base_path: "./"

components:
  terraform:
    base_path: "components/terraform"
    apply_auto_approve: false
    deploy_run_init: true
    init_run_reconfigure: true
    auto_generate_backend_file: false

stacks:
  base_path: "stacks"
  included_paths:
    - "**/*"
  excluded_paths:
    - "**/_defaults.yaml"
  name_template: "{{.vars.stage}}"

logs:
  file: "/dev/stderr"
  level: Info

# Custom CLI commands
commands:
  - name: "test"
    description: "Run all tests"
    steps:
      - atmos validate stacks
      # Test dev stack
      - atmos terraform plan whoami -s dev --identity oidc
      - atmos terraform apply whoami -s dev -auto-approve --identity oidc
      - atmos terraform destroy whoami -s dev -auto-approve --identity oidc

# Auth configuration demo (stub values)
auth:
  logs:
    level: Debug
  providers:
    oidc:
      kind: github/oidc
      region: us-east-1
      # Tags are plain, user-defined labels — used by `--tags` on
      # `atmos auth list|login|logout` to filter/select providers and identities.
      tags: [ci, github]
      spec:
        audience: sts.us-east-1.amazonaws.com
    idp-acme-saml:
      kind: aws/saml
      url: https://mock
      region: us-east-1
      tags: [enterprise, saml]
    idp-acme-sso:
      kind: aws/iam-identity-center
      start_url: https://mock
      region: us-east-1
      tags: [enterprise, sso]

  identities:
    # Used in tests
    oidc:
      kind: aws/assume-role
      via:
        provider: oidc
      principal:
        assume_role: arn:aws:iam::111111111111:role/ExampleRole
      tags: [ci, automation]

    # Example identities mapping to providers
    saml:
      kind: aws/assume-role
      via:
        provider: idp-acme-saml
      principal:
        assume_role: arn:aws:iam::111111111111:role/ExampleRole
      tags: [enterprise]

    sso:
      kind: aws/assume-role
      via:
        provider: idp-acme-sso
      principal:
        assume_role: arn:aws:iam::111111111111:role/ExampleRole
      tags: [enterprise]

    superuser:
      enabled: false
      kind: aws/user
      credentials:
        region: us-east-1
      tags: [break-glass]