Description

This rule verifies that every Reserved IP is assigned to a Droplet that appears in your authorized inventory and that the assignment can be traced to an approved change. Because a Reserved IP can be remapped between Droplets in the same datacenter in seconds, it is a control point worth watching: whoever can call the reserved-ip assign action can redirect a well-known public address to a different Droplet.

The rule cross-references each Reserved IP's current Droplet assignment against your documented, change-approved inventory and flags any mapping that points at an undocumented or unapproved Droplet.

  • Reserved IPs assigned to a Droplet not present in the approved inventory.

  • Reserved IP reassignments with no corresponding change-management record.

Rationale

A Reserved IP is often the stable public identity of a service: the address baked into DNS, partner allow-lists, and monitoring. Silently remapping it to an unapproved Droplet can hijack traffic intended for the legitimate service or route production traffic to a host outside your controls. An assignment that cannot be traced to an authorized request is either a process gap or evidence that someone with API access is manipulating networking without oversight.

Requiring every mapping to trace back to an approved change keeps a well-known address from being repurposed without anyone noticing.

Impact

Pros:

  • Prevents a public service address from being silently redirected to unapproved infrastructure.

  • Creates an auditable trail linking each mapping to an approved change.

  • Surfaces misuse of API tokens that can perform reserved-ip actions.

Cons:

  • Requires maintaining an authoritative inventory of Droplets and their intended Reserved IP mappings.

  • Adds change-management overhead to routine failover and remap operations.

Default Value

DigitalOcean applies no authorization workflow to Reserved IP assignment; any credential with write access to networking can assign or reassign a Reserved IP to any Droplet in the same region.

Pre-Requisite

  • A maintained inventory of authorized Droplets and their intended Reserved IP mappings.

  • A change-approval record (ticket or PR) for Reserved IP assignments.

  • Read access to the account's Reserved IPs and Droplets via Control Panel, doctl, or API.

Remediation

Test Plan

Using the DigitalOcean Control Panel:

  1. In the Control Panel, go to Networking, then Reserved IPs.

  2. For each Reserved IP, note the assigned Droplet name and region.

  3. Compare each assignment against your authorized inventory and change records.

  4. Pass: every Reserved IP maps to a documented Droplet with an approved assignment.

  5. Fail: any Reserved IP maps to an undocumented Droplet or an assignment with no approval record.

Using doctl or the API:

List Reserved IPs with their Droplet assignments to reconcile against inventory.

doctl compute reserved-ip list
curl -s -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" "https://api.digitalocean.com/v2/reserved_ips" | jq '.reserved_ips[] | {ip, droplet: .droplet.id, region: .region.slug}'

Pass: every `droplet.id` returned matches an authorized Droplet in your inventory. Fail: any Reserved IP is assigned to a Droplet id absent from the inventory or lacking an approval record.

Implementation Steps

Using the DigitalOcean Control Panel:

  1. For any Reserved IP mapped to an unapproved Droplet, investigate who performed the assignment and whether it was authorized.

  2. In Networking, then Reserved IPs, open the ... menu and choose Reassign to point the address back to the correct authorized Droplet (or Unassign if none is approved).

  3. Record the corrected mapping in your change system and, if misuse is suspected, rotate any API tokens that can perform reserved-ip actions.

Using doctl or the API:

Reassign a Reserved IP to the authorized Droplet, or unassign it, via the reserved-ip actions endpoint.

doctl compute reserved-ip-action assign <reserved-ip> <authorized-droplet-id>
doctl compute reserved-ip-action unassign <reserved-ip>
curl -X POST -H "Content-Type: application/json" -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" -d '{"type":"assign","droplet_id":<authorized-droplet-id>}' "https://api.digitalocean.com/v2/reserved_ips/<reserved_ip>/actions"

Backout Plan:

  1. Reassigning a Reserved IP takes effect immediately; to revert, reassign it to the previously assigned Droplet id in the same region.

  2. Record any reversion in the change system so the mapping history stays complete.

References:

  1. Reserved IPs

  2. How to Reassign or Unassign Reserved IPs

  3. doctl compute reserved-ip