cloudposse / cloudposse/github-action-atmos-terraform-plan

Unable to Disable Atmos Identity/Auth for Github Action

Open
#130 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
HCL
Stars
8
Forks
18
PR merge metrics
No merged PRs in 30d

Description

### Describe the Bug

It is possible we are doing something incorrectly, but the evidence so far seems to suggest otherwise.

I created a simple workflow to test Atmos integration with Github Actions. The plan is to use OIDC for authentication, but for local development we _do_ have an `auth` block configured in our `atmos.yaml` configuration file, per the [Atmos documentation here](https://atmos.tools/cli/configuration/auth/) (primarily SSO identities). Since we're using OIDC for Github Actions, the plan was to simply disable Atmos auth. This seems to be possible according to a [blog post here](https://atmos.tools/changelog/disable-identity-authentication). An initial glance at this action's code appeared to confirm that [here](https://github.com/cloudposse/github-action-atmos-terraform-plan/blob/d4e329e1a5ceaf4cd044a402113d2824d57e4ba6/action.yml#L351).

However, all attempts to run the atmos-terraform-plan action fail. It _seems_ as though it is trying to use the identity literally named "false" (we have also tried `0`, `off`, etc.). Our auth configuration works just fine locally and we have confirmed that we're able to disable Atmos auth locally using either environment variables or via `--identity=false`. But this does not seem to translate with this Github Action.

```markdown
# identityName

**Error:** invalid auth config

## Hints

💡 Identity specified was not found in the auth config.
# Error

**Error:** identity not found

## Explanation

false
```

When I temporarily delete our Atmos auth configuration all-together, the problem disappears.

### Expected Behavior

We expected Atmos to disable Atmos auth and instead revert back to the default behavior using the standard AWS CLI environment, thus allowing us to use OIDC instead.

### Steps to Reproduce

Create a simple workflow that just uses this Github Action. We have the identity set two different ways below to show how we've tried to set this in two of the supported ways, one via an action input and another via environment variable.

```yaml
name: 👽 Atmos Terraform Plan (Manual)
run-name: 👽 Atmos Terraform Plan (Manual)

on:
workflow_dispatch:
inputs:
component:
description: "The name of the Terraform component."
required: true
type: string
stack:
description: "The name of the Atmos stack."
required: true
type: string

permissions:
id-token: write
contents: read
pull-requests: write

jobs:
atmos-plan:
name: "Atmos Terraform Plan"
runs-on: ubuntu-latest
env:
ATMOS_IDENTITY: false
steps:
- name: Plan Atmos Component
uses: cloudposse/github-action-atmos-terraform-plan@v5
with:
component: ${{ inputs.component }}
stack: ${{ inputs.stack }}
atmos-version: 1.203.0
identity: false
```

After setting up OIDC integration per Atmos' documentation, attempt to run a 'plan' against a stack and component specified via the workflow's inputs.

### Screenshots

_No response_

### Environment

- Atmos version: `1.203.0`
- Terraform version: `1.10.2`

### Additional Context

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with action.yml around line 351, then compare the identity action input with the ATMOS_IDENTITY environment variable shown in the reproduction workflow. Run the workflow with the Atmos auth configuration present and verify that disabling identity authentication allows the OIDC-based AWS setup to proceed without treating false as an identity name.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, github-actions
Domain
authentication, ci-cd, cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.