infracost

Approving Terraform changes blind? Atlantis posts the plan Atlantis is open-source (Apache 2.0) Terraform pull request automation: a self-hosted Go server that runs terraform plan and apply from your pull requests and posts the output as a comment, so the team reviews the real plan before anything changes. It works with GitHub, GitLab, Bitbucket, Azure DevOps and Gitea, and with Terraform or OpenTofu. A pull-request (GitOps-style) workflow for infrastructure as code: plan, review, approve and apply in one place, with locks so two pull requests can't change the same folder at once. In this video: - The problem: a one-line Terraform change is approved, but the plan only ever ran on one laptop - How Atlantis works: webhooks, terraform plan, and comment commands like atlantis apply - 3 real uses from the docs: plans in review (autoplan), locks, and rules before apply - The catch: credentials, code that runs during plan, internet exposure, remote state, maturity - Who it's for, a complementary tool, and how to try it How it works: you run Atlantis on your own server and add a webhook to your repo. When a pull request touches .tf or .tofu files, Atlantis runs terraform plan in the changed folders and comments the output. Comment atlantis apply and it runs terraform apply and posts that result too. Other comment commands include atlantis plan -d with a folder name, atlantis unlock and atlantis help. Three real uses (from the Atlantis docs): 1. Plans in review: on every new pull request or new commit, Atlantis plans the folders with modified Terraform files (autoplan), and the plan shows up as a comment and a status check. 2. Locks: when a plan runs, that folder and Terraform workspace are locked to the pull request until it's merged or closed, or the plan is discarded. Another pull request that tries to plan it gets "This project is currently locked by #1" with a link. Only that folder and workspace are locked, not the whole repo. 3. Rules before apply: set apply_requirements: [approved, mergeable] in the server's repos.yaml, and atlantis apply is turned down until they're met. Both are opt-in. Note: on GitHub any user with read access can approve; to require specific people, use the mergeable requirement with branch protection. The catch: Atlantis usually runs with credentials to your cloud, so the docs stress deploying it securely. A pull request can run code during terraform plan (through a malicious provider or the external data source), before any approval, so the docs warn against public repos; use the required --repo-allowlist, a webhook secret, HTTPS and web basic auth, and keep fork pull requests off (the default). With a public Git host like github.com or gitlab.com, Atlantis must be exposed to the internet. It supports every Terraform backend except local state. It has no database: plans and locks sit on its own disk, so give it a persistent disk; if that data is lost between plan and apply, you re-plan. It's still before version 1.0: 15 releases since 2025-11-11, and v0.48.1 was a security fix, so check the release notes before upgrading. Who it's for: teams that review Terraform in pull requests and want one shared place to plan and apply. Working solo, running Terraform yourself is simpler. To see cloud costs in the same pull requests, Infracost (Apache 2.0 CLI) can post cost estimates; it does a different job, not a replacement, and Infracost Cloud is its separate hosted service. Try it (from the docs): Download a release from GitHub and extract it, then run ./atlantis testdrive. It forks an example Terraform repo into your GitHub account, installs Terraform and ngrok if needed, uses ngrok to expose Atlantis to GitHub, and starts Atlantis. Use a test repo and dummy data. Next, the Testing Locally guide runs atlantis server on port 4141 against your own repo, and the Installation Guide covers a real deployment. Links: Repo: runatlantis/atlantis Docs: runatlantis.io Test Drive: runatlantis.io Locking: runatlantis.io Command requirements: runatlantis.io Security: runatlantis.io Licence: github.com/runatlantis/atlantis/blob/main/LICENSE Complementary tool: Infracost, infracost/infracost Facts checked 2026-10-20 (Atlantis v0.48.1, 9,332 GitHub stars). Atlantis is a community project powered by volunteer contributions; per its site footer, it is a Series of LF Projects, LLC. An open-source (Apache 2.0) option to consider, not an endorsement. Not affiliated with the Atlantis project, LF Projects or Infracost. Narration: AI voice. #Atlantis #Terraform #InfrastructureAsCode Chapters 0:00 Intro 0:13 The fix 0:31 How it works 0:46 Three real uses 1:07 The catch 1:28 Who it's for 1:41 Try it