You’ve outgrown Atlantis: an honest comparison

Credit where it’s overwhelmingly due. Atlantis nailed the PR-driven workflow before anyone else, and it’s still the cleanest expression of it: plans and applies happen as pull-request comments, the diff lives next to the code review, and the whole team can see it. It runs Terraform, OpenTofu, and Terragrunt.

It’s free and open source, with no per-resource, per-run, or per-seat meter — ever. It’s self-hosted, so your plans run on your infrastructure, inside your network, under your compliance boundary. For teams with hard data-residency or air-gapped requirements, that’s not a nice-to-have, it’s the requirement. It even supports policy checks through Conftest and OPA.

For a small team that wants PR automation and has someone willing to run the daemon, Atlantis is hard to beat. The strain shows up later, as the team and the infrastructure grow past what a PR bot was built to do.

Atlantis is free and open source — genuinely, with no per-resource, per-seat, or per-run meter. If acquisition cost is the whole decision, Atlantis wins it outright, and we won’t pretend otherwise.

But the license is the smallest line item. The real cost of Atlantis is operating it: the engineer who runs, patches, and scales the daemon, plus the drift detection and governance you bolt on and maintain. That cost is invisible because it never reaches an invoice — it reaches a person.

Atlantis is a self-hosted daemon that sits between your Git provider and your Terraform state. Someone has to run it: provision and scale the host, manage webhook connectivity, hold the cloud credentials it applies with, keep it patched, and keep it available — because when Atlantis is down, nobody ships infrastructure.

None of that is hard in isolation. It’s just permanent, and it’s never anyone’s actual job. The tool you adopted to reduce infrastructure toil becomes a piece of infrastructure you maintain — with the same upgrade cycles, the same on-call exposure, and the same bus factor as anything else you run.

Atlantis acts on pull requests. That’s the model, and it means Atlantis is blind between them. It has no native way to notice when live infrastructure has drifted from state — the console hotfix during an incident, the manual change nobody encoded. The most common way teams find drift with Atlantis is the worst way: a routine plan suddenly shows forty unexpected changes.

The ecosystem’s answer is to bolt it on — a scheduled CI job that runs plans against every workspace, or a third-party project like cresta/atlantis-drift-detection. Both work. Both are also more surface area you design, wire up, alert on, and maintain. Drift detection ends up being one more side project the daemon’s owner never quite has time to finish.

A plan in Atlantis is raw `terraform plan` output in a PR comment. Reviewing it means scrolling — and on a large change, the one line that matters (a resource replacement, a security group quietly widened) reads exactly like the hundred lines that don’t. Atlantis has no AI review, no risk flagging, no summary. The safeguard is a human with the patience to read all of it, every time — which, in practice, means rubber-stamping infrastructure PRs.

InfraDots puts AI agents on every plan first: they flag the risky changes, surface what wasn’t expected, and suggest fixes before a human is in the loop. The reviewer still decides — but they decide on a reviewed plan with the risks called out, not a raw diff they’re trusted to read line by line.

Atlantis covers basic policy through Conftest/OPA, but it has no granular RBAC and no real approval governance beyond what your Git provider’s branch protection gives you. For one team, that’s fine. For several teams sharing workspaces — each needing different permissions, approval chains, and audit trails — you hit the ceiling, and there’s no higher tier to buy. You either build governance around Atlantis or migrate.

That’s the through-line of every limitation here: each one is solvable, and each solution is something you build and own. At some point the sum of those side projects is bigger than the platform they’re patching.

Atlantis is the right starting point, and the right permanent home for teams that genuinely need self-hosted. Its PR workflow is so good that the whole category, InfraDots included, learned from it.

But most teams adopt Atlantis for that workflow and then spend the next year quietly building everything around it — drift detection, governance, better review, the daemon’s own upkeep. InfraDots keeps the workflow and ships those as defaults, so they’re not your side projects.

If you’re still mostly shipping infrastructure, keep Atlantis. If you’re mostly maintaining Atlantis and the scripts that prop it up, you’ve already outgrown it — and you don’t have to give up the PR workflow to move on.