Skip to main content

Secret-store credentials through official Atmos plugins

· 2 min read
Erik Osterman
Erik Osterman
Founder @ Cloud Posse

Tools often need API tokens from a secret store as environment variables. Copying those values into shell profiles duplicates credentials and makes rotation harder. The official auth-secrets plugin lets an Atmos identity read the configured store and select exactly which values a command receives.

The Problem​

Secret storage and command authentication are separate concerns. Teams need to connect them without putting plaintext values in configuration, granting every command every secret, or tying plugin updates to an Atmos release.

The Fix​

The package provides a secret-store credential provider and an environment identity. Atmos controls the store references, masking, and authentication dependencies. The identity maps selected fields into the command environment, with a five-minute lifetime for process-local reuse.

Official packages use independent manifest versions and public OCI repositories. The built-in cloudposse catalog makes them discoverable, while consumers can opt out or configure another catalog. Installation selects one platform from the release index.

Plugin authors can use plugin release to build, test, package, publish, and sign a release. Native release planning and catalog reconciliation support independently versioned packages in one repository. One Linux job can cross-build every declared platform concurrently, run Linux tests, and prepare the OCI layout. A two-job workflow checks the inventory, then rebuilds and publishes through a protected release job. Atmos handles package iteration and catalog reconciliation without a package matrix, artifact transfer, or separate release scripts.

How to Use It​

Declare oci://ghcr.io/cloudposse/atmos/plugins/auth-secrets as a plugin package, configure a secrets/store provider, and map its credential fields through a secrets/env identity. See the complete configuration example.

Run atmos plugin install and commit the plugin lockfile before using the identity in CI. Each package version is independent of Atmos's version. Publication requires public GHCR provisioning and successful release checks and native SDK CI; source availability alone does not mean a version has been published.

Get Involved​

Read the plugin development guide to build your own package, or review the official release infrastructure.