Strategies for sharing Ansible vaults with root/administrator credentials?

Question

Historically we've been a one man devops team and stored all our passwords in Ansible vaults - including things like domain admin passwords and root account passwords.

However we're now growing and adding new team members and this creates a challenge. If we give all members of the devops team the vault and vault password they all suddenly have domain admin and root credentials - which we're hesitant to do. Some members of our team are more junior and we're trying to avoid handing out proverbial keys to the kingdom to everyone on the team.

However the Ansible scripts still need these credentials to function - to do things like join a windows active directory domain.

Is there a way with Ansible, Ansible tower or awx to grant a devops person the ability to use a credential without being able to decrypt and read it in clear text?

If not what other strategies do their teams use to address this situation?

Answer 1

This sounds like you are applying Ansible playbooks locally on peoples workstations.

The best way to protect this would be applying the playbooks using a remote system, like AWX or a CI system such as GitHub Actions or TeamCity. The CI system would have the ability to decrypt the vault and run the playbooks.

Mostly the CI system can expose the vault password to the job using an environment variable (that is hidden from end users and from the logs). You can then write a simple script which provides the password to the vault. Details here: https://docs.ansible.com/ansible/latest/user_guide/vault.html#storing-passwords-in-third-party-tools-with-vault-password-client-scripts

For example:

#!/usr/bin/env python

import os
import sys

if "ANSIBLE_VAULT_PASS" in os.environ:
  sys.stdout.write('%s\n' % os.environ['ANSIBLE_VAULT_PASS'])
  sys.exit(0)

sys.exit(1)