Scan production before plan
Require a Checkov scan before planning a production Terraform component.
apiVersion: atmos/v1
kind: Policy
metadata:
name: lifecycle-scan-production
description: "Require a Checkov scan before planning a production Terraform component."
spec:
policies:
scan-production:
on: operation
action: hooks
rule: input.event == 'before.terraform.plan' && input.stack.startsWith('prod-')
hooks:
- ref: production-scan
event: before.terraform.plan
required: true
require_success: true
hooks:
production-scan:
kind: command
command: checkov
args:
- --directory
- .
tools: {}
1 Configure
No rule parameters. Hook arguments: checkov --directory ..
Install Checkov or add approved pins to spec.tools. Adjust the prod- prefix to your stack naming convention. The scan operates on the component directory.
The selected hook must execute and succeed: both required and require_success are true. Dry-run previews it without execution.
2 Save
Save the CEL policy as policy.d/lifecycle-scan-production.yaml. Install only one implementation of each policy.
Atmos discovers policy.d/ at the project root selected by atmos.yaml discovery. Set ATMOS_POLICY_DIR to use another directory.
3 Run
Replace <component> and <stack> with your target.
atmos terraform plan <component> -s <stack>
Review required tools and callback settings before running. In CI, load policies from a protected, pinned revision. See enforcement configuration.
