apiVersion: atmos/v1
kind: Policy
metadata:
  name: terraform-limit-change-count
  description: "Cap the number of changed managed resources in one Terraform plan."
spec:
  policies:
    limit-change-count:
      on: terraform.plan
      engine: starlark
      action: deny
      reason: Too many managed resources change in this plan
      with:
        maximum: 10
      rule: |
        changes = 0
        for resource in ctx.input.get("resource_changes", []):
            if resource["mode"] == "managed" and resource["change"]["actions"] != ["no-op"]:
                changes += 1
        return "resource_changes" in ctx.input and changes > ctx.params["maximum"]