Everyone can Plan but SRE can only Apply
Terrateam Configuration
Terrateam behavior can be configured via a config.yml. This file is located in
a directory named .terrateam at the root of your Terraform repository:
.terrateam/config.yml.
See Configuration documentation for details.
Allow anyone to trigger a Plan operation but only allow members of the SRE team to trigger an Apply operation.
access_control:
policies:
- tag_query: ''
plan: ['*']
apply: ['team:sre']