apiVersion: atmos/v1
kind: Policy
metadata:
  name: terraform-protect-stateful-resources
  description: "Reject deletion or replacement of selected stateful resource types."
spec:
  policies:
    protect-stateful-resources:
      on: terraform.plan
      action: deny
      reason: Stateful resources must not be deleted or replaced
      with:
        types:
          - aws_db_instance
          - aws_rds_cluster
          - aws_s3_bucket
      rule: >-
        has(input.resource_changes) && input.resource_changes.exists(r,
          r.mode == 'managed' && r.type in params.types && 'delete' in r.change.actions)