File tree Expand file tree Collapse file tree
.claude/skills/atmos-auth Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -63,7 +63,9 @@ Profiles are defined in `profiles/<profile-name>/atmos.yaml`. Each maps identiti
6363| ------------ | -------------------- | -------------------- | --------------------- |
6464| `devops` | TerraformApplyAccess | TerraformApplyAccess | TerraformApplyAccess |
6565| `developers` | TerraformStateAccess | TerraformApplyAccess | TerraformPlanAccess |
66- | `managers` | TerraformStateAccess | TerraformPlanAccess | TerraformPlanAccess |
66+ | `managers` | TerraformApplyAccess | TerraformApplyAccess | TerraformApplyAccess |
67+
68+ Managers also have a `RootAccess` Permission Set for centralized root access to member accounts.
6769
6870**Permission Set capabilities:**
6971
@@ -83,7 +85,9 @@ Examples:
8385
8486# # Special Cases
8587
86- **superadmin profile**: IAM user with MFA for breakglass access. Avoid unless SSO is unavailable.
88+ **superadmin profile**: IAM user (`kind: aws/user`) with MFA in the root account. Used for coldstart/bootstrap
89+ before SSO is deployed, or as breakglass access. Assumes `OrganizationAccountAccessRole` into member accounts
90+ via identity chaining. Switch to your assigned SSO profile once the identity layer is deployed.
8791
8892**github-plan profile**: OIDC-based authentication for CI/CD plan operations. Uses planner roles with read-only access.
8993
Original file line number Diff line number Diff line change 1919
2020 - name : Generate a token
2121 id : github-app
22- uses : actions/create-github-app-token@v2
22+ uses : actions/create-github-app-token@v3
2323 with :
2424 app-id : ${{ secrets.ATMOS_APP_ID }}
2525 private-key : ${{ secrets.ATMOS_PRIVATE_KEY }}
Original file line number Diff line number Diff line change 4141 echo "ATMOS_CLI_CONFIG_PATH=$(realpath ${{ vars.ATMOS_CONFIG_PATH }})" >> $GITHUB_ENV
4242
4343 - name : Install Atmos
44- uses : cloudposse/github-action-setup-atmos@v2
44+ uses : cloudposse/github-action-setup-atmos@v3
4545 with :
4646 atmos-version : ${{ vars.ATMOS_VERSION }}
4747 token : ${{ github.token }}
You can’t perform that action at this time.
0 commit comments