Spacelift Self-Hosted Backup Best Practices

What to Back Up

When running Spacelift in self-hosted mode, there are three critical data sources you need to protect. Everything else (workers, queues, scheduler) is stateless and can be redeployed from the same image or chart after a restore.

1. Database (RDS)

The database holds every stack, policy, context, and token — essentially your entire Spacelift configuration.

• Enable daily snapshots or Point-in-Time Recovery (PITR)

• Configure cross-region copy for disaster recovery

2. S3 Buckets

The following buckets contain critical data and should be backed up:

• modules — module archives

• states — Terraform state files

• run-logs — run logs

• policy-inputs — OPA policy inputs

To protect these buckets, enable versioning and replication to your DR region.

3. Encryption Key (KMS or RSA)

Without the encryption key, the database cannot be decrypted after a restore.

• Use a multi-region KMS key, or

• Keep an offline copy of the RSA key