Atmos Component Vendoring

Vendoring copies external components, stacks, and other artifacts into your repository. This gives you full control over when and how dependencies change, with visibility through git diff, an immutable audit trail, and the ability to apply emergency patches without waiting for upstream releases.

Why Vendor

Terraform root modules must exist locally -- they cannot be pulled from remote sources at runtime the way child modules can. Vendoring makes this explicit: you copy the code once, commit it, and control when updates happen. This provides:

• Visibility: See actual code changes via git diff, not just version bumps.
• Audit trail: Every update is a commit with full history for compliance.
• Emergency agility: Patch vulnerabilities immediately without waiting for upstream.
• Developer experience: Full IDE navigation, grep across all code, better onboarding.
• Deployment reliability: No network dependencies during terraform apply.

Types of Vendoring

Atmos supports two approaches:

1. Vendor Configuration (vendor.yaml): A centralized manifest listing all dependencies. This is the recommended approach.