Summary

When auth.identities.<name>.default: true is defined inside an imported stack file (e.g., a _defaults.yaml that a stack manifest imports), atmos does not pick it up during identity resolution. Instead, atmos prompts the user to select an identity even though a default is configured.

Steps to Reproduce

1. Define a stack manifest that imports a defaults file:

  # stacks/orgs/acme/dev/us-east-1/foundation.yaml
  import:
    - ../_defaults
    - mixins/region/us-east-1

2. Define the default identity in the imported file:

  # stacks/orgs/acme/dev/_defaults.yaml
  import:
    - ../_defaults
  vars:
    stage: dev
  auth:
    identities:
      acme-dev:
        default: true

3. Run: atmos terraform plan my-component

Expected Behavior

Atmos resolves the default identity from the merged stack config and proceeds without prompting.

Actual Behavior

No default identity configured. Please choose an identity:

  > acme-dev
    core-root
    ...

Debug output confirms:

    DEBU  Loading stack configs for auth identity defaults
    DEBU  Loading stack files for auth defaults count=16
    DEBU  No default identities found in stack configs

Root Cause

Auth identity resolution happens early in the command lifecycle — before stack import: directives are fully merged. auth: blocks in imported files are not visible when atmos scans for default identities. Only auth: blocks defined directly in the top-level stack manifest are considered.

Workaround

Place the auth block directly in each stack manifest instead of in imported defaults files. This works but forces duplication rather than allowing inheritance via _defaults.yaml.

Related

• ATMOS-20, ATMOS-25, ATMOS-3, ATMOS-887
• PR Fix: Enable auto-import of provisioned identities from profiles #1865 (same root cause class)