Spacelift
By Spacelift, Inc.
Spacelift is a managed continuous integration and delivery platform purpose-built for infrastructure as code, orchestrating plan and apply workflows for tools such as Terraform, Pulumi, and OpenTofu with policy checks, approval gates, and…
Definition
Spacelift is a managed continuous integration and delivery platform purpose-built for infrastructure as code, orchestrating plan and apply workflows for tools such as Terraform, Pulumi, and OpenTofu with policy checks, approval gates, and drift detection built in. It runs infrastructure changes in isolated, ephemeral workers triggered by version control events, giving teams a GitOps workflow for infrastructure comparable to what CI/CD platforms provide for application code. DevOps and platform teams use it to add guardrails and automation around infrastructure change management.
Overview
Spacelift responds to a gap that generic CI/CD systems leave open: running Terraform or similar tools through a general-purpose pipeline works, but it typically requires teams to hand-build state locking, plan review workflows, drift detection, and policy enforcement themselves using scripts and third-party integrations. Spacelift packages those concerns into a platform designed specifically around infrastructure-as-code's plan-then-apply lifecycle. Mechanically, Spacelift connects to a version control repository and defines "stacks," each representing a unit of infrastructure managed by a particular IaC tool and backend. When a change is pushed, Spacelift runs the tool's plan step in an isolated, ephemeral worker, evaluates the proposed changes against configurable policies written in Open Policy Agent's Rego language, and, depending on policy and configuration, either applies automatically or waits for a human approval before running apply. It also periodically checks live infrastructure against the last known state to detect and surface configuration drift. Compared to Atlantis, which is a self-hosted, open-source tool that runs Terraform plan and apply through pull request comments, Spacelift is a fully managed SaaS platform with a broader policy engine, multi-tool support beyond Terraform, and built-in drift detection, at the cost of being a paid, hosted product rather than something a team runs on their own infrastructure. Compared to Env0, another managed IaC platform, the two overlap closely in positioning, differing mainly in their specific policy engines, pricing models, and depth of integrations with cloud cost estimation and compliance tooling. In practice, teams adopt Spacelift to enforce mandatory review and policy checks before infrastructure changes reach production, to manage many Terraform or Pulumi stacks across environments and cloud accounts from one control plane, and to get automated notifications when live infrastructure has drifted from its declared configuration. Its GitOps model means infrastructure changes flow through the same pull-request-based review process teams already use for application code. Limitations include vendor lock-in to a commercial SaaS platform for a core piece of infrastructure tooling, and the need to migrate existing ad hoc pipelines and state management practices into Spacelift's stack model, which can require nontrivial setup for large existing Terraform estates. Teams wanting a fully self-hosted, free alternative for simple pull-request-driven Terraform automation often start with Atlantis instead. Spacelift also supports custom workflow logic through hooks that run before and after plan or apply steps, letting teams integrate cost estimation tools, security scanners, or internal approval systems into the pipeline without forking the platform itself. This extensibility, combined with its policy engine, is often the deciding factor for organizations with compliance requirements that a bare CI pipeline running Terraform commands cannot satisfy on its own.
Key Features
- Orchestrates plan and apply workflows for Terraform, Pulumi, and OpenTofu
- Runs infrastructure changes in isolated, ephemeral workers
- Enforces policy checks using Open Policy Agent's Rego language
- Detects and reports configuration drift automatically
- Requires human approval gates before applying changes
- Manages many infrastructure stacks from a single control plane
- Integrates with version control for GitOps-style workflows
- Supports role-based access control across teams and environments