Per-Store Identity for Planfile Storage

Demonstrates authenticating a planfile store with a specific Atmos auth identity, independent of the component's identity.

In a multi-cloud pipeline, a component often authenticates with one cloud while its planfile store lives in another. For example, a component authenticates with an azure/subscription identity, but the planfiles are stored in an aws/s3 bucket. Without a per-store identity, the S3 upload inherits the component's non-AWS identity and fails to resolve AWS credentials.

The identity field on a store fixes this: the store authenticates with its own identity, while the component keeps using its own.

Configuration

components:
  terraform:
    planfiles:
      default: s3
      stores:
        s3:
          type: aws/s3
          identity: aws-backend    # store authenticates with this identity
          options:
            bucket: example-terraform-planfiles
            region: us-east-1

auth:
  identities:
    azure-plan:                    # component's default identity (non-AWS)
      kind: azure/subscription
      default: true
      # ...
    aws-backend:                   # AWS identity used only by the planfile store
      kind: aws/assume-role
      # ...

When identity is omitted, the store inherits the component's identity (the prior behavior), so existing single-cloud setups are unchanged.

Run

atmos validate stacks
atmos describe config

Learn More

See the Planfile Storage documentation.