apiVersion: atmos/v1
kind: Policy
metadata:
  name: lifecycle-scan-production
  description: "Require a Checkov scan before planning a production Terraform component."
spec:
  policies:
    scan-production:
      on: operation
      action: hooks
      rule: input.event == 'before.terraform.plan' && input.stack.startsWith('prod-')
      hooks:
        - ref: production-scan
          event: before.terraform.plan
          required: true
          require_success: true
  hooks:
    production-scan:
      kind: command
      command: checkov
      args:
        - --directory
        - .
  tools: {}