# Demonstrates using Atmos auth identities with stores.
# Each store references an identity for credential resolution.

base_path: "./"

stacks:
  base_path: "stacks"
  included_paths:
    - "deploy/**/*"
  excluded_paths:
    - "**/_defaults.yaml"
  name_template: "{{ .vars.stage }}"

auth:
  providers:
    acme-sso:
      kind: aws/iam-identity-center
      start_url: https://acme.awsapps.com/start
      region: us-east-1

    azure-oidc:
      kind: azure/oidc
      spec:
        tenant_id: "00000000-0000-0000-0000-000000000000"
        client_id: "11111111-1111-1111-1111-111111111111"

    gcp-adc:
      kind: gcp/adc
      spec:
        project_id: acme-prod-123456
        region: us-central1

  identities:
    prod-admin:
      kind: aws/assume-role
      via:
        provider: acme-sso
      principal:
        assume_role: arn:aws:iam::111111111111:role/ProdAdmin

    azure-prod:
      kind: azure/subscription
      via:
        provider: azure-oidc
      principal:
        subscription_id: "22222222-2222-2222-2222-222222222222"

    gcp-prod:
      kind: gcp/project
      via:
        provider: gcp-adc
      principal:
        project_id: acme-prod-123456

    # A local AWS emulator identity -- unlike prod-admin/azure-prod/gcp-prod above, this one is
    # real and running. It lets the store CRUD commands in the recorded demo actually execute,
    # with no real AWS account needed.
    local-aws:
      kind: aws/emulator
      emulator: local/aws
      default: true

# Stores with identity-based authentication.
# Each store uses a named identity instead of the default credential chain.
stores:
  prod/ssm:
    kind: aws/ssm
    identity: prod-admin
    options:
      region: us-east-1
      prefix: /atmos/prod

  prod/keyvault:
    kind: azure/keyvault
    identity: azure-prod
    options:
      vault_url: https://prod-secrets.vault.azure.net

  prod/gsm:
    kind: gcp/secretmanager
    identity: gcp-prod
    options:
      project_id: acme-prod-123456

  # Backed by the local-aws emulator identity above -- real CRUD works against this one.
  local/ssm:
    kind: aws/ssm
    identity: local-aws
    options:
      region: us-east-1
      prefix: /atmos/demo