How to Secure Valkey Managed Database Clusters

1. Install doctl, the official DigitalOcean CLI.
2. Create a personal access token and save it for use with doctl.
3. Use the token to grant doctl access to your DigitalOcean account.

   doctl auth init

4. Finally, run doctl databases firewalls append. Basic usage looks like this, but you can read the usage docs for more details:

   doctl databases firewalls append <database-cluster-id> --rule <type>:<value> [flags]

   The following example appends a firewall rule to a database cluster with the ID ca9f591d-f38h-5555-a0ef-1c02d1d1e35 that allows any resources with the example-tag to access the database:

   doctl databases firewalls append ca9f591d-f38h-5555-a0ef-1c02d1d1e35 --rule tag:example-tag

1. Create a personal access token and save it for use with the API.
2. Send a PUT request to https://api.digitalocean.com/v2/databases/{database_cluster_uuid}/firewall.

cURL

Using cURL:

curl -X PUT \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
  -d '{"rules": [{"type": "ip_addr","value": "192.168.1.1"},{"type": "droplet","value": "163973392"},{"type": "k8s","value": "ff2a6c52-5a44-4b63-b99c-0e98e7a63d61"},{"type": "tag","value": "backend"}]}' \
  "https://api.digitalocean.com/v2/databases/9cc10173-e9ea-4176-9dbc-a4cee4c4ff30/firewall"

Go

Using Godo, the official DigitalOcean API client for Go:

import (
    "context"
    "os"

    "github.com/digitalocean/godo"
)

func main() {
    token := os.Getenv("DIGITALOCEAN_TOKEN")

    client := godo.NewFromToken(token)
    ctx := context.TODO()

    req := godo.DatabaseUpdateFirewallRulesRequest{
      Rules: []*godo.DatabaseFirewallRule{
        {
         Type:  "ip_addr",
         Value: "192.168.1.1",
         Description: "a development IP address",
       },
        {
         Type:  "droplet",
         Value: "163973392",
       },
        {
         Type:  "k8s",
         Value: "ff2a6c52-5a44-4b63-b99c-0e98e7a63d61",
        },
      },
    }
    _, err := client.Databases.UpdateFirewallRules(ctx, dbID, &req)
}

Python

Using PyDo, the official DigitalOcean API client for Python:

import os
from pydo import Client

client = Client(token=os.environ.get("DIGITALOCEAN_TOKEN"))

req = {
  "rules": [
    {
      "type": "ip_addr",
      "value": "192.168.1.1",
      "description": "a development IP address",
    },
    {
      "type": "k8s",
      "value": "ff2a6c52-5a44-4b63-b99c-0e98e7a63d61"
    },
    {
      "type": "droplet",
      "value": "163973392"
    },
    {
      "type": "tag",
      "value": "backend"
    }
  ]
}
update_resp = client.databases.update_firewall_rules(database_cluster_uuid="a7a8bas", body=req)

To add, remove, or replace multiple trusted sources in one doctl command, replace the cluster’s full firewall rule list with doctl databases firewalls replace.

Pass the rules you want to keep using comma-separated type:value entries in the --rules flag. Each entry uses:

• type: droplet, k8s, ip_addr, tag, or app
• value: the resource ID, Kubernetes cluster UUID, IP address or CIDR range, tag name, or App identifier, depending on type

The rules you pass to replace become the cluster’s full trusted sources list. Any existing rule you omit is removed. To change the list safely, first list the current rules with doctl databases firewalls list, then run replace with the full set of type:value entries you want to keep. Clusters are limited to 100 firewall rules.

For required flags, examples, and output formats, see doctl databases firewalls replace.

To add, remove, or replace multiple trusted sources in a single operation, send a PUT request to /v2/databases/{database_cluster_uuid}/firewall with a JSON body that contains a rules array.

Each object in rules supports:

• type (required): droplet, k8s, ip_addr, tag, or app
• value (required): the resource ID, Kubernetes cluster UUID, IP address or CIDR range, tag name, or App identifier, depending on type
• description (optional): a short note; this appears as the rule label in the Control Panel

The rules in your request become the cluster’s full firewall rule list. Any existing rule you omit is removed. To change the list safely, first list firewall rules with GET /v2/databases/{database_cluster_uuid}/firewall, edit the returned rules array, then send your updated array with PUT to the same path. A successful update returns 204 No Content. Clusters are limited to 100 firewall rules.

For example payloads, authentication, and required OAuth scopes (database:read to list, database:update to change rules), see Update firewall rules (trusted sources) for a database in the Databases API reference.