Skip to content

External state access»

Info

While this feature allows sharing outputs between stacks, we recommend using Spacelift's native stack dependencies instead when possible. Available for all supported IaC vendors, Stack dependencies provide a more integrated workflow with granular access, proper dependency tracking and access control, and they don't require external state access to be enabled.

External state access allows you to read the state of the stack from outside authorized runs and tasks. In particular, this enables sharing the outputs between stacks using the OpenTofu/Terraform mechanism of remote state or even accessing the state offline for analytical or compliance purposes.

If enabled for a particular stack, any user or stack with Write permission to that stack's space will be able to access its state.

This feature is off by default.

Enabling external access»

Info

Only administrative stacks or users with write permission to this Stack's space can access the state.

You can enable the external access in a couple of ways.

  • through the UI

1
2
3
4
5
6
resource "spacelift_stack" "example" {
  name                            = "example"
  repository                      = "spacelift-stacks"
  branch                          = "main"
  terraform_external_state_access = true
}

Sharing outputs between stacks»

Sharing the outputs between stacks can be achieved using the OpenTofu/Terraform mechanism of remote state.

Given an account called spacecorp, and a stack named deep-thought, having the following OpenTofu/Terraform configuration.

1
2
3
output "answer" {
  value = 42
}

You can read that output from a different stack by using the terraform_remote_state data source.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
data "terraform_remote_state" "deepthought" {
  backend = "remote"

  config = {
    hostname     = "spacelift.io" # (1)
    organization = "spacecorp"    # (2)

    workspaces = {
      name = "deep-thought"       # (3)
    }
  }
}

output "ultimate_answer" {
  value = data.terraform_remote_state.deepthought.outputs.answer
}
  1. The hostname of the Spacelift system.
  2. The name of the account.
  3. The ID of the stack you wish to retrieve outputs from.

Offline state access»

Given an account called spacecorp, and a stack named deep-thought, having the following OpenTofu/Terraform configuration.

1
2
3
output "answer" {
  value = 42
}

Before you will be able to access the state of the stack, you need to retrieve an authentication token for spacelift.io.

1
terraform login spacelift.io

Next, you need a remote backend configuration.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
terraform {
  backend "remote" {
    hostname     = "spacelift.io" # (1)
    organization = "spacecorp"    # (2)

    workspaces {
      name = "deep-thought"       # (3)
    }
  }
}
  1. The hostname of the Spacelift system.
  2. The name of the account.
  3. The ID of the stack you wish to retrieve outputs from.

Finally, you can download the state of the stack.

1
tofu/terraform state pull > terraform.tfstate