THE ATMOS LIBRARY
Policy Library
Find a guardrail for your workflow. Explore its behavior, choose an engine, and make it yours.
Get started with policies →All policies
17 policies- Preserve instance ownershipAllow new owner labels but reject changing or removing an existing owner.Affected ChangesBlocks
- Block Terraform and Helmfile destroyDeny Terraform and Helmfile destroy, including the Terraform destroy flag on plan, apply, and deploy.AdmissionBlocks
- Deny !execReject !exec before configuration can start a shell.AdmissionBlocks
- Require production deployment reviewRequire a designated reviewer before applying or deploying a production instance.GitHub ActionsRequires approval
- Reject fork PR plansReject saved Terraform plans when the supplied GitHub event identifies a fork pull request.GitHub ActionsBlocks
- Notify after Helm applyRequire an HTTP callback after a successful Helm apply.Lifecycle HooksRequires hooks
- Clean up after Kubernetes failureRequire a cleanup command after a failed Kubernetes apply.Lifecycle HooksRequires hooks
- Protect production Helm releasesDeny direct deletion of Helm releases in production stacks.Lifecycle HooksBlocks
- Require TFLint after planRequire TFLint to run and succeed after each successful Terraform plan.Lifecycle HooksRequires hooks
- Scan production before planRequire a Checkov scan before planning a production Terraform component.Lifecycle HooksRequires hooks
- Allow approved instance typesRequire planned EC2 instance types to be known and explicitly approved.TerraformBlocks
- Require create-before-destroyReject Terraform replacements that destroy the old resource first.TerraformBlocks
- Disallow resource typesPrevent selected resource types from being created or retained by a change.TerraformBlocks
- Limit resource changesCap the number of changed managed resources in one Terraform plan.TerraformBlocks
- Protect stateful resourcesReject deletion or replacement of selected stateful resource types.TerraformBlocks
- Require an Owner tagRequire a known, nonempty Owner tag on planned EC2 instances.TerraformBlocks
- Weighted plan change budgetLimit changes, charging more for deletions and replacements.TerraformBlocks
