Skip to main content

Allow Policies Attached to Modules to Run on Stacks that Use Them

Feature RequestsPolicies

We would like policies, such as plan or approval, that are attached to modules to have the option to be run/evaluated on stacks that use them.

You can attach policies to stacks via labels but our internal users can specify their own labels and using autoattach:* feels clunky here. We are looking to gate specific modules with security or devops approval specifically without interfering with the end user flow much at all.

Workaround
label autoattach:*
Problem
Status: ❌ Rejected2 comments

Log in to comment and vote

Comments2

  • Aleksandra Cieslak

    Team•

    Jun 1

    Hi @Dan Ballard,

    Thanks for the detailed request! This is a well-scoped problem.

    At this point, we're not planning to build module-level policy propagation, largely because the current label-based approach (using autoattach) does cover the core need as a workaround. We know it's not the most elegant solution, but it's something that can be made to work in the meantime.

    That said, we're actively gauging interest in this area, so your feedback is valuable. If the workaround is causing real friction or leaving compliance gaps for your team, we'd love to hear more about that.

    Thanks again for taking the time to raise this.

    • Yellow Chili

      •

      Jun 8

      @Aleksandra Cieslak The latter is exactly why I raised this. Having to autoattach:* for thousands of stacks and then create logic that scopes them isn’t streamlined for us. We have users create stacks and we cannot control what labels they add or (don’t). This creates real friction and I have to justify to infosec why every policy runs on every stack.

      The only thing we can control is them using our modules and thus we would like policies that run on usage of specific modules that are infosec/compliance/devops requirements.