Run your infrastructure anywhere.

Atmos is the open-source runtime for infrastructure — it builds, authenticates, and ships Terraform, OpenTofu, Kubernetes, Helm, and containers the same way on your laptop, in CI, and with AI agents. Auth, secrets, vendoring, caching, the toolchain, workflows, and CI are built in. Point every environment at the same reusable root modules and treat the rest as configuration. Stop stringing together 25 tools.

Run it on your laptop. Run it the same in CI. Run it with agents.

Everything is open source and free.

[!TIP]

You can try out atmos directly in your browser using GitHub Codespaces

Already start one? Find it here.

Screenshots

Example of running atmos to describe infrastructure.

Introduction

Atmos turns sprawling cloud infrastructure into one declarative system you can run consistently — locally, in CI/CD, and through AI agents. Model your platform once as stacks and components, authenticate once, and run the same commands everywhere. The same code deploys to every region, environment, and stage with DRY configuration — no copy-paste, no bespoke wrapper scripts, no glue.

Cloud Posse builds and operates production infrastructure on AWS, Azure, and GCP with Atmos every day — and so do startups and enterprises managing thousands of components.

Everything you'd otherwise bolt on

Auth, secrets, vendoring, caching, the toolchain, workflows, CI, and AI are part of the runtime — not a pile of plugins you wire together.

• Unified Auth: One identity layer across AWS, Azure, and GCP — SSO, OIDC, and federation. EKS and ECR login happen automatically, and the same identity feeds Terraform, stores, and emulators.
• Secrets Management: Declare secrets per environment, source them from 10+ backends (1Password, SSM, Vault, SOPS, and more), and mask them across every channel.
• Vendoring: Pull every dependency just-in-time with version pinning and retries — no separate vendor step.
• Caching & Mirroring: A native build cache plus a transparent Terraform provider and module registry mirror — warm in CI, instant on your laptop.
• Toolchain: Auto-install the exact Terraform, OpenTofu, and Helmfile versions your stacks need — verified by checksum.
• Workflows & Automation: Orchestrate, automate, and chain anything with 25+ step types and custom commands across every component.
• GitOps & CI/CD: The same commands locally and in CI. Detect affected components, emit matrices, and catch drift.
• AI + MCP: Chat about your infrastructure, run 20+ skills, expose Atmos as an MCP server, or add --ai to any command.

Run anything, the same way

• Terraform & OpenTofu like a platform team. Plan and apply across every component in dependency order with bounded concurrency. Backends and providers are generated for you, and drift is caught automatically.
• Kubernetes & Helm as first-class workloads. Model Helmfile and Kubernetes releases beside the rest of your stack, with the same CLI you already use for Terraform.
• Containers and cloud emulators. Containers and dev containers are workloads too — and you can spin up cloud emulators locally so your whole stack runs on your laptop, with no account required to iterate.
• Bring your own. Packer, Ansible, or your own component types plug into the same registry the built-ins use.

Your laptop is the CI. CI is your laptop.

Same command, same auth, same secrets, same toolchain — whether you run it locally or in a pipeline. Atmos is git-aware: it detects what changed and plans or applies only the affected components, so CI does exactly the work that changed — nothing more.

Built for your agents

Everything is declarative and self-documenting, so AI agents can reason about your infrastructure instead of stringing together 25 tools and praying. Atmos ships a catalog of portable agent skills — working across Claude Code, Cursor, Gemini, and Copilot — and an MCP server so any agent can install what it needs and drive Atmos directly, as native tools, with no custom integration.

Extend it without forking it

• Custom Commands: Wrap any script as a first-class atmos command with flags, args, and identity.
• YAML Functions: Resolve state, outputs, secrets, and Git metadata right inside your config.
• Hooks: Run infracost, checkov, trivy, or any command on lifecycle events.
• Stores: Plug in SSM, Secrets Manager, Key Vault, Vault, Redis, and more for cross-component data.
• Validation: Enforce your own guardrails with OPA/Rego policies and JSON Schema.
• Templates & Data Sources: Pull live data into your config with Go templates and Gomplate datasources.

Use Cases

Atmos has consistently proven its strength across the cloud infrastructure and DevOps domains:

• Managing Large Multi-Account Cloud Environments: Suitable for organizations using multiple cloud accounts to separate different projects or stages of development.
• Cross-Platform Cloud Architectures: Ideal for businesses that need to manage configuration of services across AWS, GCP, Azure, etc., to build a cohesive system.
• Multi-Tenant Systems for SaaS: Perfect for SaaS companies looking to host multiple customers within a unified infrastructure. Define a baseline tenant configuration once, then onboard new tenants by reusing this baseline through pure configuration — no further code required.
• Efficient Multi-Region Deployments: Define baseline configurations with stacks and extend them across regions with DRY principles through imports and inheritance.
• Compliant Infrastructure for Regulated Industries: Create vetted configurations that comply with SOC2, HIPAA, HITRUST, PCI, and other standards, then share and reuse them across the organization via service catalogs, component libraries, [vendoring](https://atmos