# Ensure There Are No Unused Cloud Firewalls

- Source: https://support.icompaas.com/support/solutions/articles/ensure-there-are-no-unused-cloud-firewalls
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [DigitalOcean Cloud](https://support.icompaas.com/support/solutions/c_do_cloud) › [DigitalOcean Rules](https://support.icompaas.com/support/solutions/folders/digitalocean-rules)
- Last updated: 2026-08-13
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## Description

This rule identifies DigitalOcean Cloud Firewalls that are not attached to any Droplet or other applicable resource. Because Cloud Firewalls are DigitalOcean's security-group equivalent, an unattached firewall enforces nothing: its rules apply only to the Droplets (or tags) listed in its droplet\_ids and resource assignments.

The rule inspects each firewall's droplet\_ids (and tag assignments) and flags firewalls with no attached resources. On DigitalOcean, a firewall can be created and left unapplied, and a firewall applied only by a tag becomes effectively unused when no resource carries that tag.

Remediation confirms with the resource owner that a flagged firewall is genuinely no longer needed, deletes it, and folds firewall cleanup into the resource decommissioning process so orphaned policies do not accumulate.

-   Firewalls with an empty droplet\_ids array and no tag-based resource assignments
    
-   Firewalls applied only via a tag that no current resource carries
    
-   Leftover firewalls from decommissioned Droplets
    

## Rationale

Unattached firewalls are configuration clutter. They make security review harder by obscuring which policies are actually enforcing protection, and they raise the risk of mistakes: an operator may believe a rule set is protecting a workload when it is attached to nothing, or may re-attach a stale, overly permissive policy by accident. An orphaned firewall can also be a signal that a resource was removed without cleaning up its security configuration.

Removing firewalls that are confirmed unused keeps the security inventory accurate and auditable, so that every firewall that exists corresponds to a real, protected workload.

-   Orphaned policies obscure which firewalls actually enforce protection
    
-   Stale firewalls risk being re-applied with outdated, permissive rules
    
-   An unused firewall can indicate incomplete decommissioning
    

## Impact

Pros:

-   Keeps the firewall inventory accurate and auditable
    
-   Reduces the chance of re-applying a stale, permissive policy
    
-   Surfaces incomplete resource decommissioning
    

Cons:

-   A firewall kept intentionally as a template for future Droplets would be flagged
    
-   Deleting a firewall still needed for a planned attachment could delay a deployment
    
-   Requires owner confirmation before deletion, adding a review step
    

## Default Value

A DigitalOcean firewall can be created without applying it to any Droplet (the Apply to Droplets field may be left blank), so unattached firewalls persist until deleted; they are not removed automatically.

## Pre-Requisite

-   Control Panel access with permission to view and delete firewalls
    
-   A DigitalOcean API token or doctl authenticated for API/CLI checks
    
-   Confirmation from the resource owner that a flagged firewall is no longer required
    

## Remediation

### Test Plan

Using the DigitalOcean Control Panel:

1.  Sign in to cloud.digitalocean.com and go to Networking, then Firewalls.
    
2.  Review the firewall list and its Droplets column (or open each firewall's Droplets tab) to see how many resources each is applied to.
    
3.  Note any firewall showing zero applied Droplets, and check whether it is instead applied by a tag; if so, confirm at least one current resource carries that tag.
    
4.  Pass: Every firewall is attached to at least one Droplet or to a tag carried by at least one current resource.
    
5.  Fail: One or more firewalls are attached to no Droplets and to no tag that any current resource carries.
    

Using doctl or the API:

List firewalls and flag those with no attached Droplets or resource tags.

doctl compute firewall list --format ID,Name,DropletIDs,Tags

curl -s -X GET -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" "https://api.digitalocean.com/v2/firewalls" | jq '.firewalls\[\] | select((.droplet\_ids | length == 0) and (.tags | length == 0)) | {id, name}'

Pass: the query returns no firewalls (every firewall has at least one droplet\_id or an assigned tag). Fail: any firewall is returned with both an empty droplet\_ids array and no tags. For tag-only firewalls, additionally confirm the tag is carried by a live resource.

### Implementation Steps

Using the DigitalOcean Control Panel:

1.  Confirm with the resource owner that the flagged firewall is no longer needed.
    
2.  In Networking, then Firewalls, open the firewall, review its rules and (empty) resource assignments to be sure nothing depends on it.
    
3.  Open the firewall's … (More) menu (or Settings) and choose Destroy / Delete firewall, then confirm.
    
4.  Add a firewall-cleanup step to your Droplet decommissioning checklist so future orphans are removed at teardown.
    

Using doctl or the API:

Delete a confirmed-unused firewall.

doctl compute firewall delete <firewall-id>

curl -s -X DELETE -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" "https://api.digitalocean.com/v2/firewalls/<firewall-id>"

### Backout Plan:

1.  Deletion is not reversible; before deleting, record the firewall's rules (doctl compute firewall get <firewall-id> or GET /v2/firewalls/<firewall-id>) so it can be recreated if needed.
    
2.  To restore, recreate the firewall with doctl compute firewall create (or POST /v2/firewalls) using the saved rules, then re-apply it to the intended Droplets or tag.
    

## References:

1.  [DigitalOcean Cloud Firewalls overview](https://docs.digitalocean.com/products/networking/firewalls/)
    
2.  [How to Create Firewalls](https://docs.digitalocean.com/products/networking/firewalls/how-to/create/)
    
3.  [How to View All Firewall Rules Applied to a Droplet](https://docs.digitalocean.com/products/networking/firewalls/how-to/view-rules-for-droplet/)
    
4.  [Firewalls API reference](https://docs.digitalocean.com/reference/api/reference/firewalls/)
    
5.  [doctl compute firewall reference](https://docs.digitalocean.com/reference/doctl/reference/compute/firewall/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.