Policy Examples
Copy these tested policy configurations into your governing policy directory and adapt the parameters to your environment. For individually reusable policies, use the Policy Library.
Usage
The bundles below demonstrate combinations of policies. The library provides one policy per entry, with its own parameters and test cases. Each library entry has CEL and Starlark tabs containing complete, interchangeable manifests tested against the same inputs. Choose one implementation; do not install both versions of a policy.
Save a document below as a .yaml file in your policy directory, then set:
export ATMOS_POLICY_DIR="$PWD/policy.d"
Every rule in that directory is loaded. Remove unwanted rules before enabling a document. For CI, use a protected governing directory.
Terraform resource controls
| Rule | Denies when | Parameter defaults |
|---|---|---|
protect-stateful-resources | A protected resource is deleted or replaced | types: RDS instance/cluster, S3 bucket |
create-before-destroy | A replacement destroys before creating | None |
limit-change-count | More than the maximum managed resources change | maximum: 10 |
disallow-resource-types | A forbidden resource exists after the change | types: IAM users and access keys |
allowed-instance-types | An EC2 instance type is absent, unknown, or outside the allowlist | allowed: [t3.micro, t3.small] |
require-owner-tag | A planned EC2 instance lacks a known, nonempty Owner tag | None |
Run with Terraform saved-plan commands. Deleting a disallowed resource is permitted by the resource-type rule; deleting a resource protected by another rule still blocks.
GitHub event check
| Rule | Denies when | Required input |
|---|---|---|
reject-fork-plan | The PR head and base repositories differ | Complete GitHub Actions event |
Missing required CI context blocks the command, including local invocations. This is a plan-time check, not protection against running untrusted code before planning. See CI Context.
Lifecycle hooks and operation controls
| Rule | Selection | Effect |
|---|---|---|
lint-successful-plan | Successful Terraform plan | Require TFLint |
scan-production | Before Terraform plan in a prod- stack | Require Checkov |
callback-after-apply | Successful Helm apply | Require HTTP callback |
cleanup-failed-apply | Failed Kubernetes apply | Require cleanup command |
deny-production-delete | Before Helm delete in a prod- stack | Deny |
Replace the callback URL and cleanup executable. Install the tools or add approved version pins
under spec.tools. All selected hooks in this example must execute and succeed.
See Hooks for skip protection, ordering, retries, and post-apply failure semantics.
