Droplets created with terraform have no outgoing network access

I’m using terraform to provision droplets (which I’ve done before without issue), and today I ran into a problem I haven’t seen before. Droplets are unable to reach the outside network at all. At first I thought it was a DNS problem, but literally every public IP is inaccessible from within these droplets. I’ve reproduced this on several images and I’m at my wits end about how to solve this.

Everything else is working smoothly, I can reach the droplet via SSH without issue after creation, but I cannot reach any outside hostname or IP address.

Here’s what my internal network looks like:

# ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group
default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAUL
T group default qlen 1000
    link/ether b2:fc:48:21:99:b5 brd ff:ff:ff:ff:ff:ff
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode
DEFAULT group default
    link/ether 02:42:3b:8f:31:6c brd ff:ff:ff:ff:ff:ff

Here is the relevant section of my terraform config:

resource "digitalocean_droplet" "staging-cafe" {
  image = "docker-20-04"
  name = "staging-cafe"
  region = "sfo2"
  size = "s-2vcpu-4gb"
  private_networking = false
  monitoring = true
  ssh_keys = [
    digitalocean_ssh_key.hal.fingerprint
  ]
}

resource "digitalocean_firewall" "cafe" {
  name = "cafe"
  droplet_ids = [ digitalocean_droplet.staging-cafe.id ]
  inbound_rule {
      protocol = "tcp"
      port_range = "22"
      source_addresses = var.vpn_source_addrs
  }
  inbound_rule {
      protocol = "tcp"
      port_range = "443"
  }
  inbound_rule {
    protocol = "icmp"
  }
  outbound_rule {
    protocol = "tcp"
    port_range = "53"
  }
  outbound_rule {
    protocol = "udp"
    port_range = "53"
  }
  outbound_rule {
    protocol = "icmp"
  }
}

Again, this all works fine! But the host has no outgoing network access, only incoming. What other information is needed to troubleshoot this issue?