Atlantis, and a policy a pull request cannot weaken

What CI applies were missing

Moving applies from laptops to CI removes credentials from laptops. It does not guarantee that the plan a reviewer approved is the plan that runs, and security rules live only in reviewers' heads.

How the platform applies

• Atlantis plans every changed stack and posts the plan to the pull request. Projects are generated from the Terramate stack list, so the order follows the stacks' dependencies.
• Each plan is checked with conftest before it may be applied: protected resources cannot be destroyed without an earlier, reviewed allow-destroy tag; open ingress, wildcard IAM, unencrypted storage and public buckets fail.
• Apply requires an approving review, a mergeable pull request and a branch up to date with main, and applies exactly the saved plan.
• Atlantis has its own workload identity that may only assume a plan role and an apply role in each account. No keys.

deny contains msg if {
  some rc in input.resource_changes
  rc.type in protected
  "delete" in rc.change.actions
  object.get(object.get(rc.change.before, "tags", {}), "allow-destroy", "false") != "true"
  msg := sprintf("%s would be destroyed; tag it allow-destroy=true in a reviewed change first", [rc.address])
}

The policies live in the image

If the policies were read from the repository, a pull request could change the policy that checks it. They are baked into the Atlantis image instead, built and signed by CI; a policy change is a new image, reviewed like any other change. Overrides exist, but only the policy owners can approve one, and the approval is recorded on the pull request.