Description

This rule identifies VPC networks that hold no member resources, indicating they are leftovers from a decommissioned project or environment. It inspects each VPC for attached Droplets, databases, load balancers, and Kubernetes clusters and flags those with none.

On DigitalOcean a VPC cannot be deleted while it still has members, and the region's default VPC cannot be deleted at all. So this rule targets exactly the removable case: custom, non-default VPCs that are now empty and serving no purpose.

  • Custom (non-default) VPCs with zero member resources.

  • VPCs left behind after a project or environment was torn down.

Rationale

Empty VPCs are clutter. During a security review or network audit they add noise that must be reasoned about and dismissed, and a stray empty network can mask which VPCs are genuinely carrying workloads. Removing them keeps the network inventory a faithful map of what is actually running.

Because DigitalOcean already blocks deleting a VPC that has members, cleaning up the empties is low-risk and keeps peering and firewall reviews focused on live networks.

Impact

Pros:

  • Keeps the VPC inventory aligned with active infrastructure.

  • Reduces noise in network audits and peering reviews.

  • Removes decommissioning leftovers.

Cons:

  • A deleted VPC's UUID and private IP range are gone; automation or firewall rules referencing that VPC must be updated.

  • Requires owner confirmation that an empty VPC is not reserved for imminent use.

Default Value

DigitalOcean does not remove empty VPCs automatically; a VPC persists until you delete it, and a VPC cannot be deleted while it has members (the per-region default VPC cannot be deleted at all).

Pre-Requisite

  • A DigitalOcean member with write access to delete VPCs.

  • Confirmation from the owning team that an empty VPC is genuinely retired.

  • doctl or an API token with VPC read/write scope.

Remediation

Test Plan

Using the DigitalOcean Control Panel:

  1. In the Control Panel, go to Networking, then VPC.

  2. Open each VPC and review its Resources/members list.

  3. Note any non-default VPC with no member resources.

  4. Pass: every custom VPC has member resources (or is intentionally retained).

  5. Fail: one or more custom VPCs are empty and no longer needed.

Using doctl or the API:

List VPCs and check each for members.

doctl vpcs list
curl -s -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" "https://api.digitalocean.com/v2/vpcs/<vpc_id>/members"

Pass: the members endpoint (GET /v2/vpcs/<vpc_id>/members) returns resources for each non-default VPC. Fail: a non-default VPC returns an empty member list and is no longer needed.

Implementation Steps

Using the DigitalOcean Control Panel:

  1. Confirm with the owning team that the empty VPC is retired, and update any automation or firewall rules that reference it.

  2. In Networking, then VPC, open the empty VPC.

  3. Use its settings/More menu to Delete the VPC network and confirm.

Using doctl or the API:

Delete an empty VPC via doctl or the API (deletion fails while members remain).

doctl vpcs delete <vpc-id>
curl -X DELETE -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" "https://api.digitalocean.com/v2/vpcs/<vpc_id>"

Backout Plan:

  1. VPC deletion is irreversible; the UUID and IP range cannot be recovered.

  2. To restore, create a new VPC (doctl vpcs create --name <name> --region <slug>), accepting a new UUID and range, and re-point automation and new resources to it.

References:

  1. VPC

  2. VPC How-Tos

  3. doctl vpcs