Description
This rule verifies that every DigitalOcean Block Storage Volume in the account is currently attached to a Droplet. It compares the full inventory of provisioned volumes against their attachment state (the Droplet IDs associated with each volume) and flags any volume attached to no Droplet.
Unattached volumes continue to bill at their full provisioned size whether or not a Droplet is using them, so orphaned volumes are a recurring source of silent cost. They are also an overlooked data-governance risk: a volume detached from a decommissioned Droplet may still hold sensitive residual data that is no longer tracked, patched, or access-reviewed.
Remediation is to review each unattached volume with its original owner, snapshot then delete the confirmed-unneeded volumes, and make volume cleanup a standard step in every Droplet decommissioning runbook.
Block Storage Volumes attached to no Droplet (empty droplet_ids).
Volumes left behind after a Droplet was destroyed without removing its storage.
Rationale
Every unattached volume is money spent for no compute benefit and an asset nobody is actively securing. Orphaned volumes drift out of inventory reviews, so any secrets, PII, or regulated data they contain sits unmonitored and unaccounted-for — exactly the kind of forgotten data store that surfaces during a breach investigation or audit.
Keeping the volume inventory tight also keeps the account within per-account volume limits and makes cost and capacity reporting trustworthy.
Impact
Pros:
Eliminates recurring charges for storage that serves no running workload.
Removes forgotten data stores that would otherwise sit outside patching and access review.
Keeps volume inventory accurate for cost, capacity, and audit reporting.
Cons:
Deleting a volume is irreversible; a mistaken deletion of a still-needed volume causes data loss unless a snapshot was taken first.
Confirming ownership of each unattached volume takes operator time.
A snapshot taken before deletion incurs its own (smaller) storage charge.
Default Value
DigitalOcean bills Block Storage Volumes by provisioned size for as long as they exist, whether or not they are attached to a Droplet; destroying a Droplet does not automatically delete its volumes.
Pre-Requisite
A DigitalOcean account with a Member or Owner role that can view and delete volumes.
doctl authenticated, or a DigitalOcean API token, to inventory volumes at scale.
Knowledge of which workload or owner each volume belongs to, so unneeded volumes can be confirmed before deletion.
Remediation
Test Plan
Using the DigitalOcean Control Panel:
Sign in to the DigitalOcean Control Panel at cloud.digitalocean.com.
In the left menu, open Manage, then click Volumes.
Review the volume list; each volume shows the Droplet it is attached to, or appears unattached (blank) if it is not attached to any Droplet.
Note every volume with no attached Droplet.
Pass: every Block Storage Volume is attached to a Droplet (or is a documented, intentionally-retained volume).
Fail: one or more volumes are unattached with no documented business reason.
Using doctl or the API:
List all volumes and inspect the droplet_ids field on each; an empty array means the volume is unattached.
doctl compute volume list --format ID,Name,Size,Region,DropletIDs
curl -s -X GET -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" "https://api.digitalocean.com/v2/volumes"
Pass: every volume returned lists at least one Droplet in droplet_ids (doctl shows a Droplet ID). Fail: any volume has an empty droplet_ids array (blank DropletIDs).
Implementation Steps
Using the DigitalOcean Control Panel:
In the Control Panel, open Manage, then Volumes.
For each unattached volume, confirm with its owner that it is no longer needed.
Recommended: open the volume's More menu and choose Take Snapshot to preserve a recovery point before deletion.
Open the volume's More menu, choose Delete, and confirm.
Add "detach and delete unused volumes" to your Droplet decommissioning checklist.
Using doctl or the API:
Snapshot first (recommended), then delete the confirmed-unneeded volume.
doctl compute volume snapshot <volume-id> --snapshot-name pre-delete-<volume-id>
doctl compute volume delete <volume-id>
curl -s -X DELETE -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" "https://api.digitalocean.com/v2/volumes/<volume-id>"
Backout Plan:
If the volume was snapshotted before deletion, create a new volume from that snapshot (Control Panel: Create > Volumes > from Snapshot, or doctl compute volume create --snapshot <snapshot-id>).
Attach the recreated volume to the appropriate Droplet.
Re-mount the filesystem on the Droplet.
Note: a deleted volume with no snapshot cannot be recovered.