DigitalOcean integration

What Secorvia reads from DigitalOcean, and what it finds

The DigitalOcean services Secorvia lists on its homepage are Droplets, Spaces, Managed Databases and Kubernetes. It reads how those resources are configured and how they relate to each other. It does not read what is inside them, so the files in a Space and the rows in a database stay where they are.

The inventory records each resource's ID, region, tags and raw metadata, and it has resource groups of its own for DigitalOcean next to the ones for the other three providers. Each finding carries its evidence, an explanation of why it matters, remediation guidance and its compliance impact. From the Starter plan the graph that holds your DigitalOcean resources is used to rank attack paths, and those paths can cross providers when you connect more than one. Attack path analysis explains how paths are built and ranked. This page is the short version of the connection. The DigitalOcean security scanning page makes the longer case for why a DigitalOcean team needs it.

What connecting DigitalOcean takes

DigitalOcean uses an API token. Before you start, have a Personal or Team Access Token with read scope. You create it in your own DigitalOcean account, so you decide which team it belongs to and you can revoke it whenever you like.

In Secorvia you open Cloud Accounts, choose Add Cloud Account, name the connection and pick DigitalOcean: API Token. You paste the token. Secorvia works out the account from the token, so there is no account ID to type, and the one thing to check before saving is that the account it finds is the one you meant. If the wrong team appears, use a token that belongs to the intended account and correct the connection. Secret values are encrypted before they are stored and are not shown again after you save.

Spaces is a separate decision. To include it, enter both a Spaces access key ID and a Spaces secret access key. They are a different credential from the API token, and the token alone cannot read Spaces. If you leave both blank, Spaces is skipped and the other supported resource types are unaffected. Do not read the absence of Spaces findings as a clean Spaces assessment when you left the keys out.

Saving the connection starts the first scan automatically. The account's detail page shows its connection status, with links to scan history, inventory and findings for that account. Wait for the scan to finish before you read the results. The DigitalOcean connection guide shows each screen. How many accounts you can connect depends on the plan: one per provider on Free, three on Starter, 25 on Growth and no fixed limit on Enterprise.

What Secorvia does not do on DigitalOcean

Secorvia is read-only. A read-scope token can list and inspect resources, and it cannot create, change or destroy anything, so Secorvia has no way to alter your account. It reports problems and does not fix them, so a remediation is a change you make in DigitalOcean, followed by a new scan to confirm it.

This page does not claim anything beyond the four services above. Check the inventory after your first scan to see what was collected, and read the connection guide before you rely on coverage of anything else. This page also does not list individual checks, because the product's DigitalOcean rule list is not published anywhere this site can quote. A scan is a snapshot of the account at the time it ran, not a live feed.

If you want to check some of this by hand, the blog has four guides written from DigitalOcean's own documentation: Cloud Firewall rules, Spaces public access, the metadata endpoint and API tokens. They are manual guidance, not a description of what any scanner checks.

Frequently asked questions

What token scope does DigitalOcean need?

Read scope. A read-scope token can list and inspect resources and cannot change them. It can be a Personal or a Team Access Token.

Do I have to include Spaces?

No. Spaces needs its own access key ID and secret access key, separate from the API token. If you leave them blank, Spaces is skipped and the other resource types are scanned as normal.

Which DigitalOcean services does Secorvia cover?

The homepage lists Droplets, Spaces, Managed Databases and Kubernetes. The inventory after your first scan shows what was collected for your account.

Why does the wrong team appear after I save?

Secorvia works out the account from the token. Use a token that belongs to the intended account, then correct the connection.

How many DigitalOcean accounts can I connect?

One on Free, three on Starter and 25 on Growth. Enterprise has no fixed limit.