Deny production authentication
Deny any production auth provider or identity, including intermediate identities and cached credentials.
Production authentication is prohibited by this policy. Select a permitted non-production provider and identity.
apiVersion: atmos/v1
kind: Policy
metadata:
name: auth-deny-production
description: Deny any production auth provider or identity, including intermediate identities and cached credentials.
spec:
policies:
guard:
on: auth
action: deny
reason: Production authentication is prohibited by this policy. Select a permitted non-production provider and identity.
with:
production_names: []
rule: |
([input.identity, input.provider] + input.identities).exists(name,
name in params.production_names ||
name.matches('(?i)(^|[-_/])(prod|production)([-_/]|$)'))
1 Configure
This policy always applies: there is no when condition or agent filter. It denies matching authentication locally and in CI, for humans and agents alike.
The rule treats prod or production as a case-insensitive name segment separated by -, _, or /.
Examples: prod-admin, aws-prod, team/production/admin, and PROD_SSO.
Add exact names that do not follow that convention to with.production_names:
with:
production_names: [release-admin, privileged-sso]
Atmos supplies the resolved target as input.identity, the root provider as input.provider,
and every identity in the chain as input.identities. A development target is still denied
if its chain crosses a production provider or intermediate identity. A standalone identity has
an empty provider; direct provider authentication has an empty identity and identity list.
No credentials, tokens, or provider configuration are exposed to the rule.
The check runs before provider/identity authentication, credential helpers, and process/keyring/file
cache use through the auth manager. It applies to auth login, auth env, auth shell,
auth exec, credential-process exports, and component commands that use Atmos authentication.
Cached credentials do not exempt an identity from the policy. Logout remains available.
Names are configuration, not proof of which account a credential reaches. Review the naming convention and protect policy/auth configuration. This policy does not revoke previously issued credentials, block ambient credentials used outside Atmos auth, or prevent direct cloud CLI calls.
2 Save
Save the CEL policy as policy.d/auth-deny-production.yaml. Install only one implementation of each policy.
Atmos discovers policy.d/ at the project root selected by atmos.yaml discovery. Set ATMOS_POLICY_DIR to use another directory.
3 Run
atmos auth login --identity prod-admin
Review required tools and callback settings before running. In CI, load policies from a protected, pinned revision. See enforcement configuration.
