Deny !exec
Reject !exec before configuration can start a shell.
!exec is disabled because stack configuration must not run shell commands.
Instead: Pass precomputed values through environment variables and read them with !env.
apiVersion: atmos/v1
kind: Policy
metadata:
name: function-disable-exec
description: Reject !exec before configuration can start a shell.
spec:
policies:
guard:
on: function
action: deny
reason: |-
**`!exec` is disabled** because stack configuration must not run shell commands.
**Instead:** Pass precomputed values through environment variables and read them with `!env`.
rule: input.name == 'exec'
1 Configure
No parameters. The rule checks the canonical YAML function name, not shell arguments. It covers configuration loading and lazy YAML resolution, not shell hooks or Go-template functions.
The optional reason explains the block and suggests using precomputed environment values with
!env. Customize this Markdown text for your organization or omit it. It appears in the CLI error when
the rule denies execution; it is not a template and does not change the rule's behavior.
2 Save
Save the CEL policy as policy.d/function-disable-exec.yaml. Install only one implementation of each policy.
Atmos discovers policy.d/ at the project root selected by atmos.yaml discovery. Set ATMOS_POLICY_DIR to use another directory.
3 Run
atmos describe stacks
Review required tools and callback settings before running. In CI, load policies from a protected, pinned revision. See enforcement configuration.
