SaaS Orchestration: Spacelift and Terraform Cloud

Trigger Chains

If Terragrunt is the open-source, CLI-driven approach to orchestration, Spacelift and Terraform Cloud (TFC) are the managed platform equivalents. Instead of a local process building a DAG, these platforms treat each state file as a first-class "Stack" or "Workspace" and manage dependencies through an event-driven trigger system.

The mental model shifts from "a script that runs things in order" to "a pipeline where each stage automatically kicks off the next."

How trigger chains work in Spacelift:

1. The VPC Stack finishes a successful apply.
2. Spacelift's event bus detects the apply_succeeded event.
3. A trigger policy (written in OPA/Rego) evaluates: "If VPC finishes successfully, automatically queue a run on the Database Stack."
4. The Database Stack run starts, reads VPC outputs from its remote state backend, and applies.
5. The chain continues until all dependent stacks have been updated.

Spacelift's own Terraform provider can declare these dependencies as resources: one linking a dependent stack to the stack it depends on, and a companion resource mapping a specific output from the upstream stack directly to an input variable name on the downstream one. That output-to-input mapping resource is particularly powerful: it automatically passes outputs from one stack as environment variables (or Terraform variables) into the dependent stack's run context. This eliminates the need for terraform_remote_state data sources entirely — the platform handles the wiring.

Terraform Cloud achieves similar results through Run Triggers: a workspace can subscribe to one or more "source" workspaces, and a successful apply in the source automatically queues a speculative plan (or full apply, depending on configuration) in the subscriber.

The key architectural difference between Terragrunt and SaaS platforms is where the orchestration state lives. With Terragrunt, the DAG is computed fresh on every run-all invocation from the dependency blocks in your code — it is stateless and reproducible. With Spacelift or TFC, the dependency relationships are stored in the platform's own database, making them visible in a UI and auditable, but also creating a second source of truth that must be kept in sync with your infrastructure code.