Require TFLint after plan
Require TFLint to run and succeed after each successful Terraform plan.
apiVersion: atmos/v1
kind: Policy
metadata:
name: lifecycle-lint-successful-plan
description: "Require TFLint to run and succeed after each successful Terraform plan."
spec:
policies:
lint-successful-plan:
on: operation
action: hooks
rule: input.event == 'after.terraform.plan' && input.status == 'success'
hooks:
- ref: lint
event: after.terraform.plan
required: true
require_success: true
hooks:
lint:
kind: command
command: tflint
args:
- --recursive
tools: {}
1 Configure
No rule parameters. Hook arguments: tflint --recursive.
Install TFLint on the runner or add approved pins to spec.tools. Protect its configuration. Terraform detailed exit code 2 counts as success.
The selected hook must execute and succeed: both required and require_success are true. Dry-run previews it without execution.
2 Save
Save the CEL policy as policy.d/lifecycle-lint-successful-plan.yaml. Install only one implementation of each policy.
Atmos discovers policy.d/ at the project root selected by atmos.yaml discovery. Set ATMOS_POLICY_DIR to use another directory.
3 Run
Replace <component> and <stack> with your target.
atmos terraform plan <component> -s <stack>
Review required tools and callback settings before running. In CI, load policies from a protected, pinned revision. See enforcement configuration.
