Skip to main content
Hosted by Aspect, Aspect Enterprise is a complete, isolated Aspect Workflows deployment (CI runners, remote cache, remote execution and the Build Results UI) in its own account in Aspect’s cloud. Aspect provisions and operates it. It’s for teams that need isolation without running infrastructure themselves. The difference from self-hosted is whose cloud account it sits in and who holds the credentials, not what you get.

​
What Aspect operates

Everything below the endpoints:
  • Provisioning the account, the network and every service in it.
  • Monitoring, alerting and 24/7 on-call for the infrastructure.
  • Upgrades, in scheduled windows. Patch upgrades need nothing client-side; for a minor or major, Aspect sends any client-side steps before the window.
  • Capacity: runner groups and remote execution worker fleets scale to the ceilings configured for your deployment.
  • Backups and restores of the build event database.
  • Certificate issuance and renewal for your endpoints.
You never run terraform apply or hold cloud credentials.

​
What stays yours

  • Your repository and your pipelines. Workflows registers runners with your CI provider; the pipeline definitions stay in your repo and keep calling bazel.
  • Your Bazel configuration. Which actions run remotely, which platforms they target, what gets cached: all decided by your .bazelrc and your BUILD files, the same as on any other deployment.
  • The configuration surface. Runner groups, remote execution platforms, which warming set each group restores, retention windows. These are yours to decide; Aspect applies them. See Configuration options.
  • Your identity provider, if you want it. Standard deployments use Aspect sign-in, which can connect to your identity provider for SSO. You can instead replace Aspect sign-in with your own identity provider, which changes how CI authenticates; read that before you decide. With Aspect sign-in, SCIM provisioning can sync users from your directory; with your own identity provider you manage users and groups there instead.

​
Where the isolation stops

The infrastructure and the data are isolated within Aspect’s cloud: the account is Aspect’s, and Aspect’s engineers hold the credentials to operate it. That’s data isolation without data ownership; see how to choose. For ownership too, choose self-hosted.

​
Getting set up

1

Hand over what Aspect needs

A VCS app installation, a CI provider credential, and your identity provider and DNS choices. See What Aspect needs from you.
2

Agree the configuration

Runner groups sized to your pipeline, remote execution platforms matching your toolchains. See Configuration options.
3

Point your builds at it

Authenticate the CLI, write the Bazel rc, target the runner groups from CI. See local setup and CI setup.

​
Reaching the endpoints

Your cache, remote execution and build event endpoints are on the public internet, authenticated, not inside your VPC. aspect auth and the generated Bazel rc handle this for developers. For CI runners you operate yourself, or workstations that must not egress to the internet, private endpoints (AWS PrivateLink or GCP Private Service Connect) can be added to the deployment: Aspect publishes the endpoint service and you create the endpoint in your VPC. No route exchange, no CIDR coordination.

​
Changing the configuration

You request configuration changes rather than applying them, since you don’t hold Terraform for this deployment. Requesting changes covers what to send, what turnaround to expect, and which changes need a maintenance window.