# Ensure Unused Or Unattached Volumes Are Identified And Removed - Source: https://support.icompaas.com/support/solutions/articles/ensure-unused-or-unattached-volumes-are-identified-and-removed - Section: [Solutions](https://support.icompaas.com/support/solutions) › [DigitalOcean Cloud](https://support.icompaas.com/support/solutions/c_do_cloud) › [DigitalOcean Rules](https://support.icompaas.com/support/solutions/folders/digitalocean-rules) - Last updated: 2026-08-13 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ## Description This rule verifies that every DigitalOcean Block Storage Volume in the account is currently attached to a Droplet. It compares the full inventory of provisioned volumes against their attachment state (the Droplet IDs associated with each volume) and flags any volume attached to no Droplet. Unattached volumes continue to bill at their full provisioned size whether or not a Droplet is using them, so orphaned volumes are a recurring source of silent cost. They are also an overlooked data-governance risk: a volume detached from a decommissioned Droplet may still hold sensitive residual data that is no longer tracked, patched, or access-reviewed. Remediation is to review each unattached volume with its original owner, snapshot then delete the confirmed-unneeded volumes, and make volume cleanup a standard step in every Droplet decommissioning runbook. - Block Storage Volumes attached to no Droplet (empty droplet\_ids). - Volumes left behind after a Droplet was destroyed without removing its storage. ## Rationale Every unattached volume is money spent for no compute benefit and an asset nobody is actively securing. Orphaned volumes drift out of inventory reviews, so any secrets, PII, or regulated data they contain sits unmonitored and unaccounted-for — exactly the kind of forgotten data store that surfaces during a breach investigation or audit. Keeping the volume inventory tight also keeps the account within per-account volume limits and makes cost and capacity reporting trustworthy. ## Impact Pros: - Eliminates recurring charges for storage that serves no running workload. - Removes forgotten data stores that would otherwise sit outside patching and access review. - Keeps volume inventory accurate for cost, capacity, and audit reporting. Cons: - Deleting a volume is irreversible; a mistaken deletion of a still-needed volume causes data loss unless a snapshot was taken first. - Confirming ownership of each unattached volume takes operator time. - A snapshot taken before deletion incurs its own (smaller) storage charge. ## Default Value DigitalOcean bills Block Storage Volumes by provisioned size for as long as they exist, whether or not they are attached to a Droplet; destroying a Droplet does not automatically delete its volumes. ## Pre-Requisite - A DigitalOcean account with a Member or Owner role that can view and delete volumes. - doctl authenticated, or a DigitalOcean API token, to inventory volumes at scale. - Knowledge of which workload or owner each volume belongs to, so unneeded volumes can be confirmed before deletion. ## Remediation ### Test Plan Using the DigitalOcean Control Panel: 1. Sign in to the DigitalOcean Control Panel at cloud.digitalocean.com. 2. In the left menu, open Manage, then click Volumes. 3. Review the volume list; each volume shows the Droplet it is attached to, or appears unattached (blank) if it is not attached to any Droplet. 4. Note every volume with no attached Droplet. 5. Pass: every Block Storage Volume is attached to a Droplet (or is a documented, intentionally-retained volume). 6. Fail: one or more volumes are unattached with no documented business reason. Using doctl or the API: List all volumes and inspect the droplet\_ids field on each; an empty array means the volume is unattached. doctl compute volume list --format ID,Name,Size,Region,DropletIDs curl -s -X GET -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" "https://api.digitalocean.com/v2/volumes" Pass: every volume returned lists at least one Droplet in droplet\_ids (doctl shows a Droplet ID). Fail: any volume has an empty droplet\_ids array (blank DropletIDs). ### Implementation Steps Using the DigitalOcean Control Panel: 1. In the Control Panel, open Manage, then Volumes. 2. For each unattached volume, confirm with its owner that it is no longer needed. 3. Recommended: open the volume's More menu and choose Take Snapshot to preserve a recovery point before deletion. 4. Open the volume's More menu, choose Delete, and confirm. 5. Add "detach and delete unused volumes" to your Droplet decommissioning checklist. Using doctl or the API: Snapshot first (recommended), then delete the confirmed-unneeded volume. doctl compute volume snapshot --snapshot-name pre-delete- doctl compute volume delete curl -s -X DELETE -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" "https://api.digitalocean.com/v2/volumes/" ### Backout Plan: 1. If the volume was snapshotted before deletion, create a new volume from that snapshot (Control Panel: Create > Volumes > from Snapshot, or doctl compute volume create --snapshot ). 2. Attach the recreated volume to the appropriate Droplet. 3. Re-mount the filesystem on the Droplet. 4. Note: a deleted volume with no snapshot cannot be recovered. ## References: 1. [Block Storage Volumes overview](https://docs.digitalocean.com/products/volumes/) 2. [How to Create Snapshots of Volumes](https://docs.digitalocean.com/products/snapshots/how-to/snapshot-volumes/) 3. [doctl compute volume reference](https://docs.digitalocean.com/reference/doctl/reference/compute/volume/) 4. [Volumes API and CLI reference](https://docs.digitalocean.com/products/volumes/reference/) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.