Terraform for DigitalOcean

Use this integration to collect evidence from your DigitalOcean cloud infrastructure

Written By Micah

Use Terraform for DigitalOcean to collect evidence of your cloud infrastructure settings and configurations directly from DigitalOcean. Terraform integrations are a flexible, low-code solution that allow you to customize what evidence is collected from your cloud systems. Read more about our Terraform integrations.

Types of evidence you might collect with Terraform for DigitalOcean

There are many types of evidence you can collect from DigitalOcean. The flexibility of this integration is limited only by what is available from Terraform in terms of data sources supported by the DigitalOcean Terraform provider.

Important note: You do not need to use Terraform in your tech stack in order to use Terraform for DigitalOcean to collect evidence.

Here is a short, non-exhaustive list of some of the possible evidence you may collect from this integration:

  • Droplet configurations and metadata

  • Firewall rules and network settings

  • Kubernetes cluster configurations

  • Database cluster settings

  • VPC and networking configurations

  • Domain and DNS records

  • SSH key inventories

  • Project and team membership

Follow the instructions on this page to get started collecting evidence from DigitalOcean using Terraform.

Configuring Terraform for DigitalOcean

To configure the Terraform integration with DigitalOcean, you (or someone in your organization) will need access to generate personal access tokens in your DigitalOcean account.

Personal access tokens

This integration only requires read access, and it is recommended to scope the access token for least privilege. Tokens do not need an expiration date, however if you do set an expiration date and your token expires, you can reconnect the integration with a new token at a future date.

Navigate to the Integrations Manager in Strike Graph and open the Terraform for DigitalOcean integration.

Note: if you do not see this integration listed, it may not be available for your organization or role yet. Reach out to support or your Customer Success Manager to request access.

  1. Click Add DigitalOcean Access Token to begin configuring a new integration.

  2. Enter a Token Name (a descriptive label to identify this integration) and your DigitalOcean Access Token into the provided fields.

  3. Click Save.

The token name is used in the list of available integrations during evidence upload, and does not need to match the name used to generate the token itself. Use a meaningful name to help distinguish between multiple connections if needed.

You can create as many DigitalOcean connections as you need to manage scope across different tokens or projects. Everyone with access to your GRC organization will be able to use any configured DigitalOcean connections during evidence collection.

Using Terraform for DigitalOcean to collect evidence

Once you have configured a Terraform for DigitalOcean integration, you can begin using it to collect evidence of your DigitalOcean resources.

Start by navigating in Strike Graph to the item that you want to collect evidence for. You can choose to attach evidence directly for one-time evidence collection, or configure automated collection (recommended).

Click on either option, and then select the desired Terraform for DigitalOcean integration from the list of available integrations. If you have configured multiple connections, make sure you select the one with the right permissions for the evidence you plan to collect.

Define the data to collect

Terraform integrations allow you to use a few lines of code to define what data you would like to collect as evidence. These are called "data blocks" and more information about data blocks and local values can be found on the Terraform overview page.

Step 1: Define the data block. Data blocks are extensible, but follow a typical pattern:

  • data_source: Defines which DigitalOcean resource to read from. Terraform for DigitalOcean supports data collection from any resource with a supported data source from the Terraform DigitalOcean provider (see below for a list).

  • temp_name: A temporary name you define, used to refer to this data block during execution. The temp name is used in the output filename, so it is recommended to use something recognizable. Names are limited to alphanumeric characters and do not allow spaces.

  • query constraints / arguments: Many data sources require specific arguments to be included (like the name or ID of the resource you are pulling data from). Refer to the specific data source requirements in the Terraform DigitalOcean provider documentation.

Step 2: Define the local values used for the execution. This follows the pattern: data.data_source.temp_name (sometimes followed by a key if a filter argument is needed).

Run the data collection

After you have defined the data block and local values, click the Attach button to execute the data collection. This may take a few minutes as the data pipeline is set up to collect the attachment.

Once the collection is finished, you can see the collected data by clicking on the attachment to view the results.

Using Terraform for DigitalOcean with Automated Collection

It is highly recommended that you configure your evidence collection with automated collection. With Automated Collection, Strike Graph can recollect evidence attachments from DigitalOcean a few days before expiration so that your evidence remains in an effective audit-ready state.

To configure automated collection, follow the steps above after clicking on the "Automated Collection" button found on the evidence item detail pages.

Removing your Terraform for DigitalOcean integration

You can remove the integration at any time. Removing an integration does not delete any files that were attached using that integration. Removing an integration will also disrupt automated collection.

To remove:

  1. Go to the Integrations Manager and click on the Terraform for DigitalOcean card to access the integration configurations.

  2. Click the Deactivate button next to your configuration.

If you are fully removing access between Strike Graph and your DigitalOcean account, you may also wish to revoke the access token in DigitalOcean. Before revoking, verify that you are not using it for other purposes.

Troubleshooting

For additional Terraform troubleshooting tips, see the Terraform integrations overview.

Authentication errors

If you receive an authentication error, verify that your DigitalOcean access token is still valid and has the necessary read permissions. You can refresh your token by clicking the Reconnect button next to your integration in the Integrations Manager.

General formatting errors

If the error message is generic (like "Something went wrong"), check that your temp_name is formatted correctly (no spaces, only alphanumeric characters) and that there are no unexpected characters in the data block or local values.

Confirm the data_source requirements

Check that the resource you defined in the data_source is available from the DigitalOcean Terraform provider, and ensure that you have included any required query constraints or arguments.

Supported DigitalOcean data sources

The following list is a snapshot of commonly used data sources from the DigitalOcean Terraform provider. For up-to-date support and specific data source requirements, visit the Terraform documentation.

  • digitalocean_account

  • digitalocean_app

  • digitalocean_certificate

  • digitalocean_database_cluster

  • digitalocean_database_replica

  • digitalocean_domain

  • digitalocean_domains

  • digitalocean_droplet

  • digitalocean_droplets

  • digitalocean_firewall

  • digitalocean_floating_ip

  • digitalocean_image

  • digitalocean_images

  • digitalocean_kubernetes_cluster

  • digitalocean_kubernetes_versions

  • digitalocean_loadbalancer

  • digitalocean_project

  • digitalocean_projects

  • digitalocean_record

  • digitalocean_records

  • digitalocean_region

  • digitalocean_regions

  • digitalocean_reserved_ip

  • digitalocean_sizes

  • digitalocean_spaces_bucket

  • digitalocean_spaces_buckets

  • digitalocean_ssh_key

  • digitalocean_ssh_keys

  • digitalocean_tag

  • digitalocean_tags

  • digitalocean_volume

  • digitalocean_volume_snapshot

  • digitalocean_vpc

  • digitalocean_vpc_peering