POLICY
Require create-before-destroy
Reject Terraform replacements that destroy the old resource first.
Policy reason
Replacements must create before destroying
policy.d/terraform-create-before-destroy.yaml
apiVersion: atmos/v1
kind: Policy
metadata:
name: terraform-create-before-destroy
description: "Reject Terraform replacements that destroy the old resource first."
spec:
policies:
create-before-destroy:
on: terraform.plan
action: deny
reason: Replacements must create before destroying
rule: |-
has(input.resource_changes) && input.resource_changes.exists(r,
r.mode == 'managed' && r.change.actions == ['delete', 'create'])
1 Configure
None.
Pure deletions are outside this rule. Combine with stateful-resource protection when deletion must also be denied.
2 Save
Save the CEL policy as policy.d/terraform-create-before-destroy.yaml. Install only one implementation of each policy.
Atmos discovers policy.d/ at the project root selected by atmos.yaml discovery. Set ATMOS_POLICY_DIR to use another directory.
3 Run
Replace <component> and <stack> with your target.
atmos terraform plan <component> -s <stack>
Review required tools and callback settings before running. In CI, load policies from a protected, pinned revision. See enforcement configuration.
