doctl firewall rules support optional action
Introduced 2026-09-18 · score 0.97
HOW TO USE IT
When adding cloud firewall rules with doctl v1.169.0, include `action:allow` or `action:deny` in each rule string to set its action; omitted action defaults to allow.
doctl compute firewall add-rules <firewall-id> --inbound-rules "protocol:tcp,ports:22,address:<source-CIDR>,action:deny"doctl compute firewall add-rules <firewall-id> --outbound-rules "protocol:tcp,ports:22,address:<destination-CIDR>,action:allow"WHY THIS HELPS
Add inbound or outbound cloud firewall rules with an explicit allow or deny action.
BEFORE THIS CHANGE
Create rules without an explicit action, which use the API’s default-allow behavior.
REQUIREMENTS AND LIMITATIONS
- Version: v1.169.0
- <firewall-id> (required): Cloud firewall ID.
- --inbound-rules: Comma-separated rule keys; needs protocol, ports, and source location. Optional `action` accepts `allow` or `deny`; omitted defaults to allow. Supported source keys: address, droplet_id, load_balancer_uid, kubernetes_id, tag.
- --outbound-rules: Comma-separated rule keys; needs protocol, ports, and destination location. Optional `action` accepts `allow` or `deny`; omitted defaults to allow. Supported destination keys: address, droplet_id, load_balancer_uid, kubernetes_id, tag.
- action: Rule action: `allow` or `deny`. These are allowed values for the same key, not mutually exclusive fields.
- Prerequisite: Install doctl, create a DigitalOcean personal access token, then authorize doctl with `doctl auth init`.
- The action field is optional and defaults to allow on the API side.
- Existing commands and scripts that omit action continue to work unchanged.
- Docs conflict: A current DigitalOcean configure-rules page says doctl does not support `action` and recommends using the API for deny rules, conflicting with the v1.169.0 release note and the current add-rules CLI reference. That page does not establish behavior at v1.169.0; follow the version-specific release note.
FIRST-PARTY EVIDENCE
- https://github.com/digitalocean/doctl/releases/tag/v1.169.0
- https://github.com/digitalocean/doctl/pull/1963
- https://docs.digitalocean.com/reference/doctl/reference/compute/firewall/add-rules/
- https://docs.digitalocean.com/products/networking/firewalls/how-to/configure-rules/
Check the installed version and the source before using it. Entry JSON