DigitalOcean Security Lab: Firewalls, Tokens, Spaces
This is a hands-on DigitalOcean security lab. You take over a fictional start-up's DigitalOcean team and make 12 scored decisions on sign-in, roles, API tokens, Cloud Firewalls, VPC networks, Droplets, Spaces, backups and monitoring.
Feedback cites DigitalOcean documentation. Read the secure DigitalOcean architecture guide for the design behind the answers, or score your own team with the DigitalOcean Security Checklist.
You are Dana Whitfield, the first security hire at Brightwave Labs, a fictional start-up that grew on DigitalOcean: a handful of Droplets, a managed database, a Spaces bucket and a CI pipeline, all in one team. Across 12 decisions you secure it: team sign-in and roles, API token scopes, Cloud Firewalls, VPC networks, Droplet hardening, Spaces keys and bucket exposure, backups, monitoring and posture scans. Each call is scored 0 to 10 and the feedback cites the DigitalOcean documentation behind it. All names, addresses and ids are invented (example.com and documentation IP ranges).
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
TL;DRWhat this is
5 points
- A scenario lab where you secure a fictional start-up's DigitalOcean team: Droplets, a managed database, a Spaces bucket and a CI pipeline.
- You make 12 scored decisions on: secure sign-in and 2FA, team roles, personal access token scopes, a leaked token, Cloud Firewalls by role, deny rules, VPC networks and NAT gateways, Droplet hardening, Spaces access keys, public bucket exposure, backups, snapshots and versioning, and monitoring with posture scans.
- Each decision scores 0 to 10. Feedback cites the DigitalOcean documentation read on 4 November 2026. Our own reasoning is labelled PlayCISO practice.
- Free to play. All names, addresses and ids are invented. The lab teaches what to set and why; it contains no attack steps.
- Read the secure DigitalOcean architecture guide for the reference design, or score your own setup with the DigitalOcean Security Checklist.
Frequently asked questions
What does the DigitalOcean Security Lab teach?
It teaches how to secure a DigitalOcean team and what runs in it: requiring secure sign-in, choosing narrow team roles, scoping API tokens, building Cloud Firewalls by role with deny rules, separating environments in VPC networks, hardening Droplets, scoping Spaces access keys, keeping buckets private, backing up and monitoring, and running posture scans.
Why does the lab prefer custom-scope tokens over Full Access?
DigitalOcean says custom scopes let a token do only things like create Droplets or update cloud firewalls, so you grant only the permissions a workflow needs. A Full Access token has the api:write alias scope over everything your team role allows. You also choose an expiration, and the secret is shown only once.
Do Cloud Firewalls and UFW conflict?
They are separate. DigitalOcean says the Cloud Firewall service is separate from firewall software such as UFW on the Droplet, rules in one are not reflected in the other, and you should make sure they do not conflict. Cloud Firewalls block all traffic that is not expressly permitted by a rule.
Can a Spaces bucket use both a bucket policy and a limited-access key?
No. DigitalOcean says per-bucket limited-access keys are not compatible with S3-compatible bucket policies: you cannot create a limited-access key for a bucket that uses a policy, and you cannot apply a policy to a bucket that already has a limited-access key. Decide which model a bucket uses.
Does DigitalOcean scan my account for misconfigurations automatically?
Its Cloud Security Posture Management feature evaluates resource configuration and shows findings by severity, but DigitalOcean says all scans are started manually and there are no scheduled or automated scans. Plans and pricing were not checked for this lab.
Sources
All read on 4 November 2026. Lines marked “PlayCISO practice” are our own reasoning, not a vendor statement.
- DigitalOcean Docs: How to Manage Two-Factor Authentication for DigitalOcean Accounts
- DigitalOcean Docs: Secure Sign-In for DigitalOcean Teams
- DigitalOcean Docs: Teams Predefined Roles
- DigitalOcean Docs: How to Use Custom Roles
- DigitalOcean Docs: How to Manage Team Membership
- DigitalOcean Docs: How to Create a Personal Access Token
- DigitalOcean Docs: Cloud Firewalls
- DigitalOcean Docs: How to Configure Firewall Rules
- DigitalOcean Docs: How to Organize DigitalOcean Cloud Firewalls
- DigitalOcean Docs: VPC
- DigitalOcean Docs: Use VPC Networks to Secure Your Servers and Other Best Practices
- DigitalOcean Docs: Set up a Production-Ready Droplet
- DigitalOcean Docs: How to Add SSH Keys to New or Existing Droplets
- DigitalOcean Docs: How to Manage Access to DigitalOcean Spaces
- DigitalOcean Docs: How to Configure Bucket Policies (Spaces)
- DigitalOcean Docs: How to Configure DigitalOcean Spaces Versioning
- DigitalOcean Docs: Backups
- DigitalOcean Docs: Snapshots
- DigitalOcean Docs: Monitoring
- DigitalOcean Docs: How to Create, Edit, and Delete Resource Alerts
- DigitalOcean Docs: CSPM Features (Cloud Security Posture Management)
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.