POLICY
Limit resource changes
Cap the number of changed managed resources in one Terraform plan.
Policy reason
Too many managed resources change in this plan
policy.d/terraform-limit-change-count.yaml
apiVersion: atmos/v1
kind: Policy
metadata:
name: terraform-limit-change-count
description: "Cap the number of changed managed resources in one Terraform plan."
spec:
policies:
limit-change-count:
on: terraform.plan
action: deny
reason: Too many managed resources change in this plan
with:
maximum: 10
rule: >-
has(input.resource_changes) && input.resource_changes.filter(r,
r.mode == 'managed' && r.change.actions != ['no-op']).size() > params.maximum
1 Configure
maximum: 10.
Plans with up to maximum changed resources pass; a plan with more is denied. Count is per resource
change, not per action; a replacement counts once.
2 Save
Save the CEL policy as policy.d/terraform-limit-change-count.yaml. Install only one implementation of each policy.
Atmos discovers policy.d/ at the project root selected by atmos.yaml discovery. Set ATMOS_POLICY_DIR to use another directory.
3 Run
Replace <component> and <stack> with your target.
atmos terraform plan <component> -s <stack>
Review required tools and callback settings before running. In CI, load policies from a protected, pinned revision. See enforcement configuration.
