dbt Cloud Production Run with an Approval Gate

Put a human approval gate in front of every dbt Cloud production run. This blueprint triggers your dbt Cloud CI job, waits for it to pass, pauses for a reviewer to sign off, and only then triggers the production transformation job, reporting the outcome to Slack. It solves the problem of unreviewed dbt models reaching production: instead of letting a scheduler fire prod blindly, you enforce a validate, review, promote sequence that combines automated CI checks with explicit human approval for sensitive data transformations.

How it works

1. A io.kestra.plugin.core.trigger.Webhook trigger (on_promote_request) starts the flow when a release system posts to it, guarded by a key.
2. run_ci_job uses io.kestra.plugin.dbt.cloud.TriggerRun with wait: true to run the dbt Cloud CI job from ci_job_id and block until it finishes.
3. notify_approval posts to Slack via io.kestra.plugin.slack.notifications.SlackIncomingWebhook to tell the team CI passed and approval is needed.
4. approve_production uses io.kestra.plugin.core.flow.Pause with pauseDuration set from the approval_timeout input to wait for a human to resume the execution.
5. run_prod_job runs the dbt Cloud production job from prod_job_id, again with wait: true.
6. notify posts a final Slack message confirming the production run completed.

What you get

• A reproducible validate, approve, promote path for dbt Cloud.
• CI gating: a failing CI job stops the flow before approval ever matters.
• Human-in-the-loop control over production data transformations.
• Slack visibility at both the approval and completion steps.

Who it's for

• Analytics engineers managing dbt Cloud projects.
• Data platform teams enforcing change control on production models.
• Teams that need an audit trail of who approved each prod run.

Why orchestrate this with Kestra

dbt Cloud's own scheduler can run jobs on a cron or on CI events, but it cannot pause mid-pipeline and block on a human approval before promoting to production. Kestra adds that gap: a declarative YAML flow with an event-driven Webhook trigger, a native Pause task for human approval, automatic retries, and full execution lineage across the CI run, the gate, and the prod run. You get one auditable execution instead of two disconnected dbt Cloud jobs.

Prerequisites

• A dbt Cloud account with a CI job and a production job already defined.
• A Slack incoming webhook.

Secrets

• DBT_CLOUD_ACCOUNT_ID: your dbt Cloud account ID.
• DBT_CLOUD_API_TOKEN: dbt Cloud API token used to trigger runs.
• DBT_CLOUD_WEBHOOK_KEY: key that guards the webhook trigger.
• SLACK_WEBHOOK_URL: Slack incoming webhook URL for notifications.

Quick start

1. Add the secrets above to your Kestra namespace.
2. Pass ci_job_id and prod_job_id (and optionally override approval_timeout, default PT2H).
3. Trigger the flow (or POST to the webhook) and let the CI job run.
4. When the Slack approval message arrives, resume the paused execution to run production.

How to extend

• Remove the approve_production Pause for a fully automated CI to prod path.
• Add a second reviewer or route the Slack message to an approvers channel.
• Branch on CI run outputs before approving, or post run metadata into the approval message.
• Swap Slack for email or another notification plugin.

Links

• plugin-dbt documentation
• dbt Cloud orchestration with Kestra