We show that SARS-CoV-2 spike protein interacts with cell surface heparan sulfate and angiotensin converting enzyme 2 (ACE2) through its Receptor Binding Domain. Docking studies suggest a putative heparin/heparan sulfate-binding site adjacent to the domain that binds to ACE2. In vitro, binding of ACE2 and heparin to spike protein ectodomains occurs independently and a ternary complex can be generated using heparin as a template. Contrary to studies with purified components, spike protein binding to heparan sulfate and ACE2 on cells occurs codependently. Unfractionated heparin, non-anticoagulant heparin, treatment with heparin lyases, and purified lung heparan sulfate potently block spike protein binding and infection by spike protein-pseudotyped virus and SARS-CoV-2 virus. These findings support a model for SARS-CoV-2 infection in which viral attachment and infection involves formation of a complex between heparan sulfate and ACE2. Manipulation of heparan sulfate or inhibition of viral adhesion by exogenous heparin may represent new therapeutic opportunities.