Spacelift

Purpose

Maps Spacelift stacks, spaces, policies, contexts, and integrations into SubImage so infrastructure-as-code orchestration can be correlated with the cloud resources it manages.

Required Fields

Setup Steps

1. In your Spacelift account, go to Organization settings → API keys and create a secret-based API key. See the Spacelift API key docs for the current Spacelift flow.
2. Give the API key Reader access to the spaces you want SubImage to ingest. If your organization uses Spacelift login policies, make sure the API key is allowed by those policies too.
3. Save the downloaded API key file. Spacelift only shows these values once. The file includes:
   • api_key_id
   • api_key_secret
   • a token snippet for Terraform module access
4. Your GraphQL endpoint is https://<your-account>.app.spacelift.io/graphql.
5. In SubImage, fill in:
   • spacelift_api_endpoint — your GraphQL endpoint
   • spacelift_api_key_id — the API key ID, or an AWS Secrets Manager ARN / SubImage-managed secret containing it
   • spacelift_api_key_secret — the API key secret, or an AWS Secrets Manager ARN / SubImage-managed secret containing it
6. Leave spacelift_api_token blank.
7. Save the module. Cartography will use the API key ID and secret to obtain Spacelift API tokens during sync.

Advanced: Pre-generated JWT Token

Use spacelift_api_token only if you already have a Spacelift API token and want SubImage to use it directly.

1. Exchange the API key ID and secret for a Spacelift API JWT token.

   • In the Spacelift UI, use https://<your-account>.app.spacelift.io/apikeytoken.
   • Or make a GraphQL request to https://<your-account>.app.spacelift.io/graphql:

   mutation GetSpaceliftToken($id: ID!, $secret: String!) {
     apiKeyUser(id: $id, secret: $secret) {
       jwt
     }
   }

   with variables:

   {
     "id": "<api_key_id>",
     "secret": "<api_key_secret>"
   }

2. In SubImage, fill in:

   • spacelift_api_endpoint — your GraphQL endpoint
   • spacelift_api_token — the JWT token, or an AWS Secrets Manager ARN / SubImage-managed secret containing the JWT token

3. Leave spacelift_api_key_id and spacelift_api_key_secret blank.

4. Save the module.

Notes

• Configure exactly one authentication method: either spacelift_api_key_id plus spacelift_api_key_secret, or spacelift_api_token.
• The recommended API key ID and secret flow matches Spacelift's long-term API authentication guidance and lets Cartography handle token generation during sync.
• The advanced spacelift_api_token value should look like a JWT with three dot-separated parts. A downloaded API key file, an api:<id>:<secret> string, an API key ID, or an API key secret by itself will not work in this field.