Spacelift Terraform Orchestration

Git Push → Spacelift Stack → Plan → Policy Check → Approval → Apply

# .spacelift/config.yml
version: 1

stacks:
  - name: production-vpc
    root: terraform/vpc
    branch: main
    terraform_version: 1.7.0
    labels:
      - production
      - networking

  - name: production-eks
    root: terraform/eks
    branch: main
    depends_on:
      - production-vpc
    terraform_version: 1.7.0
    labels:
      - production
      - compute

# Reject plans that increase monthly cost by more than $500
package spacelift

deny[msg] {
  input.spacelift.run.type == "PROPOSED"
  cost_increase := input.third_party.infracost.total_monthly_cost_change
  cost_increase > 500
  msg := sprintf("Cost increase $%.2f exceeds $500 limit", [cost_increase])
}

# Block creation of public S3 buckets
package spacelift

deny[msg] {
  resource := input.terraform.resource_changes[_]
  resource.type == "aws_s3_bucket"
  resource.change.after.acl == "public-read"
  msg := "Public S3 buckets are not allowed"
}

# Require 2 approvals for production changes
package spacelift

approve {
  input.spacelift.stack.labels[_] == "production"
  count(input.spacelift.run.approvals) >= 2
}

Stack: production-vpc
Drift detected: 2 resources changed outside Terraform

~ aws_security_group.web
  - ingress rule added: port 22 from 0.0.0.0/0  ← Manual change!

~ aws_route_table.public
  - route added: 10.0.0.0/8 via igw-xxxx  ← Manual change!

VPC Stack → EKS Stack → App Stack → Monitoring Stack
              ↓
         RDS Stack

# Share AWS credentials across stacks
context: aws-production
  environment:
    AWS_DEFAULT_REGION: eu-west-1
  mounted_files:
    - path: /mnt/workspace/.aws/credentials
      content: ${{ secrets.AWS_CREDENTIALS }}

# All stacks with label "production" get AWS credentials
auto_attach:
  label: production

# Publish a module
spacectl module create-version \
  --id my-vpc-module \
  --version 1.2.0

# Use in stacks
module "vpc" {
  source  = "spacelift.io/myorg/vpc/aws"
  version = "~> 1.2"
}