Hey, team. I think there might be a documentation snafu. Here in the Native CI docs, it shows an example of how one can set up Github OIDC auth. This did not work. Atmos complained that the profile was not valid.

auth:
  providers:
    github-oidc:
      kind: github/oidc
      region: us-east-1
  identities:
    plat-dev/terraform:
      provider: github-oidc
      role_arn: arn:aws:iam::111122223333:role/atmos-terraform
      default: true   # Use this identity unless a component overrides it

Fortunately,

atmos auth validate

was pretty helpful and suggested useful changes, which I was later able to confirm in the more thorough auth section in the Atmos docs. I would humbly suggest that the example for the Native CI section should look something like this.

auth:
  providers:
    github-oidc:
      kind: github/oidc
      region: us-east-1
      spec:
        audience: <http://sts.amazonaws.com|sts.amazonaws.com>
  identities:
    plat-dev/terraform:
      kind: aws/assume-role
      via:
        provider: github-oidc
      principal:
        assume_role: arn:aws:iam::111122223333:role/atmos-terraform
      default: true   # Use this identity unless a component overrides it

At the bottom of doc respective doc page, is the "Edit this page" link. Also, the source code of the docs is found in the `website/` directory of the atmos repo.

Yep! Everything's public. It would be a big help if you could open a PR to clarify that the audience claim is required. github.com/cloudposse-examples/atmos-native-ci Also this is a great repository to look at as a reference. It's what we use for our demos and we keep it up to date