# Optional: Vendor Components

:::note Optional step
This step is **not required** for the tutorial. The six components in this example live in the repo under `components/terraform/`, so there's nothing to
vendor. This page is included as a design-pattern aside: in real projects you'll often pull shared components from a remote source instead of copying
them by hand. If you just want to deploy the example, skip to [Configure Validation](/quick-start/advanced/configure-validation).
:::

[Vendoring](/design-patterns/version-management/vendoring-components) is how Atmos pulls component source code from a remote location (Git, OCI, S3,
HTTP, the Terraform Registry, …) into your repository at a pinned version. It keeps your components DRY and versioned without forking shared modules.

:::tip

For more information about Atmos Vendoring and the `atmos vendor pull` CLI command, refer to:

- [Atmos Vendoring](/vendor/)
- [Vendoring Component Versions](/design-patterns/version-management/vendoring-components)
- [atmos vendor pull](/cli/commands/vendor/pull)

:::

To vendor components from a remote source, perform the following steps:

- ## - Create a `vendor.yaml` config file
  Create a `vendor.yaml` Atmos vendor config file in the root of the repo. Each `source` declares a component, the remote location to pull it from, the
  pinned `version`, and the target folder. For example, to vendor a shared `s3-bucket` component:

  **File:** `vendor.yaml`
  ```yaml
  apiVersion: atmos/v1
  kind: AtmosVendorConfig
  metadata:
    name: example-vendor-config
    description: Atmos vendoring manifest
  spec:
    # `imports` or `sources` (or both) must be defined in a vendoring manifest.
    imports: []

    sources:
      # `source` supports the following protocols: local paths (absolute and relative), OCI (https://opencontainers.org),
      # Git, Mercurial, HTTP, HTTPS, Amazon S3, Google GCP,
      # and all URL and archive formats as described in https://github.com/hashicorp/go-getter.
      # In 'source', Golang templates are supported  https://pkg.go.dev/text/template.
      # If 'version' is provided, '{{.Version}}' will be replaced with the 'version' value before pulling the files from 'source'.
      - component: "s3-bucket"
        source: "github.com/cloudposse/terraform-aws-components.git//modules/s3-bucket?ref={{.Version}}"
        version: "1.398.0"
        targets:
          - "components/terraform/s3-bucket"
        # Only include the files that match the 'included_paths' patterns.
        included_paths:
          - "**/*.tf"
        excluded_paths:
          - "**/providers.tf"
        tags:
          - storage
  ```

- ## - Vendor the dependencies
  Execute the command `atmos vendor pull` from the root of the repo.
  ```shell
  Processing vendor config file 'vendor.yaml'

  Pulling sources for the component 's3-bucket'
  from 'github.com/cloudposse/terraform-aws-components.git//modules/s3-bucket?ref=1.398.0'
  into 'components/terraform/s3-bucket'
  ```
  Atmos downloads the source into the target folder, and the component is then available exactly like a local one.

:::tip Vendored components work exactly like local ones
A vendored component reads another component's [remote state](/functions/yaml/terraform.state) and resolves [`!store`](/functions/yaml/store)/[`!secret`](/functions/yaml/secret) functions just like the local components you built earlier — no extra configuration. Atmos finds your `atmos.yaml` from the repo root (`base_path: "."`), so cross-component wiring keeps working after you vendor.
:::