Nobody applies from a laptop

The problem

Applies from laptops mean unreviewed changes, credentials on laptops and no record of what was applied when. Console fixes become the new normal until the next apply silently reverts them.

The approach

Atlantis plans every changed stack and posts the plan to the pull request, in the order the stacks depend on each other. Each plan is checked with conftest before it may be applied: protected resources cannot be destroyed, and open ingress, wildcard IAM, unencrypted storage and public buckets fail the check. Apply needs an approving review, a mergeable and up-to-date branch, and applies exactly the plan that was reviewed. The policies are baked into the Atlantis image, so a pull request cannot weaken the policy that checks it.

Identity

No keys anywhere. Atlantis runs with its own workload identity, which may only assume a plan role and an apply role in each account; CI publishes images through OIDC roles trusted only from release tags. A nightly plan of every stack opens one issue per drifted stack.

Supply chain

Third-party actions are pinned to commit SHAs; tool versions come from one file for laptops and CI alike. Images are built, scanned, given an SBOM and signed with keyless cosign; the cluster admits only images signed by the organization's release workflow. Build steps run with an allowlisted environment, so a dependency's install script never sees cloud credentials or the job token.

What changed

The plan a reviewer approves is the plan that runs, and security rules are enforced on the plan itself rather than remembered by reviewers. Drift is found the next morning instead of during the next incident.

Described as a pattern: names, numbers of systems and identifiers from the environments where this was built are left out.