Aoife is a content writer and manager with more than two decades of experience. Based in Ireland, her focus is on the tech industry, working as a senior content manager with the IaC management platform Spacelift.

All posts by Aoife O'Carroll

Aoife O'Carroll

Author title

Going to AWS Summit London? 🇬🇧🇬🇧

Title category

Get all the latest content on Infrastructure as Code, DevOps, Spacelift features & news directly to your inbox!

Level up your IaC knowledge. Stay up to date with educational devops guides & news in infrastructure as code, cloud & more!

Managing Infrastructure at Scale | Spacelift Blog

Announcing Enhanced VCS Integration  🎉 🎉

applepodcasts

spotify

missionctrl

Welcome to missionCTRL, a show dedicated to exploring the frontiers of modern DevOps. Listen (or watch) as we sit down with the practitioners who are pushing the boundaries of development

General | Spacelift Blog

General

Aoife O’Carroll

Amsterdam is at its best in spring – and this year it’s not just about the tulips blooming: <a href="https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/" target="_blank" rel="nofollow noopener">KubeCon + CloudNativeCon Europe</a> takes place in the city on 18-21 April, and Spacelift would love to meet you there. A silver sponsor of the event, Spacelift will have a team of engineers at booth S89 ready to show you how the product works, so be sure to <a href="https://calendly.com/kubecon-emea-2023" target="_blank" rel="nofollow noopener">book a meeting</a>. 
<h3>Why KubeCon + CloudNativeCon Europe 2023?</h3>
The flagship conference of the Cloud Native Computing Foundation (CNCF) brings together the industry’s most respected experts and key maintainers behind the most popular projects in the cloud native ecosystem. If you are a developer or other IT professional in the cloud-native world, you should be in Amsterdam, The Netherlands, this April. You will be mixing with more than 7,000 leading individuals in the industry, making this the perfect occasion for networking with industry professionals and learning from visionary cloud-native experts.
Meet peers and prospects while you discover and discuss key developments in microservices architectures and container orchestration with technologies like Kubernetes, Prometheus, and more. The conference offers almost limitless opportunities for learning and collaboration, with technical sessions, deep-dives, case studies, and other great events to help you hone your expertise in the rapidly evolving cloud-native field.  
<h3>What can you expect?</h3>
The KubeCon + CloudNativeCon Europe schedule is packed with sessions including keynotes, lightning talks, and breakout sessions. CNCF project maintainers will host content catering for every level of expertise, from basic introductory sessions to in-depth explorations and technical demonstrations. 
Register for the event to attend sessions on topics such as addressing practical challenges with Pod Security Admission (V Körbes and Christian Schlotter, VMware) and learning the Helm code base and community Pull Request review process (Scott Rigby and Red Hat’s Andrew Block and Karena Angell).  
Another feature of the conference is the “hallway track,” where you can collaborate with technology and business leaders on technological challenges and implementations and build valuable strategic partnerships.
<h3>How can Spacelift help you?</h3>
Spacelift is a <a href="https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/attend/faq/#sponsors" target="_blank" rel="nofollow noopener">silver sponsor</a> of KubeCon + CloudNativeCon Europe 2023. <a href="https://calendly.com/kubecon-emea-2023" target="_blank" rel="nofollow noopener">Book a slot</a> to meet us and visit our booth (S89). Our expert engineers will show you how our Infrastructure-as-Code management platform can help you manage and deploy your infrastructure more efficiently and effectively.
Be sure to pick up some quality swag and <a href="https://events.spacelift.io/landing-page/2023-kubecon-emea-amsterdam-giveaway" target="_blank" rel="noopener">enter our giveaway</a> while you’re there!
Find out which other events and conferences we are attending on our <a href="https://spacelift.io/devops-conferences-events" target="_blank" rel="noopener">DevOps events</a> page.

Why DevOps Engineers Recommend Spacelift

Introducing Blueprints by Spacelift

Integrating Security Tools With Spacelift Using Custom Inputs

Going to KubeCon + CloudNativeCon Europe 2023? Let’s meet there! Spacelift will be in Amsterdam for the cloud-native conference of the year.

181-kubecon-2023

KubeCon + CloudNativeCon Europe 2023

How to integrate the common security tools with Spacelift using the custom inputs

Learn more about new features, updates, and Spacelift product announcements.

Product Features and Updates | Spacelift Blog

Product

Flavius Dinu

Security is one of Spacelift’s biggest priorities, and apart from the state-of-the-art <a href="https://docs.spacelift.io/product/security.html" target="_blank" rel="noopener">security solutions</a> that are embedded inside the product like <a href="https://docs.spacelift.io/concepts/policy/index.html" target="_blank" rel="noopener">Policy as Code</a>, Encryption,  <a href="https://docs.spacelift.io/integrations/single-sign-on/index.html" target="_blank" rel="noopener">Single Sign On (SSO)</a>, <a href="https://docs.spacelift.io/concepts/worker-pools" target="_blank" rel="noopener">Private Worker Pools</a>, and others, in some organizations, there are tools that engineers were accustomed to and want to have the possibility to integrate them.
When it comes to integrating security tools in your workflows, Spacelift has you covered with the Custom Inputs feature. 
The way this works, in a nutshell, is:
<ul>
<li style="font-weight: 400;" aria-level="1">Install the security tool either directly on the Runner Image or as part of your <a href="https://docs.spacelift.io/concepts/configuration/runtime-configuration/index.html#before_-and-after_-hooks" target="_blank" rel="noopener">before_init</a> hook.</li>
<li style="font-weight: 400;" aria-level="1">Run the security tool as part of a before_init hook or any other hook that makes sense for your use case and save its output to a json file in the &lt;key&gt;.custom.spacelift.json format (case-sensitive, and &lt;key&gt; can be whatever you want).</li>
<li style="font-weight: 400;" aria-level="1">Access the data in a <a href="https://docs.spacelift.io/concepts/policy/terraform-plan-policy.html" target="_blank" rel="noopener">plan policy</a> under input.third_party_metadata.custom.&lt;key&gt; and manipulate it to accomplish what you want.</li>
</ul>
Only three steps have to be defined in order to accomplish an integration with any tool, so let’s see the most common ones in action:
<ol>
<li><a href="https://spacelift.io/blog/integrating-security-tools-with-spacelift#tfsec-integration">Tfsec</a></li>
<li><a href="https://spacelift.io/blog/integrating-security-tools-with-spacelift#checkov-integration">Checkov</a></li>
<li><a href="https://spacelift.io/blog/integrating-security-tools-with-spacelift#terrascan">Terrascan</a></li>
<li><a href="https://spacelift.io/blog/integrating-security-tools-with-spacelift#checkmarx-kics">Kics</a></li>
</ol>

In this <a href="https://github.com/saturnhead/spacelift-security-integrations" target="_blank" rel="nofollow noopener">repository</a>, there is some dummy Terraform code, that will create two EC2 instances. Due to the fact that it just uses an ami id and an instance type the code will be marked as vulnerable by many security tools we are going to use. 
You can replicate this repository and create a stack based on it in order to follow through with this setup.

terraform-sample-code-danger

terraform sample code danger

<a href="https://github.com/aquasecurity/tfsec" target="_blank" rel="nofollow noopener">Tfsec</a> is an awesome open-source static analysis security scanner for Terraform code. It checks Terraform code for potential security issues and provides clear and actionable feedback to help developers secure their Infrastructure as Code deployments. 
As mentioned above, in order to integrate a tool with Spacelift, we must first install it as part of the runner image or as a before_init hook. 
I am going to show you easy it is to install as part of a before_init hook. 
<h3>Installing and configuring tfsec as a before_init hook</h3>
Navigate in the Spacelift UI to your Stack → Settings → Behavior → Show Advanced Options → Initializations and add the following command before the Initialization Phase

You can drag and drop the commands to place them before the Initialization Phase, and in the end, this should look similar to this.

tfsec

If you are using the GitHub repository from above and you trigger a run, this code will not even pass the before_init phase due to the fact that it’s going to return some High vulnerabilities:

tfsec-github-repository-high-vulnerabilities

tfsec github repository high vulnerabilities

tfsec-github-repository-potential-problems-detected

tfsec github repository potential problems detected

This is not very useful because we are going to be limited to what <a href="https://spacelift.io/blog/what-is-tfsec" target="_blank" rel="noopener">Tfsec</a> is offering, and maybe some of these high vulnerabilities are not such a big deal for us. The before_init phase is not passing due to the fact that by default, Tfsec will return an exit code different than 0 on a Linux based system, whenever it finds an issue that is High or Critical.
But don’t worry, we will easily overcome this. Let’s go back to the Initializations and change the last command that we are running:

Great, now if we are going to retrigger a run, we are going to see that we arrived at the Initialization Phase:

tfsec-github-repository-retriggered-run

tfsec github repository retriggered run

That’s good, but we want to make sure that we are controlling vulnerabilities through our plan policies. So, as mentioned before, we have to save the json plan in a &lt;key&gt;.custom.spacelift.json file.
Let’s go back to the Initialization Phase and change the tfsec command run as follows:

It should look like this:

tfsec-custom-spacelift-json

tfsec custom spacelift json

<h3>Tfsec plan policy</h3>
Due to the fact that we’ve added tfsec as the value for &lt;key&gt;, this means that we can access the data in our plan policy by using input.third_party_metadata.custom.tfsec.
Let’s see a simple plan policy in action that uses this input:

This policy checks the number of high-severity issues and raises a warning if their number is less than five. Of course, you can create whatever policy you want, this is just a simple example.
In order to create the Policy go to Policies → Add Policy: 
<ul>
<li style="font-weight: 400;" aria-level="1">Add a name to your policy</li>
<li style="font-weight: 400;" aria-level="1">Select Plan Policy</li>
<li style="font-weight: 400;" aria-level="1">Select the Space in which your stack resides</li>
<li style="font-weight: 400;" aria-level="1">Paste the code inside of it</li>
</ul>
After you save, it should look like this:

tfsec-policy

tfsec policy

In order to attach the policy, go back to your Stack → Settings → Policies and select the newly created policy.

attached-policy-tfsec

attached policy tfsec

As we know, we are going to receive four high severity issues for the sample code. This means, that this policy is going to warn us after <code>terraform plan</code> executes.

plan-policy-tfsec

plan policy tfsec

If you want to deny the run if the number of high-severity issues is greater than a threshold, you can simply change the warn from the policy to deny.
And that’s it, you can customize the policies however you want based on the tfsec input.

<a href="https://github.com/bridgecrewio/checkov" target="_blank" rel="nofollow noopener">Checkov</a> is a static code analysis tool that is used to validate Terraform code for security and best practices. It scans Terraform code for potential security issues and recommends changes to improve the security and reliability of the infrastructure.
<h3>Installing and configuring checkov in before_init hook</h3>
As before, go to Stack → Settings → Behavior → Show Advanced Options → Initializations and add the following command before the Initialization Phase.

It should look similar to this:

checkov-initiialization

checkov initiialization

We are using the -s option as we don’t want the command to fail if our code has any vulnerabilities. We want to manipulate these vulnerabilities in our plan policies using custom inputs.
<h3>Checkov plan policy</h3>
We’ve now used <a href="https://spacelift.io/blog/what-is-checkov" target="_blank" rel="noopener">checkov</a> as the key for our file, so we will be able to access the result of this run in input.third_party_metadata.custom.checkov.
Let’s define a simple plan policy that counts the number of failed checks:

This policy will give you a warning if your failed checks are less than 10, but will not fail your run. Similarly, as we’ve done for tfsec, you can change warn to deny and change the condition however you please and the run is not going to happen.

checkov-policy

checkov policy

Attach the policy to the stack, and now trigger a run to see it in action.

plan-policy-checkov

plan policy checkov

By having the sample set to true, you can even see what’s going to happen in real time, exactly like you would do in the Rego Playground.

checkov-policy-preview

checkov policy preview

<ul>
<li><a href="https://spacelift.io/blog/spacelift-module-registry" target="_blank" rel="noopener">How to Use Spacelift Module Registry</a></li>
<li><a href="https://spacelift.io/blog/why-devops-engineers-recommend-spacelift" target="_blank" rel="noopener">Why DevOps Engineers Recommend Spacelift</a></li>
<li><a href="https://spacelift.io/blog/prometheus-exporter-for-spacelift" target="_blank" rel="noopener"><span data-sheets-value="{&quot;1&quot;:2,&quot;2&quot;:&quot;Monitoring Your Spacelift Account via Prometheus&quot;}" data-sheets-userformat="{&quot;2&quot;:513,&quot;3&quot;:{&quot;1&quot;:0},&quot;12&quot;:0}">Monitoring Your Spacelift Account via Prometheus</a></li>
</ul>

<a href="https://github.com/tenable/terrascan" target="_blank" rel="nofollow noopener">Terrascan</a> is another static code analysis tool that checks for security vulnerabilities.
<h3>Installing and configuring Terrascan in a before_init hook</h3>
As we’ve done for the other tools, go to Stack → Settings → Behavior → Show Advanced Options → Initializations and add the following command before the Initialization Phase:

terrascan-initialization

terrascan initialization

As <a href="https://spacelift.io/blog/what-is-terrascan" target="_blank" rel="noopener">Terrascan</a> doesn’t have any soft check implemented and the command will return a non 0 exit code, even for the smallest vulnerabilities it finds, we have used the “|| true” option to force a 0 exit code to be able to use output inside a plan policy.
<h3>Terrascan plan Policy</h3>
As we’ve used terrascan as the key for our file, we will be able to manipulate the output from the terrascan run in the plan policy using input.third_party_metadata.custom.terrascan.
Let’s define a plan policy that checks the number of violated policies and shows a warning with the number of them, also, if the number of violated policies is greater than 2, let’s deny the run.

terrascan-policy

terrascan policy

terrascan-trigger-run

terrascan trigger run

You can see the number of violated policies as a warning first and due to the fact that is greater than 2, you will get an error and the run will fail.

<a href="https://github.com/Checkmarx/kics" target="_blank" rel="nofollow noopener">Checkmarx Keeping Infrastructure as Code Secure (KICS)</a>, is in charge of finding vulnerabilities, compliance issues, and infrastructure misconfiguration early in the development cycle. This tool is also open-source, like the others, and it’s getting some traction. 
<h3>Installing and configuring Kics using a runner image</h3>
To spice things up, we will now configure a docker image with Kics and use it as a runner in Spacelift.
Example DockerFile:

You can build the image and push it to one of the supported registries for public runners. A list is available <a href="https://docs.spacelift.io/integrations/docker" target="_blank" rel="noopener">here</a>.
If you don’t want to use your own, the image is already available <a href="https://hub.docker.com/repository/docker/flaviuscdinu93/spacelift_kics/general" target="_blank" rel="nofollow noopener">here</a>.
After you have the image name, you can easily add it to the runner image section on the stack level. To do that, you will need to go to Stack → Settings → Behavior → Runner Image and add the image name here. 
Similar to this:

runner-image

runner image

After that, you are good to go.
We will need to generate a json file in the same way we were doing for the other tools. For that, we will use a before_init hook.

kics-initialization

kics initialization

Now we are ready to define a policy for this.

This policy will give you a warning with all the info, low and medium issues number and deny any run that has a high severity issue. 
It should be similar to this:

kics-policy

kics policy

After this, let’s attach it to our stack and trigger a run to see the policy in action.

kics-trigger-run

kics trigger run

We will see a warning with all the info, low and medium severity issues, and due to the fact that we have two high-severity issues, our run will be denied.

Custom inputs are a very powerful feature that can integrate with any json file. This means that the possibilities of what tools you can integrate into your plan policies is endless. Also, keep in mind that all policies defined inside of this post are just examples. You can create those however you want to accommodate your use case. Using the sample = true option will give you the possibility of seeing all the input that can be passed to your policy, and it makes it easy to write powerful policies.
At Spacelift, we care about your needs, and we understand that sometimes you want to go deep when it comes to security, so having this feature will improve your overall workflow.

<span data-sheets-value="{&quot;1&quot;:2,&quot;2&quot;:&quot;Spacelift is an alternative to using homegrown solutions on top of a generic CI. It helps overcome common state management issues and adds several must-have capabilities for infrastructure management.&quot;}" data-sheets-userformat="{&quot;2&quot;:769,&quot;3&quot;:{&quot;1&quot;:0},&quot;11&quot;:4,&quot;12&quot;:0}">Spacelift is an alternative to using homegrown solutions on top of a generic CI. It helps overcome common state management issues and adds several must-have capabilities for infrastructure management.

What is OPA? Open Policy Agent Examples & Tutorial

Automated and Manual Code Testing with DevSecOps

Infrastructure Problems that Spacelift Solves

See how to integrate common security tools (tfsec, checkov, terrascan and kics) with Spacelift using custom inputs.

168-spacelift-security-tools

168. How to integrate the common security tools with Spacelift using the custom inputssecurity tools

Derek Morgan

At Spacelift, we have historically been focused on providing sophisticated tools for advanced engineers to deploy mission-critical infrastructure to the cloud. We’ve seen some pretty complex deployments and have worked hard to ensure they always go off without a hitch. 
As we’ve grown, we’ve had several engineers request to make it easier for other engineers, developers, and people who aren’t quite as involved in the infrastructure process as they are. Essentially, these engineers hope to provide a more self-service deployment mechanism to these other engineers, and Spacelift has heeded the call! Enter Blueprints by Spacelift!

Blueprints are templates for environments that let the administrators configure all defaults, guardrails, and other settings to make it easier for anyone who needs infrastructure to deploy that infrastructure. This could be developers, managers, or other administrators. Any setting available when configuring a stack can be configured as a default value or within certain parameters in Blueprints. 
Let’s take a quick look:

what-are-blueprints

what are blueprints

As you can see, there are two Blueprints. One of those Blueprints is a draft, and the other is published. 
When a Blueprint is first created, it is set as a draft. When you are ready to publish, it’s as simple as clicking a button in the UI or switching a value in the <a href="https://registry.terraform.io/providers/spacelift-io/spacelift/latest/docs/resources/blueprint" target="_blank" rel="nofollow noopener">Spacelift Terraform Provider</a>. 
Check out this short video with the Blueprints introduction:
<div style="padding: 56.25% 0 0 0; position: relative;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src="https://player.vimeo.com/video/807756671?h=609a1b2a2c" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<script src="https://player.vimeo.com/api/player.js"></script>

Creating a new Blueprint from the UI is a simple process. Of course, since Spacelift is an IaC-first product, you can create them using our <a href="https://registry.terraform.io/providers/spacelift-io/spacelift/latest/docs/resources/blueprint" target="_blank" rel="nofollow noopener">Terraform provider</a>. Just head to the Blueprints pane and click on “Create Blueprint,” fill out the necessary fields, and “Create Blueprint Draft”:

create-blueprint-draft

Create Blueprint Draft

Once you have created the draft, you will be presented with your new Blueprint with some uncommented fields and a whole lot of fields that you can use to customize the Blueprint for your users:

customize-the-blueprint-for-your-users

Customize the Blueprint for your users

Everything that can be customized in a stack can be customized in a Blueprint. You will also notice the robust templating system, input variables, functions, etc. All of these are well <a href="https://docs.spacelift.io/concepts/blueprint/index.html" target="_blank" rel="noopener">documented</a>. 
There is even a Command Palette that can be accessed using <code>F1</code> or right-clicking in the editor window and selecting it:

command-palette

Command Palette

In the following image, I have configured the Blueprint to hardcode the repository so that it can’t be modified, provided a list of possible Spaces to use, and added the ability to pass the chosen instance size into the code as a variable:

blueprints-ml-developer-environment

blueprints ml developer environment

<ul>
<li><a href="https://spacelift.io/blog/spacelift-module-registry" target="_blank" rel="noopener">How to Use Spacelift Module Registry</a></li>
<li><a href="https://spacelift.io/blog/why-devops-engineers-recommend-spacelift" target="_blank" rel="noopener">Why DevOps Engineers Recommend Spacelift</a></li>
<li><a href="https://spacelift.io/blog/deploying-spacelift-with-spacelift" target="_blank" rel="noopener">Deploying Spacelift with Spacelift</a></li>
</ul>

Creating a stack from a Blueprint is easy! Click “Create stack” next to the Blueprint you’d like to use, fill in the necessary information, and click “Create stack” again. 
As you can see here, I have named the stack with my name, provided a list of Spaces to choose from, and can choose the size of the instance I’d like to use. 
This, of course, would be passed in as a variable to the underlying infrastructure code.

create-stack-from-blueprint

create stack from blueprint

Your stack is now ready to go with all of the defaults you configured:

blueprint-stacks

blueprint stacks

The Blueprints feature is available now for Spacelift Enterprise accounts!

<span data-sheets-value="{&quot;1&quot;:2,&quot;2&quot;:&quot;Spacelift is an alternative to using homegrown solutions on top of a generic CI solution. It allows you to automate, audit, secure, and continuously deliver your infrastructure.&quot;}" data-sheets-userformat="{&quot;2&quot;:769,&quot;3&quot;:{&quot;1&quot;:0},&quot;11&quot;:4,&quot;12&quot;:0}">Spacelift is an alternative to using homegrown solutions on top of a generic CI solution. It allows you to automate, audit, secure, and continuously deliver your infrastructure.

16 DevOps Best Practices Every Developer Should Know

How Spacelift Can Improve Your Infrastructure as Code

Introducing Blueprints by Spacelift - templates for environments that let the administrators configure all defaults, guardrails, and other settings to make it easier for anyone who needs infrastructure to deploy it.

163-blueprints-announcement

Let’s face it, managing infrastructure at scale, deploying it, and handling drift is pretty hard to do on our own. DevOps Engineers have to use so many tools nowadays, and they simply can’t have the same level of knowledge in all of them.
As we are humans, the possibility of making an error is very likely, even though we are doing the best we can to be fully attentive to what we are doing, but due to the number of complex things we are managing, this is unavoidable. Or isn’t it?
We can&#8217;t ensure that an engineer&#8217;s code won&#8217;t create unauthorized resources by simply reviewing thousands of lines of code, so a policy is needed to address this issue. Collaboration is difficult, even with version control systems. Deploying production code from multiple devices can lead to configuration breakdowns. Using different tools to manage infrastructure deployments can complicate the decision to choose a <a href="https://spacelift.io/blog/ci-cd-tools" target="_blank" rel="noopener">CI/CD tool</a>, and workflows will become complicated. Encouraging a unified approach for deployment in a team that uses multiple <a href="https://spacelift.io/blog/infrastructure-as-code-tools" target="_blank" rel="noopener">IaC tools</a> can help streamline the process and improve organizational results.

<h3>End-to-End Deployment Workflow</h3>
One of the key reasons why DevOps engineers love Spacelift is its ability to automate many of the tedious and time-consuming tasks associated with infrastructure management.
For example, Spacelift can automate your deployments end to end, having full control over what happens before or after any operation using our <a href="https://docs.spacelift.io/concepts/stack/" target="_blank" rel="noopener">Stacks</a>. This automation frees up DevOps engineers from the manual work of infrastructure management and allows them to focus on more important tasks.
<h3>Achieving true GitOps</h3>
GitOps has become one of the key paradigms lately. Commonly used when it comes to managing cloud-native services, GitOps refers to the fact that you are using your VCS as the single source of truth when it comes to managing your infrastructure, meaning that whenever you do a change to the git repository, that change will be reflected in the environment you are targeting.
As you don’t need to define complex CI/CD pipelines for deploying your code with Spacelift, but rather your changes get deployed whenever you are pushing your code, true GitOps is achieved.
<h3>Integrations</h3>
Spacelift integrates with popular tools such as Terraform, Pulumi, Kubernetes, Cloudformation, and soon Ansible, making it easy for DevOps engineers to use within their existing workflows. 
The native integrations with multiple VCS providers (GitHub, GitLab, Bitbucket, and <a href="https://spacelift.io/blog/what-is-azure-devops" target="_blank" rel="noopener">Azure DevOps</a>) and Cloud providers (AWS, Azure, GCP) and other third-party tools like <a href="https://spacelift.io/blog/terraform-cost-estimation-using-infracost" target="_blank" rel="noopener">InfraCost</a>, further streamline the process of managing infrastructure, reducing the time and effort required to make changes. <a href="https://spacelift.io/integrations" target="_blank" rel="noopener">Learn more about our integrations</a>.
<h3>Policies</h3>
Spacelift integrates with OPA and takes policies <a href="https://docs.spacelift.io/concepts/policy/" target="_blank" rel="noopener">to the next level</a>. With Spacelift, you can create several types of policies: 
<ul>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/concepts/policy/login-policy" target="_blank" rel="noopener">Login</a> &#8211; which controls who can log in and give admin rights to the required parties.</li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/concepts/policy/approval-policy" target="_blank" rel="noopener">Approval</a> &#8211; creates run reviews and approval flows that respect the security concerns of an organization.</li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/concepts/policy/notification-policy" target="_blank" rel="noopener">Notification</a> &#8211; with these types of policies, you can route notifications for your <a href="https://docs.spacelift.io/concepts/spaces/" target="_blank" rel="noopener">Spacelift Spaces</a> &#8211; and send them to your notification inbox, Slack, or your webhooks.</li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/concepts/policy/terraform-plan-policy" target="_blank" rel="noopener">Plan</a> &#8211; gives you the possibility to take control of your infrastructure plan (denying the creation of resources that, view cost estimates, and denying the actual deployment of resources if the cost is actually bigger than your threshold and more).</li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/concepts/policy/push-policy/" target="_blank" rel="noopener">Push</a> &#8211; actions that should be taken in response to pull and push that happen on your VCS.</li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/concepts/policy/trigger-policy" target="_blank" rel="noopener">Trigger</a> &#8211; making a complex workflow by creating dependencies between stacks; still, the new <a href="https://docs.spacelift.io/concepts/stack/stack-dependencies.html" target="_blank" rel="noopener">stack dependency</a> feature should be leveraged.</li>
</ul>
Not only the integration with OPA takes your policies to the next level, but it can be leveraged for customizing your workflow to the point that it suits your needs perfectly. By default, Spacelift provides the best practices, having a solid starting point, but by using it, you can truly have your own workflow.
<h3>Bring your own Workers</h3>
Workers are elements that perform your IaC tasks using containers. These tasks can include deploying code, updating resources, and running before and after actions inside of your workflow.
Creating your <a href="https://docs.spacelift.io/concepts/worker-pools" target="_blank" rel="noopener">private worker pools</a> is another key feature that Spacelift offers. 
Even though, by default, you can use the public workers that Spacelift provides, there is a possibility that you have a security requirement that requires the use of private workers. At Spacelift, we understand that you have full flexibility to opt-in to either one of the choices, and configuring private worker pools isn’t that big of a deal due to the fact that we are providing everything you need to do it on AWS, Azure, GCP or Kubernetes.
<h3>Private Registry</h3>
Using Terraform’s public registry to get modules and providers is ok, but you will most likely need to build your own modules to overcome security issues and concerns that are raised throughout your organization. Spacelift offers a private registry for <a href="https://docs.spacelift.io/vendors/terraform/module-registry.html" target="_blank" rel="noopener">modules</a> and one for <a href="https://docs.spacelift.io/vendors/terraform/provider-registry" target="_blank" rel="noopener">providers</a>. For the modules, what is different than other registries is the fact that you can write test cases and even extend them via hooks.
For more information, you can check this blog post on <a href="https://spacelift.io/blog/spacelift-module-registry" target="_blank" rel="noopener">Spacelift Module Registry – What It is and How to Use It</a>.
<h3>Drift Detection</h3>
Drift happens all the time, so how can you overcome it? It gets clearer and clearer that it’s impossible to do it manually as you cannot monitor everything all the time. One can argue that you can build a script that compares your infrastructure code with what is happening in your infrastructure and maybe run it in a cronjob that sends a notification to the interested parties.
What about reconciling the drift? That can also cause a lot of headaches. Also, these scripts have to be maintained, so that adds more overhead for your engineers.
This is a lot of work, and most likely, you will face issues, so Spacelift offers a <a href="https://docs.spacelift.io/concepts/stack/drift-detection" target="_blank" rel="noopener">solution</a> for that. Out of the box, with Spacelift’s enterprise plan, you can detect infrastructure drift, and optionally, you can even resolve it based on your IaC. The only thing you need to do is specify the interval in which you poll your infrastructure for drift, and that is done pretty easily, as described in the documentation linked above.
<h3>Other Features</h3>
Apart from everything mentioned above, Spacelift comes with the possibility of sharing variables between Stacks and mounting files to them using <a href="https://docs.spacelift.io/concepts/configuration/context" target="_blank" rel="noopener">Contexts</a>. 
You should most definitely use <a href="https://docs.spacelift.io/concepts/spaces/" target="_blank" rel="noopener">Spaces</a> throughout your account as, in this way, you delegate partial admin rights, control different levels of accesses to your Stacks and also share resources between these isolated environments.
Spacelift has its own <a href="https://registry.terraform.io/providers/spacelift-io/spacelift/latest/docs" target="_blank" rel="noopener">Terraform provider</a>, meaning that you can literally manage Spacelift with Terraform, making it easy to replicate all your configuration to a new account.

<ul>
<li><a href="https://spacelift.io/blog/infrastructure-problems-that-spacelift-solves" target="_blank" rel="noopener"><span data-sheets-value="{&quot;1&quot;:2,&quot;2&quot;:&quot;Infrastructure Problems that Spacelift Solves&quot;}" data-sheets-userformat="{&quot;2&quot;:4224,&quot;10&quot;:2,&quot;15&quot;:&quot;Arial&quot;}">Infrastructure Problems that Spacelift Solves</a></li>
<li><a href="https://spacelift.io/terraform-cloud-alternative" target="_blank" rel="noopener">Terraform Cloud Alternative – Spacelift</a></li>
<li><a href="https://spacelift.io/blog/how-specialized-solution-can-improve-your-iac" target="_blank" rel="noopener">10 Ways to Improve Your Infrastructure as Code</a></li>
</ul>

Before jumping in and showcasing some of our client’s testimonials, I want to share my 100% unbiased opinion on Spacelift before even starting an interview process for them. To be honest, I wasn’t even interested in changing my job, but I fell in love with the product, and that made me apply for this position.
I’ve been working with Terraform for more than six years on a daily basis and never felt the need to have a tool on top of it, even though I had to use <a href="https://spacelift.io/blog/what-is-terraform-cloud" target="_blank" rel="noopener">Terraform Cloud</a> in one of my previous jobs. My feelings changed when I tried Spacelift. You can check my opinion out <a href="https://techblog.flaviusdinu.com/spacelift-to-the-moon-175f6232d846" target="_blank" rel="nofollow noopener">here</a>.
One of our clients had Atlantis in place, and in order to promote their changes across all their environments, they needed to create seven pull requests to accomplish this. Apart from this being time-consuming, this process was, of course, error-prone. Another challenge they faced was the fact that they didn’t have drift detection, lacking visibility overall in their process. 
Spacelift reduced their pull requests from seven to one, and bringing drift detection to the table increased their visibility and reduced the possibility of facing errors.
“Spacelift has let us get down to a single pull request per change across all environments. We have drift detection, and we can easily see when changes are pending across all components when they have failed, so we have a lot better visibility than before. Spacelift has greatly reduced the amount of time we spend dealing with CI/CD for Terraform…” 
Read the full story <a href="https://spacelift.io/customers/spoton" target="_blank" rel="noopener">here</a>.
Spacelift’s easy-to-configure nature that offers full flexibility and the guardrails that can be configured to improve overall security helped another customer who had a couple of issues with their IaC process. They were interested in auditing, doing security scans on the code, and improving the overall security of their processes, restricting accesses, and making sure they were implementing the least privilege paradigm in their solution. In addition to this, they also needed to achieve Terraform at scale, avoiding error-prone processes, and Spacelift helped all around that. 
“I was impressed with Spacelift. It felt much more coherent than the competition…We don’t have to worry about fiddly, error-prone, manual deployment processes, which used to plague us like they plague many companies…It’s automating a lot of that grunt work and getting rid of a lot of the toil involved in managing infrastructure systems”
Read the complete <a href="https://spacelift.io/customers/lightspeed" target="_blank" rel="noopener">case study</a>.
Another customer wanted to deliver new micro-services from concept to production in one hour. They also needed to implement policies around their code, permissions, and account privileges, and they needed a private registry to push their modules and be able to test them.
Apart from that, they were also interested in having a native integration with Github in their CI/CD in order to have better processes in place.
With Spacelift, they could easily achieve all of these, and leveraging our policy examples and the ability to test modules and our native integration with top VCS providers, sped up their transition. 
“Spacelift is by far the best tool we have found as it enabled us to implement our CI/CD strategy for IaC far quicker and with more control than that we had previously thought possible.” 
Read the full testimonial <a href="https://spacelift.io/customers/tier-mobility" target="_blank" rel="noopener">here</a>.
One client was growing really fast, and with this growth, of course, they were facing a lot of challenges with their processes. They wanted to have consistent run environments, audit capabilities, and being able to hand off approvals for runs. As they were checking the market, they found similar products to Spacelift that, apart from missing some of the features that we offer, they were lacking one important thing: listening to customer feedback. 
At Spacelift, we take customers’ feedback into account whenever we are developing a new feature. Our release cadence is very aggressive, and we always want to bring the most outstanding features to our clients based on their needs. 
We are always looking for ways to improve, and we encourage feedback from our users. Whenever we are releasing a new feature, you are going to be notified about it in your Spacelift account, which means that you don’t have to check all the time to see if there is a new release or not.
“Spacelift is a tremendous time saver for me, and that in turn makes our entire development and deployment process smoother and simpler. 
Spacelift is like the final stitching on a football; it neatly ties together all of our infrastructure in a way that makes life really simple for our developers – and for me.” 
Get all the details of the <a href="https://spacelift.io/customers/brace" target="_blank" rel="noopener">case study</a>.
Another important aspect for customers when they are interested in buying a product is the price. At Spacelift, we don’t practice hidden costs, we have an always Free plan, a Cloud plan, and an Enterprise SaaS plan, and you get the details <a href="https://spacelift.io/pricing" target="_blank" rel="noopener">here</a>. For Cloud and Enterprise, you even have a 14-day trial to understand what we are offering, so you can try them without having to pay anything. Customers are very happy with our transparency and our response time.
“All the support people have been very helpful, but it really does all come back to speed and affordability — which are the big pluses for Spacelift.”
 More details on this case study: <a href="https://spacelift.io/customers/odos" target="_blank" rel="noopener">here</a>.

<h3>Other Case Studies</h3>
If you want to read more about how Spacelift is helping other organizations all over the globe, you can check out some <a href="https://spacelift.io/customers" target="_blank" rel="noopener">other stories</a> from our customers.

<h3>Engineers’ Direct Feedback from Slack</h3>
&nbsp;

why-devops-recommend-spacelift-slack

why devops recommend spacelift - slack

As you can see, people are thrilled with our solution, and even though we thought about making  DevOps engineers’ life easier when we were developing it, some customers even had their developers do end-to-end deployments without any intervention from a DevOps. 
Security, Observability, and Infrastructure Management, in general, are done way easier with Spacelift, and the overall process is simplified.

In conclusion, Spacelift is a valuable tool for DevOps engineers, as it helps them manage their infrastructure more efficiently and effectively. 
With Spacelift, DevOps engineers can automate their manual and time-consuming tasks associated with infrastructure management, improving efficiency and freeing up time for more important tasks. 
Spacelift also supports collaboration and teamwork, enabling teams to work together to manage infrastructure more effectively. 
<a href="https://docs.spacelift.io/product/security.html" target="_blank" rel="noopener">Security</a> is very important for Spacelift and having the possibility to control access, resources that can be created, and do actions based on pull/push and other <a href="https://docs.spacelift.io/concepts/policy/terraform-plan-policy.html#custom-inputs" target="_blank" rel="noopener">integrations</a> make Spacelift a really good choice for engineers all over the world.
You don’t need to have multiple tools that handle your deployment for the different IaC tools you are supporting in your organization today. You don’t even have to build different CI/CD complex automations for these various tools, as Spacelift will handle deployments without all that fuss.
For all these reasons, DevOps engineers love Spacelift, and it is quickly becoming an essential product in their toolkit.
If you want to learn more about Spacelift, <a href="https://go.spacelift.io/3VgyIFm" target="_blank" rel="noopener">sign up for free</a> or <a href="https://go.spacelift.io/3HVRChN" target="_blank" rel="noopener">book a demo with one of our engineers</a> to understand our product’s capabilities.

Infrastructure Drift Detection and How to Fix It With IaC Tools

DevSecOps: Making Security Central To Your DevOps Pipeline

Spacelift is a tool for DevOps engineers that helps them manage infrastructure more efficiently and effectively. See its key features and read client's testimonials.

KubeCon + CloudNativeCon Europe 2023

Spacelift will be in Amsterdam for the cloud-native conference of the year

Why KubeCon + CloudNativeCon Europe 2023?

What can you expect?

How can Spacelift help you?

Written by

Aoife O'Carroll

Read also

Integrating Security Tools With Spacelift Using Custom Inputs

Introducing Blueprints by Spacelift

Why DevOps Engineers Recommend Spacelift