Access to Internal Repositories under a Github Enterprise EMU tenant

[gems2000]

Hello folks,
We have been using atlantis for quite some time now in our organization. We have it enabled under multiple IAC organizations which handle all infrastructure across our products.

There is a specific use-case that we are exploring for internal enterprise-scoped terraform-modules access with a specific repository shared across our EMU tenant to be available across the organizations & atlantis installations.

I don't see specific documentation to handle this on the official one, so any help and workarounds should be of help!

[dosubot[bot]]

Hi @gems2000! I'm Dosu and I’m helping the atlantis team.

Atlantis currently supports only one GitHub App installation ID per instance, which means you can't use a single Atlantis instance to access internal repositories across multiple organizations within a GitHub Enterprise EMU tenant. The main workaround is to run a separate Atlantis instance (and GitHub App installation) for each organization that needs access to the shared modules repo. There is ongoing discussion about supporting multiple GitHub Apps or credentials per instance, but this isn't available yet (discussion).

For accessing internal/shared module repositories, configure Atlantis with the following:

• Use the --gh-hostname flag to point to your GitHub Enterprise hostname.
• Authenticate using either a GitHub App (--gh-app-id, --gh-app-key-file, --gh-app-installation-id) or a personal access token (--gh-token or --gh-token-file).
• Use the --repo-allowlist flag to specify which repositories Atlantis should accept webhooks from. You can allow all repos in your enterprise with a pattern like github.yourcompany.com/* (docs).
• Enable --write-git-creds to let Atlantis write a .git-credentials file for cloning private modules over HTTPS.

If your internal modules repo only supports SSH, be aware that Atlantis rewrites SSH URLs to HTTPS in .gitconfig, which can break SSH-only access. There are community-proposed hacks to override this behavior, but they're not recommended for production (thread).

For best security, always use a restrictive --repo-allowlist and set webhook secrets to ensure only trusted sources can trigger Atlantis (security docs).

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}