Skip to main content

Allow read-only AWS integrations to be autoattached

Feature RequestsIntegrationsStacks

We have separate AWS IAM roles for Spacelift integration attachments, so we can allow preview runs to run on unapproved code changes, without worrying about someone being able to make a change to the underlying AWS resources from their GitHub branch.

This is working well, except autoattach:<label> no longer works to attach these integrations, because it defaults to allowing writes. So we have to explicitly create every integration attachment for every stack.

Is it possible to allow autoattach_read:<label> (and autoattach_write:<label> for symmetry) labels on AWS integrations to specify what the integration should be used for on the stacks that match?

Workaround
Problem
Status: ✅ Completed1 comment

Log in to comment and vote

Comments1

  • Aleksandra Cieslak

    Team•

    Jun 11

    Hi!

    Great news, this is actually already supported!

    You can use the autoattach_read:<label> and autoattach_write:<label> labels on your AWS integrations to control exactly what each integration is used for when auto-attached to matching stacks.

    So in your case:

    • Integration for preview runs only → label it autoattach_read:<your-label>

    • Integration for apply runs → label it autoattach_write:<your-label>

    • Your stacks just need the matching <your-label> label

    This way Spacelift will automatically attach the right integration with the right permission level.

    Full details in our docs: https://docs.spacelift.io/concepts/configuration/context#read-and-write-permission-for-aws-and-azure-integrations

    Let us know if you run into any issues setting this up!