apiVersion: atmos/v1
kind: Policy
metadata:
  name: terraform-protect-stateful-resources
  description: "Reject deletion or replacement of selected stateful resource types."
spec:
  policies:
    protect-stateful-resources:
      on: terraform.plan
      engine: starlark
      action: deny
      reason: Stateful resources must not be deleted or replaced
      with:
        types:
          - aws_db_instance
          - aws_rds_cluster
          - aws_s3_bucket
      rule: |
        for resource in ctx.input.get("resource_changes", []):
            if resource["mode"] == "managed" and resource["type"] in ctx.params["types"] and "delete" in resource["change"]["actions"]:
                return True
        return False