apiVersion: atmos/v1
kind: Policy
metadata:
  name: command-deny-destroy
  description: Deny Terraform and Helmfile destroy, including the Terraform destroy flag on plan, apply, and deploy.
spec:
  policies:
    guard:
      on: command
      engine: starlark
      action: deny
      rule: |
        return ctx.input["command"] == "terraform destroy" or ctx.input["destroy"]