# atmos auth validate

Use this command to validate your global `auth` configuration in `atmos.yaml`, or the merged authentication configuration for a selected stack.

## Usage

```shell
atmos auth validate [--stack <stack> [--component <component>]] [--verbose]
```

## Arguments

- **n/a** — No positional arguments.

## Examples

```shell
# Basic validation
atmos auth validate

# Validate every concrete component in dev
atmos auth validate --stack dev

# Validate demo's merged auth, including imports and component overrides
atmos auth validate --stack dev --component demo

# Verbose output
atmos auth validate --verbose
```

## Global and scoped validation

Without `--stack`, validation checks only `atmos.yaml` and its configuration overlays/profiles.
Every identity must be complete in that configuration. If an identity's `principal` is supplied
by a stack manifest, use `--stack` to validate the merged configuration instead of adding a
placeholder principal to `atmos.yaml`.

With `--stack`, each concrete component's auth is merged independently with the global auth
configuration using the same inheritance and override rules as component execution. All component
types are checked. `--component` narrows the selection to that name across component types and
requires `--stack`. Abstract components are excluded. An empty selection fails; a failing identity
or provider reports its stack, component, and component type.

This is a static configuration check. It does not authenticate, run Terraform, or evaluate
stack templates or YAML functions, including locals and native includes. Local imports and
inheritance are merged with template rendering disabled. Remote imports are rejected without fetching. Dynamic auth values such as `principal.assume_role: '{{ .vars.role_arn }}'`
or `!terraform.output` produce a **cannot fully validate** error instead of being accepted as
resolved values. Dynamic import paths and manifests that require template rendering are not
supported by scoped validation. Unrelated component expressions are left unevaluated.

The global `--base-path`, `--config`, `--config-path`, and `--profile` selectors apply in both modes.

## Flags

- **`--stack` (alias `-s`)** — Validate each concrete component's merged auth in a logical stack or stack manifest path.
- **`--component` (alias `-c`)** — Validate only components with this name in the selected stack. Requires `--stack`.
- **`--verbose` (alias `-v`)** — Enable verbose output.

## Environment variables

- **`ATMOS_AUTH_VALIDATE_VERBOSE`** — Set to `true` to enable verbose output by default.