DigitalOcean New Droplet Governance Guard

Catch shadow infrastructure minutes after it appears. This blueprint uses the DigitalOcean droplet trigger to fire one execution for every new droplet detected on the account, then applies a simple governance rule: droplet names must start with an approved environment prefix such as web-, db-, worker-, or staging-. Machines that pass are logged for audit; machines that fail are powered off, not deleted, and reported to Slack so a human decides whether to rename and revive them or remove them. Powering off instead of deleting keeps the guard safe to run even when the policy has false positives.

How it works

1. on_new_droplet (io.kestra.plugin.digitalocean.droplet.Trigger) polls the account every 5 minutes and starts an execution per droplet it has not seen before, exposing trigger.id, trigger.name, trigger.region, trigger.status, and trigger.createdAt.
2. evaluate_naming_policy (io.kestra.plugin.core.flow.If) extracts the first hyphen-separated segment of the droplet name and checks it against the approved prefix list.
3. On violation, power_off_rogue (io.kestra.plugin.digitalocean.droplet.Action) sends a POWER_OFF action, containing the machine while preserving its disk, and alert_security posts the droplet's full identity to Slack with instructions for the reviewer.
4. On compliance, log_compliant writes an audit log line, so the execution history doubles as a record of every droplet that ever joined the account.
5. The errors block raises a distinct alert when the guard itself breaks, because a silently failing guard is worse than none.

What you get

• Detection of every new droplet within the polling interval, whoever created it and however they created it.
• Automatic containment that is reversible by design: powered-off machines keep their disks and can be renamed and restarted.
• A Slack review queue for violations and an execution-history audit trail for everything else.
• A policy expressed in one templated expression that is trivial to adapt to your own conventions.

Who it's for

• Platform and security teams whose developers hold DigitalOcean access and occasionally click Create Droplet outside Terraform.
• Organizations with cost controls that need untracked compute surfaced and stopped quickly.
• Teams building lightweight cloud governance without deploying a full CSPM product.

Why orchestrate this with Kestra

DigitalOcean has no native policy engine: nothing in the platform reacts when a droplet is created, and account-level alerts cover billing thresholds, not resource creation. Kestra turns the public API into an event source with the droplet trigger, keeps the detection state between polls, and gives the response, power off plus notify, retries, logging, and a full audit trail. The same pattern extends to any rule you can express over the trigger's outputs, from naming to region allowlists.

Prerequisites

• A DigitalOcean personal access token with read scope for droplets and write scope for droplet actions.
• A Slack incoming webhook routed to the channel that owns infrastructure review.
• An agreed naming convention; the shipped rule accepts names starting with web-, db-, worker-, or staging-.

Secrets

• DIGITALOCEAN_TOKEN: DigitalOcean personal access token.
• SLACK_WEBHOOK_URL: Slack incoming webhook URL.

Quick start

1. Add the two secrets above to your Kestra namespace.
2. Edit the prefix list in evaluate_naming_policy to match your naming convention.
3. Deploy the flow; the trigger is active immediately and will baseline the account on its first poll.
4. Create a test droplet with a non-compliant name and watch it get powered off and reported within one polling interval.

How to extend

• Enforce a region allowlist instead of, or in addition to, naming by checking trigger.region in the If condition.
• Escalate from power-off to droplet.Delete for high-security accounts once the policy has proven itself without false positives.
• Add droplet.Get after detection to fetch the droplet's public IP and feed it into a firewall or VPN blocklist.
• Route violations to an approval flow with io.kestra.plugin.core.flow.Pause, letting a human approve deletion directly from the Kestra UI.

Links

• DigitalOcean plugin documentation
• Kestra triggers