Weighted plan change budget
Limit changes, charging more for deletions and replacements.
The plan exceeds the permitted change budget
apiVersion: atmos/v1
kind: Policy
metadata:
name: terraform-starlark-change-budget
description: Limit a plan's change budget, charging more for deletions and replacements.
spec:
policies:
change-budget:
on: terraform.plan
engine: cel
action: deny
reason: The plan exceeds the permitted change budget
with:
maximum: 5
deletion_weight: 3
rule: |
((has(input.resource_changes) ? input.resource_changes : []).filter(r,
r.mode == 'managed' && 'delete' in r.change.actions).size() * params.deletion_weight +
(has(input.resource_changes) ? input.resource_changes : []).filter(r,
r.mode == 'managed' && !('delete' in r.change.actions) &&
r.change.actions != ['no-op']).size()) > params.maximum
1 Configure
maximum: 5. deletion_weight: 3.
Each managed resource with a delete action costs deletion_weight points (default 3), including
replacement in either order. Other changed managed resources cost one point. No-op resources and
data reads cost zero. A plan passes while its total is at most maximum. The budget applies to one
plan, not multiple component runs.
2 Save
Save the CEL policy as policy.d/terraform-starlark-change-budget.yaml. Install only one implementation of each policy.
Atmos discovers policy.d/ at the project root selected by atmos.yaml discovery. Set ATMOS_POLICY_DIR to use another directory.
3 Run
Replace <component> and <stack> with your target.
atmos terraform plan <component> -s <stack>
Review required tools and callback settings before running. In CI, load policies from a protected, pinned revision. See enforcement configuration.
