Financial institutions are constantly adapting their IT infrastructures — not just to keep pace with customer demand, but also to manage specific challenges around security and compliance. Infrastructure as code (IaC) is an approach that delivers on both fronts, allowing you to create enhanced workflows that manage infrastructure deployment safely, reliably, and at speed.
In this post, we outline nine best practices that organizations in the financial sector should embrace to scale their IaC in a fast, secure, and compliant way.
- Standardize practices, templates, and configurations to prevent vulnerabilities
- Enforce role-based access control (RBAC) for optimum security
- Use a secure IaC management platform to minimize risk
- Leverage policy as code to reduce the potential for human error
- Use drift detection to reconcile your IaC
- Integrate third-party security tools to safeguard infrastructure
- Make infrastructure self-service to work faster
- Use environment promotion to reinforce stability and trust
- Adopt self-hosted for maximum control
If engineers don’t follow consistent infrastructure setup practices, critical resources can be left accessible to everyone — including potential attackers. Maintaining the kind of consistent infrastructure setup you need to prevent misconfigurations and vulnerabilities requires predictability — which can be difficult to achieve as the number of users multiplies.
The most reliable approach is to introduce standardized practices, templates, and configurations when defining and provisioning infrastructure resources. Using an IaC tool such as OpenTofu or Terraform, you can set up private module registries that align with your organization’s best practices. Developers can then reference and use these to create trusted, reusable configurations, ensuring consistency and accelerating development efforts.
Pairing your tool of choice with an IaC orchestration product gives you even greater control over your workflow. You can bring custom code, custom tasks, and custom runner images, and also install and configure your preferred third-party security tools. Being able to customize your workflows with an IaC management platform such as Spacelift enhances your flexibility.
Standardizing your IaC approach also makes the auditing process much easier. All financial companies rely on robust audit trails to ensure transparency, accountability, and compliance. By asynchronously sending webhooks to a user-supplied endpoint, Spacelift’s audit trail feature supports auditing all operations that change Spacelift resources. You can get on with deployments, knowing that your infrastructure aligns with all your regulatory and company-specific requirements.
As your organization scales its IaC, tightening access control becomes even more important. Growing user numbers make relying on a single admin impractical or even impossible. RBAC enforces access permissions targeted at distinct roles within the company, minimizing the risk of data breaches by giving employees and systems access only to the information they need to perform their functions.
A combination of User Management, Spaces, and policies helps achieve RBAC in Spacelift. The Spaces feature provides restricted administrative access so that employees can use their designated Space to create stacks and policies and perform various administrative actions, without disrupting resources in other Spaces.
Resources in Spacelift are generally spaced, which means they belong to a Space. This centralized resource sharing maintains resource efficiency, encourages standardization across the organization, and boosts flexibility and scalability.
Policies are among these spaced resources. You can use policies to:
- Define access control at the Space level (login policies).
- Limit runs based on resource parameters (plan policies).
- Prevent runs until multiple approvals are provided (approval policies).
- Control what occurs after a PR or a merge happens (trigger policies).
- Define notifications for runs (notification policies).
You can also use policies to enforce standardization and ensure that regulations are respected. When paired with stack sependencies, they are invaluable for constructing an environment promotion system that reduces human intervention and errors to a minimum.
Security is obviously a pivotal concern for organizations in the financial sector, and that starts with the partners they choose. The IaC platform you choose should be driven by a security-first mindset that permeates the entire organization that delivers it. You can’t just patch security onto your IaC; security best practices must be embedded into every stage of the development and deployment process.
If you decide to rely on an external provider for managing your IaC, ensure that they are SOC2 type II–certified. This cybersecurity compliance framework ensures that third-party service providers store and process client data in a secure manner. Other identifiers of a secure IaC provider include encryption across the platform and enablement of Single Sign On (SSO) via SAML2.0 and OIDC.
In addition, avail of private workers to ensure data isolation and thereby limit the risk of exposure via shared resources. Depending on your industry niche, these should be adaptable to specific regulatory or compliance requirements. They create the perfect balance for financial firms, delivering SaaS scalability with the assurance of dedicated infrastructure.
Spacelift’s focus on security extends beyond these must-have security features to encrypting the temporary run state end to end so that only the workers in your worker pool can look inside it. This is achieved through asymmetric encryption. Access to the private key is restricted to the person who generates it.
Whichever cloud you use, Spacelift helps keep you secure with cloud integrations that manage your resources without the need to save long-lived static credentials in the stack environment or in an associated context. Instead, you dynamically generate short-lived credentials to authenticate to different cloud providers, vastly reducing the risk of security threats. As well as minimizing the potential fallout from a security breach, this fulfills the principle of least privilege, so access is allowed only when necessary, and it is time-limited.
Organizations that handle payment card information must follow strict regulations, some of which require much of their infrastructure to be policy-driven to ensure rules and decision-making are codified and executed in an automated way. A policy-as-code approach based on Open Policy Agent (OPA) helps companies create robust guardrails for the application and deployment lifecycle without having to invest manual effort.
Before they discover policy as code, many financial companies rely on a largely manual approach to IaC, working locally and pushing changes individually. However, this strategy becomes untenable as companies scale. Policies reduce developers’ manual workload and accelerate the deployment process.
By controlling specific decision points in the process, Spacelift’s policies reinforce existing security integrations and prevent deployments that fail to meet the requirements or regulations established by your standardization process. You can also leverage the policy workbench to accelerate policy development by sampling the inputs.
Spacelift’s approach to policy has transformed productivity for growing payments platform Moov, liberating developers from manual tasks. SRE Adam Jackman is excited by the potential to use policies to minimize Moov’s manual workload and speed up the deployment process. They are now in a position to restructure their Terraform to enable easier policy management, and “with Spacelift we will be able to restructure it to do it well,” he says.
When the actual state of your architecture does not match the defined state in your IaC configuration, you have drift. Drift happens, but when it goes undetected, it can cause security vulnerabilities, violated regulatory requirements, and volatile system behavior. These can all undermine the trustworthiness and reliability vital for operating in the financial sector.
Spacelift’s drift detection and optional remediation is a welcome solution for an industry particularly susceptible to regulatory and security sensitivities. With drift detection, your organization’s infrastructure is kept consistent, compliant, and secure, protecting both the firm’s operations and customers’ financial data.
For payments and software company SpotOn, Spacelift has exposed configuration drift in a way that is easy for users to consume. As their DevOps engineering manager Alex Siegman puts it, “It’s good to have that exposure working in the same way as our typical workflow.”
Security vulnerability scanning tools monitor code templates on a continuous basis, seeking out potential security flaws or misconfigurations that could compromise infrastructure. The combined imperatives of safeguarding sensitive financial data and staying agile with modern software practices make these tools vital for companies in financial services.
They allow you to identify and remediate vulnerabilities at the code level, before infrastructure is even provisioned, eliminating any associated security threats. This is precisely the approach required for limiting risk in infrastructure deployments because security is embedded from the start instead of being applied later. For organizations in the financial industry, integrating vulnerability scanning into IaC processes reinforces their defenses and ensures they are following CI/CD best practices. This bolsters trust and fulfills the strict cybersecurity standards associated with this industry.
Spacelift integrates with any security vulnerability scanning tool. It does this either via a custom runner image or by installing and configuring in pre-init hooks, and it also enables you to define policies based on the output of a scan.
Integrate your choice of third-party tools — including these examples for tfscan, Checkov, terrascan, and kicks.
To retain a competitive advantage, it is vital for ambitious financial companies to allow individual teams to provision, manage, and decommission their infrastructure resources on-demand — without the direct involvement of a dedicated IT team for infrastructure. They operate in fast-paced, innovation-driven environments, so adopting self-service infrastructure enables their teams to work at speed. The faster you can iterate, test, and deploy new financial products or features, the faster your time to market.
Empowered by this agility, companies can pivot swiftly as market demands change and new opportunities arise. Even better, once you have established appropriate governance and automated checks, self-service infrastructure helps preserve excellent security and compliance standards while giving teams the freedom to work on tasks that add true business value.
Spacelift’s Blueprints are templates for stacks and all the configurations associated with them. As well as defining which VCS repo and backend your stack will use, you can also choose associated policies and contexts and schedule every behavioral setting.
Payroll solution PayFit has an engineering team of 115, so it was vital that they could be self-sufficient while using the platform. “We cannot support developers 24 hours a day, so they need to be able to understand themselves how the tool works with the documentation and with the UI,” explains senior platform engineer Kévin Lemele. Fortunately, this was not an issue with Spacelift. “For documentation, Spacelift is one of the best we have seen because everything is written,” says Kévin.
Environment promotion is the structured progression of software or infrastructure changes from development through multiple stages to production. The sensitivity and regulatory complexity of the financial industry make this staged approach pivotal for several reasons.
Primarily, it prevents bugs and security vulnerabilities from entering the process by ensuring that changes are monitored in controlled environments before they reach production. It also enhances the trust levels among users, regulators, and stakeholders because they can be assured that deployed services are stable, secure, and aligned with established standards.
Environment promotion takes place via a regulated change management process that can be intricate and can delay deployments. However, the environment promotion process that Spacelift implements can follow a change management flow by combining the stack dependencies feature with policies to keep deployments regulated, reliable, and fast. Stack dependencies also enable you to pass outputs easily and securely from one stack to another.
For financial companies that have also implemented effective standardization, environment promotion can conjure the “golden path” to production. The so-called golden path guarantees that no change happens without stringent testing, validation, and approval processes, eliminating possible vulnerabilities and errors before they reach production.
One of the many Spacelift customers that operate in the financial sector is the global payments platform Checkout, which continues to accelerate with our platform. They now develop faster, and that efficiency has impacted the entire company. Spacelift allows them to get feedback on their code and apply changes faster while ensuring policies are applied consistently throughout their infrastructure changes. By leveraging Spacelift’s private module registry, they can easily store, share, and test their Terraform modules from the same platform that handles their deployments.
SaaS is not an option for companies operating in the financial industry that have specific requirements around governance, compliance, security, and regulation. However, self-hosting gives them heightened control of their infrastructure, allowing them to tailor security measures to their particular requirements and comply with regional and sector-specific regulations.
The key difference between Spacelift Self-Hosted on AWS or AWS Gov Cloud and Spacelift SaaS is that the SaaS version is completely managed and maintained by Spacelift, whereas the customer takes responsibility for installing and configuring the product in AWS in the self-hosted version.
Other differences between the self-hosted and SaaS enterprise versions include:
- No VCS Agents (Your self-service installation should connect to private VCS systems.)
- No public worker pool available from Spacelift
- No out-of-the-box functionality for dynamic credentials for Microsoft Azure and Google Cloud integrations (You can leverage OIDC integrations for them.)
Every ambitious organization innovates to meet and anticipate changing customer demands. However, those in the financial industry must approach that innovation with a laser focus on security and compliance. Spacelift delivers that balance with a flexible IaC management platform that integrates with any cloud environment, empowering you to streamline infrastructure deployment processes securely and maintain that competitive edge.
With its robust security stance, policy-based approach, granular access control, self-hosted capabilities, drift detection, and more, compliance is baked into the infrastructure lifecycle. Ultimately, Spacelift turns financial organizations into digital pioneers with the operational resilience to dominate the competition.
To discover how Spacelift can help you scale securely, book a demo with one of our engineers.
The Most Secure IaC Management Tool
Spacelift is a flexible orchestration solution for IaC development that delivers optimal security, resilience, and reliability for industries such as financial services. Enjoy enhanced collaboration, automation, and control for simpler, faster provisioning of secure cloud-based infrastructures.
