RowShield vs Atlantis: database posture versus Terraform state

Head to head: Atlantis vs RowShield

Column claims about Atlantis are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.

What Atlantis does

Atlantis turns Terraform collaboration into a pull-request workflow. When an engineer opens a pull request, Atlantis runs terraform plan and posts the output as a comment; an approved comment then triggers the apply. Locks prevent two people applying conflicting changes to the same directory, and the whole flow lives where code review already happens.

Teams adopt it because it makes infrastructure changes legible: every plan attaches to a reviewable diff, and every apply has a named author. As a piece of GitOps plumbing it does its job well, self-hosted and free, which keeps it popular with teams who like their tooling close to home.

Where the scopes differ

Atlantis reasons about declared state: the match between HCL, the Terraform state file and the resources a cloud provider reports. A Supabase project, though, is more than its declared resources. Row-level security policies live in the Postgres catalog, grants are granted inside the database, and much of this shifts day to day through the dashboard, SQL editor and hotfix migrations rather than through Terraform.

That gap matters because the dangerous drift in a Supabase project is rarely a changed instance size. It is a table created quickly in the dashboard without protection enabled, a policy widened during debugging and never narrowed, or a grant to the anon role that grew quietly. None of these appear in a plan output, because none belong to the state Atlantis manages.

The three-capability lens makes the split precise. Of configuration posture, live behaviour as the anon caller, and drift over time, Atlantis holds a slice of drift only, and only for declared cloud resources. Posture and behaviour sit entirely below its instruments.

Why Supabase teams choose RowShield over Atlantis

RowShield treats the running database as the artifact worth auditing. It connects read-only, walks the catalog, and evaluates rules that govern exposure: RLS_DISABLED on public tables, RLS_NO_POLICIES where enablement exists without a single policy, predicates lacking supporting indexes, bare per-row auth.uid() calls, and the grants that decide what anonymous visitors may fetch.

Because it inspects the live system, the dashboard edit made yesterday afternoon is caught tonight, not whenever someone next writes Terraform. Continuous monitoring replaces the assumption baked into every pipeline tool: that nothing changes outside the pipeline. For Supabase specifically, plenty does.

Where Atlantis is the right choice

If your pain is unreviewed infrastructure changes, Atlantis remains a sound answer. It enforces discipline on Terraform merges, keeps an audit trail of plans, and costs nothing in licence terms. Teams whose databases are wholly managed as code, with dashboard access locked down, get genuine coverage from it.

It is also the pragmatic pick for organisations standardising on self-hosted tooling with no new vendor relationships. What it should never be asked to attest to is database posture, because it was never designed to look there — even teams who need it for that core job add RowShield beneath it.

Using both

The two tools share no surface area, which makes them straightforward companions. Atlantis governs how declared infrastructure changes; RowShield observes how the database actually behaves between changes. Many teams run a pipeline tool for the former and accept that policies edited under pressure need a watcher of their own.

A practical split: Atlantis approves the diff before it lands, RowShield verifies the posture afterwards, including every human shortcut taken along the way.

Frequently asked

Is RowShield affiliated with Atlantis?

No. RowShield is built by Veristria, an independent company, and has no commercial or development relationship with the Runatlantis maintainers. Statements about Atlantis reflect its public documentation.

Does Atlantis detect drift in Supabase row-level security?

Only for policies managed as Terraform resources passing through its pipeline. Policies created or edited in the dashboard, or applied straight to the database, sit outside the state it tracks and outside its drift reports.

Can I use both together?

Yes. Atlantis needs version control and cloud credentials; RowShield needs a read-only Postgres connection. They observe different layers, so nothing conflicts.