How Infinite Campus unified IaC governance across cloud and on-premises

Infinite Campus is an enterprise software technology company whose mission is to provide a fully integrated Student Information System (SIS) and related solutions to the K-12 education space. The team was seeking a cost-effective SaaS infrastructure management solution that would give them the flexibility of using a combination of Terraform and AWS CloudFormation. We spoke with Staff Engineer Emerson Van Note about how Spacelift has helped them achieve and maintain consistent, secure infrastructure management.

As the Infinite Campus team scaled its Terraform usage across AWS infrastructure, they needed an effective approach to implementing an audit trail, ensuring isolation between engineers, and cleanly enforcing least-privilege access.

The challenge extended beyond the cloud. Infinite Campus was simultaneously adopting Terraform for its on-premises infrastructure and needed a way to manage deployments consistently across both environments. It would not have been practical or feasible to operate separate workflows, tooling, or governance models for cloud versus on-premises. Indeed, it would have undermined the entire point of standardizing on IaC.

The team knew they needed a SaaS platform that could:

• Enforce per-run, scoped access
• Centralize state management without manual intervention
• Govern infrastructure consistently across AWS and on-premises
• Fit within the budget realities of a public education company

The Infinite Campus team evaluated the major players: env zero, Scalr, and Terraform Cloud. Spacelift emerged as the clear winner for two intersecting reasons.

The first was affordability. Operating in the K–12 space means perpetual cost sensitivity, and Spacelift’s pricing model fit where the others did not. The second reason was multi-tool support. The team was already using Terraform and could see CloudFormation becoming part of the picture as their AWS footprint grew. Spacelift’s support for multiple IaC tools and its expanding toolchain gave Infinite Campus room to grow without switching platforms.

“Spacelift has added the ability to run even more types of IaC,” Emerson notes. “That’s something I’d highlight to any team in a similar situation.”

The preference for SaaS was also deliberate because they wanted the operational benefits of IaC management without adding it to the list of things to maintain.

The key priority that Spacelift met was ensuring secure access for the Infinite Campus team. Spacelift workers carry scoped credentials that operate only within the AWS environment during a run, so access is contained and auditable.

State management followed suit. For teams using Terraform, Spacelift now acts as the control plane for state access. “Spacelift isolates us from direct state updates unless we’re importing something that was created originally manually,” Emerson explains. “And even then, we can quickly import through Spacelift and get those things managed with IaC as we discover them.” As a result, Infinite Campus has avoided any significant state-related incidents. For a team simultaneously developing its expertise in both Terraform and IaC, that’s a meaningful indicator of platform stability.

Managing cloud and on-premises under one roof

Infinite Campus runs a hybrid of monorepo and polyrepo structures (networking infrastructure lives in a monorepo, for example) and stack creation reflects that variety. On-premises stacks are created via the Terraform API, while AWS-side work includes Terraform provider-based stack creation, particularly for ephemeral stacks used in integration testing. The team is increasingly favoring the provider-based approach for new deployments, treating their stack definitions as IaC in their own right.

Critically, state management is consistent whether a stack is targeting AWS or on-prem. “It’s nice to have them consistent,” Emerson says. That consistency reduces cognitive overhead and means governance policies apply uniformly — there’s no second-class tier for on-premises infrastructure.

Policies, contexts, and EKS deployments

Infinite Campus uses Spacelift policies primarily as PR filters for repositories that lean monorepo: When a single repository feeds multiple stacks, policies control which changes flow into which stack at any given time. All on-premises stacks use policies for this purpose.

Contexts play a particularly important operational role in the team’s Kubernetes deployments. EKS clusters are managed with environment-specific version information set via contexts, along with hooks that perform version-based replacements during runs. This allows the team to maintain version consistency per environment without hardcoding values into stack configurations. 

Kubernetes cluster scaling as a customer reliability win

“The big difference with Spacelift is that it has made it easy for us to split new Kubernetes clusters to help our customers run things more reliably. Contexts help us codify a few things to support that.” — Emerson Van Note, Staff Engineer, Infinite Campus

For a platform serving so many students and their schools, reliability is essential. Spacelift can now consistently scale and segment Kubernetes clusters, using Spacelift contexts to codify the version and configuration logic. This gives Infinite Campus a repeatable path to reliability for end customers.

Zero major state incidents

The Infinite Campus team has experienced no major state-related incidents since moving to Spacelift. This is a direct and measurable outcome of the platform’s isolation model.

Security posture locked in

Spacelift workers handle AWS access in a controlled, per-run scope, and the team has a clear model for how infrastructure access is governed.

Consistent governance across environments

Spacelift provides a unified control plane for cloud versus on-premises Terraform runs. State management, access governance, and stack policies work the same way regardless of the target environment. For a lean infrastructure team with broad responsibilities, that consistency reduces operational burden and lowers the risk of environment-specific blind spots.

Looking ahead

As Infinite Campus continues to mature its IaC practice, the team is moving toward more provider-based stack creation, with infrastructure definitions kept as code throughout, rather than relying on UI-driven stack management. They’re also exploring broader use of Spacelift’s expanding toolchain as their multi-tool environment evolves.

Ultimately, Spacelift has become the platform that makes consistent, secure infrastructure management achievable — without the overhead of building or maintaining it themselves.

* INFINITE CAMPUS is a registered trademark of Infinite Campus, Inc.