cloudposse/atmos v1.222.0-rc.12

on GitHub

• Make the terraform after-apply store-outputs hook path inherit the run's auto-detected identity for
  stores that don't declare their own identity, matching the main terraform path.
• Add a new internal/exec.HookStoreDefaultIdentity helper (auto-detect the active identity from the
  auth manager's chain, normalize empty/select/disabled to ""); cmd/terraform's
  injectHookStoreAuthResolver now calls SetAuthContextResolverWithDefaultIdentity instead of the
  resolver-only variant.
• Fix an adjacent bug: pkg/store.defaultIdentityForStore was missing *SecretsManagerStore
  (aws/asm), so AWS Secrets Manager stores never inherited a default identity on any path. Added
  the case so aws/asm behaves like aws/ssm.
• Tests: internal/exec.TestHookStoreDefaultIdentity (new), cmd/terraform
TestInjectHookStoreAuthResolver_InheritsDefaultIdentity (replaces …_ResolverOnly), updated
  pkg/store default-identity test so identity-less aws/asm asserts inheritance, and Floci E2E
  TestAWSStoreHooks_InheritedIdentity_FlociE2E with fixture aws-store-hooks-floci-inherit.
• Fix doc: docs/fixes/2026-06-27-store-hook-inherit-default-identity.md.

why

• Hook fix. Under Atmos auth, atmos terraform apply on a component with a store-outputs hook
  applied successfully but then failed in the hook when the target store had no identity:

  INFO  Running hooks event=after.terraform.apply status=success
  ✓ Fetching <output> from <component> in <stack>
  Error: failed to assume write role: … get identity: get credentials:
  failed to refresh cached credentials, no EC2 IMDS role found, … ec2imds: GetMetadata …
  

  Hooks run in a freshly-loaded config, so the apply-phase store registry (and its injected default
  identity) is gone. The hook re-injected the resolver but no default identity, so identity-less
  stores fell back to the default AWS SDK credential chain — empty under Atmos auth (credentials live
  in the keyring, not the environment) — and dropped to EC2 IMDS. The main terraform path and !store
  reads already inherit the run's identity; this removes a surprising asymmetry and completes the
  follow-up explicitly deferred in #2625 ("Component-identity inheritance for identity-less stores is
  intentionally left for a follow-up design decision").

• ASM fix. defaultIdentityForStore handled *SSMStore, *AzureKeyVaultStore, and *GSMStore
  but not *SecretsManagerStore, so aws/asm stores without an explicit identity could never
  inherit one. This was latent before (and was even codified by the old test); the hook fix's E2E
  surfaced it.

• Backward compatible. HookStoreDefaultIdentity returns "" whenever no identity is resolved
  (no auth manager, or empty/select/disabled), and SetAuthContextResolverWithDefaultIdentity("")
  is a no-op for the default — so runs without Atmos auth keep their prior ambient/default-SDK
  credential behavior, and stores with an explicit identity are never overridden.

references

• Follow-up to #2625 (AWS stores/secrets auth; deferred identity-less inheritance in the hook path).
• Related fix docs: docs/fixes/2026-06-17-aws-stores-secrets-auth-and-gists.md,
  docs/fixes/2026-05-25-store-hook-missing-backend-role-assumption.md.

Summary by CodeRabbit

• New Features
  • Store output hooks now inherit the run’s detected/default identity when a store doesn’t specify an explicit identity.
  • AWS Secrets Manager store output identity handling now matches the default-identity behavior of other supported stores.
• Bug Fixes
  • Prevents hook-phase authentication failures under Atmos auth when no fallback AWS credentials are available.
• Documentation
  • Added a clarification on identity inheritance semantics for store-output hooks.
• Tests
  • Added/updated unit tests and a Floci end-to-end test covering identity inheritance for SSM/ASM hook outputs.