CoverOps on DigitalOcean
Read-only through a custom-scoped API token that only reads.
The access you give
A custom-scoped read token.
- Only read scopes: account, droplet, block storage, database, load balancer, reserved IP, snapshot, Kubernetes, monitoring, billing, sizes and regions
- A 90-day expiry is suggested. When it checks the token CoverOps asks to delete a tag that does not exist: a read-only token is refused, and a token that could write is flagged so you can replace it
The token is encrypted at rest (AES-256-GCM) and used only by scans.
What it reads
- Droplets, volumes, snapshots, reserved IPs, load balancers, managed databases and Kubernetes clusters
- Monitoring metrics and billing
Never read: your application data, database contents or the files in your storage.
Where the rupee figures come from
Billed cost from your DigitalOcean billing; resources it cannot price at list prices, labelled as estimates.
What it finds
- Idle and oversized droplets and databases
- Unattached volumes, old snapshots and unused reserved IPs
What it changes
Advice only on DigitalOcean: each finding comes with the doctl command and its undo.
How to connect
- Sign up and open Cloud accounts → Connect DigitalOcean
- In the control panel, create a token under API → Tokens with only the read scopes listed
- Paste it, press Verify access, then Connect
How to end it
Delete the token in the DigitalOcean control panel. Access ends at once. Your workloads keep running: none of them ever ran on CoverOps. More in revoking access and the security overview.
Other clouds: AWS · Azure · Google Cloud · Oracle Cloud