Sign Up
Agents propose. Atlas plans. You approve.

The safest way to change a database.

Atlas is Terraform for databases. Engineers and agents edit the schema as code. Atlas plans and tests every change and flags data loss, locks, and breaking changes. Nothing deploys until you approve.
Get startedBook a demo
Vercel
Nvidia
Meta
Trusted by leading companies
Databricks
Intel
Procter & Gamble

How it works

Code is cheap now. Downtime isn't.

Agents write schema changes in seconds. Atlas catches those that would lock a table or lose data before they reach production.

Set up Atlas from your coding agent ↓

30 minutes with one of the Atlas engineers.

Book a demo

Schema as Code

Like Terraform, for databases.

Define your schema in any language or ORM, and compose them like Terraform modules. Atlas plans, lints, and deploys safe migrations. Declarative or versioned, your choice.

Your Code
1-- atlas:import functions.sql
2
3CREATE TABLE users (
4 id serial NOT NULL,
5 name varchar(255) NOT NULL,
6 email varchar(255) UNIQUE NOT NULL,
7 phone varchar(20),
8 bio text,
9 PRIMARY KEY (id)
10);
11
12CREATE TABLE user_logs (
13 id serial NOT NULL,
14 user_id int NOT NULL,
15 body text NOT NULL,
16 PRIMARY KEY (id),
17 CONSTRAINT user_fk FOREIGN KEY (user_id) REFERENCES users(id)
18);
20261023070315_add_user_logs.sqlAtlas Output
1-- Modify "users" table
2ALTER TABLE "users"
3 ADD COLUMN "phone" varchar(20) NULL,
4 ADD COLUMN "bio" text NULL;
5
6-- Create "user_logs" table
7CREATE TABLE "user_logs" (
8 "id" serial NOT NULL,
9 "user_id" int NOT NULL,
10 "body" text NOT NULL,
11 PRIMARY KEY ("id"),
12 CONSTRAINT "user_fk"
13 FOREIGN KEY ("user_id")
14 REFERENCES "users" ("id")
15);
PostgreSQLMySQLSQL ServerMariaDBClickHouseRedshiftSQLiteOracleSnowflakeSpannerDatabricksCockroachDBAurora DSQLYugabyteDBAzure FabricAzure HorizonDB

Security as Code

Shift left database security.

Define roles, users, and permissions as code. Atlas automatically diffs, plans, and applies changes to bring any database in line with the desired state.

Roles & Users
1role "app_readonly" {
2 comment = "Read-only access"
3}
4
5role "app_writer" {
6 member_of = [role.app_readonly]
7}
8
9user "api_service" {
10 member_of = [role.app_writer, role.rds_iam]
11}
12
13user "dashboard" {
14 password = var.dash_password
15 member_of = [role.app_readonly]
16}
Permissions
1permission {
2 for_each = [table.users, table.orders]
3 for = each.value
4 to = role.app_readonly
5 privileges = [SELECT]
6}
7
8permission {
9 for = table.orders
10 to = role.app_writer
11 privileges = [INSERT, UPDATE]
12}
13
14permission {
15 for = schema.public
16 to = role.app_admin
17 privileges = [ALL]
18}
policy.hclPolicy
1rule "schema" "no-superuser" {
2 role {
3 assert {
4 predicate = predicate.not_superuser
5 message = "prohibited"
6 }
7 }
8}
9
10rule "schema" "no-grantable" {
11 permission {
12 assert {
13 predicate = predicate.not_grantable
14 message = "not allowed"
15 }
16 }
17}
18
19# rule "schema" "require-rls" { ... }
20# rule "schema" "view-invoker" { ... }
DefineRoles & permissions as code
Planatlas schema plan
ReviewPolicy checks in CI
DeployK8s operator applies
Security as Code →

Data as Code

Declarative data management.

Seed lookup tables, compare desired vs. live state, and insert reference data. Atlas generates the exact DML needed, with three sync modes for precise control.

Your Data
1data {
2 table = table.countries
3 rows = [
4 { id = 1, code = "US", name = "United States" },
5 { id = 2, code = "IL", name = "State of Israel" },
6 { id = 4, code = "VN", name = "Vietnam" },
7 { id = 5, code = "FR", name = "France" },
8 ]
9}
10
11data {
12 table = table.order_status
13 rows = [
14 { id = 1, name = "pending", active = true },
15 { id = 2, name = "shipped", active = true },
16 { id = 3, name = "delivered", active = true },
17 { id = 4, name = "returned", active = false },
18 ]
19}
output.sqlINSERT mode
1-- insert into "countries":
2INSERT INTO "countries" ("id", "code", "name")
3 VALUES (5, 'FR', 'France');
4
5-- insert into "order_status":
6INSERT INTO "order_status" ("id", "name", "active")
7 VALUES (4, 'returned', false);
From
Files
Static Data
Directory
Database
Data Sync
To
PostgreSQL
MySQL
10+more
Get started with Data as Code →

DataOps as Code

Day 2 database operations.

Backfills, GDPR deletion, and reports, declared as code. Agents write the operation, and tests verify it in CI along two axes: the result it produces, and the privileges it runs with.

Your Script
1script "exec" "archive_dormant" {
2 # Stop cleanly if there is nothing to archive.
3 condition "have_dormant" {
4 sql = <<-SQL
5 SELECT count(*) > 0 FROM accounts
6 WHERE last_seen < '2020-01-01'
7 SQL
8 }
9
10 # Read the rows once, bind them for the write below.
11 query "dormant" {
12 sql = <<-SQL
13 SELECT id FROM accounts
14 WHERE last_seen < '2020-01-01'
15 SQL
16 rows { id = int }
17 }
18
19 # Touch exactly those rows, or roll the whole unit back.
20 exec "purge" {
21 sql = <<-SQL
22 DELETE FROM accounts
23 WHERE id IN (SELECT value FROM json_each(?))
24 SQL
25 args = [jsonencode(query.dormant.rows[*].id)]
26 expect_rows = length(query.dormant.rows)
27 }
28}
atlas script exec
ready
tx ONE_UNITon_error ROLLBACK
no-opfalse
conditionhave_dormantpassed
SELECT count(*) > 0 FROM accounts
true
querydormant1,204 rows
SELECT id FROM accounts WHERE last_seen < …
rows
execpurgeexpect_rows ok
DELETE FROM accounts WHERE id IN (…)
commit
Get started with DataOps as Code →
Databricks logo
“Atlas enables our team to efficiently and safely manage our application schema. With features like linting, automated migrations for our ORM, and Kubernetes support, it seamlessly integrates into our development ecosystem.”
Michael Caulley, Software Eng Lead
Memorial Sloan Kettering logo
“Generating and applying migrations is very straight-forward. A powerful and elegant tool, we are now integrating Atlas into our GitHub workflows. Atlas is a natural extension of the tools we already use and a joy to work with!”
Noreen Wu, Senior Software Engineer
Softserve logo
“Finally, a tool that eases the headaches of dealing with migrations, dirty states, merging conflicts, and thinking about rolling back to previous states... hands down, with Atlas, I've had the best experience ever!”
Alexander Sadowski, Full Stack Developer

Verification

Catch dangerous migrations before they ship.

Atlas analyzes every migration for destructive changes, table locks, data loss risks, and concurrent index violations. In CI, on the CLI, or pre-deployment.

Code Review Guardrails

Agent Feedback Loop

pull request
feat: add tenant isolation & reader role#312
@claude-codewants to mergefeat/tenant-rls→main
Files Changed1 files, +12 -3
Status
Step
Result
1 new migration file detected
20250410131547.sql
ERD and visual diff generated
View Visualization
Simulate on dev database
Passed (23ms)
Analyze 20250410131547.sql4 reports were found in analysis
Destructive changes detectedDropping non-virtual column "email"
Data dependent changes detectedAdding a non-nullable "varchar" column "phone" without a DEFAULT value
Blocking table change detectedChanging column type from "int" to "bigint" requires table rewrite
Concurrent index violationCreating index non-concurrently acquires SHARE lock, blocking writes
3 passed
4 diagnostics
147ms

Runs on every pull request in

Cloud Native

Deploy from the pipeline you already run.

Apply schema changes from GitHub Actions, GitLab CI, Azure DevOps, Bitbucket, CircleCI, Argo CD, Flux, Terraform, or the Kubernetes Operator, the same way you ship the rest of your stack.

Terraform
Kubernetes
Argo CD
Crossplane
GitHub Actions
GitLab CI
Azure DevOps
More

schema.tf

terraform {
  required_providers {
    atlas = {
      source  = "ariga/atlas"
      version = "~> 0.9.7"
    }
  }
}

provider "atlas" {
  dev_url = "docker://postgres/15/myapp"
}

data "atlas_schema" "sql" {
  src = "file://${path.module}/schema.sql"
}

resource "atlas_schema" "postgres" {
  url = "postgres://root:pass@localhost:5432/app?sslmode=disable"
  hcl = data.atlas_schema.sql.hcl
}

$ terraform apply

data.atlas_schema.sql: Reading...
data.atlas_schema.sql: Read complete after 2s [id=p93KLX2q4UI326LN/4cssQ]

Terraform will perform the following actions:

  # atlas_schema.postgres will be created
  + resource "atlas_schema" "postgres" {
      + hcl = <<-EOT
            table "users" {
              schema = schema.myapp
              column "id" {
                null = false
                type = int
              }
              column "name" {
                null = false
                type = varchar(255)
              }
              primary_key {
                columns = [column.id]
              }
            }
        EOT
      + id  = (known after apply)
      + url = (sensitive value)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

The following SQL statements will be executed:

CREATE TABLE users (
  id SERIAL PRIMARY KEY,
  name VARCHAR(255) NOT NULL
);

Atlas Cloud

The control plane for your database changes.

Every change to every object, across every environment: who approved it, where it ran, and the SQL it executed. Plus lineage, drift detection, and the Security Graph.

atlasgo.cloud
LIVE
Schema Registry
Deployment Logs
Audit Trail
Schema Statistics
Production Safeguards

A versioned registry for migration directories, ERDs, and schema docs.

Get started with Atlas Cloud →

Monitoring as Code

Detect drift. Get the SQL that fixes it.

Atlas monitors live databases for schema drift, permission mismatches, and policy violations. When drift is detected, it generates the exact SQL to bring them back in line. Atlas can block the next deploy to a drifted database until it's fixed.

agent.hclConfig
1# Auto-discover all production RDS instances.
2data "rds_discovery" "production" {
3 region = "us-east-1"
4 filter {
5 tags = {
6 Environment = "production"
7 Team = "backend"
8 }
9 name_regex = ".*-prod$"
10 }
11}
12
13# Monitor all matched RDS instances.
14instance "production" {
15 for_each = data.rds_discovery.production.urls
16 url = each.value
17 default_monitor "all" {
18 snapshot_interval = "1h"
19 schemas = ["public"]
20 }
21}
CSPMCIEMDSPM
outside the database
BLIND SPOTGRANTS·PII·PRIVILEGES·CVES·CROSS-TENANT·RLS·DRIFT
↓
atlas sees inside
↓
usersinvoicessessionsordersproductscategoriespaymentsaudit_logsrolesapi_keysaccountspermissionsteamsmigrationsnotificationstokensCRITICALCross-tenant exposureRLS disabled on accounts, all rows visibleCRITICALPermission driftGRANT ALL added outside approved PR flowWARNINGPrivilege escalationdeploy_bot granted SUPERUSER
Atlas Bot2:45 PM
Drift detected on users

RLS disabled on accounts, all rows visible

84 objects · 203 relationships
criticalwarningok
Monitoring as Code →

Lineage Graph

Where every column comes from.

Column-level lineage across tables, views, and datasets, for developers and agents. Select a column to see where its data comes from, which expressions shape it, and what depends on it downstream. The same graph prints from the CLI as compact JSON for agents, or as OpenLineage for catalogs.

atlasgo.cloud
shop/lineage
6 objects · 8 column edges
order_items
Show 2 more columns
products
Show 3 more columns
inventory
Show 2 more columns
order_fact@21DATASET
Show 10 more columns
inventory_stats@1209DATASET
Show 1 more column
order_item_insights_vVIEW
Show 17 more columns
Base:shop.order_item_insights_v
1 source · 2 expressions · 1 downstream column
stdoutlingraph
$ atlas cloud repo lingraph --slug shop \
| jq '.edges[] | select(.fromColumn == "line_item_price" or .toColumn == "line_item_price")'
{
"from": "schema/shop/table/order_items",
"to": "schema/shop/dataset/order_item_insights_v/order_fact@21",
"fromColumn": "price",
"toColumn": "line_item_price",
"expr": "oi.price AS line_item_price"
}
{
"from": "schema/shop/dataset/order_item_insights_v/order_fact@21",
"to": "schema/shop/view/order_item_insights_v",
"fromColumn": "line_item_price",
"toColumn": "discounted_line_revenue",
"expr": "cast(((of.line_item_quantity * of.line_item_price) * (1 - (coalesce(of.product_discount, 0) / 100))) as decimal(12,2)) AS discounted_line_revenue"
}

Click a column to highlight its lineage path. Click an f marker to pin its expression.

Lineage Graph →

Security Graph

Who can access what, and why.

Every role, grant, and object in a repository on one graph, colored by its worst analyzer finding, from CVEs to privilege escalation. Select an object to trace its blast radius, or print the graph as JSON from the CLI for a CI gate or an agent's context.

atlasgo.cloud
payments/security
12 objects · 16 relationships
SELECTSELECT, UPDATESELECTalicecarolapp_readbilling_rwbilling_supportaccess_logaccountsinvoicesftransfer_fundspublicpg_partmanpg_ivm
Details
Nameaccounts
Severity levelNormal
Issues
No findings
Granted to
app_readSELECT
billing_rwSELECT, UPDATE
billing_supportSELECT
Blast radiusAffects 0 · Affected by 5
CriticalHighElevatedNormal
stdoutsecgraph
$ atlas cloud repo secgraph --slug payments \
| jq '.nodes[] | select(.type == "table" and .name == "accounts")'
{
"id": "table/accounts",
"type": "table",
"name": "accounts",
"reports": []
}

Click an object to trace its blast radius. Click a tier to highlight every object at that severity.

Security Graph →

Agents

Set up from your coding agent.

Atlas ships skills for Claude Code, Codex, Cursor, and Copilot. Install them and start the onboarding skill. The agent sets up Atlas in your project one stage at a time, from schema as code to production, and checks each stage.

What the skills cover/Set up by hand

$ claude plugin marketplace add ariga/atlas$ claude plugin install atlas@ariga

It installs the Atlas plugin, with all its skills, for every project on this machine.

Then start the onboarding skill in Claude Code:

/atlas:atlas-onboard

Claude Code guide

Make your next migration boring.

Atlas plans, checks, and tests every change before it merges, whether a person or an agent wrote it.

Get startedBook a demo