Automated DigitalOcean Firewall Audits
Every Monday, WebRun opens DigitalOcean, reads every cloud firewall and its inbound rules, finds ports open to all addresses and droplets attached to no firewall at all, checks the SSH keys and team members still holding access, opens a Trello card for each finding, and files the week's report in Google Drive.
How do I check which of my cloud servers have ports open to the internet?
WebRun audits your DigitalOcean account every Monday: firewall rules that allow a port from all addresses, droplets attached to no firewall, and the SSH keys and team members still holding access. It opens a Trello card for each finding and files a dated report in Google Drive, so exposure is closed before a scanner finds it.
- Droplets running with no firewall are named every Monday
- Ports open to all addresses get a dated ticket, not a shrug
- A weekly audit trail sits in Drive when a customer asks for one
Built for DevOps engineers · platform teams · startup CTOs · agencies · managed hosting providers
What does WebRun do on every run?
The exact actions WebRun takes, in order - in plain language, so you can adjust anything.
-
WebRun signs in and gets to work
Opens
cloud.digitalocean.comin a real browser with your saved login - no setup, no API keys. -
1
DigitalOcean - audit firewalls, droplets, and access
digitalocean.com
WebRun opens DigitalOcean to audit firewalls, droplets, and access. - Open DigitalOcean and list every cloud firewall with its inbound rules
- Flag any rule that allows a port from all IPv4 or all IPv6 addresses, noting the port and protocol
- List droplets attached to no firewall at all, with their region and tags
- Read the account SSH keys and note any that no current engineer recognises
- Check the team members list for accounts that should have been removed
- Read only. WebRun never edits a firewall rule, removes a key, or touches a droplet
Done when Every open rule, unprotected droplet, and stale access holder is listed.
-
2
Trello - open a card per finding
trello.com
WebRun opens Trello to open a card per finding. - Add a card to your infrastructure board for each finding
- Title it with the droplet or firewall name and the exposure, such as a port open to all addresses
- Put the highest risk findings, unprotected droplets and open administrative ports, at the top of the list
- Close cards whose finding no longer appears in this week's audit
Done when Every current finding has an open Trello card and fixed ones are closed.
-
3
Google Drive - file the weekly audit report
drive.google.com
WebRun opens Google Drive to file the weekly audit report. - Save the week's audit as a dated document in your infrastructure folder in Google Drive
- Include the full rule by rule listing, not just the flagged items, so the report stands on its own
- Keep prior weeks in place so an auditor can see when an exposure opened and when it closed
Done when This week's dated audit report is filed in Google Drive.
How is each run configured?
Secure by default
Connect once, stays signed in
WebRun signs in once and keeps each session in a persistent environment, so every run picks up right where it left off.
Every action is checked against this policy before it runs.
Questions, answered
Will it close a port or delete an SSH key itself?
No. WebRun reads your DigitalOcean account and never edits a firewall rule, removes a key, or changes team access. Closing an exposure stays a deliberate human change.
How is this different from checking a new droplet's setup?
A setup check covers the moment a droplet is created. This audits what is already running, including droplets that drifted out of a firewall or keys that outlived the engineer who added them.
Does it need shell access to the droplets?
No. It works entirely from the DigitalOcean control panel, and the strict policy blocks shell commands outright. Nothing is run on your servers.
Related templates
Put this on autopilot.
Turn it on in minutes - or have our team set it up for you.