native NFS snapshot scheduler.

doctl nfs snapshot create --name <name> --region <region-slug> --share-id <share-id>
curl -s -X POST -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" -H "Content-Type: application/json" -d '{"type":"snapshot","region":"<region-slug>","params":{"name":"<snapshot-name>"}}' "https://api.digitalocean.com/v2/nfs/<nfs-id>/actions"

Backout Plan:

  1. To stop the routine, disable the scheduled automation you created.

  2. Delete unwanted snapshots (NFS Snapshots view in the Control Panel, or DELETE /v2/nfs/snapshots/<nfs-snapshot-id>).

  3. Note: deleting a snapshot removes that recovery point.

References:

  1. Network File Storage overview

  2. How to Create a Network File Storage Snapshot

  3. Network File Storage features (snapshots)

  4. Network File Storage API reference