Policies

Use policies to regulate Atmos's execution lifecycle: control component operations and require hooks at lifecycle events. For Terraform, use policies to inspect plan changes and reject operations that violate your rules. Policies use CEL expressions or Starlark function bodies and load from policy.d/ by default, with ATMOS_POLICY_DIR available as an override. Use tag and label selectors to attach rules to instances.

Experimental

Choose an input

Input kind	Components	Evaluated when	Actions
function	Configuration loading and resolution	Before YAML function execution and Go-template calls	deny, require_approval
source	Imports, downloads, includes, and guarded template access	Before accessing each guarded source destination	deny, require_approval
command	All runnable CLI commands	Before argument validation and pre-run hooks	deny, require_approval
component.command	Shared stack resolution	Before component templates/functions and tool execution	deny, require_approval
terraform.plan	Terraform / OpenTofu	After a successful saved plan and before saved-plan apply	deny, require_approval
operation	Terraform, Helmfile, Helm, Kubernetes	At the component's lifecycle hook events	deny, hooks, require_approval
atmos.affected	All supported inventory types	During explicit affected analysis, before filtering or scheduling	deny, require_approval

GitHub Actions context is available to all kinds. Admission, plan, and lifecycle rules run regardless of --affected; affected rules run only when affected analysis is requested. Component configuration validation uses the separate settings.validation configuration.

Quick start

Create a policy file:

policy.d/terraform.yaml

apiVersion: atmos/v1
kind: Policy
metadata:
  name: safety
  description: Prevent accidental deletion or replacement of managed resources.
spec:
  policies:
    prevent-deletion:
      on: terraform.plan
      action: deny
      reason: Resources must not be deleted or replaced
      rule: >-
        has(input.resource_changes) && input.resource_changes.exists(r,
          r.mode == 'managed' && 'delete' in r.change.actions)

Run a plan from the directory containing policy.d/:

atmos terraform plan vpc -s dev

A matching rule blocks the command, names itself in the error, and exits with code 77. A plan containing no managed-resource deletions passes this rule. To apply a passing saved plan:

atmos terraform apply vpc -s dev --from-plan

For CI enforcement, load policies from a protected source, not an unreviewed pull-request checkout.

Reference

Browse the Policy Library for individual policies, parameters, and tested input cases. Each policy offers CEL and Starlark tabs backed by the same test fixtures. Copy one implementation; the selected language is remembered across library pages.

Page	Contents
Library	Searchable catalog with CEL/Starlark implementations and shared tests per policy
Configuration	Directory loading, manifest fields, rule actions, enforcement setup
Inputs and Expressions	CEL variables, operation fields, missing values, evaluation results
Sources and Filesystem	Source transports, destinations, and local path confinement
Starlark	Function bodies, read-only inputs, loops, helpers, and execution limits
Terraform Plans	Plan JSON, saved-plan commands, failure handling
Affected Changes	File, instance, component, stack, and structured-field changes
Hooks	Hook definitions, selection, execution and success requirements
CI Context	GitHub event data, metadata, required inputs, permissions
Examples	Tested policy configurations to copy and adapt