Stack policies
Enforce and automate infrastructure stack approvals with Rego
Stack policies evaluate infrastructure plans before an approval-gated stack run proceeds. They can reject a run that violates a guardrail, automatically approve a known-safe plan, or leave the run undecided so it continues to the configured human or AI approval flow.
Stack policies use the plrl.stack Rego package.
Supported input
Plural evaluates a stack policy with the following top-level input:
Field | Description |
|---|---|
input.plan | A reduced Terraform plan containing terraform_version and resource_changes |
input.run_type | The run operation: plan, apply, or destroy |
input.stack | Stack metadata, including its name, project, and Git configuration |
input.commit | Metadata for the commit associated with the run |
input.actor | The initiating user, including identity, service-account status, roles, and groups |
input.costs | Infracost resources reported for the run, or an empty array when no cost data is available |
input.violations | Vulnerability and misconfiguration findings reported for the run, or an empty array when none are available |
The input.actor object contains:
Field | Type | Description |
|---|---|---|
id | string | User ID |
name | string | User display name |
email | string | User email address |
service_account | boolean | Whether the actor is a service account |
roles.admin | boolean | Whether the actor is a Plural administrator |
groups | string array | Names of the groups the actor belongs to |
Each entry in input.plan.resource_changes contains:
Field | Description |
|---|---|
address | Full Terraform resource address |
type | Terraform resource type, such as aws_eks_cluster |
name | Resource name |
provider_name | Short provider name |
change.actions | Planned actions, such as create, update, delete, or replace |
change.before | Resource state before the run |
change.after | Expected resource state after the run |