POLICY
Allow approved instance types
Require planned EC2 instance types to be known and explicitly approved.
Policy reason
Instance type must be known and approved before apply
policy.d/terraform-allowed-instance-types.yaml
apiVersion: atmos/v1
kind: Policy
metadata:
name: terraform-allowed-instance-types
description: "Require planned EC2 instance types to be known and explicitly approved."
spec:
policies:
allowed-instance-types:
on: terraform.plan
action: deny
reason: Instance type must be known and approved before apply
with:
allowed:
- t3.micro
- t3.small
rule: >-
has(input.resource_changes) && input.resource_changes.exists(r,
r.mode == 'managed' && r.type == 'aws_instance' && r.change.after != null &&
(!has(r.change.after.instance_type) ||
!(r.change.after.instance_type in params.allowed) ||
(has(r.change.after_unknown.instance_type) && r.change.after_unknown.instance_type == true)))
1 Configure
allowed: [t3.micro, t3.small].
Deleting an instance is permitted. An unknown-value marker blocks even when after contains an approved placeholder.
2 Save
Save the CEL policy as policy.d/terraform-allowed-instance-types.yaml. Install only one implementation of each policy.
Atmos discovers policy.d/ at the project root selected by atmos.yaml discovery. Set ATMOS_POLICY_DIR to use another directory.
3 Run
Replace <component> and <stack> with your target.
atmos terraform plan <component> -s <stack>
Review required tools and callback settings before running. In CI, load policies from a protected, pinned revision. See enforcement configuration.
