Pawel is the CEO & Co-Founder at Spacelift. Previously, he was the Co-Founder and Managing Director at FitPass Group. Pawel holds a degree in Operations & Information Management from the University of Pennsylvania.

All posts by Pawel Hytry

Pawel Hytry

Author title

Going to AWS Summit London? 🇬🇧🇬🇧

Title category

Get all the latest content on Infrastructure as Code, DevOps, Spacelift features & news directly to your inbox!

Level up your IaC knowledge. Stay up to date with educational devops guides & news in infrastructure as code, cloud & more!

Managing Infrastructure at Scale | Spacelift Blog

Announcing Enhanced VCS Integration  🎉 🎉

applepodcasts

spotify

missionctrl

Welcome to missionCTRL, a show dedicated to exploring the frontiers of modern DevOps. Listen (or watch) as we sit down with the practitioners who are pushing the boundaries of development

Exploring the Tech Stack: Spacelift's Supported Tools and Frameworks

Learn more about new features, updates, and Spacelift product announcements.

Product Features and Updates | Spacelift Blog

Product

Spacelift is a sophisticated, continuous integration and deployment (CI/CD) platform for infrastructure-as-code. We provide a collaborative environment for building the platform your teams need, with deep insight, full control, and unlimited flexibility.
<h2>Which technologies and frameworks does Spacelift support?</h2>
Spacelift integrates with leading infrastructure automation tools and technologies, providing you with a comprehensive deployment and management experience for your infrastructure. We support the following technologies:
<ul>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/vendors/ansible/index.html" target="_blank" rel="noopener">Ansible</a> </li>
<li style="font-weight: 400;" aria-level="1">ARM/Bicep (coming soon)</li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/vendors/cloudformation/integrating-with-cdk.html#integrating-with-aws-cloud-development-kit-cdk" target="_blank" rel="noopener">AWS CDK</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/vendors/cloudformation/index.html" target="_blank" rel="noopener">AWS CloudFormation</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/vendors/kubernetes/index.html" target="_blank" rel="noopener">Kubernetes</a></li>
<li style="font-weight: 400;" aria-level="1">OpenTofu</li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/vendors/pulumi/index.html" target="_blank" rel="noopener">Pulumi</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/vendors/cloudformation/integrating-with-the-serverless-framework.html" target="_blank" rel="noopener">Serverless</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/vendors/terraform/index.html" target="_blank" rel="noopener">Terraform</a> (all MPL versions up to 1.5.7)</li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/vendors/terraform/terragrunt.html" target="_blank" rel="noopener">Terragrunt</a></li>
</ul>
<h2>What if I want to run something else?</h2>
Spacelift, from day one, has allowed you to fully customize the execution environment – from your own execution binaries and libraries to adding your own tooling for all the infrastructure-as-code frameworks. As DevOps and platform engineering practitioners, we knew that our platform must be there for you when you need to handle a specific scenario.
You can accomplish it in two ways:
<ol>
<li> Bring your own Docker image.</li>
<li> Use hooks, specifically the before_init hook, to download necessary executables.</li>
</ol>
You can find detailed instructions <a href="https://docs.spacelift.io/integrations/docker#customizing-the-runner-image" target="_blank" rel="noopener">here</a>.
If you have any further questions, please don&#8217;t hesitate to <a href="mailto:support@spacelift.io" target="_blank" rel="noopener">contact our support team</a>.

<span data-sheets-value="{&quot;1&quot;:2,&quot;2&quot;:&quot;Spacelift is an alternative to using homegrown solutions on top of a generic CI. It helps overcome common state management issues and adds several must-have capabilities for infrastructure management.&quot;}" data-sheets-userformat="{&quot;2&quot;:769,&quot;3&quot;:{&quot;1&quot;:0},&quot;11&quot;:4,&quot;12&quot;:0}">Spacelift is an alternative to using homegrown solutions on top of a generic CI. It helps overcome common state management issues and adds several must-have capabilities for infrastructure management.

Why Generic CI/CD Tools Will Not Deliver Successful IaC

What Makes Spacelift Secure

Why DevOps Engineers Recommend Spacelift

See which technologies and frameworks Spacelift supports and what to do if you want to run something else.

265-spacelift-tools

General | Spacelift Blog

General

Paweł Piwosz

Infrastructure as code (IaC) is still in its infancy. According to the August 2022 <a href="https://www.gminsights.com/industry-analysis/infrastructure-as-code-market" target="_blank" rel="noopener">Global Market Insights Inc</a>, the market is predicted to grow from $1B to $3.5B by 2030, at an annual rate of around 22%, and <a href="https://www.emergenresearch.com/industry-report/infrastructure-as-code-market" target="_blank" rel="noopener">other reports</a> predict similar growth. As the market matures, the complexity of adoptions will increase, intensifying the need for adequate processes and tools.

In this post, we focus on the four key elements that successful IaC delivers and generic CI/CD tooling does not:
<ol>
<li><a href="https://spacelift.io/blog/infrastructure-as-code-with-generic-ci-cd#1-automation">Automation</a> 
</li>
<li style="font-weight: 400;" aria-level="1"><a href="https://spacelift.io/blog/infrastructure-as-code-with-generic-ci-cd#2-continuous-processes">Continuous processes</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://spacelift.io/blog/infrastructure-as-code-with-generic-ci-cd#3-infrastructure-orchestration-">Infrastructure orchestration</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://spacelift.io/blog/infrastructure-as-code-with-generic-ci-cd#4-governance">Governance</a></li>
</ol>
We outline how a dedicated solution can help businesses attain these four pillars and successfully manage their IaC, debunking the myths around dedicated IaC solutions, and concluding with the benefits of choosing a specialized platform for managing IaC successfully.

IaC emerged from the Automation element of the CALMS (Culture, Automation, Lean, Measurement, and Sharing) framework and is a pillar of the modern DevOps Approach. Automation has always been a goal of engineers, who previously used scripting languages like Bash or even programming languages to try to achieve it. 
Ultimately, Configuration Management emerged as a way to manage operating systems configuration, application deployments, and configurations; and IaC was introduced to manage cloud infrastructure in a way that <a href="https://spacelift.io/blog/business-benefits-of-iac" target="_blank" rel="noopener">maximized business value</a>.
Apart from delivering business benefits, IaC allowed Agile teams to manage their own infrastructure more easily and effectively. Interaction with infrastructure (even cloud infrastructure) was no longer siloed but could be equally distributed among multiple teams. However, this could also prompt issues that we will discuss later.

IaC certainly introduced valuable benefits, but the process only automated single executions — not the entire process. Many organizations implemented CI/CD for applications, but infrastructure was treated separately, and automation (in the form of Configuration Management or IaC) was still executed manually. This led to significant issues, including inconsistent executions, incomplete understanding of the process inside teams, lack of communication, long delays, and lack of control. These made the process for infrastructure unreliable and unpredictable.
The solution was CI/CD processes and tools. 
According to the <a href="https://cd.foundation/state-of-cd-2023/" target="_blank" rel="noopener">State of CD report</a>, if developers are involved in DevOps activities, 29% of them manage and provision infrastructure programmatically, with different kinds of IaC tools. The report also states that when using multiple DevOps technologies, companies can decrease lead time, increase deployment frequency, and ultimately decrease the MTTR (Mean Time To Restore).
Combining IaC execution with <a href="https://spacelift.io/blog/ci-cd-pipeline" target="_blank" rel="noopener">CI/CD pipelines</a> finally allowed organizations and teams to automate processes, not just executions. 
Let’s look at the diagrams below:

cicd-processes-and-tools

CICD processes and tools

In the simplified picture of the process above, we clearly see the discontinuity between change and execution. We need two manual, unconnected steps: One is publishing the code of IaC, and the second concerns deploying to the target environment (in this case, AWS). 
This leads to multiple problems, such as gaps in governance and compliance, broken processes, etc. CI/CD allows us to fix these gaps.

simplified-iac-process

simplified iac process

Adding an automated process of execution through CI/CD not only completes the flow, but also removes manual steps from the process. We can clearly understand what change triggers execution. We can control the process by understanding the whole flow. 

Combining those two approaches — for infrastructure and for delivery — created a continuous flow, which should be instant in terms of trigger. There is no delay between committing the code and action triggered in the CI/CD tool. In this way, the organization significantly reduces one of the Lean’s waste &#8211; <a href="https://theleanway.net/The-8-Wastes-of-Lean" target="_blank" rel="noopener">waiting state</a>.

In the CI/CD world, specialized tools like ArgoCD or Octopus focus on one function or one group of products, whereas generic CI/CD tools like Jenkins, CircleCI, and GitHub Actions cover the whole Continuous Integration/Continuous Delivery (or Deployment) field. 
The main limitation of CI/CD tools derives from the design of the approach &#8211; not the specific tool &#8211; and is a default behavior of this type of tool. DevOps is pictured as an infinite loop, whereas the CI/CD pipeline is represented by a straight line. This line is a part of the infinite loop, of course, but the problem here is that one execution of the CI/CD pipeline is a single, encapsulated entity, which is not tightly connected to the whole lifecycle.
Let’s look at the simplified view of the generic pipeline:
&nbsp;

generic-ci-cd-pipeline

generic ci cd pipeline

How do engineering teams build IaC code? 
Well, there is no one answer to this question. However, in more complicated solutions we can observe multiple templates and even multiple stacks with very focused functions. Create a network layer, create a database layer, a storage layer and so on.
 The diagram below illustrates this approach:

iac-stacks

iac stacks

We see a complete disconnection between pipelines, which leads to multiple issues.
As the organization grows, so does the infrastructure. In the case of application-focused pipelines, it requires more work to properly manage the growing number of application pipelines. 
Using the architecture patterns of microservices in the proper way eliminates this obstacle, but it also creates siloed areas of responsibility and management. 
In the case of infrastructure, engineering teams apply many solutions, and there is almost always a disconnect between infrastructure elements in different stacks. As the infrastructure grows, the complexity of managing stacks also intensifies because more stacks are created and executed, and the increased connections between these stack executions must be managed.
Modern CI/CD tools allow us to trigger one pipeline from another or configure the pipeline execution in a flexible way, but this is just a workaround for the main problem— a lack of orchestration.

Organizations should enforce three main goals for governance when thinking about IaC: compliance, security, and cost control. These elements are not relevant to scale. All organizations want to be secure and run their business in a cost-effective manner. However, the complexity of governance management grows as companies scale. Furthermore, companies operating in sectors such as finance, energy, or healthcare are governed by specific industry regulations.
Generic CI/CD tooling can be adapted to these restrictions from a technical standpoint, but this results in a siloed approach with risks for collaboration, communication, and understanding of the process.
Proper security for IaC is crucial. Infrastructure is highly sensitive to all vulnerabilities, not just as a potential vector of attack for cybercriminals, but also from the perspective of the risks for the infrastructure’s stability and scalability incorporated in its design. According to Prisma Cloud’s <a href="https://www.paloaltonetworks.com/state-of-cloud-native-security" target="_blank" rel="noopener">State of Cloud-native Security Report 2023</a>, 90% of organizations struggle with detecting and fixing cyber threads within an hour. Of the respondents to this report, 78% stated that they are expected to have minimal learning for cloud security. 
This should be an “aha” moment for organizations. We enforce a shift-left approach, which is appreciated by teams, but the point is that security for infrastructure is different from security for applications, and development teams shouldn’t be forced to learn a whole new area. And here we hit a huge drawback of generic CI/CD tools, where teams are fully responsible for their pipelines. Even with shared libraries etc., the team that establishes a new pipeline must be aware of the configuration.
&nbsp;

<ul>
<li><a href="https://spacelift.io/blog/why-devops-engineers-recommend-spacelift" target="_blank" rel="noopener">Why DevOps Engineers Recommend Spacelift</a></li>
<li><a href="https://spacelift.io/blog/introducing-spacelift-self-hosted" target="_blank" rel="noopener">Take Control with Spacelift Self-Hosted on AWS</a></li>
<li><a href="https://spacelift.io/blog/getting-started-with-spacelift-self-hosted" target="_blank" rel="noopener">Why is it Worth Using Self-Hosted Solution</a></li>
</ul>

Generic CI/CD tools can achieve only very loose coupling between automation, continuous processes, orchestration, and governance. 
This is because the main goal of CI/CD tools is the continuous integration and delivery of code to production systems. CI/CD utilizes automation, but from a process perspective, it doesn’t matter for the CI/CD tool what code it ships. CI/CD can orchestrate and govern the entire setup, but it is mostly manual work and requires specialized knowledge from all development teams.
This decoupling is shown in the diagram below:

generic-ci-cd-tools-diagram

generic ci cd tools diagram

Dedicated tools like Spacelift encapsulate the whole spectrum of infrastructure SDLC in one tool, as in the diagram below:

spacelift-ci-cd-diagram

spacelift ci cd diagram

With this in mind, organizations can control the whole process from all angles, like tooling, processes themselves, governance, security, and compliance.
<h3>Debunk the myths about dedicated tools</h3>
It is a common perception that organizations should limit the number of tools in the delivery chain. This does not mean that organizations should not use specialized tools for their chain of operations. We have to analyze the business value of the tool:
<ul>
<li style="font-weight: 400;" aria-level="1">Does the tool decrease the complexity of the SDLC?</li>
<li style="font-weight: 400;" aria-level="1">What part of SDLC can be covered by the tool?</li>
<li style="font-weight: 400;" aria-level="1">Does the organization have the skills required to use the tool properly?</li>
<li style="font-weight: 400;" aria-level="1">Does the tool affect the lead time?</li>
<li style="font-weight: 400;" aria-level="1">Does the tool affect service restoration?</li>
</ul>
<h4>Add the proper tool to improve lead time</h4>
Chapter 4.3 of the State of the CD Report 2023 mentioned earlier confirms that organizations with diversified tooling are more likely to be top performers in terms of lead time for code changes. The important thing is to use a prudent approach to incorporating tools in the SDLC &#8211; not simply add more tools for the sake of it. 
<h4>Improve distribution of skills in your teams</h4>
Another myth is that more tools means you’ll need more skills. If the organization considers all business needs and opportunities prudently, the opposite might be the case. If continuous automation is characterized by proper orchestration and governance, workloads are decreased for <a href="https://teamtopologies.com/key-concepts" target="_blank" rel="noopener">stream-aligned teams</a>.
<h4>Pay for the tool, not for work</h4>
It is common to view tools, licenses, etc. as costs for the organization. However, if the tool decreases the amount of work needed, the organization lowers its operational costs. Upskilling all development teams to use specific IaC, CI/CD, and orchestration tools will be more time- and effort-consuming than using a dedicated tool within a dedicated team.
<h4>Don’t be discouraged by vendor lock-in</h4>
The vendor lock-in dilemma is raised frequently, especially in the cloud-native approach. The perception of avoiding vendor lock-in at any cost is unfortunate and might lead to unnecessary issues in processes. Every organization is subject to some vendor lock-in, by selecting a cloud vendor, software vendors, programming languages, or even a specific delivery methodology.

Generic CI/CD tools are simply not up to the task of fully controlling and monitoring infrastructure. As we discussed previously, they don’t know what technology they ship. They don’t know what happens before or after a pipeline is executed. The CI/CD pipeline is designed to deliver the code from VCS to production in an automated, controlled way.
Spacelift’s platform includes delivery pipelines but it is also aware of the technology the organization uses and is able to orchestrate and govern the whole infrastructure.
Let’s take a look at these elements one by one:
<h3>Awareness of AUTOMATION</h3>
Spacelift is aware of infrastructure technology. During the process of <a href="https://docs.spacelift.io/concepts/stack/creating-a-stack#configure-backend" target="_blank" rel="noopener">creating the stack</a>, the proper backend technology must be selected &#8211; for example, Terraform. This determines the behavior of the run. Applying specific <a href="https://docs.spacelift.io/concepts/policy/">policies</a> also increases this awareness of the technology used in the process.
<h3>CONTINUOUS processes</h3>
As core functionality, Spacelift stacks are <a href="https://docs.spacelift.io/concepts/stack/creating-a-stack#integrate-vcs" target="_blank" rel="noopener">connected to the Version Control System</a> of your choice, and each <a href="https://docs.spacelift.io/concepts/run/" target="_blank" rel="noopener">run</a> can be executed after committing code to the repository. Furthermore, this functionality is also used for the pull requests process. This approach decreases the lead time significantly and allows control of the executions in a very granular way.
<h3>ORCHESTRATE the SDLC</h3>
Spacelift orchestrates all your stacks, executions and technologies through a couple of mechanisms implemented. With <a href="https://docs.spacelift.io/concepts/blueprint/" target="_blank" rel="noopener">Blueprints,</a> organizations can enforce optimum infrastructure quality and security. <a href="https://docs.spacelift.io/concepts/spaces/" target="_blank" rel="noopener">Spaces</a> allow organizations to control the executions and privileges in a very granular way. This is achieved by specific configuration of access for users, variables, and variable sets (called <a href="https://docs.spacelift.io/concepts/configuration/context" target="_blank" rel="noopener">contexts</a>). To enforce orchestration, Spacelift offers <a href="https://docs.spacelift.io/concepts/policy/" target="_blank" rel="noopener">policies</a>, <a href="https://docs.spacelift.io/concepts/stack/stack-dependencies" target="_blank" rel="noopener">stack dependencies</a>, and <a href="https://docs.spacelift.io/concepts/stack/stack-settings#customizing-workflow" target="_blank" rel="noopener">customizations of the workflow</a>.
<h3>Control your infrastructure with properly implemented GOVERNANCE</h3>
Finally, Spacelift allows organizations to implement and enforce the proper governance models. 
Security of the process can be enhanced through Blueprints, Spaces, policies, and granular access mentioned previously. For Terraform, this can also be done through <a href="https://docs.spacelift.io/vendors/terraform/module-registry" target="_blank" rel="noopener">Terraform registry</a>.
Execution can be secured easily by implementing security frameworks for the runs, and, most importantly, this implementation can be enforced by policies applied to stacks.
Implementation of cost control is possible for Terraform stacks using custom inputs and policies with Infracost. Finally, with <a href="https://docs.spacelift.io/concepts/resources" target="_blank" rel="noopener">full view on the resources</a> deployed, the organization is able to understand and control all infrastructure resources.

Spacelift allows organizations to use one tool to conveniently govern and orchestrate the continuous automation of infrastructure. This allows businesses to increase the cohesion of their infrastructure, decrease the lead time, and restore time. 
The table below sums up the advantages of using Spacelift as a dedicated tool for infrastructure management:
<table>
<tbody>
<tr>
<td>Increase</td>
<td>Decrease</td>
</tr>
<tr>
<td>Infrastructure cohesion                  </td>
<td>Lead time</td>
</tr>
<tr>
<td>Deployment frequency</td>
<td>Restore time</td>
</tr>
<tr>
<td>Control over lifecycle</td>
<td>Manual processes and control                  </td>
</tr>
<tr>
<td>Security</td>
<td>Learning curve</td>
</tr>
<tr>
<td>Process’s awareness</td>
<td>Tooling costs</td>
</tr>
</tbody>
</table>
As Eficode stated in their <a href="https://www.eficode.com/guides/devops-trends-2023" target="_blank" rel="noopener">DevOps Trends 2023 guide</a>, organizations move beyond automation to orchestration. This statement is valid for infrastructure too. This type of orchestration allows organizations to control waste and inefficiencies in their value streams (also stated in Eficode’s guide).
Spacelift offers a single pane of glass for your infrastructure. In an industry where understanding and the ability to act quickly is crucial, using this platform provides a significant advantage over generic tools, which were designed mostly for handling application code, not infrastructure.
Are you looking for the best orchestration of your infrastructure? <a href="https://spacelift.io/schedule-demo" target="_blank" rel="noopener">Book a demo with our engineering team</a> to discuss your options in more detail.

<span data-sheets-value="{&quot;1&quot;:2,&quot;2&quot;:&quot;Spacelift is a sophisticated SaaS product for Infrastructure as Code that helps DevOps develop and deploy new infrastructures or changes quickly and with confidence.&quot;}" data-sheets-userformat="{&quot;2&quot;:769,&quot;3&quot;:{&quot;1&quot;:0},&quot;11&quot;:4,&quot;12&quot;:0}">Spacelift is a sophisticated SaaS product for Infrastructure as Code that helps DevOps develop and deploy new infrastructures or changes quickly and with confidence.

CI/CD Security: What is It, Risks & 20 Best Practices

10 Strategies to Build and Manage Scalable Infrastructure

Building the DevOps Pipeline - Key Concepts & Stages

The key elements that successful IaC delivers and generic CI/CD tooling doesn't. See how a dedicated solution helps businesses successfully manage their IaC.

260-iac-with-generic-ci-cd-tools

Why Generic CI/CD Tools Will Not Deliver Successful IaC 

Flavius Dinu

Infrastructure as Code(IaC) offers tremendous scalability, efficiency, and reliability benefits, but it’s essential to remember that it is always subject to security-related threats.

infrastructure-vulnerabilities

infrastructure vulnerabilities

Vulnerabilities can be exploited at any point in the application lifecycle. Even though you are doing everything right on the application level to ensure security, if you don’t focus enough attention on the infrastructure, you will likely have breaches.
The main points where you need to secure your infrastructure are:
<ul>
<li aria-level="1">Network</li>
</ul>
<ul>
<li style="list-style-type: none;">
<ul>
<li style="list-style-type: none;">
<ul>
<li style="font-weight: 400;" aria-level="2">Firewalls → Use stateful and stateless firewalls to filter traffic (Network Security Groups, Network Access Control Lists, etc.).</li>
<li style="font-weight: 400;" aria-level="2">Segmentation → Split network resources as much as possible (use multiple VPCs, subnets, etc.). to reduce blast radiusMonitor network traffic </li>
</ul>
</li>
</ul>
</li>
</ul>
<ul>
<li aria-level="1">Access Control</li>
</ul>
<ul>
<li style="list-style-type: none;">
<ul>
<li style="list-style-type: none;">
<ul>
<li style="font-weight: 400;" aria-level="2">IAM → Use the least-privileged access control option everywhere. Define multiple roles and policies to ensure different levels of access.</li>
<li style="font-weight: 400;" aria-level="2">MFA → Use multi-factor authentication — it adds another layer of security by always asking users to provide one-time passcodes in order to log in to their accounts.</li>
<li style="font-weight: 400;" aria-level="2">Response Plans → Ensure your company has a plan in place to respond to security breaches.</li>
</ul>
</li>
</ul>
</li>
</ul>
<ul>
<li aria-level="1">Data</li>
</ul>
<ul>
<li style="list-style-type: none;">
<ul>
<li style="list-style-type: none;">
<ul>
<li style="font-weight: 400;" aria-level="2">Encryption → Data should be encrypted both at rest and in-transit with strong encryption protocols such as AES.</li>
<li style="font-weight: 400;" aria-level="2">Backup → Regular backups ensure functionality in case of disasters.</li>
</ul>
</li>
</ul>
</li>
</ul>
<ul>
<li aria-level="1">Runtime</li>
</ul>
<ul>
<li style="list-style-type: none;">
<ul>
<li style="list-style-type: none;">
<ul>
<li style="font-weight: 400;" aria-level="2">Instance hardening → Use base configurations and disable unnecessary services to reduce the blast radius.</li>
<li style="font-weight: 400;" aria-level="2">Regular patching → Apply patches, especially security-related ones as soon as possible.</li>
</ul>
</li>
</ul>
</li>
</ul>

<h3>Common security concerns in IaC</h3>
Now that we understood the main points of securing infrastructure, we need to discuss the most common security pattern concerns with IaC:
<table>
<tbody>
<tr>
<td>Issue</td>
<td>Description</td>
</tr>
<tr>
<td>Misconfiguration</td>
<td>This is one of the most common issues in the IaC world and can affect all the main points discussed above. 
For example, an engineer could potentially leave a port open in Security Group, leaving a critical EC2 instance accessible to the world.</td>
</tr>
<tr>
<td>Hard-Coded Secrets</td>
<td>Adding secrets in the configuration code, such as passwords, API Keys, Tokens, etc, will lead to unauthorized access to the application, if the code is compromised.</td>
</tr>
<tr>
<td>Lack of Security Tests</td>
<td>Many tools can assess your IaC configurations’ vulnerabilities. Without using these kinds of tools and blocking deployments in case issues are found, vulnerabilities are added to the infrastructure, facilitating exploitation.</td>
</tr>
<tr>
<td>Lack of Encryption</td>
<td>Information sent or received will be stored in a readable format, without encryption, making it vulnerable to unauthorized access or breaches.</td>
</tr>
<tr>
<td>Audit Trails</td>
<td>Logging and auditing are very important to detect malicious activity. Setting them up as early as possible will facilitate threat detection and response.</td>
</tr>
<tr>
<td>Outdated Dependencies</td>
<td>Similar to application software (try starting a nodejs application developed 5 years ago without any new changes; you will find over 100 vulnerabilities), IaC can also have outdated dependencies. As soon as tools have a new LTS version available, you should try to update in order to avoid vulnerabilities.</td>
</tr>
</tbody>
</table>

<h3>Best practices in IaC security</h3>
Putting certain best practices in place can facilitate Infrastructure and IaC security. This should be done as soon as you start a project:
<ul>
<li style="font-weight: 400;" aria-level="1">Use SSO and enable MFA.</li>
<li style="font-weight: 400;" aria-level="1">Use the Least Privileged access model.</li>
<li style="font-weight: 400;" aria-level="1">Encrypt data at rest and in transit.</li>
<li style="font-weight: 400;" aria-level="1">Use a security vulnerability scanning tool to find breaches in your code or images.</li>
<li style="font-weight: 400;" aria-level="1">Perform audits and penetration testing.</li>
</ul>

<h3>SOC2 Type II Certified</h3>
Even though this certification is not mandatory for SaaS products, in today’s world it is one of the most relevant certifications when it comes to security. 
Five pillars of trust are assessed:
<ul>
<li aria-level="1">Security</li>
</ul>
<ul>
<li style="list-style-type: none;">
<ul>
<li style="list-style-type: none;">
<ul>
<li style="font-weight: 400;" aria-level="2">Access Control, Web Application Firewall (WAF), MFA, Intrusion Detection</li>
</ul>
</li>
</ul>
</li>
</ul>
<ul>
<li aria-level="1">Availability</li>
</ul>
<ul>
<li style="list-style-type: none;">
<ul>
<li style="list-style-type: none;">
<ul>
<li style="font-weight: 400;" aria-level="2">Monitoring Network Performance, Availability, Site-failover</li>
</ul>
</li>
</ul>
</li>
</ul>
<ul>
<li aria-level="1">Integrity</li>
</ul>
<ul>
<li style="list-style-type: none;">
<ul>
<li style="list-style-type: none;">
<ul>
<li style="font-weight: 400;" aria-level="2">Data Integrity and processing</li>
</ul>
</li>
</ul>
</li>
</ul>
<ul>
<li aria-level="1">Confidentiality</li>
</ul>
<ul>
<li style="list-style-type: none;">
<ul>
<li style="list-style-type: none;">
<ul>
<li style="font-weight: 400;" aria-level="2">Data confidentiality and how it can be achieved</li>
</ul>
</li>
</ul>
</li>
</ul>
<ul>
<li aria-level="1">Privacy</li>
</ul>
<ul>
<li style="list-style-type: none;">
<ul>
<li style="list-style-type: none;">
<ul>
<li style="font-weight: 400;" aria-level="2">Collection, Use, Disclosure, and Disposal of personal information</li>
</ul>
</li>
</ul>
</li>
</ul>
Obtaining this certification involves a CPA firm that specializes in SOC assessments. The certification is valid for 12 months.  A renewal audit will be necessary after that. Even though this certification renews annually, you are required to continuously monitor and refine the trust pillars to ensure compliance.
<h3>Security audits</h3>
Apart from the SOC2 audit, Spacelift engages regularly with external security firms to perform audits and penetration testing. This process happens at least once a year, and in addition to this, Spacelift’s security team conducts internal audits regularly. 
Penetration testing (pen testing) helps to uncover weaknesses from the perspective of an attacker before the actual hackers can exploit them. Multiple types of pen testing are available:
<ul>
<li style="list-style-type: none;">
<ul>
<li style="font-weight: 400;" aria-level="1">White Box Testing → Ethical hackers will have full knowledge of the system including source code and architecture diagrams</li>
<li style="font-weight: 400;" aria-level="1">Black Box Testing → Ethical hackers will have no knowledge of the system</li>
<li style="font-weight: 400;" aria-level="1">Grey Box Testing → This will be a combination of Black and White testing, as ethical hackers will have partial knowledge of the system</li>
</ul>
</li>
</ul>
By using this combination of audits and pen testing, Spacelift identifies weaknesses faster and can easily test if security defenses work as expected. 

<h3>Encryption</h3>
It is no secret that SaaS Spacelift is hosted on AWS. All the data sources we are using (S3, Databases, SNS Topics, SQS Queues) are encrypted at rest using AWS KMS keys with restricted and audited access. The entire data is encrypted at rest and in transit, and all traffic is handled using secure transport protocols, apart from the infra-VPC traffic between the load balancer and the webserver, which is protected by a very restrictive AWS security group.
Customer secrets are extra encrypted at rest, in a way that should withstand even an internal attacker.
<h3>Security-first development approach</h3>
As you can see, we are launching many features on a monthly basis. We have the capability and the manpower to release even more features than we are currently doing, but for us, security concerns rank higher than anything else.
Whenever we release a new feature, we go through the security aspects of that feature, to ensure compliance and avoid any potential security vulnerabilities.

<ul>
<li><a href="https://spacelift.io/blog/introducing-spacelift-self-hosted" target="_blank" rel="noopener">SaaS not an Option? Install Spacelift Self-Hosted on AWS</a></li>
<li><a href="https://spacelift.io/blog/why-devops-engineers-recommend-spacelift" target="_blank" rel="noopener">Why DevOps Engineers Recommend Spacelift</a></li>
<li><a href="https://spacelift.io/blog/how-specialized-solution-can-improve-your-iac" target="_blank" rel="noopener">How Spacelift Can Improve Your Infrastructure as Code</a></li>
</ul>

<h3>Single Sign-On</h3>
Apart from logging in using GitHub, GitLab, and Google, Spacelift offers the possibility to log in using Single Sign-On (SSO). This offers centralized access to resources. To accommodate this use case, you can use either <a href="https://docs.spacelift.io/integrations/single-sign-on/#setting-up-saml" target="_blank" rel="noopener">SAML 2.0</a> or <a href="https://docs.spacelift.io/integrations/single-sign-on/#setting-up-oidc" target="_blank" rel="noopener">OIDC</a>.
SSO is useful from many points of view:
<ul>
<li style="list-style-type: none;">
<ul>
<li style="font-weight: 400;" aria-level="1">Elevates user experience → Users won’t need to remember multiple usernames and passwords for different applications.</li>
<li style="font-weight: 400;" aria-level="1">Improved security → Offers better oversight and control of user access, and having a single user/password combination, a stronger password policy can be enforced without burdening the users. You can also take advantage of session timeouts to automatically log out users after a period of inactivity, in this way, reducing the risk of unauthorized access.</li>
<li style="font-weight: 400;" aria-level="1">Integrated MFA → Seemless integration with MFA systems will bolster security by requiring an additional verification step.</li>
<li style="font-weight: 400;" aria-level="1">Streamlined onboarding and offboarding → Administrators can manage access from a centralized location. Whenever someone joins or leaves a company, access can be granted or revoked from a single place.</li>
<li style="font-weight: 400;" aria-level="1">Decreases helpdesk costs → With SSO, there will typically be a lower number of reset requests, as users will only need to remember one user/password combination.</li>
</ul>
</li>
</ul>
To enable SSO on your Spacelift account, you first need to create the account by using one of the supported <a href="https://docs.spacelift.io/getting-started#step-1-create-your-spacelift-account" target="_blank" rel="noopener">Identity Providers</a>. The user that creates the account using this option will become the Managed IdP Administrator. 
If you are configuring SSO, this admin user is disabled, and the first user to successfully log in to the Spacelift account will become the SSO Admin. To avoid locking your account, login policies won’t be evaluated for administrator (both Managed IdP and SSO).
Before starting the configuration per-se of SSO, it is important to create backup credentials as shown <a href="https://docs.spacelift.io/integrations/single-sign-on/backup-credentials" target="_blank" rel="noopener">here</a>, in order to avoid misconfigurations of SSO or to avoid not being able to log in if the SSO provider has an outage.
If you don’t want to use SAML 2.0, you can leverage OIDC. To see how you can configure SSO by leveraging OIDC you check out our guides for:
<ul>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/integrations/single-sign-on/gitlab-oidc-setup-guide" target="_blank" rel="noopener">Gitlab</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/integrations/single-sign-on/okta-oidc-setup-guide" target="_blank" rel="noopener">Okta</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/integrations/single-sign-on/onelogin-oidc-setup-guide.html" target="_blank" rel="noopener">OneLogin</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/integrations/single-sign-on/azure-ad-oidc-setup-guide" target="_blank" rel="noopener">Azure AD</a></li>
</ul>
<h3>Private workers</h3>
By default, in Spacelift, you will use a managed worker pool hosted and operated by us. If you have special requirements regarding your security or compliance that cannot be obtained via a public worker, you can configure a private worker pool.
To take advantage of the flexibility and security of our private worker pools, temporary run state is encrypted end-to-end by using asymmetric encryption. Only the workers in the configured private worker pool will have access to the temporary run state. 
For both public and private workers, you have a view that shows information about their status and how many queued runs they have.

spacelift-private-workers

spacelift private workers

There are three possible statuses for workers:
<ul>
<li style="font-weight: 400;" aria-level="1">Idle → Available for runs</li>
<li style="font-weight: 400;" aria-level="1">Busy → Is processing or is preparing to process a run</li>
<li style="font-weight: 400;" aria-level="1">Drained → Not accepting new work</li>
</ul>
When you are selecting a worker pool, you can also see what stacks are using it:

spacelift-eks-worker-pool

spacelift eks worker pool

You can easily set up private worker pools on both virtual machines or containers by following this <a href="https://docs.spacelift.io/concepts/worker-pools#setting-up" target="_blank" rel="noopener">guide</a>.
<h3>Access private VCS</h3>
To access private VCS, you can leverage <a href="https://docs.spacelift.io/concepts/vcs-agent-pools" target="_blank" rel="noopener">VCS Agent Pools</a> in Spacelift. They work in conjunction with the private workers, so the workers you are configuring should have access to the private VCS instance.
Creating a VCS Agent Pool can be done by navigating to VCS Agent Pools and clicking on Create VCS Agent Pool.

spacelift-private-vcs

spacelift private vcs

After you have created the VCS agent pool, a file will be downloaded automatically containing a configuration token. This token will be leveraged to establish the connection between your Spacelift instance and the private VCS. With the configuration done, you will be able to see how many active connections you have.
Whenever you need to specify an endpoint that should leverage your vcs agent pool, you should prepend it with private://my-vcs-agent-pool-name/path.
<h3>Spaces</h3>
We talked about access control. <a href="https://docs.spacelift.io/concepts/spaces/" target="_blank" rel="noopener">Spaces</a> are the component that will help you achieve it. They are logical containers that typically group Stacks, Policies, Modules, Worker Pools, and Cloud Integrations. 
Spaces are used for giving users limited admin access, giving them the ability to create all the resources mentioned above in their own Space, without interfering with entities that are defined in other Spaces.
Two Spaces are created by default when you create the account: the root space which is the father of all Spaces and the legacy space, which is used for backward compatibility to the era of pre-spaces Spacelift.
Three roles can be assigned in a Space:
<ul>
<li style="font-weight: 400;" aria-level="1">Read → View resources in a Space</li>
<li style="font-weight: 400;" aria-level="1">Write → Read capabilities + trigger runs</li>
<li style="font-weight: 400;" aria-level="1">Admin → Write capabilities + Can create/modify spaced resources</li>
</ul>

spacelift-spaces-table

spacelift spaces table

In the above table, you can see an example separation of privileges between the roles mention and also the Root Space Admin, which has access to everything.
<h3>Cloud integrations</h3>
Whenever you are deploying resources to a cloud provider, you need a mechanism to authenticate to that provider. Sure, you can use static credentials, but by doing that, you will increase the chances of breaches. To avoid the “evil” static credentials, we can leverage <a href="https://docs.spacelift.io/integrations/cloud-providers/" target="_blank" rel="noopener">dynamic credentials through native integrations</a> in Spacelift.
At Spacelift, you can integrate natively with AWS, GCP, and Azure, and you can also create integrations via OIDC.
Let’s see how easy it is to set up a <a href="https://docs.spacelift.io/integrations/cloud-providers/aws" target="_blank" rel="noopener">native integration in AWS</a>.
Before creating the integration, you will need to create a role in your AWS account with a custom trust policy:

spacelift-cloud-integration-custom-trust-policy

spacelift cloud integration custom trust policy

Replace yourSpaceliftAccountName with the name of your Spacelift account.
After that, add permissions to the role. For simplicity, I’ve given administrative access, but you can get as restrictive as you want:

permissions-policies-spacelift

permissions policies spacelift

Add a name to your role, create it, and go to your Spacelift account.

cloud-integrations-spacelift-security

cloud integrations spacelift security

You will only need to add a name to the integration, copy/paste the Role ARN, and click on Create Integration.
To attach the role to any of your stacks, you will need to navigate to the Stack, go to Settings, and then go to Integrations.

attach-aws-integration

attach aws integration

<h3>Environment variables and contexts</h3>
You can define <a href="https://docs.spacelift.io/concepts/configuration/environment#environment-variables" target="_blank" rel="noopener">environment variables</a> in Spacelift with two options:
<ul>
<li style="font-weight: 400;" aria-level="1">Plain Text variables which have read/write capabilities</li>
<li style="font-weight: 400;" aria-level="1">Sensitive variables which have write-only capabilities</li>
</ul>

environment-variables-and-contexts

Environment variables and contexts

These variables can be attached directly to a stack, but you can also add them to a <a href="https://docs.spacelift.io/concepts/configuration/context" target="_blank" rel="noopener">Context</a>. With Contexts, you can group multiple environment variables and <a href="https://docs.spacelift.io/concepts/configuration/environment#mounted-files" target="_blank" rel="noopener">mounted files</a> and share them between multiple stacks. This is really useful, as it will save considerable time and reduce the overhead of creating the same variables over and over again.
<h3>Policies</h3>
At Spacelift, Policy as Code plays a very important role when it comes to governing the platform. With <a href="https://docs.spacelift.io/concepts/policy/" target="_blank" rel="noopener">Policies</a>, you can: 
<ul>
<li style="font-weight: 400;" aria-level="1">Define access control at the Space level with <a href="https://docs.spacelift.io/concepts/policy/login-policy" target="_blank" rel="noopener">login policies</a></li>
<li style="font-weight: 400;" aria-level="1">Restrict runs based on resource parameters with <a href="https://docs.spacelift.io/concepts/policy/terraform-plan-policy" target="_blank" rel="noopener">plan policies</a></li>
<li style="font-weight: 400;" aria-level="1">Require multiple approvals for a run by leveraging the <a href="https://docs.spacelift.io/concepts/policy/approval-policy" target="_blank" rel="noopener">approval policies</a></li>
<li style="font-weight: 400;" aria-level="1">Use <a href="https://docs.spacelift.io/concepts/policy/trigger-policy" target="_blank" rel="noopener">trigger policies</a> to control what happens when a PR or a merge occurs</li>
<li style="font-weight: 400;" aria-level="1">Define notifications for runs with the <a href="https://docs.spacelift.io/concepts/policy/notification-policy" target="_blank" rel="noopener">notification policies</a></li>
</ul>
We understand that OPA can be hard if you don’t have any experience with it, so that’s why we offer:
<ul>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/concepts/policy/#policy-workbench" target="_blank" rel="noopener">Policy Workbench</a> → Sampling mechanism for policies that makes testing policies easier. This can be used when you are developing the policies per se by providing an input, or you can leverage this mechanism on a run, to use the input you get from your terraform plan </li>
<li style="font-weight: 400;" aria-level="1"><a href="https://github.com/spacelift-io/spacelift-policies-example-library" target="_blank" rel="noopener">Policy Library</a> → Collection of over 50 reusable policies that can be leveraged in your automation</li>
</ul>
Let’s walk through the process of creating a simple approval policy that will require your run to have at least two approvals and no rejections:
Go to Policies, select Create Policy, and specify the type as approval. Paste in the following <a href="https://github.com/spacelift-io/spacelift-policies-example-library/blob/main/approval/two-approvals-no-rejections.rego">code</a>.
In the end, it should look like this:

creating-a-new-policy

creating a new policy

Now, this policy can be attached to any Stack by navigating to the Stack’s settings and selecting policies. 
On a run, this will look like:

policy-on-run

policy on run

<h3>Custom inputs</h3>
Spacelift gives you full flexibility in integrating tools inside your workflow. With our custom inputs feature, if you are integrating a third-party tool, we offer you the ability to define custom policies for it. 
See an example of <a href="https://spacelift.io/blog/integrating-security-tools-with-spacelift" target="_blank" rel="noopener">how you can integrate security tools such as checkov, tfsec, terrascan, and kics</a>.
<h3>Module registry</h3>
Terraform modules are essential for reusability, and hosting them in a registry and leveraging versioning can help address issues from the start. 
Spacelift’s <a href="https://docs.spacelift.io/vendors/terraform/module-registry" target="_blank" rel="noopener">module registry</a> is a little bit different from Terraform’s module registry, in the sense that, with us, you can leverage some of the other features that we have when you are creating your module. 
Apart from being able to leverage features such as Contexts, Policies, and Worker Pools, with Spacelift’s registry, you are also unlocking <a href="https://docs.spacelift.io/vendors/terraform/module-registry#tests" target="_blank" rel="noopener">tests</a> that help to ensure your module is working properly, and you can even check the code for vulnerabilities by leveraging lifecycle hooks.
You can check out how easy it is to configure a module <a href="https://docs.spacelift.io/vendors/terraform/module-registry#module-configuration" target="_blank" rel="noopener">here</a>, and if you want to leverage Dependabot to automatically update your modules, <a href="https://docs.spacelift.io/vendors/terraform/module-registry#dependabot" target="_blank" rel="noopener">this configuration</a> will be helpful.
<h3>State management</h3>
Spacelift manages your Terraform state but also gives you the possibility to manage your own. If you let us manage your state, it is also important to understand <a href="https://docs.spacelift.io/vendors/terraform/state-management#how-it-works" target="_blank" rel="noopener">how it works</a>. 
Behind the scenes, we are using S3 buckets to manage the state, but what we are also doing to make things more secure is generating one-off credentials for each run or task and injecting them directly into your terraform project as .tf file.
By using these one-off credentials and our state server, we can easily map state access and state changes to legitimate Spacelift runs, thus protecting against malicious or unauthorized accesses. As far as we know, we are the only ones that do this — more proof that we are a security-first company.
<h3>Self-hosted Spacelift</h3>
As you have seen, Spacelift SaaS is secure, but if your organization has a requirement to keep everything air-gapped, we got you covered with our self-hosted option.
Read more about <a href="https://spacelift.io/blog/introducing-spacelift-self-hosted" target="_blank" rel="noopener">the benefits of using Spacelift Self-Hosted on AWS</a>, and if you are interested to see how you can configure it, this <a href="https://spacelift.io/blog/getting-started-with-spacelift-self-hosted" target="_blank" rel="noopener">article</a> is for you.

Security is everyone’s responsibility, and with the continuous modernization of infrastructure, the importance of it cannot be overstated. 
Spacelift’s number one priority is and always will be security. With our product, you not only minimize the chances of unauthorized access, but you also get improved resilience and reliability.
If you want to see how flexible our product is in action, you are welcome to create a <a href="https://spacelift.io/free-trial" target="_blank" rel="noopener">free account </a>or <a href="https://spacelift.io/schedule-demo" target="_blank" rel="noopener">book a demo</a> with one of our engineers.

Infrastructure as Code (IaC) and Policy as Code Scanning for Vulnerabilities

Vault Integration in Spacelift

12 AWS IAM Security Best Practices

Spacelift’s number one priority is and always will be security. Take a look at Spacelift security architecture and security features.

33-what-makes-spacelift-secure

Let’s face it, managing infrastructure at scale, deploying it, and handling drift is pretty hard to do on our own. DevOps Engineers have to use so many tools nowadays, and they simply can’t have the same level of knowledge in all of them.
As we are humans, the possibility of making an error is very likely, even though we are doing the best we can to be fully attentive to what we are doing, but due to the number of complex things we are managing, this is unavoidable. Or isn’t it?
We can&#8217;t ensure that an engineer&#8217;s code won&#8217;t create unauthorized resources by simply reviewing thousands of lines of code, so a policy is needed to address this issue. Collaboration is difficult, even with version control systems. Deploying production code from multiple devices can lead to configuration breakdowns. Using different tools to manage infrastructure deployments can complicate the decision to choose a <a href="https://spacelift.io/blog/ci-cd-tools" target="_blank" rel="noopener">CI/CD tool</a>, and workflows will become complicated. Encouraging a unified approach for deployment in a team that uses multiple <a href="https://spacelift.io/blog/infrastructure-as-code-tools" target="_blank" rel="noopener">IaC tools</a> can help streamline the process and improve organizational results.

<h3>End-to-End Deployment Workflow</h3>
One of the key reasons why DevOps engineers love Spacelift is its ability to automate many of the tedious and time-consuming tasks associated with infrastructure management.
For example, Spacelift can automate your deployments end to end, having full control over what happens before or after any operation using our <a href="https://docs.spacelift.io/concepts/stack/" target="_blank" rel="noopener">Stacks</a>. This automation frees up DevOps engineers from the manual work of infrastructure management and allows them to focus on more important tasks.
<h3>Achieving true GitOps</h3>
GitOps has become one of the key paradigms lately. Commonly used when it comes to managing cloud-native services, GitOps refers to the fact that you are using your VCS as the single source of truth when it comes to managing your infrastructure, meaning that whenever you do a change to the git repository, that change will be reflected in the environment you are targeting.
As you don’t need to define complex CI/CD pipelines for deploying your code with Spacelift, but rather your changes get deployed whenever you are pushing your code, true GitOps is achieved.
<h3>Integrations</h3>
Spacelift integrates with popular tools such as Terraform, Pulumi, Kubernetes, Cloudformation, and soon Ansible, making it easy for DevOps engineers to use within their existing workflows. 
The native integrations with multiple VCS providers (GitHub, GitLab, Bitbucket, and <a href="https://spacelift.io/blog/what-is-azure-devops" target="_blank" rel="noopener">Azure DevOps</a>) and Cloud providers (AWS, Azure, GCP) and other third-party tools like <a href="https://spacelift.io/blog/terraform-cost-estimation-using-infracost" target="_blank" rel="noopener">InfraCost</a>, further streamline the process of managing infrastructure, reducing the time and effort required to make changes. <a href="https://spacelift.io/integrations" target="_blank" rel="noopener">Learn more about our integrations</a>.
<h3>Policies</h3>
Spacelift integrates with OPA and takes policies <a href="https://docs.spacelift.io/concepts/policy/" target="_blank" rel="noopener">to the next level</a>. With Spacelift, you can create several types of policies: 
<ul>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/concepts/policy/login-policy" target="_blank" rel="noopener">Login</a> &#8211; which controls who can log in and give admin rights to the required parties.</li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/concepts/policy/approval-policy" target="_blank" rel="noopener">Approval</a> &#8211; creates run reviews and approval flows that respect the security concerns of an organization.</li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/concepts/policy/notification-policy" target="_blank" rel="noopener">Notification</a> &#8211; with these types of policies, you can route notifications for your <a href="https://docs.spacelift.io/concepts/spaces/" target="_blank" rel="noopener">Spacelift Spaces</a> &#8211; and send them to your notification inbox, Slack, or your webhooks.</li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/concepts/policy/terraform-plan-policy" target="_blank" rel="noopener">Plan</a> &#8211; gives you the possibility to take control of your infrastructure plan (denying the creation of resources that, view cost estimates, and denying the actual deployment of resources if the cost is actually bigger than your threshold and more).</li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/concepts/policy/push-policy/" target="_blank" rel="noopener">Push</a> &#8211; actions that should be taken in response to pull and push that happen on your VCS.</li>
<li style="font-weight: 400;" aria-level="1"><a href="https://docs.spacelift.io/concepts/policy/trigger-policy" target="_blank" rel="noopener">Trigger</a> &#8211; making a complex workflow by creating dependencies between stacks; still, the new <a href="https://docs.spacelift.io/concepts/stack/stack-dependencies.html" target="_blank" rel="noopener">stack dependency</a> feature should be leveraged.</li>
</ul>
Not only the integration with OPA takes your policies to the next level, but it can be leveraged for customizing your workflow to the point that it suits your needs perfectly. By default, Spacelift provides the best practices, having a solid starting point, but by using it, you can truly have your own workflow.
<h3>Bring your own Workers</h3>
Workers are elements that perform your IaC tasks using containers. These tasks can include deploying code, updating resources, and running before and after actions inside of your workflow.
Creating your <a href="https://docs.spacelift.io/concepts/worker-pools" target="_blank" rel="noopener">private worker pools</a> is another key feature that Spacelift offers. 
Even though, by default, you can use the public workers that Spacelift provides, there is a possibility that you have a security requirement that requires the use of private workers. At Spacelift, we understand that you have full flexibility to opt-in to either one of the choices, and configuring private worker pools isn’t that big of a deal due to the fact that we are providing everything you need to do it on AWS, Azure, GCP or Kubernetes.
<h3>Private Registry</h3>
Using Terraform’s public registry to get modules and providers is ok, but you will most likely need to build your own modules to overcome security issues and concerns that are raised throughout your organization. Spacelift offers a private registry for <a href="https://docs.spacelift.io/vendors/terraform/module-registry.html" target="_blank" rel="noopener">modules</a> and one for <a href="https://docs.spacelift.io/vendors/terraform/provider-registry" target="_blank" rel="noopener">providers</a>. For the modules, what is different than other registries is the fact that you can write test cases and even extend them via hooks.
For more information, you can check this blog post on <a href="https://spacelift.io/blog/spacelift-module-registry" target="_blank" rel="noopener">Spacelift Module Registry – What It is and How to Use It</a>.
<h3>Drift Detection</h3>
Drift happens all the time, so how can you overcome it? It gets clearer and clearer that it’s impossible to do it manually as you cannot monitor everything all the time. One can argue that you can build a script that compares your infrastructure code with what is happening in your infrastructure and maybe run it in a cronjob that sends a notification to the interested parties.
What about reconciling the drift? That can also cause a lot of headaches. Also, these scripts have to be maintained, so that adds more overhead for your engineers.
This is a lot of work, and most likely, you will face issues, so Spacelift offers a <a href="https://docs.spacelift.io/concepts/stack/drift-detection" target="_blank" rel="noopener">solution</a> for that. Out of the box, with Spacelift’s enterprise plan, you can detect infrastructure drift, and optionally, you can even resolve it based on your IaC. The only thing you need to do is specify the interval in which you poll your infrastructure for drift, and that is done pretty easily, as described in the documentation linked above.
<h3>Other Features</h3>
Apart from everything mentioned above, Spacelift comes with the possibility of sharing variables between Stacks and mounting files to them using <a href="https://docs.spacelift.io/concepts/configuration/context" target="_blank" rel="noopener">Contexts</a>. 
You should most definitely use <a href="https://docs.spacelift.io/concepts/spaces/" target="_blank" rel="noopener">Spaces</a> throughout your account as, in this way, you delegate partial admin rights, control different levels of accesses to your Stacks and also share resources between these isolated environments.
Spacelift has its own <a href="https://registry.terraform.io/providers/spacelift-io/spacelift/latest/docs" target="_blank" rel="noopener">Terraform provider</a>, meaning that you can literally manage Spacelift with Terraform, making it easy to replicate all your configuration to a new account.

<ul>
<li><a href="https://spacelift.io/blog/infrastructure-problems-that-spacelift-solves" target="_blank" rel="noopener"><span data-sheets-value="{&quot;1&quot;:2,&quot;2&quot;:&quot;Infrastructure Problems that Spacelift Solves&quot;}" data-sheets-userformat="{&quot;2&quot;:4224,&quot;10&quot;:2,&quot;15&quot;:&quot;Arial&quot;}">Infrastructure Problems that Spacelift Solves</a></li>
<li><a href="https://spacelift.io/terraform-cloud-alternative" target="_blank" rel="noopener">Terraform Cloud Alternative – Spacelift</a></li>
<li><a href="https://spacelift.io/blog/how-specialized-solution-can-improve-your-iac" target="_blank" rel="noopener">10 Ways to Improve Your Infrastructure as Code</a></li>
</ul>

Before jumping in and showcasing some of our client’s testimonials, I want to share my 100% unbiased opinion on Spacelift before even starting an interview process for them. To be honest, I wasn’t even interested in changing my job, but I fell in love with the product, and that made me apply for this position.
I’ve been working with Terraform for more than six years on a daily basis and never felt the need to have a tool on top of it, even though I had to use <a href="https://spacelift.io/blog/what-is-terraform-cloud" target="_blank" rel="noopener">Terraform Cloud</a> in one of my previous jobs. My feelings changed when I tried Spacelift. You can check my opinion out <a href="https://techblog.flaviusdinu.com/spacelift-to-the-moon-175f6232d846" target="_blank" rel="nofollow noopener">here</a>.
One of our clients had Atlantis in place, and in order to promote their changes across all their environments, they needed to create seven pull requests to accomplish this. Apart from this being time-consuming, this process was, of course, error-prone. Another challenge they faced was the fact that they didn’t have drift detection, lacking visibility overall in their process. 
Spacelift reduced their pull requests from seven to one, and bringing drift detection to the table increased their visibility and reduced the possibility of facing errors.
“Spacelift has let us get down to a single pull request per change across all environments. We have drift detection, and we can easily see when changes are pending across all components when they have failed, so we have a lot better visibility than before. Spacelift has greatly reduced the time we spend dealing with CI/CD for Terraform…” 
Read the full story <a href="https://spacelift.io/customers/spoton" target="_blank" rel="noopener">here</a>.
Spacelift’s easy-to-configure nature that offers full flexibility and the guardrails that can be configured to improve overall security helped another customer who had a couple of issues with their IaC process. They were interested in auditing, doing security scans on the code, and improving the overall security of their processes, restricting accesses, and making sure they were implementing the least privilege paradigm in their solution. In addition to this, they also needed to achieve Terraform at scale, avoiding error-prone processes, and Spacelift helped all around that. 
“I was impressed with Spacelift. It felt much more coherent than the competition…We don’t have to worry about fiddly, error-prone, manual deployment processes, which used to plague us like they plague many companies…It’s automating a lot of that grunt work and getting rid of a lot of the toil involved in managing infrastructure systems.”
Read the complete <a href="https://spacelift.io/customers/lightspeed" target="_blank" rel="noopener">case study</a>.
Another customer wanted to deliver new micro-services from concept to production in one hour. They also needed to implement policies around their code, permissions, and account privileges, and they needed a private registry to push their modules and be able to test them.
Apart from that, they were also interested in having a native integration with Github in their CI/CD in order to have better processes in place.
With Spacelift, they could easily achieve all of these, and leveraging our policy examples and the ability to test modules and our native integration with top VCS providers, sped up their transition. 
“Spacelift is by far the best tool we have found as it enabled us to implement our CI/CD strategy for IaC far quicker and with more control than that we had previously thought possible.” 
Read the full testimonial <a href="https://spacelift.io/customers/tier-mobility" target="_blank" rel="noopener">here</a>.
One client was growing really fast, and with this growth, of course, they were facing a lot of challenges with their processes. They wanted to have consistent run environments, audit capabilities, and being able to hand off approvals for runs. As they were checking the market, they found similar products to Spacelift that, apart from missing some of the features that we offer, they were lacking one important thing: listening to customer feedback. 
At Spacelift, we take customers’ feedback into account whenever we are developing a new feature. Our release cadence is very aggressive, and we always want to bring the most outstanding features to our clients based on their needs. 
We are always looking for ways to improve, and we encourage feedback from our users. Whenever we are releasing a new feature, you are going to be notified about it in your Spacelift account, which means that you don’t have to check all the time to see if there is a new release or not.
“Spacelift is a tremendous time saver for me, and that in turn makes our entire development and deployment process smoother and simpler. 
Spacelift is like the final stitching on a football; it neatly ties together all of our infrastructure in a way that makes life really simple for our developers – and for me.” 
Get all the details of the <a href="https://spacelift.io/customers/brace" target="_blank" rel="noopener">case study</a>.
Another important aspect for customers when they are interested in buying a product is the price. At Spacelift, we don’t practice hidden costs, we have an always Free plan, a Cloud plan, and an Enterprise SaaS plan, and you get the details <a href="https://spacelift.io/pricing" target="_blank" rel="noopener">here</a>. For Cloud and Enterprise, you even have a 14-day trial to understand what we are offering, so you can try them without having to pay anything. Customers are very happy with our transparency and our response time.
“All the support people have been very helpful, but it really does all come back to speed and affordability — which are the big pluses for Spacelift.”
 More details on this case study: <a href="https://spacelift.io/customers/odos" target="_blank" rel="noopener">here</a>.

<h3>Other Case Studies</h3>
If you want to read more about how Spacelift is helping other organizations all over the globe, you can check out some <a href="https://spacelift.io/customers" target="_blank" rel="noopener">other stories</a> from our customers.

<h3>Engineers’ Direct Feedback from Slack</h3>
&nbsp;

why-devops-recommend-spacelift-slack

why devops recommend spacelift - slack

As you can see, people are thrilled with our solution, and even though we thought about making  DevOps engineers’ life easier when we were developing it, some customers even had their developers do end-to-end deployments without any intervention from a DevOps. 
Security, Observability, and Infrastructure Management, in general, are done way easier with Spacelift, and the overall process is simplified.

In conclusion, Spacelift is a valuable tool for DevOps engineers, as it helps them manage their infrastructure more efficiently and effectively. 
With Spacelift, DevOps engineers can automate their manual and time-consuming tasks associated with infrastructure management, improving efficiency and freeing up time for more important tasks. 
Spacelift also supports collaboration and teamwork, enabling teams to work together to manage infrastructure more effectively. 
<a href="https://docs.spacelift.io/product/security.html" target="_blank" rel="noopener">Security</a> is very important for Spacelift and having the possibility to control access, resources that can be created, and do actions based on pull/push and other <a href="https://docs.spacelift.io/concepts/policy/terraform-plan-policy.html#custom-inputs" target="_blank" rel="noopener">integrations</a> make Spacelift a really good choice for engineers all over the world.
You don’t need to have multiple tools that handle your deployment for the different IaC tools you are supporting in your organization today. You don’t even have to build different CI/CD complex automations for these various tools, as Spacelift will handle deployments without all that fuss.
For all these reasons, DevOps engineers love Spacelift, and it is quickly becoming an essential product in their toolkit.
If you want to learn more about Spacelift, <a href="https://go.spacelift.io/3VgyIFm" target="_blank" rel="noopener">sign up for free</a> or <a href="https://go.spacelift.io/3HVRChN" target="_blank" rel="noopener">book a demo with one of our engineers</a> to understand our product’s capabilities.

Infrastructure Drift Detection and How to Fix It With IaC Tools

Infrastructure Problems that Spacelift Solves

DevSecOps: Making Security Central To Your DevOps Pipeline

Spacelift is a tool for DevOps engineers that helps them manage infrastructure more efficiently and effectively. See its key features and read client's testimonials.

Exploring the Tech Stack: Spacelift’s Supported Tools and Frameworks

Which technologies and frameworks does Spacelift support?

What if I want to run something else?

The Most Flexible CI/CD Automation Tool

Written by

Pawel Hytry

Read also

Why Generic CI/CD Tools Will Not Deliver Successful IaC

What Makes Spacelift Secure

Why DevOps Engineers Recommend Spacelift