Auth inheritance not scoping to stack

[seanlongnyc]

Our stacks run fine normally. We have our atmos profiles defined in /rootfs/usr/local/etc/atmos/profiles/*
And define/reference the corresponding identity for stacks in /stacks/orgs/gold/*/*/_defaults.yaml

Encountered an issue where if /stacks/orgs/gold/data/staging/us-east-1/monitoring-agent.yaml
has the following lines added:

auth:
  identities:
    data-staging/terraform:
      default: true

Then all stacks across all OUs begin to load that identity. Here is debug logs showing that the plan is run on a plat-staging stack and loads the identity for data-staging. We also tried the plat-prod stack and had the same results

Found component 'eks/test-eks-agent' in the stack 'plat-use1-staging' in the stack manifest 'orgs/gold/plat/staging/us-east-1/monitoring-test'
 DEBU  Resolved component path type=terraform component=helm-release resolved_path=/Users/seanlong/repos/gold-infra/components/terraform/eks/helm-release base_path=/Users/seanlong/repos/gold-infra/components/terraform env_override=false
 DEBU  Running CI hooks event=before.terraform.plan force_ci=false
 DEBU  CI integration disabled in config (ci.enabled is not true)
 DEBU  CI provider not detected provider=generic
 DEBU  terraformRunWithOptions entry subCommand=plan args=[eks/test-eks-agent]
 DEBU  Profiles loaded from CLI env profiles=[cloud]
 DEBU  Loading profile profile=cloud location=project path=/Users/seanlong/repos/gold-infra/rootfs/usr/local/etc/atmos/profiles/cloud
 DEBU  Loaded configuration directory source="profile 'cloud'" files=1 pattern=/Users/seanlong/repos/gold-infra/rootfs/usr/local/etc/atmos/profiles/cloud/**/*
 DEBU  Profiles loaded successfully profiles=[cloud] count=1
 DEBU  Git root base path discovery enabled
 DEBU  Using git repository root as base path path=/Users/seanlong/repos/gold-infra
 DEBU  ProcessCommandLineArgs input componentType=terraform args="[plan eks/test-eks-agent]"
 DEBU  After ParseFlags identity.Value="" identity.Changed=false
 DEBU  Routing to ExecuteTerraform (single-component)
 DEBU  ExecuteTerraform entry SubCommand=plan ComponentFromArg=eks/test-eks-agent FinalComponent="" Stack=plat-use1-staging StackFromArg=""
 DEBU  Loading profile profile=cloud location=project path=/Users/seanlong/repos/gold-infra/rootfs/usr/local/etc/atmos/profiles/cloud
 DEBU  Loaded configuration directory source="profile 'cloud'" files=1 pattern=/Users/seanlong/repos/gold-infra/rootfs/usr/local/etc/atmos/profiles/cloud/**/*
 DEBU  Profiles loaded successfully profiles=[cloud] count=1
 DEBU  Git root base path discovery enabled
 DEBU  Using git repository root as base path path=/Users/seanlong/repos/gold-infra
 DEBU  Checking if should call ExecuteDescribeComponent Stack=plat-use1-staging ComponentFromArg=eks/test-eks-agent SubCommand=plan
 DEBU  Profiles loaded from CLI env profiles=[cloud]
 DEBU  Loading profile profile=cloud location=project path=/Users/seanlong/repos/gold-infra/rootfs/usr/local/etc/atmos/profiles/cloud
 DEBU  Loaded configuration directory source="profile 'cloud'" files=1 pattern=/Users/seanlong/repos/gold-infra/rootfs/usr/local/etc/atmos/profiles/cloud/**/*
 DEBU  Profiles loaded successfully profiles=[cloud] count=1
 DEBU  Git root base path discovery enabled
 DEBU  Using git repository root as base path path=/Users/seanlong/repos/gold-infra
 DEBU  Found component 'eks/test-eks-agent' in the stack 'plat-use1-staging' in the stack manifest 'orgs/gold/plat/staging/us-east-1/monitoring-test'
 DEBU  Resolved component path type=terraform component=helm-release resolved_path=/Users/seanlong/repos/gold-infra/components/terraform/eks/helm-release base_path=/Users/seanlong/repos/gold-infra/components/terraform env_override=false
 DEBU  CreateAndAuthenticateManager called identityName="" hasAuthConfig=true
 DEBU  Loading stack configs for auth identity defaults
 DEBU  Loading stack files for auth defaults count=284
 DEBU  Found default identity in stack config identity=data-staging/terraform file=/Users/seanlong/repos/gold-infra/stacks/orgs/gold/data/staging/us-east-1/monitoring-test.yaml

We've tested in Atmos 1.210 , 1.211, and 1.213

[Erik Osterman (Cloud Posse) (osterman)]

Apologies for the delay. Escalating this.

[Andriy Knysh (aknysh)]

seanlongnyc we are going to test this and fix ASAP. If we find any issues in Atmos, the fix will be released in the next release this week

[Erik Osterman (Cloud Posse) (osterman)]

We think it could be related to cloudposse/atmos#2293

[Andriy Knysh (aknysh)]

seanlongnyc please try the latest Atmos release https://github.com/cloudposse/atmos/releases/tag/v1.215.0, let us know how it's working for you.

The release contains the following fixes: cloudposse/atmos#2303