Demo: Auth

This demo showcases how to structure an Atmos project with an auth section in atmos.yaml.

It intentionally only validates stack manifests (no Terraform applies) to avoid requiring real cloud credentials in CI.

What You'll See

• Multiple providers (github/oidc, aws/saml, aws/iam-identity-center) and the identities that assume roles through them
• Plain tags: [...] on providers and identities — used to filter/select them with --tags, without contacting real cloud APIs
• atmos auth list --tags narrowing the tree to a subset of providers/identities
• atmos auth login --tags auto-selecting the single matching identity (or prompting when more than one matches)
• atmos auth logout --tags logging out of every provider that matches, in one command

Try It

cd examples/demo-auth

# See the full provider/identity tree
atmos auth list

# Narrow it to only the enterprise-tagged providers/identities (any-match)
atmos auth list --tags enterprise

# --tags on login auto-selects when exactly one identity matches (here, "oidc").
# It then fails with a controlled "GitHub OIDC ... only available in GitHub
# Actions" error, since this stub provider has no real OIDC token to exchange
# outside of CI — confirming the right identity was selected without needing
# real cloud credentials.
atmos auth login --tags ci

# --tags on logout logs out of every matching provider (here, both SAML and SSO)
atmos auth logout --tags enterprise

Key Files

File	Purpose
atmos.yaml	auth.providers/auth.identities with tags: [...] on each

Learn More

See the Atmos docs for more information.