Terraform Atlantis Pull Request Automation

Developer opens PR → Atlantis runs terraform plan → Posts plan as PR comment
                                                          ↓
                                    Reviewer approves → Comment "atlantis apply" → Applied

# Docker
docker run -p 4141:4141 \
  ghcr.io/runatlantis/atlantis:latest server \
  --gh-user=atlantis-bot \
  --gh-token=ghp_xxx \
  --gh-webhook-secret=webhook-secret \
  --repo-allowlist='github.com/myorg/*'

# Kubernetes Helm
helm install atlantis runatlantis/atlantis \
  --set github.user=atlantis-bot \
  --set github.token=ghp_xxx \
  --set github.secret=webhook-secret \
  --set orgAllowlist='github.com/myorg/*'

Ran Plan for dir: `environments/production`

<details>
<summary>Show Output</summary>

Terraform will perform the following actions:

  # aws_instance.web will be updated in-place
  ~ resource "aws_instance" "web" {
      ~ instance_type = "t3.medium" -> "t3.large"
    }

Plan: 0 to add, 1 to change, 0 to destroy.
</details>

* :arrow_forward: To **apply** this plan, comment: `atlantis apply -d environments/production`

# atlantis.yaml (in repo root)
version: 3
projects:
  - name: production
    dir: environments/production
    workflow: default
    autoplan:
      when_modified: ["*.tf", "*.tfvars", "../modules/**/*.tf"]
      enabled: true
    apply_requirements: [approved, mergeable]

  - name: staging
    dir: environments/staging
    workflow: default
    autoplan:
      when_modified: ["*.tf", "*.tfvars", "../modules/**/*.tf"]
      enabled: true

⚠️ This project is currently locked by PR #42.
Wait for that PR to be merged or closed.

# repos.yaml (server-side)
repos:
  - id: github.com/myorg/*
    apply_requirements: [approved, mergeable]
    allowed_overrides: [workflow]
    allow_custom_workflows: true

  - id: github.com/myorg/infrastructure
    apply_requirements: [approved, mergeable, undiverged]
    workflow: production
    
workflows:
  production:
    plan:
      steps:
        - init
        - run: tflint
        - plan
    apply:
      steps:
        - apply

# Use IRSA on EKS
serviceAccount:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456:role/atlantis

# Or Workload Identity on GKE
serviceAccount:
  annotations:
    iam.gke.io/gcp-service-account: atlantis@project.iam.gserviceaccount.com