Atmos Authentication and Identity Management

Atmos Auth provides a unified authentication layer for multiple cloud providers. It consolidates AWS SSO, SAML, OIDC, GitHub Actions, GCP Workload Identity Federation, Azure, Atmos Pro, and static credentials into a single configuration model in atmos.yaml. Credentials are managed through providers (upstream authentication systems) and identities (the roles and accounts obtained from those providers), with support for identity chaining, keyring-based credential storage, and integrations like ECR, EKS, ACR, AKS, and GitHub STS.

Architecture Overview

The auth system has four layers configured under the auth: key in atmos.yaml:

1. Providers -- Upstream systems that issue initial credentials (SSO, SAML, OIDC, GCP ADC/WIF).
2. Identities -- Roles, permission sets, or accounts obtained from providers or chained from other identities.
3. Keyring -- Secure credential storage backend (system keyring, encrypted file, or in-memory).
4. Integrations -- Client-side credential materializations (ECR/ACR Docker login, EKS/AKS kubeconfig, GitHub STS).