Example: OPA Policy Validation

Validate the vpc component against OPA (Rego) policies before it is ever provisioned. The component is a credential-free mock, so the only moving part is the policy itself.

What You'll See

The vpc component carries a settings.validation section (in stacks/catalog/vpc/defaults.yaml) that runs an OPA policy. The policy and its shared constants live under stacks/schemas/opa:

• stacks/schemas/opa/vpc/validate-vpc-component.rego - the policy.
• stacks/schemas/opa/catalog/constants/constants.rego - reusable constants and error messages imported by the policy.

Two stacks are wired to fail on purpose so you can see each rule fire:

• dev sets three Availability Zones and an invalid VPC name.
• prod maps public IPs on launch.

Try It

# `dev` violates the Availability-Zone-count and VPC-name rules
atmos validate component vpc -s dev

# `prod` forbids mapping public IPs on launch
atmos validate component vpc -s prod

# The same policy can be run explicitly with command-line flags
atmos validate component vpc -s dev \
  --schema-path vpc/validate-vpc-component.rego \
  --schema-type opa \
  --module-paths catalog/constants

Each command exits non-zero and prints the policy error messages, which is also what blocks atmos terraform apply for a component that fails validation.