Fix AWS store auth and add Floci E2E coverage (#2625)

* Fix AWS store auth and add Floci E2E coverage

* Polish AWS secrets examples and Floci toolchain

* Address floci review feedback

* De-risk store auth resolver injection

* Fix acceptance CI failures

* Pass GitHub token to Floci toolchain CI

* Auto-start Floci emulators for local E2E tests; store auth/endpoint fixes

Add testcontainers-based auto-start for the opt-in Floci cloud-emulator E2E
tests. When ATMOS_TEST_FLOCI=true and the FLOCI_* endpoints are unset, the
suite detects the container runtime (Docker or Podman, via pkg/container),
wires Podman's API socket into testcontainers, and brings the AWS/GCP/Azure
emulators up on dynamic ports, tearing them down afterward. CI keeps its
service containers (pre-set endpoints make auto-start a no-op), and tests skip
cleanly with an actionable message when no runtime is available.

Also includes this branch's AWS SSM / Secrets Manager / Azure Key Vault / GCP
Secret Manager store auth and endpoint changes and their tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Cover decodeNodeWithYamlFunctions error and alias branches

Add a focused test for the error-propagation paths (failing scalar decode
inside a mapping and a sequence) and the default/alias branch of
decodeNodeWithYamlFunctions, raising it from ~73% to ~97%.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Move AWS resolver endpoint into auth context

* Address CodeRabbit review feedback on test quality

- aws_ssm_param_store_test: assert applied option behavior (region,
  endpoint, profile, config/creds files) not just option count, so
  auth precedence can't regress silently
- precondition_cached_tools_test: use OS-agnostic temp-dir PATH fixture
  instead of hardcoded /usr/bin
- cli_test: bound Floci auto-start with a 3m timeout context so a hung
  Podman/Docker call can't block TestMain indefinitely

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Add perf.Track to SetAuthContext and cover lowercase identity fallback

- setup.go: add the required perf.Track defer to the public SetAuthContext
  function, matching the package convention (nil atmosConfig)
- setup_test: make TestSetAuthContext_WithIdentityResolverEndpoint
  table-driven to also exercise the strings.ToLower identity-name fallback
  in endpointURLFromManager (mixed-case input, lowercase-keyed identity)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Add store integration coverage

* Fix Vault test HTTP handler

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Andriy Knysh <aknysh@users.noreply.github.com>

Author: 3 people

.github/workflows/test.yml

@@ -31,8 +31,8 @@ permissions:
   pull-requests: read
 
 env:
-  TERRAFORM_VERSION: "1.9.7"
-  OPEN_TOFU_VERSION: "1.9.1"
+  TERRAFORM_VERSION: "1.15.6"
+  OPEN_TOFU_VERSION: "1.12.2"
   HELM_VERSION: "v3.19.2"
   HELMFILE_VERSION: "v1.1.0"
   PACKER_VERSION: "1.14.2"
@@ -281,7 +281,7 @@ jobs:
         run: make testacc
 
       - name: Upload coverage report to Codecov
-        if: matrix.flavor.target == 'linux' && (success() || failure())
+        if: matrix.flavor.target == 'linux' && hashFiles('coverage.out') != ''
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -408,6 +408,77 @@ jobs:
             exit "${status}"
           }
 
+  # Run Go E2E tests against Floci. These cover store/secrets workflows that are
+  # easier to assert directly from Go than through the demo `atmos test` runner.
+  floci-go:
+    name: "[floci] go e2e"
+    needs: build
+    runs-on: ubuntu-latest
+
+    services:
+      floci:
+        # Pin by immutable digest for reproducibility/supply-chain safety (matches our SHA-pinned actions). Comment tracks the human-readable tag.
+        image: floci/floci@sha256:c88ec20bf221630dd195d38a14eeb0ac52ddfa72c37ebb3c8aa17f63ae27c5f2 # 1.5.23
+        ports:
+          - 4566:4566
+      floci-gcp:
+        # Pin by immutable digest for reproducibility/supply-chain safety. Comment tracks the human-readable tag.
+        image: floci/floci-gcp@sha256:a6420f308ad721fa4a203b70658563eab9c8fbc8d091feca2d95016239f5854a # latest
+        ports:
+          - 4588:4588
+      floci-az:
+        # Pin by immutable digest for reproducibility/supply-chain safety. Comment tracks the human-readable tag.
+        image: floci/floci-az@sha256:1e514c57db14dc41938f7925bbc1aca0293aa4da272c7014d98f1fba378cedb2 # latest
+        ports:
+          - 4577:4577
+
+    timeout-minutes: 30
+    steps:
+      - name: Download build artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: build-artifacts-linux
+          path: /usr/local/bin
+
+      - name: Set execute permissions on atmos
+        run: chmod +x /usr/local/bin/atmos
+
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        # setup-go v6 requires runner v2.327.1+ and can affect toolchain handling.
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version-file: "go.mod"
+          cache: false
+
+      - name: Install OpenTofu with Atmos toolchain
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          atmos toolchain install --default opentofu/opentofu@${{ env.OPEN_TOFU_VERSION }}
+          atmos toolchain env --format=github
+
+      - name: Verify OpenTofu
+        run: tofu version
+
+      - name: Install Linux build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends libudev-dev pkg-config
+
+      - name: Run Floci Go E2E tests
+        env:
+          ATMOS_TEST_FLOCI: "true"
+          FLOCI_ENDPOINT_URL: "http://localhost:4566"
+          FLOCI_GCP_ENDPOINT: "http://localhost:4588"
+          FLOCI_AZURE_ENDPOINT: "http://localhost:4577"
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: go test ./tests -run 'Test(AWS(StoreHooks|Secrets)|GCPSecrets|AzureSecrets)FlociE2E' -count=1 -timeout 15m -v
+
   # run k3s demo tests
   k3s:
     name: "[k3s] ${{ matrix.demo-folder }}"
@@ -681,7 +752,7 @@ jobs:
             }
 
   release:
-    needs: [test, lint, mock, k3s, floci, docker, validate]
+    needs: [test, lint, mock, k3s, floci, floci-go, docker, validate]
     if: github.event_name == 'push'
     uses: cloudposse/.github/.github/workflows/shared-go-auto-release.yml@8244c7c9142e92281e7841f655fa48e9ceb9b454 # main
     with:

agent-skills/skills/atmos-config/SKILL.md

@@ -179,7 +179,7 @@ auth:
 
 stores:
   ssm/dev:
-    type: aws-ssm-parameter-store
+    kind: aws/ssm
     options:
       region: us-east-1
       identity: dev-admin

agent-skills/skills/atmos-config/references/sections-reference.md

@@ -271,19 +271,19 @@ Configures external key-value store backends.
 ```yaml
 stores:
   ssm/dev:
-    type: aws-ssm-parameter-store
+    kind: aws/ssm
+    identity: dev-admin
     options:
       region: us-east-1
-      identity: dev-admin
 
   secrets:
-    type: azure-key-vault
+    kind: azure/keyvault
     options:
       vault_url: https://my-vault.vault.azure.net/
 ```
 
-Supported types: `aws-ssm-parameter-store`, `azure-key-vault`, `google-secret-manager` (alias: `gsm`),
-`redis`, `artifactory`.
+Supported kinds: `aws/ssm`, `aws/asm`, `azure/keyvault`, `gcp/secretmanager`, `redis`, `artifactory`.
+Legacy `type` aliases are still supported for backward compatibility.
 
 For complete store configuration, see the `atmos-stores` skill.
 

agent-skills/skills/atmos-stores/SKILL.md

@@ -1,14 +1,14 @@
 ---
 name: atmos-stores
-description: "Store backends: AWS SSM, Azure Key Vault, Google Secret Manager, Redis, Artifactory configuration, hooks integration, cross-component data sharing"
+description: "Store backends: AWS SSM, AWS Secrets Manager, Azure Key Vault, Google Secret Manager, Redis, Artifactory configuration, hooks integration, cross-component data sharing"
 metadata:
   copyright: Copyright Cloud Posse, LLC 2026
   version: "1.0.0"
 ---
 
 # Atmos External Stores
 
-Stores are external key-value backends configured in `atmos.yaml` that enable components to share data outside of Terraform state. Atmos supports five store providers: AWS SSM Parameter Store, Azure Key Vault, Google Secret Manager, Redis, and JFrog Artifactory.
+Stores are external key-value backends configured in `atmos.yaml` that enable components to share data outside of Terraform state. Atmos supports store providers including AWS SSM Parameter Store, AWS Secrets Manager, Azure Key Vault, Google Secret Manager, Redis, and JFrog Artifactory.
 
 ## When to Use Stores
 
@@ -23,23 +23,28 @@ For Terraform-managed outputs, prefer `!terraform.state` (fastest) or `!terrafor
 
 ## Configuring Stores in atmos.yaml
 
-All stores are declared under the top-level `stores:` key in `atmos.yaml`. Each store has a unique name, a `type`, and provider-specific `options`:
+All stores are declared under the top-level `stores:` key in `atmos.yaml`. Each store has a unique name, a `kind`, and provider-specific `options`. The legacy `type` field remains supported for compatibility, but `kind` is canonical:
 
 ```yaml
 # atmos.yaml
 stores:
   prod/ssm:
-    type: aws-ssm-parameter-store
+    kind: aws/ssm
+    options:
+      region: us-east-1
+
+  prod/asm:
+    kind: aws/asm
     options:
       region: us-east-1
 
   prod/azure:
-    type: azure-key-vault
+    kind: azure/keyvault
     options:
       vault_url: "https://my-keyvault.vault.azure.net/"
 
   prod/gcp:
-    type: google-secret-manager
+    kind: gcp/secretmanager
     options:
       project_id: my-project
 
@@ -77,13 +82,13 @@ Stores that support identity-based authentication accept an `identity` field at
 ```yaml
 stores:
   prod/ssm:
-    type: aws-ssm-parameter-store
+    kind: aws/ssm
     identity: prod-aws  # References an identity defined in the auth section
     options:
       region: us-east-1
 ```
 
-Identity-based auth is supported by AWS SSM, Azure Key Vault, and Google Secret Manager. It is not supported by Redis or Artifactory (a warning is logged if configured).
+Identity-based auth is supported by AWS SSM, AWS Secrets Manager, Azure Key Vault, and Google Secret Manager. It is not supported by Redis or Artifactory (a warning is logged if configured).
 
 ## Store Provider Configuration
 
@@ -92,7 +97,7 @@ Identity-based auth is supported by AWS SSM, Azure Key Vault, and Google Secret
 ```yaml
 stores:
   prod/ssm:
-    type: aws-ssm-parameter-store
+    kind: aws/ssm
     options:
       region: us-east-1           # Required
       prefix: myapp               # Optional: prepended to all key paths
@@ -105,12 +110,26 @@ Authentication uses the AWS default credential chain (environment variables, sha
 
 Key format: `/<prefix>/<stack-parts>/<component-parts>/<key>` (segments joined by `/`).
 
+### AWS Secrets Manager
+
+```yaml
+stores:
+  prod/asm:
+    kind: aws/asm
+    options:
+      region: us-east-1
+      prefix: myapp
+      stack_delimiter: "/"
+```
+
+Use `secret: true` with `kind: aws/asm` for declared secrets managed through `atmos secret` and `!secret`.
+
 ### Azure Key Vault
 
 ```yaml
 stores:
   prod/azure:
-    type: azure-key-vault
+    kind: azure/keyvault
     options:
       vault_url: "https://my-keyvault.vault.azure.net/"  # Required
       prefix: myapp               # Optional
@@ -126,7 +145,7 @@ Key format: `<prefix>-<stack-parts>-<component-parts>-<key>` (segments joined by
 ```yaml
 stores:
   prod/gcp:
-    type: google-secret-manager  # Also accepts "gsm"
+    kind: gcp/secretmanager
     options:
       project_id: my-project     # Required
       prefix: myapp              # Optional
@@ -312,7 +331,7 @@ Atmos merges these into a complete hook definition at resolution time.
 ```yaml
 stores:
   prod/ssm:
-    type: aws-ssm-parameter-store
+    kind: aws/ssm
     options:
       region: us-east-1
       read_role_arn: arn:aws:iam::123456789012:role/SSMReader
@@ -328,12 +347,12 @@ Define separate stores per region:
 ```yaml
 stores:
   prod-us/ssm:
-    type: aws-ssm-parameter-store
+    kind: aws/ssm
     options:
       region: us-east-1
 
   prod-eu/ssm:
-    type: aws-ssm-parameter-store
+    kind: aws/ssm
     options:
       region: eu-west-1
 ```
@@ -347,7 +366,7 @@ Reference the appropriate store in each stack's configuration.
 ```yaml
 stores:
   prod/ssm:
-    type: aws-ssm-parameter-store
+    kind: aws/ssm
     options:
       region: us-east-1
 ```
@@ -381,7 +400,7 @@ components:
 
 ## Security Best Practices
 
-- **Secrets exposure**: `!store` values appear in stdout when running `atmos describe stacks` or `atmos describe component`. Avoid storing highly sensitive secrets in stores that are frequently described.
+- **Secrets exposure**: `!store`, `!store.get`, and `atmos.Store` read values in cleartext and reject stores marked `secret: true`. Use `secret: true` plus `!secret` and `atmos secret` for sensitive values.
 - **Least privilege**: Use `read_role_arn`/`write_role_arn` to separate read and write permissions. Grant only the permissions each operation needs.
 - **Environment variables for tokens**: Never hardcode access tokens. Use `!env` or environment variables (`ARTIFACTORY_ACCESS_TOKEN`, `JFROG_ACCESS_TOKEN`, `ATMOS_REDIS_URL`).
 - **Cold-start handling**: Always provide `| default` values for store lookups that may reference unprovisioned components.
@@ -392,7 +411,7 @@ components:
 
 | Problem | Cause | Solution |
 |---------|-------|----------|
-| `store type not found` | Invalid `type` in store config | Use one of: `aws-ssm-parameter-store`, `azure-key-vault`, `google-secret-manager`, `gsm`, `redis`, `artifactory` |
+| `store type not found` | Invalid `kind`/`type` in store config | Use one of: `aws/ssm`, `aws/asm`, `azure/keyvault`, `gcp/secretmanager`, `redis`, `artifactory` |
 | `region is required` | Missing `region` for SSM store | Add `region` to store options |
 | `vault_url is required` | Missing `vault_url` for Azure | Add `vault_url` to store options |
 | `project_id is required` | Missing `project_id` for GCP | Add `project_id` to store options |