Two Approaches to Terraform Automation
Running Terraform from developer laptops is a governance nightmare. Who ran what, when, against which state? Did they use the right variable files? Were they authenticated with the right credentials? These questions get harder to answer as team size grows.
From our experience, Atlantis and Terraform Cloud both solve this by moving Terraform execution into an automated pipeline triggered by pull requests. But they solve it in very different ways, and the choice between them affects your daily workflow more than most comparison articles suggest.
Atlantis: Self-Hosted, PR-Driven Terraform
Here is where things get interesting -- Atlantis is an open-source Go application that watches your GitHub/GitLab/Bitbucket repositories for pull requests that modify Terraform files. When it detects a change, it runs terraform plan and posts the output as a PR comment. Engineers review the plan, and when approved, someone comments atlantis apply to execute the change.
A common scenario: The entire conversation happens in the PR. Plan output, approval, apply output, error messages — all visible in the same thread where the code review is happening. I've found this workflow to be exceptionally clear. New engineers understand it immediately because it maps directly to the code review process they already know.
# atlantis.yaml (repo-level config)
version: 3
projects:
- name: networking-prod
dir: infrastructure/networking
workspace: prod
autoplan:
enabled: true
when_modified:
- "*.tf"
- "*.tfvars"
apply_requirements:
- approved
- mergeable
- name: compute-prod
dir: infrastructure/compute
workspace: prod
autoplan:
enabled: true
when_modified:
- "*.tf"
apply_requirements:
- approvedHere is where things get interesting -- The apply_requirements section is where governance lives. You can require PR approval, passing status checks, and merge eligibility before allowing anyone to run apply. Combined with GitHub's CODEOWNERS file, this creates a solid approval chain: the networking team must approve networking changes, the security team must approve security group changes, etc.
Terraform Cloud: Managed Everything
On the practical side, Terraform Cloud is HashiCorp's managed platform. It handles state storage, locking, plan execution, policy enforcement (via Sentinel or OPA), variable management, and a web UI for reviewing runs. The GitHub integration triggers plans on PRs, similar to Atlantis.
Here is where things get interesting -- The key difference is operational overhead. Atlantis is a server you run, monitor, upgrade, and secure. Terraform Cloud is a SaaS product. For small teams, this tradeoff heavily favors Terraform Cloud — you don't have an ops engineer to babysit an Atlantis deployment. For larger organizations, the calculus shifts because Terraform Cloud's pricing scales with resource count, and you probably already have the infrastructure to run Atlantis reliably.
Cost Comparison for a Real Workload
Our team manages about 2,000 Terraform resources across 15 workspaces. Here's what each option costs us:
As a concrete example, Atlantis: One t3.large EC2 instance ($60/month), an ALB ($16/month), and the engineering time to keep it updated and monitored (roughly 2 hours per month). Total: ~$100/month plus engineering time.
In production, Terraform Cloud Team tier: $20/user/month for 12 users, plus $0.00014/resource/hour for managed resources. For our scale, that's about $450/month. The Plus tier adds SSO, audit logging, and policy enforcement — features that larger organizations can't skip — and costs significantly more.
The cost alone doesn't tell the whole story. Terraform Cloud's run UI is genuinely better than reading plan output in a PR comment. The variable management eliminates the "where do secrets live" problem. The audit log satisfies compliance requirements without additional tooling. Whether that's worth 4x the dollar cost depends on your team's constraints.
Policy Enforcement: Where They Diverge Most
On the practical side, Atlantis delegates policy enforcement to external tools. You can run Checkov, OPA, or custom scripts as pre-plan or pre-apply hooks. This is flexible but requires you to build and maintain the integration yourself. I've seen teams wire up conftest (OPA for Terraform plans) to Atlantis and it works well, but it's another piece of infrastructure to maintain.
In production, Terraform Cloud includes Sentinel (HashiCorp's policy language) or OPA integration natively. Policies run automatically between plan and apply, and policy failures block the apply with a clear explanation. The feedback loop is tighter because everything lives in one platform.
# Sentinel policy example (Terraform Cloud)
import "tfplan/v2" as tfplan
main = rule {
all tfplan.resource_changes as _, rc {
rc.type is "aws_s3_bucket" implies
rc.change.after.server_side_encryption_configuration is not null
}
}Sentinel's language is unique to HashiCorp's ecosystem. If you're already invested in OPA for Kubernetes admission control, API gateway policies, and other non-Terraform use cases, running OPA through Atlantis keeps your policy language unified. If Terraform is your only policy enforcement point, Sentinel's tight integration with Terraform Cloud is hard to beat.
Scaling Considerations
For reference, Atlantis runs one plan/apply at a time per workspace by default. For teams with many workspaces and frequent changes, this creates a queue. You can scale Atlantis horizontally with multiple instances behind a load balancer, but you need to coordinate which instance handles which workspace to avoid lock conflicts.
At this point, Terraform Cloud runs plans in isolated containers and can handle concurrent runs natively. You don't think about scaling the execution layer — HashiCorp handles it. For organizations running hundreds of applies per day, this is a meaningful operational advantage.
The team I work with runs about 30-40 applies per day. Atlantis handles this fine on a single instance with parallel plan execution enabled. If we hit 100+ daily applies, I'd seriously evaluate Terraform Cloud or a scaled Atlantis deployment with dedicated workers per workspace group.
My Recommendation
Start with Terraform Cloud if you're a team of fewer than 10 engineers and don't have dedicated operations capacity. The managed service eliminates a class of operational problems you shouldn't spend time on at that scale.
Evaluate Atlantis when you need cost control at scale, have specific compliance requirements that Terraform Cloud's multi-tenant SaaS model doesn't satisfy, or want to keep all automation self-hosted. The PR-based workflow is genuinely excellent, and the operational overhead is manageable for teams that already run their own CI infrastructure.
Don't discount the hybrid approach: Terraform Cloud for state management and variable storage, with CI-driven plans that bypass Terraform Cloud's run infrastructure. HashiCorp documents this pattern (they call it "CLI-driven runs"), and it gives you managed state without managed execution pricing.
Operational Day Two: Maintenance and Upgrades
Choosing between Atlantis and Terraform Cloud isn't just about initial setup. The ongoing maintenance burden differs significantly, and that's where the real cost shows up over a year or two.
Atlantis needs regular upgrades. The project releases new versions roughly monthly, and because Atlantis runs as a server in your infrastructure, upgrading means planning a deployment, testing in staging, and rolling to production. Terraform Cloud upgrades automatically — HashiCorp handles the deployment, and you get new features without downtime or effort. For a team that's already stretched thin on operations capacity, this difference matters more than any feature comparison.
On the other hand, Atlantis's self-hosted nature means you control exactly when features change. We've seen Terraform Cloud introduce UI changes and workflow modifications that confused our team until they adjusted. With Atlantis, upgrades happen on your schedule, and you can pin to a specific version indefinitely if a new release introduces changes you're not ready for.
Security Model Differences
Atlantis runs in your infrastructure with your cloud credentials. The security perimeter is whatever you define — VPC isolation, IAM roles, webhook validation. You're responsible for securing it, but you also have full control over how it's secured.
Terraform Cloud is a SaaS product. Your Terraform state — which contains resource IDs, IP addresses, and sometimes sensitive outputs — lives on HashiCorp's servers. For many organizations, this is fine. Their security controls are well-documented and regularly audited. For organizations with strict data residency requirements or regulatory constraints that prohibit storing infrastructure metadata in third-party services, it's a non-starter.
Terraform Cloud's agent mode offers a middle ground: the Terraform execution happens in your infrastructure via agents you deploy, while state management and the UI remain in HashiCorp's cloud. This satisfies teams that don't want cloud credentials leaving their network while still benefiting from the managed UI and state handling.