Terraform remains a standard for infrastructure as code, yet managing Terraform at scale introduces complexity that teams must resolve. The rise of Terraform Automation and Collaboration Software has created a category of tools designed to reduce that complexity. Atlantis is an open source Terraform automation tool that streamlines infrastructure changes through pull request workflows. The tool automates Terraform plan and apply operations while providing centralized execution, state management, and governance controls. As a Cloud Native Computing Foundation sandbox project with Apache 2.0 licensing, Atlantis has established itself as the leading self-hosted alternative to commercial Terraform automation platforms. Its primary value proposition lies in enabling organizations to implement collaborative infrastructure-as-code workflows while maintaining complete control over their deployment environment and sensitive credentials.
Atlantis is free and open source under the Apache 2.0 license. It can be self-hosted without any licensing cost, making it a popular choice for teams automating Terraform pull request workflows. Some companies offer paid support or hosted versions, but the core tool itself is free. The project has a healthy contribution history and is widely used in production at organizations of all sizes. It does not have commercial backing, so critical fixes depend on community contributors and pull request reviewers.
What Atlantis is and why it exists
Atlantis is an automation tool that enhances the PR workflows for Terraform projects. It is used to reduce the complexity of collaboration and governance for your Terraform workflow. The tool is open source and does not offer any SaaS, so you will have to install and configure it yourself.
With Atlantis, you get support for multiple VCS providers such as GitHub, Bitbucket, GitLab, and Azure DevOps, and you can leverage both Terraform and Terragrunt workflows. Atlantis runs as a golang binary or Docker image and you can deploy it on VMs, Kubernetes, Fargate, etc. It is a better, more flexible CI/CD for Terraform, offering maximum security without sacrificing functionality.
The focus of Atlantis addresses core challenges in collaborative infrastructure management by preventing state file corruption, eliminating race conditions between concurrent changes, and providing comprehensive audit trails of all infrastructure modifications. The tool removes the risks associated with executing Terraform commands on individual developer machines while enabling broader team participation in infrastructure changes through familiar pull request workflows. It serves platform engineering teams seeking to implement standardized processes for infrastructure changes while maintaining security and compliance requirements.
How Atlantis works in a pull request flow
Atlantis offers a structured approach that ensures infrastructure changes are made in a controlled, transparent, and collaborative manner, integrating seamlessly with the existing pull request workflow used by development teams.
Initialization is the first step. You need to install and configure Atlantis in your environment. It can be configured either on-premise, or in a cloud environment. There are various ways to install it.
The typical workflow proceeds as follows:
- A developer opens a pull request that contains Terraform changes
- Atlantis detects the pull request and runs terraform plan automatically
- Atlantis adds the plan results as a comment on the PR
- If the run is discarded, the process stops at this point
- If the review ends with an approval, you can run atlantis apply via a PR comment
- Atlantis will run terraform apply behind the scenes and comment the output on the PR
- If everything is successful, you can merge the pull request and delete the feature/hotfix branch
The main benefit of using Atlantis with Terraform is that it enables automated Terraform operations via pull requests, enforcing infrastructure-as-code workflows through Git. When a PR is opened, Atlantis runs plan, adds results as a comment, and applies changes only after review and approval, reducing risk and improving collaboration.
Atlantis and GitHub are a natural pairing for Terraform automation. Developers open pull requests, Atlantis plans automatically, and applies happen through PR comments.
Core benefits and use cases
The main focus of Atlantis is to extend Terraform's capabilities when working in a team. It ensures changes are collaborative, auditable, and consistent.
- Enhanced collaboration: Atlantis fosters better collaboration among team members by integrating with version control systems. It provides a centralized platform for code review and feedback, ensuring a structured and efficient workflow.
- Pull request management: Atlantis excels in managing pull requests within your VCS. It enables the automatic triggering of Terraform commands within the context of pull requests, allowing reviewers to make thorough decisions when there are infrastructure changes.
- Automation and consistency: It automates Terraform workflows and maintains consistency across different environments. Terraform commands are automated, and this reduces the need for manual intervention and minimizes human error.
- Integration with CI/CD systems: Atlantis can be seamlessly integrated into CI/CD systems, enabling IaC CI/CD
Deployment options and self-hosted control
Atlantis is self-hosted, open source, and Git-comment-driven. Because it runs as a binary or container, teams choose the deployment model that matches their security and operational requirements.
Common deployment targets include:
- Virtual machines
- Kubernetes
- AWS Fargate
- Google Compute Engine with a Terraform module that deploys resources to run Atlantis
The Google Compute Engine module provides a reference implementation for production ready deployment. Feature highlights include:
| Feature | Description |
|---|---|
| Container-Optimized OS | Atlantis runs as a Docker container on a container optimized VM |
| Managed Instance Group | The VM instance is part of a MIG, this ensures Atlantis is always up and running |
| External HTTPS Load Balancer | A Layer 7 load balancer is created together with a managed SSL certificate for the provided domain |
| Identity-Aware Proxy | The Atlantis UI can be protected by Google Cloud Identity-Aware Proxy, this adds an additional layer of security by requiring users to authenticate with their Google account |
| Custom port | The module features the ability to run Atlantis on a custom port, simply set ATLANTIS_PORT environment variable |
| Separate Persistent Data Disk | The VM instance has a separate attached persistent data disk attached to it to ensure Atlantis data is persisted and not lost if the VM is deleted or terminated |
| Shielded VM | A Shielded VM is a VM that's hardened by a set of security controls that help defend against rootkits and bootkits |
Configuration for the port can be expressed as environment variables:
ATLANTIS_PORT=8080
This allows the service to run on a non-default port while the load balancer fronts it with HTTPS.
Service account, DNS record, Identity-Aware Proxy, and other prerequisites are documented as part of the module's configuration steps.
Atlantis versus managed alternatives
What's the difference between Atlantis and Terraform Cloud / HCP Terraform?
| Aspect | Atlantis | Terraform Cloud / HCP Terraform |
|---|---|---|
| Hosting model | Self-hosted, open source | HashiCorp managed offering |
| Licensing | Apache 2.0, free to self-host | Per-seat pricing |
| Interface | Git-comment-driven | Web UI |
| Policy features | Governance via workflow and external controls | Private module registry and Sentinel policy engine |
| Trigger model | Runs on PR events and comment triggers | Runs on pushes to specific branches in addition to API-triggered runs |
| Execution control | Gives more control over execution environment | Abstracts server management away |
Atlantis gives you more control over the execution environment; Terraform Cloud abstracts the server management away. The core automation model differs too: Atlantis runs on PR events and comment triggers; Terraform Cloud runs on pushes to specific branches in addition to API-triggered runs.
OpenTofu compatibility
Does Atlantis work with OpenTofu? Yes. Atlantis treats OpenTofu as a drop-in replacement for Terraform at the execution layer. Install the OpenTofu binary on your Atlantis server, set ATLANTISDEFAULTTFVERSION to point to it, or use the terraformversion field in atlantis.yaml, and plan and apply commands run against OpenTofu. Locking, commenting, and approval mechanics are identical.
An example configuration snippet for version selection:
ATLANTIS_DEFAULT_TF_VERSION=opentoofu
This allows teams to migrate runtimes without changing pull request workflows.
Operational considerations
Because Atlantis is self-hosted, organizations retain complete control over their deployment environment and sensitive credentials. Centralized execution prevents state file corruption and eliminates race conditions between concurrent changes. Comprehensive audit trails of all infrastructure modifications are generated through PR comments and VCS history.
The tool removes the risks associated with executing Terraform commands on individual developer machines while enabling broader team participation in infrastructure changes through familiar pull request workflows. Platform engineering teams can implement standardized processes for infrastructure changes while maintaining security and compliance requirements.
Conclusion
Atlantis delivers a self-hosted, community driven approach to Terraform automation that prioritizes control, auditability, and collaborative review. By binding Terraform plan and apply to pull request lifecycle events, it enforces a transparent workflow where changes are reviewed, planned, approved, and applied in a single auditable trail. The open source Apache 2.0 license and Cloud Native Computing Foundation sandbox status provide a governance model that avoids vendor lock-in while supporting multiple VCS providers and both Terraform and Terragrunt workflows.
The practical value shows in production deployments where state safety, race condition prevention, and centralized execution matter. The Google Compute Engine module illustrates how teams operationalize Atlantis with hardened VMs, managed instance groups, persistent disks, and identity aware access. Compatibility with OpenTofu extends the runtime choice without altering workflow mechanics.
For organizations that require full ownership of credentials and execution environments and prefer Git-comment driven automation over a managed web console, Atlantis offers a mature, widely adopted path to collaborative infrastructure as code. The trade off is self-management of the service, which is acceptable for platform engineering teams that already operate self-hosted tooling and value the ability to tailor security, networking, and availability to internal standards.