atmos auth validate

Use this command to validate your global auth configuration in atmos.yaml, or the merged authentication configuration for a selected stack.

atmos auth validate --help

Usage

atmos auth validate [--stack <stack> [--component <component>]] [--verbose]

Arguments

n/a

No positional arguments.

Examples

# Basic validation
atmos auth validate

# Validate every concrete component in dev
atmos auth validate --stack dev

# Validate demo's merged auth, including imports and component overrides
atmos auth validate --stack dev --component demo

# Verbose output
atmos auth validate --verbose

Global and scoped validation

Without --stack, validation checks only atmos.yaml and its configuration overlays/profiles. Every identity must be complete in that configuration. If an identity's principal is supplied by a stack manifest, use --stack to validate the merged configuration instead of adding a placeholder principal to atmos.yaml.

With --stack, each concrete component's auth is merged independently with the global auth configuration using the same inheritance and override rules as component execution. All component types are checked. --component narrows the selection to that name across component types and requires --stack. Abstract components are excluded. An empty selection fails; a failing identity or provider reports its stack, component, and component type.

This is a static configuration check. It does not authenticate, run Terraform, or evaluate stack templates or YAML functions, including locals and native includes. Local imports and inheritance are merged with template rendering disabled. Remote imports are rejected without fetching. Dynamic auth values such as principal.assume_role: '{{ .vars.role_arn }}' or !terraform.output produce a cannot fully validate error instead of being accepted as resolved values. Dynamic import paths and manifests that require template rendering are not supported by scoped validation. Unrelated component expressions are left unevaluated.

The global --base-path, --config, --config-path, and --profile selectors apply in both modes.

Flags

--stack (alias -s)

Validate each concrete component's merged auth in a logical stack or stack manifest path.

--component (alias -c)

Validate only components with this name in the selected stack. Requires --stack.

--verbose (alias -v)

Enable verbose output.

Environment variables

ATMOS_AUTH_VALIDATE_VERBOSE

Set to true to enable verbose output by default.