Bugfix: auth identities should default load the AWS Environment vars (if AWS based identities)
#1623
Conversation
📝 WalkthroughWalkthroughAdds AWS file-based environment resolution to Environment() for assume-role and permission-set identities. Introduces GetProviderName() to derive provider from Via config. Merges AWS file manager-derived env vars before identity config env. Updates tests to set Via.Provider and assert AWS_* variables. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant C as Caller
participant I as Identity.Environment()
participant P as GetProviderName()
participant FM as AWSFileManager
participant AWS as GetEnvironmentVariables()
C->>I: Environment()
I->>P: Resolve provider (Via.Provider / Via.Identity)
P-->>I: providerName or error
alt provider resolved
I->>FM: NewAWSFileManager()
alt created
I->>AWS: GetEnvironmentVariables(providerName, identityName)
AWS-->>I: [KEY=VAL...]
I->>I: Merge AWS env -> env map
else creation failed
I-->>C: error (joined with ErrAuthAwsFileManagerFailed)
end
I->>I: Overlay config Env
I-->>C: env map
else error
I-->>C: error
end
note over I,AWS: Applies to assume-role and permission-set identities
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested labels
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
pkg/auth/identities/aws/permission_set.go (1)
166-171: Consider adding Via.Identity fallback for consistency.The
GetProviderName()implementation here only checksVia.Provider, while the assume_role.go version also falls back toVia.Identityfor chained identities. This inconsistency may limit permission set identities from chaining through other identities.Verify if permission set identities need to support chaining via Via.Identity. If so, apply this diff:
func (i *permissionSetIdentity) GetProviderName() (string, error) { if i.config.Via != nil && i.config.Via.Provider != "" { return i.config.Via.Provider, nil } + if i.config.Via != nil && i.config.Via.Identity != "" { + return i.config.Via.Identity, nil + } return "", fmt.Errorf("%w: permission set identity %q has no valid via configuration", errUtils.ErrInvalidIdentityConfig, i.name) }
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (3)
pkg/auth/identities/aws/assume_role.go(1 hunks)pkg/auth/identities/aws/assume_role_test.go(1 hunks)pkg/auth/identities/aws/permission_set.go(2 hunks)
🧰 Additional context used
📓 Path-based instructions (5)
pkg/**/*.go
📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)
Place business logic in pkg rather than in cmd
Files:
pkg/auth/identities/aws/assume_role_test.gopkg/auth/identities/aws/assume_role.gopkg/auth/identities/aws/permission_set.go
**/*_test.go
📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)
**/*_test.go: Every new feature must include comprehensive unit tests
Test both happy paths and error conditions
Use table-driven tests for multiple scenarios
**/*_test.go: Write unit tests as table-driven tests focused on behavior; prefer high coverage for pkg/ and internal/exec/; comments must end with periods.
Use t.Skipf with a reason instead of t.Skip; never skip without a reason.
Test files must mirror implementation file names (e.g., aws_ssm_store_test.go pairs with aws_ssm_store.go).
Files:
pkg/auth/identities/aws/assume_role_test.go
**/*.go
📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)
**/*.go: All code must pass golangci-lint checks
Follow Go error handling idioms and use meaningful error messages
Wrap errors with context using fmt.Errorf("context: %w", err)
Consider custom error types for domain-specific errors
Follow standard Go coding style; run gofmt and goimports
Use snake_case for environment variables
Document complex logic with inline comments
**/*.go: All comments must end with periods across all Go code (godot linter enforced).
Organize imports into three groups (stdlib, 3rd-party, Atmos) separated by blank lines and sorted alphabetically within groups; preserve existing aliases.
Add defer perf.Track(<atmosConfig|nil>, ".")() at the start of all public and critical private functions, followed by a blank line.
All errors must be wrapped using static errors from errors/errors.go; prefer errors.Join for multiple errors, fmt.Errorf with %w for context, and check with errors.Is; never use dynamic errors directly.
Use utils.PrintfMarkdown() to render embedded markdown examples for CLI help output.
Co-locate unit tests with implementation files; integration tests reside under tests/.
Distinguish UI output from logging: UI prompts/status/errors to stderr; data/results to stdout; logging for system/debug info only with structured fields.
Most text UI must go to stderr; only data/results to stdout. Prefer utils.PrintfMessageToTUI for UI messages.
Bind all environment variables with viper.BindEnv(); every env var must have an ATMOS_ alternative binding.
Favor cross-platform code: prefer SDKs over external binaries, use filepath/os/runtime, and handle OS-specific differences or use build tags.
For non-standard execution paths, capture telemetry using telemetry.CaptureCmd or telemetry.CaptureCmdString without collecting user data.
Search for existing methods and utilities (internal/exec, pkg/) before implementing new functionality; prefer reuse/refactoring over duplication.
Files:
pkg/auth/identities/aws/assume_role_test.gopkg/auth/identities/aws/assume_role.gopkg/auth/identities/aws/permission_set.go
pkg/**/*_test.go
📄 CodeRabbit inference engine (CLAUDE.md)
Place unit tests for packages under pkg/ as *_test.go files.
Files:
pkg/auth/identities/aws/assume_role_test.go
**/!(*_test).go
📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)
Document all exported functions, types, and methods with Go doc comments
Files:
pkg/auth/identities/aws/assume_role.gopkg/auth/identities/aws/permission_set.go
🧬 Code graph analysis (3)
pkg/auth/identities/aws/assume_role_test.go (1)
pkg/schema/schema_auth.go (1)
IdentityVia(42-45)
pkg/auth/identities/aws/assume_role.go (2)
pkg/auth/cloud/aws/files.go (1)
NewAWSFileManager(43-51)errors/errors.go (1)
ErrAuthAwsFileManagerFailed(364-364)
pkg/auth/identities/aws/permission_set.go (2)
pkg/auth/cloud/aws/files.go (1)
NewAWSFileManager(43-51)errors/errors.go (1)
ErrAuthAwsFileManagerFailed(364-364)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
- GitHub Check: Analyze (go)
- GitHub Check: Lint (golangci)
- GitHub Check: Lint (golangci)
- GitHub Check: Analyze (go)
- GitHub Check: Build (windows-latest, windows)
- GitHub Check: Analyze (go)
- GitHub Check: Lint (golangci)
- GitHub Check: Summary
🔇 Additional comments (4)
pkg/auth/identities/aws/assume_role_test.go (1)
72-82: LGTM! Test coverage validates AWS environment variable integration.The test now properly validates that
Environment()includes AWS file-based environment variables alongside custom config vars. The Via.Provider setup and assertions for AWS_SHARED_CREDENTIALS_FILE, AWS_CONFIG_FILE, and AWS_PROFILE are correct.pkg/auth/identities/aws/permission_set.go (1)
5-5: Solid implementation of AWS environment variable integration.The changes correctly merge AWS file-based environment variables before applying identity config vars. Error handling with
errors.JoinandErrAuthAwsFileManagerFailedfollows the established patterns.Also applies to: 139-156
pkg/auth/identities/aws/assume_role.go (2)
172-199: Well-implemented AWS environment variable integration.The
Environment()method now correctly merges AWS file-based environment variables before applying identity config vars. The error handling is robust, and the precedence order ensures custom config vars can override AWS defaults.
201-212: Excellent provider resolution logic with proper fallback.The
GetProviderName()method properly handles both direct provider references and chained identity scenarios. The fallback logic ensures flexibility while maintaining clear error messages when neither is configured.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1623 +/- ##
==========================================
+ Coverage 64.47% 64.50% +0.02%
==========================================
Files 333 333
Lines 37303 37331 +28
==========================================
+ Hits 24052 24080 +28
+ Misses 11310 11304 -6
- Partials 1941 1947 +6
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
|
These changes were released in v1.194.1. |
what
Atmos auth execandatmos auth envneed the default AWS Env variables of AWS to function properly. Main implementation had this feature, but was removed unintentionally from refactoring how the Environment() block was used.why
atmos auth exec -- aws s3 lsand selecting an identity to work as expected.references
Summary by CodeRabbit
New Features
Tests