Atlantis — Terraform Pull Request Automation for Teams

What it is

Atlantis is a self-hosted application that automates Terraform workflows through pull requests. When you open a PR that modifies Terraform code, Atlantis automatically runs terraform plan and posts the output as a PR comment. Team members review the plan, and when approved, comment atlantis apply to execute the changes.

Atlantis targets infrastructure teams that want peer review for Terraform changes. It enforces a workflow where no infrastructure change happens without a plan being reviewed in a pull request.

How it saves time or tokens

Atlantis eliminates the manual cycle of running terraform plan locally, pasting output into a PR, and then running terraform apply from a local machine. It also prevents the 'who ran apply last' problem by locking workspaces to specific PRs.

The audit trail is automatic. Every plan and apply is recorded in the PR history, making compliance and post-incident analysis straightforward.

How to use

1. Deploy the Atlantis server:

atlantis server \
  --atlantis-url='https://atlantis.example.com' \
  --gh-user='atlantis-bot' \
  --gh-token='ghp_xxx' \
  --repo-allowlist='github.com/myorg/*'

1. Add an atlantis.yaml to your Terraform repository:

version: 3
projects:
  - name: production
    dir: environments/production
    workflow: default
    autoplan:
      when_modified: ['*.tf', '*.tfvars']
      enabled: true

1. Open a PR modifying Terraform files. Atlantis posts the plan automatically. Comment atlantis apply to execute.

Example

Atlantis workflow with custom plan and apply steps:

version: 3
workflows:
  custom:
    plan:
      steps:
        - run: terraform fmt -check
        - init
        - plan
    apply:
      steps:
        - run: echo 'Applying to production'
        - apply
projects:
  - name: prod
    dir: environments/prod
    workflow: custom

Custom steps let you add linting, cost estimation (infracost), or policy checks (OPA/Conftest) before plan or apply.

Related on TokRepo

• AI tools for DevOps -- Infrastructure automation and CI/CD tools
• AI tools for automation -- Workflow automation for development teams

Common pitfalls

• Not configuring workspace locking. Without locking, two PRs modifying the same Terraform state can conflict. Atlantis locks workspaces by default, but verify the behavior in your configuration.
• Running Atlantis without HTTPS. Atlantis receives webhook payloads from GitHub/GitLab. Without HTTPS and webhook secrets, attackers could trigger arbitrary Terraform commands.
• Storing Terraform state in the Atlantis server. Atlantis does not manage state. Use a remote backend (S3, GCS, Terraform Cloud) for state storage.