Sign Up
Docs
All Guides

Step-by-step Atlas walkthroughs

Databases

Database-specific Atlas guides

Setting up CI/CD

Wire Atlas into your pipeline

ORMs and Frameworks

Integrate Atlas with any ORM

Shift Left Database Security

Roles, permissions, and policies as code

Seed Data as Code

Lookup tables and reference data

Deploying on Kubernetes

Run via the Atlas Operator

Terraform Provider

Manage schemas via Terraform

Database Governance

End-to-end control and compliance

Schema Drift Detection

Block drift before and after deploys

AI-Safe Database Changes

Safe schema changes at machine speed

Modernize Schema Migrations

Apply modern CI/CD to schema changes

Standardize Schema Migrations

One migration tool to rule them all

Database per tenant

Manage thousands of databases as one

PRICING
Sign InSign Up
Agents propose. Atlas plans. You approve.

manage your database schema as code with atlas

Atlas is how engineers and agents change the database without breaking it.
Get StartedSchedule a Demo
Vercel
Nvidia
Meta
Trusted by leading companies
Databricks
Intel
Procter & Gamble

Goodbye manual schema changes, Hello Atlas

Declarative database schema management — define your desired state, Atlas computes the plan

The Old Way
hand-write every ALTER TABLE
no review for destructive changes
schema drift across environments
RISKY
The Atlas Way
schema/categories.sql
@@ -3,6 +3,5 @@
11CREATE TABLE 'categories' (
22 'category_name' varchar(255) NOT NULL,
33 'category_description' text NULL,
!
44 'updated_at' timestamp NULL ON UPDATE CURRENT_TIMESTAMP,
55 'created_at' timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
66 PRIMARY KEY ('id').
77(END)
Change Code
atlas git:(main) x atlas schema apply --env localPlanning migration statements (1 in total):-- modify "categories" table:-> ALTER TABLE "categories" DROP COLUMN "category_description";
Analyzing planned statements (1 in total):
-- destructive change detected: data loss possibleDS102: column "category_description" contains data
Destructive change blocked.Data loss detected. Migration rejected.
Still using legacy tools?

Flyway and Liquibase require you to write every migration by hand.

Atlas is declarative: define your desired state, and it computes the plan. Deterministic, reliable, and built for the AI era.

vs
vs
vsORMs
See Full Comparison →

Schema as Code

Like Terraform, for databases.

Define your schema in any language or ORM, and compose them like Terraform modules. Atlas plans, lints, and deploys safe migrations. Declarative or versioned, your choice.

Your Code
1-- atlas:import functions.sql
2
3CREATE TABLE users (
4 id serial NOT NULL,
5 name varchar(255) NOT NULL,
6 email varchar(255) UNIQUE NOT NULL,
7 phone varchar(20),
8 bio text,
9 PRIMARY KEY (id)
10);
11
12CREATE TABLE user_logs (
13 id serial NOT NULL,
14 user_id int NOT NULL,
15 body text NOT NULL,
16 PRIMARY KEY (id),
17 CONSTRAINT user_fk FOREIGN KEY (user_id) REFERENCES users(id)
18);
20260903195446_add_user_logs.sqlAtlas Output
1-- Modify "users" table
2ALTER TABLE "users"
3 ADD COLUMN "phone" varchar(20) NULL,
4 ADD COLUMN "bio" text NULL;
5
6-- Create "user_logs" table
7CREATE TABLE "user_logs" (
8 "id" serial NOT NULL,
9 "user_id" int NOT NULL,
10 "body" text NOT NULL,
11 PRIMARY KEY ("id"),
12 CONSTRAINT "user_fk"
13 FOREIGN KEY ("user_id")
14 REFERENCES "users" ("id")
15);
PostgreSQLMySQLSQL ServerMariaDBClickHouseRedshiftSQLiteOracleSnowflakeSpannerDatabricksCockroachDBAurora DSQLYugabyteDBAzure FabricAzure HorizonDB

Security as Code

Shift left database security.

Define roles, users, and permissions as code. Atlas automatically diffs, plans, and applies changes to bring any database in line with the desired state.

Roles & Users
1role "app_readonly" {
2 comment = "Read-only access"
3}
4
5role "app_writer" {
6 member_of = [role.app_readonly]
7}
8
9user "api_service" {
10 member_of = [role.app_writer, role.rds_iam]
11}
12
13user "dashboard" {
14 password = var.dash_password
15 member_of = [role.app_readonly]
16}
Permissions
1permission {
2 for_each = [table.users, table.orders]
3 for = each.value
4 to = role.app_readonly
5 privileges = [SELECT]
6}
7
8permission {
9 for = table.orders
10 to = role.app_writer
11 privileges = [INSERT, UPDATE]
12}
13
14permission {
15 for = schema.public
16 to = role.app_admin
17 privileges = [ALL]
18}
policy.hclPolicy
1rule "schema" "no-superuser" {
2 role {
3 assert {
4 predicate = predicate.not_superuser
5 message = "prohibited"
6 }
7 }
8}
9
10rule "schema" "no-grantable" {
11 permission {
12 assert {
13 predicate = predicate.not_grantable
14 message = "not allowed"
15 }
16 }
17}
18
19# rule "schema" "require-rls" { ... }
20# rule "schema" "view-invoker" { ... }
DefineRoles & permissions as code
Planatlas schema plan
ReviewPolicy checks in CI
DeployK8s operator applies
Security as Code →

Data as Code

Declarative data management.

Seed lookup tables, compare desired vs. live state, and insert reference data. Atlas generates the exact DML needed, with three sync modes for precise control.

Your Data
1data {
2 table = table.countries
3 rows = [
4 { id = 1, code = "US", name = "United States" },
5 { id = 2, code = "IL", name = "State of Israel" },
6 { id = 4, code = "VN", name = "Vietnam" },
7 { id = 5, code = "FR", name = "France" },
8 ]
9}
10
11data {
12 table = table.order_status
13 rows = [
14 { id = 1, name = "pending", active = true },
15 { id = 2, name = "shipped", active = true },
16 { id = 3, name = "delivered", active = true },
17 { id = 4, name = "returned", active = false },
18 ]
19}
output.sqlINSERT mode
1-- insert into "countries":
2INSERT INTO "countries" ("id", "code", "name")
3 VALUES (5, 'FR', 'France');
4
5-- insert into "order_status":
6INSERT INTO "order_status" ("id", "name", "active")
7 VALUES (4, 'returned', false);
From
Files
Static Data
Directory
Database
Data Sync
To
PostgreSQL
MySQL
10+more
Get started with Data as Code →

DataOps as Code

Day 2 database operations.

Backfills, GDPR deletion, and reports, declared as code. Agents write the operation, and tests verify it in CI along two axes: the result it produces, and the privileges it runs with.

Your Script
1script "exec" "archive_dormant" {
2 # Stop cleanly if there is nothing to archive.
3 condition "have_dormant" {
4 sql = <<-SQL
5 SELECT count(*) > 0 FROM accounts
6 WHERE last_seen < '2020-01-01'
7 SQL
8 }
9
10 # Read the rows once, bind them for the write below.
11 query "dormant" {
12 sql = <<-SQL
13 SELECT id FROM accounts
14 WHERE last_seen < '2020-01-01'
15 SQL
16 rows { id = int }
17 }
18
19 # Touch exactly those rows, or roll the whole unit back.
20 exec "purge" {
21 sql = <<-SQL
22 DELETE FROM accounts
23 WHERE id IN (SELECT value FROM json_each(?))
24 SQL
25 args = [jsonencode(query.dormant.rows[*].id)]
26 expect_rows = length(query.dormant.rows)
27 }
28}
atlas script exec
ready
tx ONE_UNITon_error ROLLBACK
no-opfalse
conditionhave_dormantpassed
SELECT count(*) > 0 FROM accounts
true
querydormant1,204 rows
SELECT id FROM accounts WHERE last_seen < …
rows
execpurgeexpect_rows ok
DELETE FROM accounts WHERE id IN (…)
commit
Get started with DataOps as Code →
Databricks logo
“Atlas enables our team to efficiently and safely manage our application schema. With features like linting, automated migrations for our ORM, and Kubernetes support, it seamlessly integrates into our development ecosystem.”
Michael Caulley, Software Eng Lead
Medical Solutions logo
“Generating and applying migrations is very straight-forward. A powerful and elegant tool, we are now integrating Atlas into our GitHub workflows. Atlas is a natural extension of the tools we already use and a joy to work with!”
Noreen Wu, Senior Software Engineer
Softserve logo
“Finally, a tool that eases the headaches of dealing with migrations, dirty states, merging conflicts, and thinking about rolling back to previous states... hands down, with Atlas, I've had the best experience ever!”
Alexander Sadowski, Full Stack Developer

Verification

Catch dangerous migrations before they ship

Atlas analyzes every migration for destructive changes, table locks, data loss risks, and concurrent index violations. In CI, on the CLI, or pre-deployment.

Code Review Agent

CLI Tool

pull request
feat: add tenant isolation & reader role#312
@claude-codewants to mergefeat/tenant-rls→main
Files Changed1 files, +12 -3
Status
Step
Result
1 new migration file detected
20250410131547.sql
ERD and visual diff generated
View Visualization
Simulate on dev database
Passed (23ms)
Analyze 20250410131547.sql4 reports were found in analysis
Destructive changes detectedDropping non-virtual column "email"
Data dependent changes detectedAdding a non-nullable "varchar" column "phone" without a DEFAULT value
Blocking table change detectedChanging column type from "int" to "bigint" requires table rewrite
Concurrent index violationCreating index non-concurrently acquires SHARE lock, blocking writes
3 passed
4 diagnostics
147ms

Automate code review on

Cloud Native

Modern deployments

Deploy schema changes with confidence using our modern CI/CD pipeline

Terraform
Kubernetes
Argo CD
Crossplane
GitHub Actions
GitLab CI
Azure DevOps
More

schema.tf

terraform {
  required_providers {
    atlas = {
      source  = "ariga/atlas"
      version = "~> 0.9.7"
    }
  }
}

provider "atlas" {
  dev_url = "docker://postgres/15/myapp"
}

data "atlas_schema" "sql" {
  src = "file://${path.module}/schema.sql"
}

resource "atlas_schema" "postgres" {
  url = "postgres://root:pass@localhost:5432/app?sslmode=disable"
  hcl = data.atlas_schema.sql.hcl
}

$ terraform apply

data.atlas_schema.sql: Reading...
data.atlas_schema.sql: Read complete after 2s [id=p93KLX2q4UI326LN/4cssQ]

Terraform will perform the following actions:

  # atlas_schema.postgres will be created
  + resource "atlas_schema" "postgres" {
      + hcl = <<-EOT
            table "users" {
              schema = schema.myapp
              column "id" {
                null = false
                type = int
              }
              column "name" {
                null = false
                type = varchar(255)
              }
              primary_key {
                columns = [column.id]
              }
            }
        EOT
      + id  = (known after apply)
      + url = (sensitive value)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

The following SQL statements will be executed:

CREATE TABLE users (
  id SERIAL PRIMARY KEY,
  name VARCHAR(255) NOT NULL
);

Atlas Cloud

A DBRE platform for operating production databases

Schema registry, deployment logs, audit trails, and production safeguards. Everything your team needs to operate databases at scale.

atlasgo.cloud
LIVE
Schema Registry
Deployment Logs
Audit Trail
Schema Statistics
Production Safeguards

A versioned registry for migration directories, ERDs, and schema docs.

Book a Demo

Monitoring as Code

Continuous monitoring. Auto-remediation.

Atlas monitors live databases for schema drift, permission mismatches, and policy violations. When drift is detected, it generates the exact SQL to bring them back in line.

agent.hclConfig
1# Auto-discover all production RDS instances.
2data "rds_discovery" "production" {
3 region = "us-east-1"
4 filter {
5 tags = {
6 Environment = "production"
7 Team = "backend"
8 }
9 name_regex = ".*-prod$"
10 }
11}
12
13# Monitor all matched RDS instances.
14instance "production" {
15 for_each = data.rds_discovery.production.urls
16 url = each.value
17 default_monitor "all" {
18 snapshot_interval = "1h"
19 schemas = ["public"]
20 }
21}
CSPMCIEMDSPM
outside the database
BLIND SPOTGRANTS·PII·PRIVILEGES·CVES·CROSS-TENANT·RLS·DRIFT
↓
atlas sees inside
↓
usersinvoicessessionsordersproductscategoriespaymentsaudit_logsrolesapi_keysaccountspermissionsteamsmigrationsnotificationstokensCRITICALCross-tenant exposureRLS disabled on accounts, all rows visibleCRITICALPermission driftGRANT ALL added outside approved PR flowWARNINGPrivilege escalationdeploy_bot granted SUPERUSER
Atlas Bot2:45 PM
Drift detected on users

RLS disabled on accounts, all rows visible

84 objects · 203 relationships
criticalwarningok
Monitoring as Code →

Lineage Graph

Where every column comes from.

Column-level lineage across tables, views, and datasets, for developers and agents. Select a column to see where its data comes from, which expressions shape it, and what depends on it downstream. The same graph prints from the CLI as compact JSON for agents, or as OpenLineage for catalogs.

atlasgo.cloud
shop/lineage
6 objects · 8 column edges
order_items
Show 2 more columns
products
Show 3 more columns
inventory
Show 2 more columns
order_fact@21DATASET
Show 10 more columns
inventory_stats@1209DATASET
Show 1 more column
order_item_insights_vVIEW
Show 17 more columns
Base:shop.order_item_insights_v
1 source · 2 expressions · 1 downstream column
stdoutlingraph
$ atlas cloud repo lingraph --slug shop \
| jq '.edges[] | select(.fromColumn == "line_item_price" or .toColumn == "line_item_price")'
{
"from": "schema/shop/table/order_items",
"to": "schema/shop/dataset/order_item_insights_v/order_fact@21",
"fromColumn": "price",
"toColumn": "line_item_price",
"expr": "oi.price AS line_item_price"
}
{
"from": "schema/shop/dataset/order_item_insights_v/order_fact@21",
"to": "schema/shop/view/order_item_insights_v",
"fromColumn": "line_item_price",
"toColumn": "discounted_line_revenue",
"expr": "cast(((of.line_item_quantity * of.line_item_price) * (1 - (coalesce(of.product_discount, 0) / 100))) as decimal(12,2)) AS discounted_line_revenue"
}

Click a column to highlight its lineage path. Click an f marker to pin its expression.

Lineage Graph →

Security Graph

Who can access what, and why.

Every role, grant, and object in a repository on one graph, colored by its worst analyzer finding, from CVEs to privilege escalation. Select an object to trace its blast radius, or print the graph as JSON from the CLI for a CI gate or an agent's context.

atlasgo.cloud
payments/security
12 objects · 16 relationships
SELECTSELECT, UPDATESELECTalicecarolapp_readbilling_rwbilling_supportaccess_logaccountsinvoicesftransfer_fundspublicpg_partmanpg_ivm
Details
Nameaccounts
Severity levelNormal
Issues
No findings
Granted to
app_readSELECT
billing_rwSELECT, UPDATE
billing_supportSELECT
Blast radiusAffects 0 · Affected by 5
CriticalHighElevatedNormal
stdoutsecgraph
$ atlas cloud repo secgraph --slug payments \
| jq '.nodes[] | select(.type == "table" and .name == "accounts")'
{
"id": "table/accounts",
"type": "table",
"name": "accounts",
"reports": []
}

Click an object to trace its blast radius. Click a tier to highlight every object at that severity.

Security Graph →
Built for Every Team, Every Workflow

ready to modernize your database workflow?

GitOps-native CI/CD for secure and compliant database management

Get StartedSchedule a Demo