Skip to content
Spacelift Flows

Template Gallery

AI Agent with Slack Approvals

AI Agents with tools are very useful, but when the tools are delicate or have a non-trivial blast radius, it's crucial to have a human in the loop for reviewing any such tool use. This is an AI Agent example with the Anthropic app and an approval harness for tool use. The agent responds to messages on Slack, and all tool use needs to be interactively approved by the user on Slack.

AIAnthropicSlackUtilities

PostgreSQL MCP Server

With AI assistants, one of the biggest challenges is safely exposing your internal data and services to the model. With Flows you can easily expose anything as an MCP server - safely, with guardrails, OAuth2 authorization, and full auditability. With private agents you can even expose private resources (e.g. databases) to public AI assistants, in a safe and easy way. *Warning: If you use this template verbatim, make sure to use a constrained database user limited to what you want your AI assistant to access.*

AIMCP ServerPostgreSQL

AWS Organizations Account Creator

This Flow automates the creation of AWS Organization Accounts through a self-service form. It creates the account, waits for it to be ready, and then creates a role inside of it.

Self-ServiceAWS API - IAMAWS API - OrganizationsForms

Cloudflare AutoRAG Doc Search

An AI-powered documentation search bot that uses Cloudflare AutoRAG for semantic search and Anthropic Claude for response generation. Mention the bot in Slack with a search query to get AI-generated answers grounded in your knowledge base. Very simple with only a single search, no agentic loop.

AIAnthropicCloudflareSlack

OpenAI Agent with Slack Approvals

AI Agents with tools are very useful, but when the tools are delicate or have a non-trivial blast radius, it's crucial to have a human in the loop for reviewing any such tool use. This is an AI Agent example with the OpenAI app and an approval harness for tool use. The agent responds to messages on Slack, and all tool use needs to be interactively approved by the user on Slack.

AIOpenAISlackUtilities

PagerDuty Slackbot

A comprehensive incident management bot that integrates PagerDuty with Slack. Automatically creates dedicated incident channels, generates AI-powered summaries using Anthropic Claude, and provides interactive Slack messages for incident response actions. Great example of an advanced ai-flavoured Slack Bot.

Incident ManagementAnthropicPagerDutySlack

PostgreSQL Database Management Form

Demonstrates using the PostgreSQL app along with Flows Forms to create an internal database management UI.

Self-ServiceFormsPostgreSQL

S3 Webhook Archiver

Archives incoming webhook payloads to Amazon S3. Receives HTTP requests, stores them in a self-provisioned S3 bucket, and provides retrieval endpoints. A simple demonstration of using the S3 API, including resource management (bucket creation).

CloudAWS API - S3AWS Resources

Backstage Self-Service Spacelift Template Provisioning

Flows extends Backstage's Software Templates with multi-step orchestration capabilities (conditional branching, human approvals), audit logging and 3rd party integrations. Exposing a Flow as a Backstage Software template is as simple as adding and configuring a Backstage Entrypoint block, removing the need to maintain custom Scaffolder actions or redeploying Backstage. See the [Extending Backstage with Flows](/guides/backstage-integration/) guide for a full walkthrough. This Flow exposes a [Spacelift Template](https://docs.spacelift.io/concepts/template) deployment as a Software Template form on Backstage. Before the deployment is triggered, the Platform Team is asked for approval via Slack. After the resource is deployed, the details are sent to the requester in a Slack DM.

Self-ServiceBackstageSlackSpacelift

Full Environment Vending

This Flow implements full environment vending on top of [Spacelift Templates](https://docs.spacelift.io/concepts/template). Developers request an environment through a Flows Form. The request is validated against naming conventions, then routed through a two-level approval on Slack — first the team lead, then the budget owner. Once approved, the environment is provisioned by deploying a Spacelift Template with the requested inputs, and the requester is notified on Slack with the deployment outputs. Environments can be staging, sandbox, or ephemeral. Ephemeral environments are automatically torn down after the requested TTL expires, with a teardown notice posted to Slack.

Self-ServiceFormsSlackSpacelift

Forms Self-Service S3 Bucket Provisioning

Flows lets you build automated self-service flows, whether integrated into your existing tools (e.g. Jira, ServiceNow) or fully self-contained with Flows Forms. In this template, we automatically respond to S3 bucket (substitute anything you yourself would like to provision) provisioning requests. The Platform team is asked for approval on Slack, and once approval is given, the bucket is created, and details are given back to the requester.

Self-ServiceAWS API - S3FormsSlack

Jira Self-Service S3 Bucket Provisioning

Flows lets you build automated self-service flows, wherever your team members already are. In this template, we automatically respond to S3 bucket (substitute anything you yourself would like to provision) provisioning requests on Jira. The Platform team is asked for approval on Slack, and once approval is given, the bucket is created, and details added to the Jira ticket.

Self-ServiceAWS API - S3JiraSlack

Jira Self-Service Spacelift Template Provisioning

Spacelift Templates already give you a great easy-to-use form-based UI for provisioning infrastructure in a self-service fashion. Paired with Flows, you can bring this self-service provisioning experience to wherever your team members already are. In this flow, we receive Jira self-service provisioning tickets, handle them by deploying Spacelift Templates, and send outputs back to the Jira ticket. Before the development database is provisioned, we also ask the Platform Team for approval on Slack. [Read more about Spacelift Templates.](https://docs.spacelift.io/concepts/template)

Self-ServiceJiraSlackSpacelift

Linear Self-Service S3 Bucket Provisioning

This template showcases issue manipulation and events on Linear. After a ticket with the `provision:s3` is created, a message is posted on Slack. On approval, the resource is created and the status is reflected on the issue.

Self-ServiceAWS API - S3LinearSlack

Deploy Spacelift Templates using ServiceNow

Spacelift Templates already give you a great easy-to-use form-based UI for provisioning infrastructure in a self-service fashion. Paired with Flows, you can bring this self-service provisioning experience to the ServiceNow Service Catalog. This flow creates a ServiceNow catalog item for provisioning an Aurora database stack, capturing the deployment name, database engine, instance class, database name and master username. When the item is requested, the flow deploys the corresponding Spacelift Template, then marks the request item as completed or failed depending on the deployment outcome, posting the deployment details back as a comment.

Self-ServiceServiceNowSpacelift

Simple Teams Bot

A Teams bot that listens for `@mentions`, presents an interactive Adaptive Card, and responds with live data from Microsoft Graph based on the user's button selection

BasicsTeams BotTeams ManagementVariables

Spacelift Drift Detection Notifications

This Flow will let you know about any unconfirmed drift reconciliation runs in Spacelift by creating a Jira ticket and sending you a message on Slack.

Self-ServiceJiraSlackSpacelift

Spacelift Staged Batch Rollout

Rolling the same change out to every Spacelift stack at once is risky — a bad commit can take down every environment simultaneously. This Flow turns a push to your main branch into a staged rollout across your stacks, with humans kept in the loop on Slack at every gate. On the happy path, a commit to the tracked branch opens a Slack thread and rolls out through three stages — dev, then staging, then prod. Each stage deploys to its own set of stacks, and between stages the Flow asks for approval in Slack before promoting to the next one. If a stage fails, the Flow asks in Slack whether to retry — approving re-runs the whole stage, rejecting halts the rollout. Any other error is reported to Slack. Implementation notes for adapting it: each stage deploys with a Spacelift "Trigger Run Batch" block (a stage succeeds only if no run in the batch fails) wrapped in a Concurrency Group so only one rollout runs per environment at a time, and the Slack approve/retry logic is reused across all the gates via a single Utilities subroutine block. The stages, their stacks, and the Slack channel are hardcoded as a starting point for you to tweak.

OrchestrationGitHubSlackSpaceliftUtilities

Spacelift Unconfirmed Runs Notifications

This Flow will remind you about unconfirmed Stacks in Spacelift on a daily schedule.

Self-ServiceSlackSpacelift

AI-Powered Initial Response for Zendesk

Automatically replies to new Zendesk support tickets with a helpful, empathetic first response generated by Claude (Anthropic). When a ticket is created, Claude analyzes the subject and description and posts a professional public comment — reducing response times and keeping customers informed while your team reviews the issue.

AIAnthropicZendesk

Anthropic AI Agent

A minimal AI Agent example with the Anthropic app and simple tools for demonstration purposes. Responds to messages on Slack.

AIAnthropicSlack

Certificate Expiry Monitoring

This Flow keeps TLS certificates from expiring silently. Every day it walks the cluster's namespaces, reads every kubernetes.io/tls secret, and extracts each certificate's expiry directly from the certificate data — no cert-manager or external inventory required. A certificate entering the 30-day window gets a Jira renewal ticket and a Slack warning; inside the final 7 days it escalates to a critical alert with a new ticket. Each certificate is alerted once per severity, so the daily scan stays quiet until something changes. When a scan finds that an alerted certificate was renewed, the Flow closes the Jira ticket automatically and confirms in Slack, completing the lifecycle without manual bookkeeping. Scan failures are reported to the same channel. After importing, connect the Flow to your systems: configure the Kubernetes app installation with your API server URL and a token, set the Jira project key on the renewal ticket block, and create a SLACK_CHANNEL_ID secret with the channel to alert. The warning and critical thresholds live in the Classify Certificates expression, and the scan schedule on the Daily Cert Scan block.

ReliabilityJiraKubernetesSlack

Compliance Scan Reporter

This Flow turns raw compliance-scan output into action the moment a scan completes. A scan tool posts its results to the Flow's webhook, which acknowledges immediately and classifies every finding by severity. Critical findings alert the compliance Slack channel, each critical or high finding gets its own Jira remediation ticket with the full context (tool, target, resource, suggested remediation), and the raw report is archived to S3 for the audit trail. If any of the reporting steps fail, the error is posted to the same Slack channel, so a scan never disappears silently. The webhook accepts a JSON body with tool, scanId, target, completedAt, and a findings array of {id, title, severity, resource, description, remediation}. After importing, connect the Flow to your systems: point your scan tool at the /scan-results endpoint, set the Jira project key on the remediation ticket block, the S3 bucket and region on the archive block, and a SLACK_CHANNEL_ID secret with the channel to post to.

ComplianceAWS API - S3JiraSlack

Database Backup Verification

This Flow verifies on a daily schedule that every monitored RDS database has a recent backup, comparing the newest snapshot against each database's expected backup window. When a backup is overdue or missing, it creates a PagerDuty incident with the details — which database, the last known backup time, and how overdue it is — and posts a Slack alert tagging the on-call DBA. Each stale backup only pages once, and successful verifications are recorded in memory. If the check itself fails, the error is reported to Slack, so verification never fails silently.

Incident ManagementAWS API - RDSPagerDutySlack

Datadog Monitor Escalation

Automatically routes Datadog monitor events by severity. Warnings send a message to the on-call Slack channel, while alerts create an incident in Incident.io and automatically scale up the Kubernetes deployment.

Incident ManagementDatadogKubernetesSlackincident.io

Explode Pattern

Uses the Explode block to fan out work across multiple items in parallel. Lists S3 objects, processes each one individually, then collects all results back together. It's important to use the Collect block at the end to wait for all parallel work to finish before proceeding.

Advanced PatternsAWS API - S3

GitHub Deployment Correlation

This Flow enriches incidents with GitHub deploy context. An incident webhook (from PagerDuty, Datadog, or any other alerting tool) triggers queries for recent deployments and merged pull requests in the affected repository. These are correlated with the alert onset, and a summary of the last change events is posted to the incident Slack channel, with the most recent change before onset flagged as the most likely cause. Reading deployments requires granting the Deployments (read-only) repository permission to your GitHub App and accepting the permission update for its installation.

Incident ManagementGitHubSlack

Honeycomb Triggers into ClickUp Tasks

A minimal Honeycomb setup to catch all triggers and create ClickUp tasks from them.

Incident ManagementClickUpHoneycomb

Incident Enrichment

This Flow reacts to a PagerDuty incident the moment it triggers and gathers the context an on-call engineer would otherwise collect by hand: the most recent Spacelift runs on the affected service's stack (with how many minutes before onset each finished), Datadog events from the hour leading up to the incident, and the current state of Datadog monitors. It correlates everything into a single structured summary and posts it to the incident Slack channel, so triage starts with the likely causes already on screen. If any of the lookups fail, the error is reported to the same channel instead of failing silently. After importing, connect the Flow to your systems: set the PagerDuty service ID on the incident trigger, the Spacelift stack ID in the runs query variables, the tag filter on the Datadog monitors block, and a SLACK_CHANNEL_ID secret with the channel to post to.

Incident ManagementDatadogPagerDutySlackSpacelift

Kubernetes Ephemeral Environment

Creates an ephemeral Kubernetes environment for the AWS 2048 sample application in a namespace specified by the user through a form submission.

Self-ServiceFormsKubernetes

Kubernetes Deployment Scaling

When the monitor alerts, the Flow reads the deployment's current replica count and HPA status, then applies a capped scale-up: if an autoscaler manages the deployment it raises its `minReplicas` floor (a direct replica patch would be overridden), otherwise it patches `spec.replicas` directly. After a rollout grace period it verifies pod readiness and posts the outcome to Slack with before/after metrics — or a warning when pods aren't ready. Recovery notifications never trigger scaling, and failures are reported to Slack. After importing, configure the Datadog and Kubernetes installations, point the Kubernetes blocks at your deployment, set the monitor ID, and create a `SLACK_CHANNEL_ID` secret. Add the `@webhook-spacelift-flows-...` handle created by the Datadog installation to your monitor's message so alerts reach the Flow. The scaling step and replica cap are constants in the Plan Scaling expression.

ReliabilityDatadogKubernetesSlack

Kubernetes Namespace Provisioning

This Flow turns namespace provisioning into a self-service request. A developer fills in a form (namespace name, team, environment, resource tier, owner email), the request is validated against naming conventions and reserved names, and a message with Approve and Deny buttons goes to the platform Slack channel. On approval the Flow provisions everything a team needs: the namespace itself (labeled by team, environment, and tier, with Prometheus scrape annotations), a ResourceQuota matching the requested tier, a deployer service account with an admin role binding scoped to the namespace, and a network policy restricting ingress to in-namespace traffic. The requester gets the access details in Slack, denials reply in the approval thread, and provisioning failures are reported with the namespace and error attached. After importing, connect the Flow to your systems: configure the Kubernetes app installation with your API server URL and a provisioning token, and create a SLACK_CHANNEL_ID secret with the channel to post approvals and notifications to. The naming rules, resource tiers, and provisioned resource bodies are plain JavaScript in the validation and Create Resource blocks, so they are easy to adapt to your conventions.

Self-ServiceFormsKubernetesSlack

MongoDB Database Management Form

Demonstrates using the MongoDB app along with Flows Forms to create an internal database management UI.

Self-ServiceFormsMongoDB

PagerDuty MCP

Exposes PagerDuty incident management operations as MCP tools that can be called by AI assistants. Includes listing incidents, adding notes, and resolving incidents through the Model Context Protocol.

AIMCP ServerPagerDuty

Parallel Fetching

Demonstrates how to run multiple HTTP requests in parallel using Group Keys and Collect blocks. Sends concurrent requests and aggregates the results once all responses arrive. It's important to use the Collect block at the end to merge all parallel branches back together.

Advanced Patterns

Rundeck

Schedule and trigger Rundeck jobs, track executions to completion, and send results via email and Slack.

OrchestrationRundeckSMTPSlack

Secret Rotation Orchestrator

This Flow automates the full credential rotation lifecycle. On a monthly schedule it fetches the current secret version from AWS Secrets Manager, generates a strong replacement with the Secrets Manager API, and stores it as the new current version - the old one stays available as AWSPREVIOUS for rollback. The new credential is pushed to the consuming Spacelift stack as a write-only environment variable, and the Flow then triggers a run on that stack: a finished run is the proof that consumers actually work with the new credential. A successful rotation is recorded in the rotation-history data table and announced in Slack. If the verification run fails, or anything breaks after the new version was stored, the Flow moves the secret back to the previous version, restores the old value on the stack, opens a PagerDuty incident, records the rolled-back rotation, and alerts Slack. Failures where rollback is not applicable - or where the rollback itself failed - skip straight to alerting and are flagged for manual intervention. After importing, connect the Flow to your systems: give the AWS Secrets Manager installation credentials that can read and write the rotated secret (plus secretsmanager:GetRandomPassword, which is not resource-scoped), point the secret ID and region fields at your secret, set the Spacelift stack ID on the update, restore, and verification blocks, fill in the PagerDuty service ID and from-email, and create a SLACK_CHANNEL_ID secret. The rotation cadence lives on the Rotation Schedule block.

ReliabilityAWS API - Secrets ManagerPagerDutySlackSpacelift

ServiceNow Provisioning

A self-service provisioning flow triggered by ServiceNow catalog requests. When a user submits a request, an S3 bucket is automatically created and the request is updated with completion status. The ServiceNow catalog entry is fully managed by the Flows block.

Self-ServiceAWS API - S3ServiceNow

Simple Slackbot

A basic Slack bot that responds to @mentions with commands. It reacts to "@mention hello" by greeting the user, and "@mention info" by fetching and displaying the user's Slack profile information.

BasicsSlack

Simple SSH

Demonstrates SSH commands and file uploads. Shows how to work with infrastructure for tasks like remote host management.

CloudSSH

Simple Webhook Handler

A minimal webhook handler that receives HTTP GET requests and responds with a personalized greeting. Great for learning how HTTP Endpoint blocks produce request events and expect response events back.

Basics

Spacelift Change Auto-Approval

When a tracked Spacelift run stops in the Unconfirmed state, the Flow checks PagerDuty for open incidents on the affected service and ServiceNow for an approved change window covering the current time. If both checks pass, the run is confirmed automatically. Otherwise an approval request goes to Slack with the context attached — the triggering commit, active incidents, and change window state. Approvals confirm the run and add work notes with the run details and approver to the ServiceNow change request; rejections reject the run in Spacelift. Every decision is recorded in a `change-decisions` data table, and failures alert Slack while the run stays safely unconfirmed. After importing, configure the Spacelift, PagerDuty, and ServiceNow app installations, set your stack ID on the Unconfirmed Run trigger and PagerDuty service ID on Check Active Incidents, and create a `SLACK_CHANNEL_ID` secret for the approval channel.

Change ManagementPagerDutyServiceNowSlackSpacelift

Spacelift Drift Detection to ServiceNow

This Flow will let you know about any unconfirmed drift reconciliation runs in Spacelift by creating a ServiceNow incident with the stack name, drift summary, run URL and commit details.

Incident ManagementServiceNowSpacelift

Subroutines

Four user management APIs (create, update, delete, login) all call a single reusable Audit Logger subroutine - demonstrating how to write logic once and use it everywhere.

BasicsUtilities

Temporary Elevated Access

This Flow implements just-in-time elevated access for Kubernetes. When a developer opens the request form, the Flow fetches the cluster's namespaces live and offers them as choices, along with an access level (the built-in view, edit, or admin cluster roles), a duration, and a mandatory justification. The request goes to an approver in Slack with Approve and Deny buttons. On approval the Flow creates a RoleBinding for the requester scoped to the chosen namespace, records the grant in the access-grants audit table, and starts a timer for the requested duration. When the timer fires, the RoleBinding is deleted and the audit row is marked revoked, so access always expires on schedule without anyone remembering to clean it up. Grants, denials, revocations, and failures are all reported to Slack, and the audit table keeps the full history with timestamps. After importing, connect the Flow to your systems: configure the Kubernetes app installation with your API server URL and a token, and create a SLACK_CHANNEL_ID secret with the channel to post approvals and notifications to. The audit table is created automatically on import. The access levels and durations are plain values in the form definition and the Sleep block's duration map, so they are easy to adapt.

Access ManagementFormsKubernetesSlack

Variables

Shows usage of the Variables app for project-level and flow-local variables.

BasicsVariables