cloudparts

Spacelift

A hosted or self-hosted platform that runs Terraform, OpenTofu, Pulumi, CloudFormation, Kubernetes and Ansible changes from Git, with plans on pull requests, approvals and guardrails written as OPA policies, and workers you can run in your own network.

What it is
Infrastructure as code
Used for
CI/CD pipelines
Type
Commercial product
Made by
Spacelift, Inc.
License
Proprietary (the spacectl CLI and Terraform provider are MIT; Intent is Apache 2.0)
Facts checked
24 October 2026
Website

What it is

Spacelift is a CI system built only for infrastructure code. Its central object is a stack: one Git repository and folder, one tool (Terraform, OpenTofu, Terragrunt, Pulumi, CloudFormation, Kubernetes manifests or Ansible) and the state and settings that go with it. A pull request starts a proposed run, which posts the plan back to the pull request; a push to the tracked branch starts a tracked run, which plans, waits for confirmation if there are changes, and then applies. A tracked run holds a lock on its stack, so two applies never overlap. Stack dependencies run related stacks in order, so a network stack applies before the cluster that needs it.

Rules are written in Rego and evaluated by Open Policy Agent at fixed points: who may log in, which Git pushes trigger runs, who must approve a run, and which planned changes are allowed. A plan policy reads the plan as JSON, so deny can fail any run that would create a static IAM access key, and warn can send it to a human. Policies attach to stacks by label. Drift detection reruns proposed runs on a schedule and can start a tracked run to put things back.

Runs execute on workers, in Docker containers. Spacelift hosts a public pool, or you run a private pool on your own machines or in Kubernetes; private workers only make outbound connections and encrypt run state with a key only you hold. The product is SaaS (including a FedRAMP-authorised version) or self-hosted, and plans are priced by users and workers rather than by managed resources. In 2026 Spacelift renamed this product Spacelift Deploy, alongside Flows (visual automations) and Intent (an AI tool that creates cloud resources from natural-language requests through Terraform providers).

Why teams pick it

  • One workflow for several IaC tools, including OpenTofu and Terraform side by side, so a company is not tied to one vendor’s cloud
  • Guardrails as code: OPA policies can block a plan, require approvals or route notifications, and they are versioned and testable like other code
  • Private workers run inside your network with your own IAM roles and images, and only need outbound HTTPS
  • Priced by users and workers, not by the number of resources under management

Watch out for

  • Proprietary, and paid plans are quote-only; the free plan allows 2 users and 1 public worker
  • Drift detection works only on private workers, so you have to run your own worker pool to get it
  • Rego is another language to learn, and policy mistakes can quietly block or allow runs
  • Private workers on the older MQTT transport must move to HTTP long-polling before MQTT is turned off on 30 March 2027

Alternatives

What all infrastructure as code have in common →Compare side by side →
AWS Cloud Development Kit (CDK)AWSDefine AWS infrastructure in TypeScript, Python, Java, C# or Go; the CDK turns it into CloudFormation templates and CloudFormation deploys them.AWS CloudFormationAWSAWS’s own infrastructure-as-code service: describe resources in a JSON or YAML template and CloudFormation creates them as one stack, in order, and rolls back on failure.+1 AWS Serverless Application Model (SAM)CrossplaneOpen sourceTurns a Kubernetes cluster into a control plane for infrastructure: you declare a bucket or a database as a Kubernetes object, and controllers create it and keep putting it back if it drifts.+1 UpjetEncoreOpen sourceA backend framework for TypeScript and Go in which services declare the databases, topics, buckets and cron jobs they need as typed objects in code; Encore reads those declarations and runs them locally or provisions them in your AWS or GCP account.GrizzlyArchivedOpen sourceGrafana Labs’ deprecated grr command line tool for keeping Grafana dashboards, alert rules and data sources as YAML, JSON or Jsonnet files and pushing them to Grafana.HashiCorp PackerCommercialBuilds machine images (AMIs, Azure and Google images, VMware, Docker) from one HCL template, so every server starts already configured.HCP WaypointCommercialHashiCorp’s hosted internal developer platform: developers create apps and add databases from templates that run Terraform modules in HCP Terraform.NitricOpen sourceA multi-language framework in which code asks for APIs, buckets, queues, topics and databases through an SDK; at deploy time Nitric collects those requests and a provider plugin turns them into AWS, Google Cloud or Azure resources, through Pulumi or generated Terraform.OpenTofuOpen sourceThe open-source fork of Terraform, created after HashiCorp’s 2023 licence change: same HCL, same providers, tofu instead of terraform.PulumiOpen sourceInfrastructure as code in TypeScript, Python, Go, C#, Java, YAML or HCL: a program declares resources, and Pulumi’s engine diffs them against saved state and calls the cloud APIs through providers.Serverless FrameworkCommercialA CLI that turns one serverless.yml file of functions and the events that trigger them into a CloudFormation stack, and deploys it with your code to AWS Lambda.SSTOpen sourceA TypeScript framework that defines a whole app, from Next.js front end to functions, containers and databases, in one config file and deploys it to your own AWS or Cloudflare account.TerraformCommercialThe most widely used infrastructure-as-code tool: declare resources in HCL, review a plan, and apply it through provider plugins.WingPreviewOpen sourceA programming language for the cloud that puts infrastructure and the code that runs on it in one program: the compiler turns it into Terraform for AWS, Azure or Google Cloud plus JavaScript for the functions, and can also run it all in a local simulator.

How it fits with other technologies

A plan policy in Rego: fail any run that creates a static AWS access key · text

package spacelift

import rego.v1

deny contains sprintf(message, [resource.address]) if {
  message := "static AWS credentials are evil (%s)"
  some resource in input.terraform.resource_changes
  some action in resource.change.actions
  action == "create"
  resource.type == "aws_iam_access_key"
}

# Attach it to every stack labelled autoattach:no-static-keys

See it in a real stack

No architecture uses Spacelift yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2020–2026

Spacelift was founded in 2020 by Marcin Wyszyński, a former site reliability engineer at Google and Facebook who had been consulting for European scale-ups, and Paweł Hytry. Wyszyński had built a tool to manage infrastructure for his clients, and interest from fintech companies convinced him to turn it into a product. General-purpose CI tools ran Terraform but knew nothing about state, plans, drift or who should approve an apply; Spacelift set out to be CI that did.

In 2021 the company raised a $15 million Series B led by Insight Partners, by then supporting Terraform, Pulumi and CloudFormation, with offices in Redwood City and Warsaw. When HashiCorp moved Terraform from the MPL to the Business Source License in August 2023, Spacelift was one of the companies behind the OpenTF manifesto and put engineers on the fork, which became OpenTofu under the Linux Foundation.

A $51 million Series C led by Five Elms Capital followed in July 2025. Later that year Spacelift released Intent, an open-source tool that lets an AI assistant create cloud resources through Terraform providers under the same policy engine. In 2026 the original product was renamed Spacelift Deploy when Spacelift Flows, a visual automation builder, joined it.

Why it’s built this way

A specialised CI for infrastructure instead of plugins for general CI
Infrastructure runs need things a build pipeline lacks: state locking, a plan to review, confirmation before apply, drift checks and approvals tied to what will change.
Open Policy Agent and Rego for every decision point
Rules about logins, triggers, approvals and plans can then be written, reviewed and tested as code instead of clicked together in a UI.
Workers that can run in the customer’s network
Applying infrastructure needs powerful cloud credentials; private workers keep them, and the decrypted run state, inside the customer’s own account.
Back the OpenTofu fork
Terraform’s 2023 licence change restricted products that embed it, which threatened Spacelift’s own business and the wider tooling built on open-source Terraform.

Timeline

  1. 2020

    Founded by Marcin Wyszyński and Paweł Hytry

  2. 2021

    $15 million Series B led by Insight Partners; supports Terraform, Pulumi and CloudFormation

  3. 2023

    Co-signs the OpenTF manifesto and works on the Terraform fork that becomes OpenTofu

  4. 2025

    $51 million Series C in July; Spacelift Intent released as open source

  5. 2026

    Product renamed Spacelift Deploy as Spacelift Flows launches

Sources12 · facts checked 24 October 2026

Improve this page on GitHub