Policy Engine
The Policy Engine lets your team apply governance rules to cloud-resource provisioning. Every time a resource is created, updated, or imported, Atmosly evaluates it against your active policies and either allows it, warns, blocks it, or routes it for approval.
Policies govern Cloud Resources — they are separate from Guardrails (which govern Kubernetes cluster actions).
Navigating to the Policy Engine
The Policy Engine lives under Settings → Policy Engine. It has two tabs:
| Tab | What it contains |
|---|---|
| Templates | A catalog of built-in, ready-to-use policy templates grouped by category. This is where you create policies. |
| Active Policies | The policies currently in effect for your organization, with their scope and enforcement. |
The Policy Engine requires the View Cloud Resource permission (the same permission that gates Cloud Resources).
How Policies Work
A policy is a governance rule with the following attributes:
| Attribute | Description |
|---|---|
| Category | Security, Cost, Compliance, Naming, Tagging, or Approval |
| Rule type | The specific check the policy performs (see below) |
| Enforcement | Block (Hard) — rejects a violating request; Warn (Soft) — allows it but flags a warning. Approval-category policies instead route the request for review. |
| Provider scope | Applies to all providers, or only AWS / only GCP |
| Applicable services | The resource types the policy applies to (empty = all types) |
| Cloud accounts | The accounts the policy applies to (empty = all accounts) |
| Priority | Lower number = higher priority when multiple policies apply |
| Active | Whether the policy is currently enforced |
Rule Types
Governance rules:
- Security — require encryption at rest, require encryption in transit, block public access, require deletion protection
- Cost / sizing — limit maximum instance size, restrict storage size, restrict storage type
- Compliance — restrict allowed regions, restrict allowed resource types, restrict engine versions, require backups
- Naming & tagging — enforce a naming convention, require specific tags
Approval rules (route a request for human review instead of blocking outright):
- Always require approval
- Require approval above a cost threshold — when the estimated monthly cost exceeds a set amount
- Require approval when tags match a condition
- Require approval for the first resource of its kind
Creating Policies
Policies are created from templates — battle-tested guardrails you can adopt and then tune:
- Go to Settings → Policy Engine → Templates.
- Browse the templates, grouped by category. Each card shows its enforcement (Block or Warn).
- Select one or more templates and click Apply selected. This seeds them as active policies for your organization.
Once seeded, open a policy from Active Policies to scope and tune it.
Scoping & Tuning a Policy
From a policy's detail page you can adjust:
- Enforcement — switch between Block (Hard) and Warn (Soft)
- Active — turn the policy on or off
- Priority — 1–1000 (lower = higher priority)
- Cloud accounts — limit the policy to specific accounts (leave empty to apply org-wide)
- Applicable services — limit the policy to specific resource types (leave empty to apply to all)
- Rule parameters — the specific values the rule checks (e.g., the allowed regions, the required tags, the cost threshold)
You can also Clone a policy or Remove it.
Enforcement Outcomes
When a resource is provisioned, updated, or imported, each applicable policy produces a verdict:
| Verdict | Meaning |
|---|---|
| Passed | The resource satisfies the policy. |
| Warning | A soft (Warn) policy was violated — the operation is allowed, but flagged. |
| Violated | A hard (Block) policy was violated — the operation is rejected. |
Approval-category policies route the request to a Pending Approval state, where an authorized user approves or rejects it (optionally with notes).
Where Results Appear
- During provisioning — the Review step and violation alerts show which policies would block or warn before you submit.
- On the resource — the Policies tab on a resource's detail page shows the latest evaluation: which policies were checked, their category, rule type, enforcement, verdict, and message, along with an evaluation history.
Policy evaluations are recorded at create/update/import time. The Policies tab reflects the result of the most recent operation on the resource rather than re-running checks live.