feat(cloudformation): migration guide, inline templates, and field-test fixes [EXPERIMENTAL]

[Erik Osterman (Cloud Posse) (osterman)]

what

• Phase 4 (final layer) of the native aws/cloudformation component type: backend management
  (backend create/describe/update/delete/list) for the S3 artifact bucket CloudFormation
  packaging uses, and a migration guide for Rain/raw-CloudFormation users.
• A full field-test pass across the whole feature, with fixes for every finding: bulk-selection
  infinite recursion (shared by every bulk-capable component type), logs stdout routing, missing
  confirmation gates, changeset/diff leaks, error-sentinel misuse, and small doc drift.
• Real backend auto-provisioning (provision.backend.enabled: true now actually provisions,
  instead of requiring a manual backend create first).
• Inline CloudFormation templates: template: is now the inline template body (string or
  structured map, flowing through Atmos's own {{ }} templating pipeline), and a new path: key
  takes over the file-reference role template: used to have.
• Fixes a missing identity EndpointURL override in the shared pkg/ci/artifact/s3 store that
  broke template uploads against emulated AWS endpoints (e.g. Floci).
• Fixes aws cfn/helm/kubernetes duplicating the entire global CLI flag set as local
  persistent flags (found via this session's --help output investigation).
• Makes --labels repeatable across every command family that has it (kubernetes, helm,
  container, workflow, terraform, vendor, list, cloudformation), matching --tags' existing
  repeatable-flag behavior.

why

• This is the layer that makes the feature real for users: end-to-end backend lifecycle
  management, a documented migration path off Rain, and every rough edge found during a real,
  adversarial DX test pass fixed before the feature is announced.
• Inline templates and the duplicate-flag-registration fix are genuine capability/DX gains
  discovered during this pass, not originally scoped work.

references

• Individual fixes are each documented under docs/fixes/.
• Migration guide: website/docs/migration/from-rain.mdx
• Closes out the 6-PR stack starting at cloudformation-component-prd.

[atmos-pro]

Tip

Atmos Pro  

No affected stacks workflow was detected for this pull request.
If this is expected, no action is needed.
Learn More. Ask AI.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

None

[github-actions]

Resource Changes Found for bucket in test

Plan: 4 to add, 0 to change, 0 to destroy.

To reproduce this locally, run:

atmos terraform plan bucket -s test

---

Create

+ aws_s3_bucket.checkov_target
+ aws_s3_bucket.this
+ aws_s3_bucket.trivy_target
+ aws_s3_bucket_public_access_block.trivy_target

Terraform Plan Summary

  # aws_s3_bucket.checkov_target will be created
  + resource "aws_s3_bucket" "checkov_target" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "atmos-native-ci-e2e-checkov-test"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags_all                    = (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule (known after apply)

      + grant (known after apply)

      + lifecycle_rule (known after apply)

      + logging (known after apply)

      + object_lock_configuration (known after apply)

      + replication_configuration (known after apply)

      + server_side_encryption_configuration (known after apply)

      + versioning (known after apply)

      + website (known after apply)
    }

  # aws_s3_bucket.this will be created
  + resource "aws_s3_bucket" "this" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "atmos-native-ci-e2e-test"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags                        = {
          + "AtmosFixture" = "native-ci-e2e"
          + "Stage"        = "test"
        }
      + tags_all                    = {
          + "AtmosFixture" = "native-ci-e2e"
          + "Stage"        = "test"
        }
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule (known after apply)

      + grant (known after apply)

      + lifecycle_rule (known after apply)

      + logging (known after apply)

      + object_lock_configuration (known after apply)

      + replication_configuration (known after apply)

      + server_side_encryption_configuration (known after apply)

      + versioning (known after apply)

      + website (known after apply)
    }

  # aws_s3_bucket.trivy_target will be created
  + resource "aws_s3_bucket" "trivy_target" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "atmos-native-ci-e2e-trivy-test"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags_all                    = (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule (known after apply)

      + grant (known after apply)

      + lifecycle_rule (known after apply)

      + logging (known after apply)

      + object_lock_configuration (known after apply)

      + replication_configuration (known after apply)

      + server_side_encryption_configuration (known after apply)

      + versioning (known after apply)

      + website (known after apply)
    }

  # aws_s3_bucket_public_access_block.trivy_target will be created
  + resource "aws_s3_bucket_public_access_block" "trivy_target" {
      + block_public_acls       = true
      + block_public_policy     = true
      + bucket                  = (known after apply)
      + id                      = (known after apply)
      + ignore_public_acls      = true
      + restrict_public_buckets = true
    }

Plan: 4 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + bucket_name = "atmos-native-ci-e2e-test"

[codecov]

Codecov Report

❌ Patch coverage is 89.35673% with 91 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.65%. Comparing base (e108500) to head (835c153).

Files with missing lines	Patch %	Lines
cmd/aws/cloudformation/backend/backend_helpers.go	81.96%	18 Missing and 4 partials ⚠️
cmd/aws/cloudformation/backend/backend_create.go	85.22%	8 Missing and 5 partials ⚠️
cmd/aws/cloudformation/backend/backend_delete.go	86.30%	5 Missing and 5 partials ⚠️
cmd/aws/cloudformation/backend/backend_describe.go	85.71%	5 Missing and 5 partials ⚠️
cmd/aws/cloudformation/backend/backend_list.go	82.75%	5 Missing and 5 partials ⚠️
cmd/aws/cloudformation/backend/backend_update.go	83.67%	4 Missing and 4 partials ⚠️
cmd/aws/cloudformation/backend/flag_values.go	74.19%	5 Missing and 3 partials ⚠️
cmd/aws/cloudformation/cloudformation.go	93.33%	2 Missing ⚠️
pkg/component/aws/cloudformation/executor.go	88.88%	1 Missing and 1 partial ⚠️
pkg/component/aws/cloudformation/spec.go	89.47%	1 Missing and 1 partial ⚠️
... and 3 more

Additional details and impacted files

@@                               Coverage Diff                               @@
##           osterman/cfn-phase3-stacksets-observability    #3002      +/-   ##
===============================================================================
+ Coverage                                        83.61%   83.65%   +0.03%     
===============================================================================
  Files                                             1975     1984       +9     
  Lines                                           192295   193027     +732     
===============================================================================
+ Hits                                            160797   161471     +674     
- Misses                                           23489    23511      +22     
- Partials                                          8009     8045      +36     

Flag	Coverage Δ
unittests	83.65% <89.35%> (+0.03%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
cmd/aws/cloudformation/backend/backend.go	100.00% <100.00%> (ø)
cmd/container/container.go	77.27% <100.00%> (ø)
cmd/container/verbs.go	88.40% <100.00%> (ø)
cmd/helm/helm.go	94.41% <100.00%> (ø)
cmd/kubernetes/kubernetes.go	93.50% <100.00%> (ø)
cmd/list/components.go	83.88% <100.00%> (ø)
cmd/list/dependencies.go	91.11% <100.00%> (ø)
cmd/list/flag_wrappers.go	100.00% <100.00%> (ø)
cmd/list/instances.go	71.42% <100.00%> (ø)
cmd/list/metadata.go	64.93% <100.00%> (ø)
... and 42 more

... and 4 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.