DigitalOcean Firewall: Default "Allow All" Ingress Rule Added in 2024 Alters Automated Provisioning

Goal

To determine how the new default “Allow All” ingress rule behaves for droplets that are not created through the UI.

Uncertainty

Documentation indicates the rule applies only to UI‑created droplets, but no explicit statement exists for API‑created droplets or for droplets that later join a firewall group.

Questions

• When a droplet is created via the API and then assigned to a firewall group, is the default “Allow All” rule automatically added or suppressed?
• Does the “Require Confirmation” toggle affect removal of the default rule for droplets that are already part of a firewall group?
• When a Floating IP is attached to a droplet, does the inherited firewall configuration include the default rule, and is that rule subject to the same confirmation requirement?