apiVersion: atmos/v1
kind: Policy
metadata:
  name: terraform-create-before-destroy
  description: "Reject Terraform replacements that destroy the old resource first."
spec:
  policies:
    create-before-destroy:
      on: terraform.plan
      engine: starlark
      action: deny
      reason: Replacements must create before destroying
      rule: |
        for resource in ctx.input.get("resource_changes", []):
            if resource["mode"] == "managed" and resource["change"]["actions"] == ["delete", "create"]:
                return True
        return False