Note 11

Nobody applies from a laptop

Infrastructure delivery through Atlantis: a plan for every changed stack on the pull request, checked against security policy, applied only after approval, nightly drift detection, and a supply chain signed end to end.

CI/CD
Atlantis
Terraform
Terramate
AWS
Security

In the platform: Launch package · CI/CD module, also sold on its own
Experience behind it: Designed the CI roles and the reusable pipeline library with its versioning. The baseline adds Atlantis with policy checks, image signing and admission-time verification.

What CI applies were missing

Moving applies from laptops to CI removes credentials from laptops. It does not guarantee that the plan a reviewer approved is the plan that runs, and security rules live only in reviewers' heads.

How the platform applies

Atlantis plans every changed stack and posts the plan to the pull request. Projects are generated from the Terramate stack list, so the order follows the stacks' dependencies.
Each plan is checked with conftest before it may be applied: protected resources cannot be destroyed without an earlier, reviewed allow-destroy tag; open ingress, wildcard IAM, unencrypted storage and public buckets fail.
Apply requires an approving review, a mergeable pull request and a branch up to date with main, and applies exactly the saved plan.
Atlantis has its own workload identity that may only assume a plan role and an apply role in each account. No keys.

deny contains msg if {
  some rc in input.resource_changes
  rc.type in protected
  "delete" in rc.change.actions
  object.get(object.get(rc.change.before, "tags", {}), "allow-destroy", "false") != "true"
  msg := sprintf("%s would be destroyed; tag it allow-destroy=true in a reviewed change first", [rc.address])
}

The policies live in the image

If the policies were read from the repository, a pull request could change the policy that checks it. They are baked into the Atlantis image instead, built and signed by CI; a policy change is a new image, reviewed like any other change. Overrides exist, but only the policy owners can approve one, and the approval is recorded on the pull request.

What it changes

The plan a reviewer approves is the plan that runs, and security rules are enforced on the plan itself rather than remembered by reviewers. Drift is found the next morning instead of during the next incident.

Next: Three products from one repository with Terramate All notes ←

Start a conversation

Bring your infrastructure
into focus.

Tell me what you are building, operating, or trying to improve.

Let’s talk