POLICY
Disallow resource types
Prevent selected resource types from being created or retained by a change.
Policy reason
Long-lived IAM users and access keys are not permitted
policy.d/terraform-disallow-resource-types.yaml
apiVersion: atmos/v1
kind: Policy
metadata:
name: terraform-disallow-resource-types
description: "Prevent selected resource types from being created or retained by a change."
spec:
policies:
disallow-resource-types:
on: terraform.plan
action: deny
reason: Long-lived IAM users and access keys are not permitted
with:
types:
- aws_iam_user
- aws_iam_access_key
rule: >-
has(input.resource_changes) && input.resource_changes.exists(r,
r.mode == 'managed' && r.type in params.types && r.change.after != null)
1 Configure
types: [aws_iam_user, aws_iam_access_key].
Deletion is permitted as remediation. This checks the plan's resource changes, not an independent inventory of existing resources.
2 Save
Save the CEL policy as policy.d/terraform-disallow-resource-types.yaml. Install only one implementation of each policy.
Atmos discovers policy.d/ at the project root selected by atmos.yaml discovery. Set ATMOS_POLICY_DIR to use another directory.
3 Run
Replace <component> and <stack> with your target.
atmos terraform plan <component> -s <stack>
Review required tools and callback settings before running. In CI, load policies from a protected, pinned revision. See enforcement configuration.
