Ability to disable arbitrary terraform command arguments

[sw-carlin]

Being able to add arbitrary arguments to the Atlantis apply comment makes it fairly easy to circumvent access restrictions to protected environments. We should be able to disable this feature.

[lkysow]

Hi, can you elaborate on what you mean by this? Do you mean how you can add atlantis apply -- -var-file=foo? How does this allow access to protected environments (not saying it doesn't, just want to know the mechanism). Thanks!

[sw-carlin]

In the case of my project, we're supplying the environment name as a terraform variable. So you could write something like atlantis apply -- -var="env=prod" and bam, they've deployed to prod.

[mechastorm]

@sw-carlin Would this be similar to another feature request I am also proposing at #113 ?

[sw-carlin]

That's definitely related as they are using a similar multi-envrionment setup. I have decided that if my team uses Atlantis we'll convert to using workspaces which I guess solves this issue for us.

[lkysow]

This can be achieved via a custom workflow that doesn't use the built-in commands and so won't allow the extra args to be applied:

workflows:
  custom:
    apply:
      steps:
      - run: terraform apply -out $PLANFILE